Latest posts of: landomata

Quote from: smartwart on January 02, 2014, 12:12:14 PM

Quote from: jl777 on January 02, 2014, 11:50:50 AM

I am not a cryptographer and ...

James

so please, don't try to be one.

I don;t think he is trying to be one.

Quote from: Come-from-Beyond on January 02, 2014, 10:32:15 AM

Quote from: landomata on January 02, 2014, 10:30:34 AM

If coins are stolen....we can freeze them until a full investigation is completed.

Who will play judge Dredd?

Quote from: Come-from-Beyond on January 02, 2014, 10:19:36 AM

In continuation of recent discussion about Voting System and destruction of coins... While we r waiting for the release, we could discuss another moral dilemma:

Should we use power of Nxt network to attack those who attack us? I mean ddosing ddosers / black PR sites and similar things, we won't attack those who don't attack us, of coz...

but freezing would be great in the case of the stolen coins.....as we have been recently having.

If coins are stolen....we can freeze them until a full investigation is completed.

And thieves would not longer have an incentive to steal.

Quote from: swartzfeger on January 02, 2014, 10:03:01 AM

Just saw trans id: 12835497147525856752 hit my unconfirmed transactions. That's quite a bit of coin, right there.

All the drama the last two days certainly hasn't slowed things at degex, either.

EVRYONE PLS WATCH THIS TRANSACTION!....we never know if they are using corrupted client.

Edit: I know many ppl r moving funds to new account....but we should still be vigilant.

Quote from: BitThink on January 02, 2014, 09:37:26 AM

As a currency with cap more than 1 million, I don't think setting up a dedicate server for downloading is too expensive to be feasible.

Auto update clients direct from the blockchain...this was planned from the beginning...lets just expedite the roll out.

Quote from: swartzfeger on January 02, 2014, 09:24:27 AM

One thing that hasn't been mentioned (I don't think), how are we going to vet/verify future client downloads?

As much as I don't share some users' level of conviction when it comes to user adoption vs. difficulty (I think this is rickyjames point), regular users having to worry about 1) brain wallet, 2) clunky client installer PLUS having to verify SHA256 for every update might drive people away.

I also think a permanent solution should be found for the above issues.

Quote from: laowai80 on January 02, 2014, 08:15:17 AM

Quote from: landomata on January 02, 2014, 08:10:35 AM

Quote from: landomata on January 02, 2014, 07:48:27 AM

Can we put in place a block on all previous clients (from inside blockchain) until the fresh secure client is release on an urgent basis?

Can someone answer this QUESTION!!!

0.4.8 is secure if the hash is verified.

I mean we don;t know who downloaded the corrupted client between now and when it was first uploaded.

We should just block all clients ASAP!.....total freeze....I AM NOT SURE IF THIS IS EVEN POSSIBLE.

Quote from: landomata on January 02, 2014, 07:48:27 AM

Can we put in place a block on all previous clients (from inside blockchain) until the fresh secure client is release on an urgent basis?

Can someone answer this QUESTION!!!

Someone just got Nxt stolen on forum:

Edit:
https://nextcoin.org/index.php/topic,2014.0.html

Quote from: laowai80 on January 02, 2014, 07:58:55 AM

Quote from: Boiar on January 02, 2014, 07:57:38 AM

Guys, I just wanna remind about my BTC that I sent to 1BCN1ugdKdWd9pQ8Am9hMhtHZfmbXzxE8a

Am I supposed to get them back on 3rd January?

If so, I'd like to clarify:
0.0175 BTC
My BTC wallet: 1DTyh359GysoFaqeT7WYuZPUap77XpSLWn
TxID: 6e45a21c77349d6f314c1f023f4faf2c9f4a91bf2ad133b25d1c43cea5d2a7b8

Thanks.

wrong thread, you need to post this in the exchange support thread, dgex thread? or we have 2 exchanges now, please post there.

No I think he sent his BTC by mistake AFTER the fundraiser was over.

CfB pls advise.

Can we put in place a block on all previous clients (from inside blockchain) until the fresh secure client is release on an urgent basis?

Are these randomly generated passwords stored by the generating service in some centralized database?

Quote from: laowai80 on January 01, 2014, 08:39:44 PM

Isn't the party line not to use the word 'official' any more? Cheesy

Official doesn;t have to mean centralized Grin

Quote from: smaragda on January 01, 2014, 08:34:26 PM

Quote from: landomata on January 01, 2014, 08:28:19 PM

Quote from: Come-from-Beyond on January 01, 2014, 08:24:19 PM

We can download client from anywhere. Just make sure SHA256 checksum matches the one provided by Jean-Luc.

not everyone can run this setup

Please expand landomata.

meaning the average user shouldn't have to run this check.

Edit: there should one secured official source for client updates...preferably Blockchain to clients

Quote from: Come-from-Beyond on January 01, 2014, 08:24:19 PM

We can download client from anywhere. Just make sure SHA256 checksum matches the one provided by Jean-Luc.

not everyone can run this setup

Quote from: laowai80 on January 01, 2014, 07:57:20 PM

Keylogger is the main suspect of course.

There is really no way to protect against keyloggers except proper vigilance....yet malware is still everywhere and not going away anytime soon.

This is where Rickyjames/Opti-carriers idea comes in handy

Quote from: Come-from-Beyond on January 01, 2014, 07:51:22 PM

Quote from: landomata on January 01, 2014, 07:46:02 PM

We haven't looked at this possibility...updating client from the blockchain would solve this.

It's enough to modify only JavaScript part to send entered passphrases to adversary's server.

Edit: It's only 10 lines of JS code.

so how do we protect again this.

Quote from: Come-from-Beyond on January 01, 2014, 07:43:09 PM

I've got PaulyC's password. It's uncrackable and matches the account. If he is not trolling then we have 4 explanations:

- Someone cracked SHA256 and Curve25519 (why then multi-million accounts not hacked?)
- Someone distributes modified NRS (someone should decompile PaulyC's software)
- Keylogger
- He used online node that records entered passphrases

We haven't looked at this possibility...updating client from the blockchain would solve this.

Quote from: Come-from-Beyond on January 01, 2014, 07:32:03 PM

Quote from: landomata on January 01, 2014, 07:29:32 PM

You mean account spikes?.....in a linear fashion....as if someone was artificially opening accounts in a fixed amount across a specific time interval?

Nxt (and Bitcoin) doesn't work such the way.

doesn't each new passphase entered unlock a new account?

Quote from: EpicThomas on January 01, 2014, 06:42:04 PM

Quote from: EvilDave on January 01, 2014, 06:40:42 PM

Quick question on the theft issue:

If someone is just running a brute force attack on the whole NXT network attempting to hit the jackpot, wont this activity be very visible in the blockchain?
Way I see it, every password generated by the brute force attack will create an account.
Can anyone (with more skillz than me) have a look at the account creation (possibly vs IP address) stats and see if something wierd is showing up?

The account will not show up in the blockchain before a transaction is made.

so it would be impossible to track account creation..as all passphase attempt will unlock one account....each time a different passphase is entered