|
The problem here is that over 90% of the population is using Microsoft Windows as their desktop / laptop OS which is inherently insecure. This is not because the OS itself is insecure. In fact, with some expertise, Microsoft Windows can be made secure but rather because of the whole Microsoft Windows / proprietary software ecosystem. Up-selling and not security is the primary design feature of consumer laptops / and desktops today. Security itself becomes an "up-sell". Buy a laptop from a major retailer and it is a trail for this and trail for that, including of course a trail for the anti-virus / anti malware software. The irony is that there are already paid for alternatives for security; however do not expect the "expert" at the retail store to tell their customer this. Why because they are required to "up-sell". All this does is create a massive breeding ground for viri and malware in the Microsoft Windows ecosystem. If one adds to this that Microsoft Windows itself is designed for centralized control by Microsoft, we have an ecosystem that is from both a security and philosophical point of view fundamentally incompatible with Bitcoin and other crypto-currencies.
I know this may sound radical, but as far as I am concerned, the best solution is to replace Microsoft Windows with GNU/Linux rather than to keep trying to make the square peg (Bitcoin) fit into the round hole (Microsoft Windows).
|
|
|
|
So I was reading what Fred Wilson stated today And I think that that’s probably going to be first big commercial opportunity in bitcoin, [...] to create secure systems. What if Bitcoin will improve and boost the IT security in general and especially private people's security? What if better security overall will teach everyone how to secure their systems and in the same time it will help them to decentralize a bit from the governments? Bitcoin may give power to the people in a lot more ways than the financial system. If it motivates enough people to switch from Microsoft Windows to GNU/Linux in order to avoid serious financial loss, then yes it will give power to the people and take it away not just from governments but also from large controlling multinational corporations that are for the most part far worse than most governments. |
|
|
|
|
My favourite is 5. Anyone who has been around the Canadian telecommunications scene anytime during the last 30 years should know to stay well away from Rogers. This company is well known for perfecting the art of providing totally atrocious customer service for years, from introducing negative option billing, to grounding a cable modem by drilling into a live gas line, to harassing people who were not even their customer with endless collection calls. The list of horror stories involving Rogers is just endless. What happened to Canadian Bitcoins is not surprising at all given that the provider involved is non other than Rogers. Their mistake for which they paid dearly is to not remove their servers from the data centre the moment that Rogers bought it.
|
|
|
|
Because it includes the transaction amount plus the change. Let me guess the transaction was sent from an exchange, the exchange deducted 0.01 XMR for the TX fee and sent the balance of 99.99 XMR. The reason I say this is because there is nothing that adds exactly to 100.00 XMR in the outputs, however I do get 99.99 XMR from the outputs. |
|
|
|
I completed my donation of 202.33 XMR and provided the payment id to fluffypony via PM. I generated the XMR payment id as follows: a) Visit http://www.random.org/integers/?mode=advancedb) Under part 1: choose 64 random integers with each integer between 0 and 15. For number of columns choose 64, 32 or 16. This is for ease of formatting. c) Under part 2: choose hexadecimal, part 3: choose "As a bare-bones text document (type text/plain)", part4: choose "Generate your own personal randomization right now" d) Under part 5: choose "Get Numbers" e) Copy the generated numbers to a text editor, gedit in GNU/Linux, is a good choice and then edit out the non printing characters. The result is a perfectly valid XMR payment id and unlike using an exchange no third party is aware of it. Furthermore this does not clutter up the exchange's database. |
|
|
|
It is possible today to get up to 20:1 margin on Bitcoin CFDs and up to 10:1 margin on Litecoin CFDs today using an FX broker not an exchange. http://www.avatrade.com/trading-info/trading-conditions There is no need to use one FX broker for "paper" or one exchange for "actual" for this attack to work. In fact the more decentralized the market for both the "paper" and the "actual" the better since that will allow the attacker to hide her hand. Correct me if I am wrong, but CFDs is not the actual commodity being traded. There is no delivery of commodity if CFD is bought, everything is cash settled. CFD price is following price of commodity exchanges or crypto exchanges in the case of cryptos, not leading it. So if an attacker buys actual crypto commodity in large amounts on one exchange with one hand and at the same time sells CFD with another hand at another broker/exchange, the price on the first exchange would start growing, everyone will rush to buy (people like to buy when the price grows), the price will be growing even more, arbitrageurs will quickly jump on board and make sure the price is about the same on all exchanges and with all brokers (now the attacker's short position is well under water). If the attacker keeps persisting and demand from the attacker and other people keeps growing, the attacker will soon have to cover their short position in CFDs with a huge loss because the broker will send a margin call or would have to add cash to maintain it. In the end, because people take delivery of the crypto, the attacker would have to close short positions at a loss, no matter how much fiat the attacker has, because the crypto would be depleted at exchanges and price goes to infinity (remember: 95-99% of traders don't take delivery of wheat, copper or steel, but many take delivery of cryptos because it's very easy to do). Yes CFDs are cash settled this is correct; however there is a counter party to the CFDs that has to hedge her position. This has to ultimately happen by selling the actual, either by the market makers at the brokers or by other market participants engaging in arbitrage selling the actual (at a small premium) and buying the paper at (a small discount). So it is very possible for the paper market to lead the actual market. If both the actual long and paper short are acquired gradually and across multiple brokers and exchanges the impact on the market is minimal. One must keep in mind that until the moment of the attack the attacker can keep her net position neutral, then increase her position to net short just before the attack to profit for the plunge in price caused by the chaos resulting from the attack. Your point about taking delivery with crypto-currencies is very valid; however in this case it only serves to ensure that those writing the CFDs maintain tightly hedged positions themselves to minimize their risk, thereby keeping the paper and actual markets in sync. This will magnify the effect of the attack. Edit: This attack works best when the market is otherwise moving sideways. |
|
|
|
I believe for the lower Dan levels a simple transaction id or screenshot from an exchange is good... but I will verify, and determine if there is a way to use payment IDs.
I am considering a donation at the 4th dan level just over 200 XMR. Edit: The coins are in my personal wallet not on an exchange. I still keep my MTGox YubiKey on my keychain by the way.  |
|
|
|
It is possible today to get up to 20:1 margin on Bitcoin CFDs and up to 10:1 margin on Litecoin CFDs today using an FX broker not an exchange. http://www.avatrade.com/trading-info/trading-conditions There is no need to use just one FX broker for "paper" or just one exchange for "actual" for this attack to work. In fact the more decentralized the market for both the "paper" and the "actual" the better since this will allow the attacker to hide her hand. |
|
|
|
Can one not attack a proof of stake coin by purchasing the actual coin and at the same time selling short on the "paper / derivative" market thereby effectively maintaining a neutral or even a short position on the coin during the attack?
Short answer: No. Long answer: it's a quick way for that exchange to be out of business if the exchange doesn't limit the short position of that customer (it's not like naked short selling is present on many exchanges now, because exchanges understand the limited supply nature of crypto currencies and that they can quickly go bankrupt if they allow this naked short selling, or at least with something over 1:2 leverage). If the attacker withdraws, this will be noticeable immediately, because blockchain is transparent, people will notice the exchange's reserves are depleting and will do mass withdrawals too. There is no economic incentive for an exchange to allow customers to have large short positions, because if the price stays the same, they lose on: a) fees (the larger the fiat price of a crypto, the larger the fee they can collect, because the fee is usually set in crypto); b) bad reputation for the exchange, people will notice that volume of trading is huge, but the price stays the same, meaning something funky is going on on that exchange, and will go to other exchanges. This funky business may have worked with Mt.Gox, because the willybot kept the price to the upside, so people were ok with that, but won't work, if volume is going up significantly, but price stays the same, it's not natural and means someone is doing something criminal. Besides, in NXT, for example, there are plans to go to decentralized gateways and multigateways to deposit/withdraw, multigateway is already developed and functioning on live net, centralized exchanges don't fit the decentralized concept of NXT, they are a single point of failure, an entity you have to trust, hence they will not be relevant in the future. I am sure, there are other nuances why this attack is not possible in practise, at least for an established crypto like NXT, but those above should be enough for now. The attacker does not have to be an exchange, nor is there a need for a centralized market for the attack to work. It is possible today enter into BTC and LTC contracts for difference vs USD using an FX broker or brokers with something else such as USD or EUR as collateral. One can use this to create a short position on the coin. One then at the same time purchases the same amount of the actual coin, thereby not moving the market because of arbitrage between the FX broker or brokers and the actual coin market or markets. This kind of thing happens all the time with commodities, stocks and fiat currencies where the paper market exceeds the actual physical market by many orders of magnitude. Furthermore there are many valid reasons why people would do this kind of hedging. The only reason this does not work with current proof of stake coins is that they are still too young to create a viable derivatives market. The problem with proof of stake is that the stake represented on the blockchain may not represent at all the exposure of the holder of the stake to the coin, if the holder of the stake has hedged her exposure to the coin with derivatives. The more established the coin, the more likelihood of a derivatives market around the coin and consequently the greater the risk of this kind of attack. |
|
|
|
In the original thread, Risto noted:
"I think honor is enough for kyu grades. For Dan levels, you should contact the treasurer in advance and he will give you something that resembles a satoshimessage (or whatever that identifies you)."
So what is the process now for Dan levels, and who is the treasurer?
One of the options is to make the donation and send the XMR transaction id of the donation to cAPSLOCK. Could the OP please confirm if this would work? Thanks. Edit: Correction: Generate and send a payment ID for the transaction not a transaction ID |
|
|
|
|
Can one not attack a proof of stake coin by purchasing the actual coin and at the same time selling short on the "paper / derivative" market thereby effectively maintaining a neutral or even a short position on the coin during the attack?
|
|
|
|
Hi guys, I used bitcoin-qt as my bitcoin wallet and I forgot to setup a password  So today I checked my wallet and a very small amount of bitcoins were stolen: https://blockchain.info/de/address/1CPEdjFu6TaZpPFGQ81zHaW7prtJ1pk8LVIs there any chance I get these BTC back? Or do I have to pay to learn the lesson? After that, I moved to multibit and saved it on several USB-Sticks with a strong password using KeyPass obfuscating. Is there anything else I have to take care of? Thx for your help! Regards My suggestion is to not use Microsoft Windows and to use GNU/Linux instead, and yes encrypt your wallet. If one originally created the wallet on Microsoft Windows move the coins to a new wallet created on GNU/Linux. I have been involved with Bitcoin since 2011 and have not lost a single satoshi to malware; however I would not let a single of my satoshi near Microsoft Windows. Make sure to make multiple redundant backups of wallet.dat and keep in mind that after 100 transactions the change or received funds are no longer backed up when using Bitcoin-qt. A good habit is to back up wallet.dat after 20 transactions or so. By the way I stopped using Microsoft Windows for fiat banking back in 2006 before Bitcoin even existed for the same reasons. |
|
|
|
|
Are you planning two way trade or just selling to the customer?
|
|
|
|
Interesting.
I run an electrum wallet on my laptop and keep 10-25 coins on it at all times for daily transactions.
I'm online all day, and thus my electrum is online too. I'd be pretty surprised to wake up and find my coins gone.
here's my address: 1DDWEQM11uMUKiqpGEWvBT2at3CjCw3Vra
Hack away!
So I'm guessing this guy probably got a RAT (remote access terminal) installed on his laptop by clicking on a link in an email or downloading an infected wallet client.
My theory: He was running Microsoft Windows. |
|
|
|
Before ever making a cold storage wallet, scan your pc thoroughly, use up2date antivirus, and also scan with Hitman Pro after that.
Or just use an Linux OS, no need to mess about with any of that nonsense. PHD Candidate Bitcoin researcher had ~9000 BTC stolen while he was using Linux. CDecker on this forum. https://bitcointalk.org/index.php?action=profile;u=49Notice his user number is 49 too. Hell he could even be Satoshi(probably not though). Link to post where this loss occurred please! Was he using an encrypted wallet? Were encrypted wallets even available at the time? Using GNU/Linux with an encrypted wallet will drastically reduce by many orders of magnitude the threat of Bitvoin theft. |
|
|
|
|
Just want to clarify the system requirements for the malware.
Let me guess. The malware requires Microsoft Windows in order for it to be able to steal your coins.
|
|
|
|
This is technically true, however in order for this to materialize there needs to be demand for such loans, which there is not.
Precisely. Which is why we have not seen the hyper inflation in the US that many have predicted. Edit: This leads to my original point. Without an inflationary collapse of USD to save gold and other PMs, bitcoin could easily devastate the gold and other PM markets. |
|
|
|
You do know what those excess reserves mean right? If they pull them out and start lending, which is ironically what is likely to happen if interest rates go UP without the bribe rate (the interest rate on excess reserves) going up, an extra $26 Trillion can work its way into the M2. That would constitute an increase greater than 200%. Thats one really wound up spring ready to snap back.
In order for that not to happen, they have to do two things. Suppress the earnings of financial institutions so owner's equity doesn't creep into those reserves, and keep the bribe rates at least as they are right now proportional to mortgage and other forms of lending that "leads into the economy."
Are you talking about the excess reserves that banks hold at the US Fed or something else? The latest data puts those reserves at around $2.6T, not $26T. That's still a lot, obviously, but only about 20% of M2 instead of 200%. See the Federal Reserve site for the latest data: http://www.federalreserve.gov/releases/h3/current/2.6T USD of excess reserves can generate an increase of 26T USD in M2 because the reserve requirement is at most 10%. http://www.federalreserve.gov/monetarypolicy/reservereq.htm. For each dollar the Federal Reserve prints the banks can print an additional nine dollars because of fractional reserve banking. |
|
|
|
but I think they will find it difficult to hide $200m in purchases..even over a period of a year.
According to the article, Masters is "co-principal of Global Advisors Jersey Ltd.—which trades up to $2 billion of energy and equities". The bitcoin hedge fund is launching in less than a month. Do you really think he hasn't already acquired a significant number of bitcoins? He may, but not necessary all on behalf of the hedge fund. |
|
|
|
|
Show Posts
