FYI: I would still appreciate a reply to my argument about Bitcoin Lightning (payment channels) solving IoT problem, and how the fees are by design going to be less than 1 satoshi & Lightning's infinite transaction capacity...
> https://bitcointalk.org/index.php?topic=1216479.msg13311118#msg13311118

Hi, I just wanted to thank you for answering my questions to the best of your ability. I did not get a chance to thank you, previously.

I still remain hugely skeptical, mainly because I think Lightning is being hugely underestimated. The Bitcoin community is pouring enormous resources into solving micro-/nano- transactions via Lightning & related technologies (Lightning is only 1 implementation; there will be multiple, competing, interoperable implementations with varying degrees of trust-minimization, and various ETAs). The peer review done so far has uncovered no major problems, and the timeline for LN is decent (I originally said 3 months for testnet; the Lightning team has just released an updated ETA of ~6 months for alpha/beta quality on mainnet!).

I also don't understand what you mean by fees not being low enough on LN. The LN's express initial purpose is to allow transactions of a few pennies (USD), aka by current exchange rate 0.0001 BTC. And, in fact, it's being designed to allow sending transactions as low as 1 satoshi (I have confirmed this with LN devs previously). This is impossible, unless the fee was simultaneously lower than 1 satoshi. In fact, the fee can be as low as 0.001 satoshis. They are actually subdividing satoshis by 1,000 in LN's design, since fees will be within that order of magnitude.

So, I'm curious what you have to say about that?

Regardless, good luck with IOTA.

I didn't say Bitcoin will be safe without upgrading. I'm just saying it's not sensible to imagine that Bitcoin will not be upgraded well ahead of time, in order to deal with quantum. The topic of quantum keeps coming up repeatedly in the Bitcoin community, and everyone is well aware of its status and progress and potential threat. It will be addressed, if & when needed, according to the market's demand. I have faith in making that assumption.

No, feel free to criticize away. Please don't avoid the questions + reasoning I've provided?

Refute it all, if able.

re: Lightning

It's better to source up-to-date documents. The paper you cited is 10 months old and was the first version released:

• http://lightning.network/lightning-network-paper.pdf
• https://github.com/ElementsProject/lightning/blob/master/doc/deployable-lightning.pdf
• http://lightning.network/lightning-network-summary.pdf
• http://lightning.network/lightning-network-technical-summary.pdf

From the summary document:

I'm having an impossible time understanding how the IOTA project is viable. It aims to service the IoT niche. However, Bitcoin already is tackling this niche in a variety of ways. Let's remember that BTC has first mover advantage & network effect (should not be underestimated), as well as hundreds of millions of $ in funding distributed among projects aiming to directly/indirectly make BTC & IoT a reality.

1.   Lightning (IoT vision with nano-payments, unlimited transactions after opening channel, infinitesimally low fees) -- ETA: 3 months for testnet version / Pre-reqs: CLTV (already active), CSV (active within 2 months), malleability fix via SW (active within 3 months).

2.   21, Inc. (explicit vision of IoT, $120+ million funding, relationships with top computer networking companies like Qualcomm, Broadcom, Cisco, Intel, etc.) -- already out with a very hype-ey, successful 21 bitcoin computer MVP that is attracting a lot of attention from Silicon Valley types / Vision of mass market, low-cost/free chip as final product integrated at the scale of millions into consumer electronics devices (and, like I said, the crucial *relationships* with vendors to realistically make this happen).

3.   Sidechains that are 2-way-pegged (Blockstream is working directly on this problem, Paul Sztorc of Bitcoin Hivemind is also working on it with Drivechain) -- Once available, this means essentially any blockchain tech can be custom created and pegged to BTC. If we need a custom designed IoT-specific blockchain, then no problem, sidechain functionality will exist to facilitate it (just like Sergio Lerner's RootStock is taking advantage of right now, with their recently released white paper, but *by building on top of BTC via a sidechain* -- not as a separate block chain)

As for this marketing about quantum-resistance, this is a far-off/futuristic problem. If we have learned anything from history, it is that technological problems are always resolved, one way or another. There is currently $6 billion USD of incentive to solve the quantum problem (plus whatever other problems exist), and that incentive will only be increasing in coming years. It's difficult to see how the argument can be made that such problems spell doom for BTC & so somehow justify IOTA?

Let's assume that magically what I've said so far is addressed sufficiently.

What is the plan for IOTA to actually gain traction? So far, what I see is: "we hope the community will work hard to bring success". Really? This is the plan, and people are throwing 1,000 BTC at this 'castle in the sky'? Presumably, only because of the name recognition of 'come from beyond' backing it, just like Ethereum attracted attention mainly because of Vitalik's backing.

If I'm wrong about all this, then I look forward to a comprehensive refutation

-eragmus

Besides BIP 62, which will take time to finalize, what can be done to prevent this attack? What steps can wallets and payment processors take? Thanks for being a good sport.

Hi,

I basically joined to get feedback on an issue that has already been raised by someone else on this forum, but has not been answered yet.

The link with the inquiry:
https://bitcointalk.org/index.php?topic=331043.msg3551051#msg3551051

The inquiry itself:
How secure is blockchain.info's wallet extension for Chrome?

Blockchain.info offers a Chrome extension for it's "My wallet". This should eliminate the problem of potentially compromised javascript because the "full javascript bitcoin client is included in the browser extension" (quote from their site). This sounds good and I get the feeling that using the Chrome extension adds another security layer. But I'm not sure how I can verify that the extension itself is not compromised. Has anyone reviewed the code for this? Is there a way to make sure the installed extension actually is safe?

More info from Blockchain:
https://blockchain.info/wallet/verifier

"My Wallet works differently than traditional hosted bitcoin wallets as the bitcoin client runs within your own browser. This means, in theory, if blockchain.info was hacked your wallet would still be safe. However there is a weakness in that the server could be altered to serve modified javascript which could intercept your password or bitcoin addresses.

The chrome browser extension eliminates this problem. The full javascript bitcoin client is included in the browser extension so it is no longer necessary to download any javascript from our servers. The result is a client which has all of the benefits of a web wallet service but requires very little trust to be placed in any 3rd party."

I'm interested in a user-friendly interface to interact with my Bitcoins, but I'm also heavily interested (as should anyone!) in security. It seems their Chrome extension implementation solves the only/main security issue that their regular non-extension website-based service has, which as Blockchain states above, is that their server "could be altered to serve modified javascript which could intercept your password or bitcoin addresses".

But then again, this depends on the Chrome extension. So, to reiterate as the other poster asked, has their extension been verified to be safe without bugs? Is it open-source?

--

On a related issue, Blockchain.info describes their security, as follows:
https://blockchain.info/wallet/ways-to-access

Specifically, their web client (the most popular mode of access) is described like this:
Web Interface
The web interface uses javascript running in your browser to encrypt your wallet and create transactions independently from the server. However the code is downloaded from the server each time the page is opened and it is therefore possible for the server potentially to alter the behavior of the client to act maliciously. The web interface therefore requires the most trust in Blockchain's server security.

good - Server cannot spend your coins.
good - Backup your wallet locally.
bad - Server can modify the behavior of the client.
bad - Server can lie about transactions.

Does anyone know if the Chrome extension solves both the 'bad' issues, or only the one about the server being able to modify the behavior of the client, if hacked?

If it solves both 'bad' issues listed, does this mean truly infallible security? If not, any other tips?

I think Bitcoin is great, but security should be the number 1 focus. Too many people in the population are computer illiterate or newbish, and if Bitcoin is to enter the mainstream and gain trust, the security issue must be resolved, so people can feel safe having Bitcoins.

If this chrome browser extension can be truly safe, then it will go a huge way! It took me 5 seconds to download/install the extension from the Chrome store, which is highly used by millions of Chrome users already. This means it's highly accessibly by non-savvy users (definitely more accessible than downloading a separate standalone app), and easier to use (you must admit most Bitcoin wallet apps have terrible user interfaces, at least compared to the slick Blockchain.info wallet UI).

Thanks!