I thought we had four variants of JS signing. Is there more you need?
What four? We have zero |
|
|
|
There is no way Nxt is going to catch dodge until basic things are rolled out.
(1) A light easy to use client
(2) The native client ability to sign transaction and broadcast them to a public node so people don't have to download Java and run NRS
Without these two things, forget about anyone outside tech nerd using Nxt.
We have "huge" big projects but basic functionality is missing
It's coming. Well, the priorities are screwed up. Roll out local signing of transaction before AE As things stand, Nxt isn't even usable on a mobile device as you can't send money from a phone without sharing your password with untrusted third-party node. |
|
|
|
|
There is no way Nxt is going to catch dodge until basic things are rolled out.
(1) A light easy to use client
(2) The native client's ability to sign transaction and broadcast it to a public node (with no risk of compromising password) so people don't have to download Java and run NRS
Without these two things, forget about anyone outside tech nerd using Nxt.
We have "huge" big projects but basic functionality is missing
|
|
|
|
Well, back to the stolen coins. What was the passphrase?
Hi, the password was of 14 characters. The stolen NXTs went to the account 10715382765594435905 which is BTER account. The password for the account from which NXTs were stolen is the same as the one I use with BTER. Please also see the quote 23218 in page 1161. Someone else had also his NXTs and they went to this BTER account. The balance of this account is 41 million which makes me think one of the big persons is involved. Since your account is already compromised, what was the password? |
|
|
|
I emailed Dmitry Skiba and actually got a response Hi,
Actually I don't know nothing about cryptography, I just ported that code from C to Java many years ago. So I can't really answer your question.
Regards,
Dmitry
Hilarious. I think this ends the discussion and the fix should be included in the main client... BloodyRookie (and doctorevil) obviously understands it much better The bug was in original C version by Matthijs van Duin. Dmitry Skiba just ported it to java |
|
|
|
|
No news on nexern's client?
|
|
|
|
I emailed Dmitry Skiba and actually got a response Hi,
Actually I don't know nothing about cryptography, I just ported that code from C to Java many years ago. So I can't really answer your question.
Regards,
Dmitry
|
|
|
|
Unfortunately, I've come to the conclusion that the brainwallet feature is not meant for average users. I think we should keep it as an advanced option, but by default a client should implement a bitcoin-like wallet, for the safety of our users.
well that's one reason, why clienxt's design made it look/feel like like bitcoin wallet...  You've implemented a bitcoin-like wallet for Nxt? Cool! Do you still allow the user to use a brainwallet if he so chooses? BCNext wanted the brainwallet feature to keep governments from forcing the disclosure of private keys -- with a brainwallet the private key is generated on-the-fly so there is no key to give up. (In practice, however, I think this is easily defeated by rubber-hose cryptanalysis.) Could somebody explain the concept of the brainwallet to me? How can the average joe remember 50 letters or even more when having more than one account? User Password managers. I use https://lastpass.com/It's been around for years (maybe 10?). it's pretty safe as all encryptions are done on local computer. You just need one very strong master password |
|
|
|
tell you DGEX to send and receive your deposits in 10 minutes. lol
I don't know what Dgex problems are but I can use bter to sell and buy Nxt within minutes. This is DGex problem, not Nxt. Would you buy online clips (porn or not) with Nxt if you get the download link AFTER 24 hours? That will make Nxt useless. Even bitcoin with 10 minute for one confirmation is faster. I will accept Nxt as a merchant with even one confirmation (1 minute), but I won't accept Nxt if transactions are reversible for 24 hours. I would rather then find a better currency. |
|
|
|
Simple mode....
ACTUAL/NOW/CURRENT:
1) you send 1000 NXT and NXT 1 fee
2) shows that balance (false) / show is received at the destination (false)
3) it is effective in 1440 confirmations (after 48 hours)
4) someone forge the commission NXT
WITH CANCEL:
1) you send 1000 NXT and NXT 1 fee
2) shows that balance (false) / show is received at the destination (false)
3) you cancel the transfer before the confirmation 800 (~24 hours). you recover the amount, the recipient returns to its normal amount.
4) someone forge the commission NXT
___________________
Because you think DGEX and the other sites take so long to process transactions? Are not congested. Are only waiting for 1440 confirmations.
I don't know what you are trying to say here. Nxt transactions are irreversible. You don't have to wait for 1440 confirmations . After 10 confirmations (around 10 minutes) merchant can ship product. I would ship it even after one confirmation. You suggestions doesn't make any sense. This will make Nxt almost useless currency, or at least the slowest currency in the world. 24 hours before a seller can send you product? What if it's digital download? 24 hours wait before you can download? I would rather use a currency that is quicker then waste time with Nxt. No thanks. |
|
|
|
Advocating paragraph: " Transparency extended to absolute leads to inability to cheat thus removing necessity to think if someone should trust another one.", I think you should add the option to cancel a transaction, "even at the cost of losing the fee!"If an option is implemented where transactions can be reversed, I myself and about 90% of all investors/enthusiasts would leave the ship. This might be the most retarded idea of the century. Props This idea could save many users being hacked and emptied.  1) send 1000 NXT and 2 fee 2) 800 before confirmation, canceled. 3) you back to 1000, but the 2 of fee are ongoing and will be forged. The system is not lost! everyone happy! This is dumb idea. People will buy things/services and then cancel the transactions, stealing from the merchants. This is exactly the problem with credit card chargeback frauds, but here it will be 100 times worse. No one should be able to cancel transaction. Cryptos are irreversible as they should be. Use escrow. Would be really dumb not to cancel transactions if equally "are not real" until they reach the 1440 confirmations. I can pay you now, but will have to wait until 1440 to be effective confirmations. that is, it is not real. and 1440 confirmations are 48 hours! In other words, even slower system than bitcoin. Bitcoin needs 10 minute for 1 confirmation, and 60 minutes for 6 confirmations to be safe, so now here we have a system that is much much slower than bitcoin. Merchants can't ship products (or send you downloadable links if you bought digital products) for 48 hours. No thanks. |
|
|
|
Advocating paragraph: " Transparency extended to absolute leads to inability to cheat thus removing necessity to think if someone should trust another one.", I think you should add the option to cancel a transaction, "even at the cost of losing the fee!"If an option is implemented where transactions can be reversed, I myself and about 90% of all investors/enthusiasts would leave the ship. This might be the most retarded idea of the century. Props This idea could save many users being hacked and emptied. 1) send 1000 NXT and 2 fee 2) 800 before confirmation, canceled. 3) you back to 1000, but the 2 of fee are ongoing and will be forged. The system is not lost! everyone happy! This is dumb idea. People will buy things/services and then cancel the transactions, stealing from the merchants. This is exactly the problem with credit card chargeback frauds, but here it will be 100 times worse. No one should be able to cancel transaction. Cryptos are irreversible as they should be. Use escrow. |
|
|
|
Last one from me:
There's nothing to prove, math stays the same, it's the implementation that's wrong not the math,.
All the math is already in the file in the comments, those comments were made by this "xmath" dude from sci.crypt (I assume this is Matthijs van Duin).
"doctorevil" thinks the patch is kosher https://nextcoin.org/index.php/topic,3915.msg37082.html#msg37082Given his history, we should take his advice and apply the patch. |
|
|
|
I give 99% that fix of Curve25519 is safe, but the rest 1% doesn't let me to use the fix coz this part is the most critical part of Nxt. So without a formal proof I'll stick to loop inside Crypto.sign.
Last one from me: There's nothing to prove, math stays the same, it's the implementation that's wrong not the math,. All the math is already in the file in the comments, those comments were made by this "xmath" dude from sci.crypt (I assume this is Matthijs van Duin). Do you have link Matthijs van Duin comments? Maybe that will convince CFB if you posted the link to Matthijs van Duin |
|
|
|
Hey Jean-Luc... no more database issues with 0.7.2!!!  Maybe there is hope for the raspberry owners after all... let's see what they report. Please add something in the web client to gracefully stop the server. I use javaw so I don't have a console window |
|
|
|
|
Here are some suggestions on how to improve over Nxt
(1) Don't let the user choose the passphrase by default. Brain wallet should be an advanced feature and not a default option. Generate a 256-bit random seed for the user, and save that (in encrypted form) in wallet.dat file. The user will provide the password for the encryption. Don't ever save the seed unencrypted on the hard drive, ever. Don't make that an available option. Encryption password must be a requirement (and the user must type it twice).
(2) Make the accounts deterministic, so the user will only have to back up wallet.dat once (not like Bitcoin's QT where regular backups are required).
Basically, it should work something like this:
seed = 256-bit randomly generated and saved encrypted in wallet.dat
Account-One = Hash (seed)
If the user creates more accounts,
Account-two = Hash (Account-One + seed)
Account-three = Hash (Account-two + seed)
etc etc .
The user can create as many accounts as they want. As long as they never lose the seed, they will be fine. No regular backups required.
(3) Do not include any code that has anything to do with signing transaction in server code. The signing should be client's job. That way the users who don't want to download the server software can just download a lightweight client and connect to a public node and safely use it without ever transmitting the secret seed over the internet.
|
|
|
|
<rant>
Wow, watching this thread. Disappointed in so many...
10 stakes? 25? 50??? C'mon guys! What the F*** are you trying to pull? Seriously!!!... little less greed, please.
Certainly appreciate trying to get your friends and family wrong, nothing wrong there. That's what YOUR STAKE is for... distribute it, use it, share it. Only then will NEM gain value. Hoarding will get NEM nowhere.
If your friends and family want to be a part of the initial distribution, have them follow the simple registration procedures on their own. If they are unable to do so, then they will not be a useful stakeholder, IMHO. Stakeholders will need to pool together to offer bounties for effort, tip people you see doing good, organize social campaigns to get exposure, petition exchanges, etc.
STAKEHOLDERS NEED TO BE INVOLVED.
If your friends and family are so woefully incompetent that they can't register on their own, they will not be a valuable stakeholder.
</rant>
Seriously, stop with the greed. Be a good stakeholder. Don't kill NEM before its even born.
(Apologies to utopianfuture for venting here, I know you've got a lot to consider. My hats off to you, sir.)
Why refund the cheaters? The rules were plain at the beginning. The cheaters tried using everyone else as fools. FSCK EM. That is what they wanted to do to everyone else. I disagree. Extra funds should be returned with explanation as to why. One stake remains. @utopianfuture I think you are trying to do a very noble and good thing with the stake distribution. Clearly, it has gotten out of hand and people are taking advantage of your generous offering. At this point, people are becoming wise to mixing and will be more difficult to perform analysis on any new registrants. Therefore, I suggest closing registration immediately and perform a thorough taint analysis on all registrations received. Distribution is wide enough, and registration has lasted long enough. Vet the current list with the best analysis you can and ensure the integrity of the process. Best regards. Says the guy who mixed the coins for all his stakes. JackNeedles just wants to increase his % share by taking away other people's stakes. As soon as possible I will publication my list of sockpuppet accounts. I would like to ask you don't worry about those people whose try to mixing their addresses. I have been working to identify them. There are other ways to catch them. I hope you understand why i don't give you more details. What would be nice would be that you keep the money of all sock puppets who registered with more than 10 accounts. No need to refund them the money. |
|
|
|
@ DaFockBro
I don't believe him anything^^
Exactly. 15 to 20 stakes. What a joke. I say lets close this already. We have enough stakeholders. Everyone new is basically a sock puppet. |
|
|
|
 Introducing tipNXT.comWith tipNXT.com you can tip any Nxt user worldwide! I hope that this service will be used often! Thank you very much. I don't get it. Why would I want to use this, enter my account secret via non-SSL, when I can tip an account with any client? Somebody would have to be f@#King insane to use this service. Hey, nothing personal, Passion_ltc ! Things like this require local signing and only the signed transaction then is broadcast to the server. We need more software (local clients, javascript code) that the websites like the above can use where user signs the transaction on his own machine. Now instead of wasting "bounties" and time on insecure voodoo ideas like plugins, scripting VM, this is something that is really useful. Basically it would mean you can connect to any online server/service (like tipNXT.com) and use it safely as you will never broadcast your password over the internet. Where is the bounty on that? This should have 100K+ bounty and it should be implemented in such a way that any site or client can use it. |
|
|
|
|
Show Posts
