As a public key on a colored coin?
Your account number is public key already. You're constantly trying to create unnecessary entities. Want to "freeze" some coins with some new private key? Just create new account with this key, trasfer coins to it, and then use this key only when you need to spend this coins. The problem is that the "lucky gold strike" loophole for somebody else to hit this new account when miskeying their own password exists just like it exists for the old one. Psychologically to the public this is always going to be perceived as a flaw because they don't understand how unlikely it is. You haven't increased security one iota, you have only created a different winning lottery number. Publically announcing to the world not to accept withdrawals from an account closes this loophole. That will make a huge psychological difference to the public. And I am telling you, for NXT to succeed with the public, irrational psychological issues are going to have to be addressed. You still need a pass at some point to make an announcement like "I want to spend this money again" right ? you would still need to enter this pass into the network right ? It is essentially the same thing as current implementation. |
|
|
|
I want to tell the world to never accept a withdrawal from my NXT account. To do this I click a button on my client and go to a special page. I pay a NXT fee and the page generates two numbers, a public key and a private key. I attach the public key to a colored coin. THis is my announcement to the world to lock my account... This can be done with existing functionality. Just create new account, send coins to it and never use this account until NXT costs $500. This is absolutely the same scheme as yours. And it's free  That's basically what I did. Create an account with very strong pass (even a 160 bit pass is enough). Name it saving and transfer all your fund there. Never put the password online again. Nothing can break this account unless they can break down the whole NXT network. |
|
|
|
Hey, looks like I just got robbed, too.
Someone please check this account: 12152013998194592943
They now have 147k+ from me.
Had a 40 char random password, capital, lower, numbers, symbols.
WTF?
you're 11794318797680953099? http://22k.io/-account/12152013998194592943Yes, that was me. Just created a new account, though, and sent the remaining 100k there. If you acc got hacked they will take all not leaving you with 100K. |
|
|
|
But I really do believe that some kind of hooks for a 2 factor authorization should be built into the code for transfers above a certain amount.
This makes sense Edit: A thief could always transfer smaller amounts under the threshold.... How about this - you can pay a fee to tell the blockchain that no further withdrawals are to be accepted from this account for all future times, and upon payment of the fee you register a second 50+ character password that can be used in the future to inform the blockchain to reauthorize withdrawals from the subject account. We gotta do something here. There are multiple reports of people having their NXT wallets emptied when they didn't want it to be during the low volume alpha / beta operations shakedown of NXT. We have to do more that just say, "Well, if you used a strong password, it wasn't hacked by brute force". I doubt any of these report is actually true since when they are all silent when further proofs and information are requested. Remember that any hostile entity would have an incentive to slur NXT's security. Surely we want to improve user's experience so it would be good to brainstorm but the conception that current implementation is of poor security needs to be disapproved. |
|
|
|
email service provided watching the blockchain.. this is very centralized
One company is centralized but many companies providing similar services and competing against each other. That process is decentralization. You still needs one person taking initiatives and responsibility. Decentralization is different from collectivism. it is centralized in a sense that if two or three companies exist and it is required to use them to send a transaction, then it breaks the whole concept. no need to worry about 90% attacks then , you can have 3 people break it. You can't have an economy unless individuals taking initiative. But why restricted in 2-3 companies. These are peripheral services, you are not required to use them and if they don't do a good jobs, then others will and replace them . |
|
|
|
email service provided watching the blockchain.. this is very centralized
One company is centralized but many companies providing similar services and competing against each other. That process is decentralization. You still needs one person taking initiatives and responsibility. Decentralization is different from collectivism. |
|
|
|
Block chain check:
29993 7542917420413518667 woensdag 1 januari 2014 15:11:25
8 2 + 8 1'175 B
1 16489812608969511447 599 %
Same here, there was a moment I think we had a fork. It is looking okie right now. 29998 792771258323459600 1/1/2014 9:17:57 AM 0 0 + 0 0 B 1 4048985520109362351 222 % |
|
|
|
Is this a really random pass or a passphrase that you can remember ? While Nxt security is not yeat at a desirable level I think it is an user's issue that your acc got hacked. Utopian, thanks. COMPLETELY random like (not exactly) *&D(_xa,I7:{"X plus another 28 characters, etc. 35 total. wth? Gotta try to sleep now. argh! Then it wasn't brute forced. Not possible. How much NXT did you lose pal? Yep, can't brute force this type of pass. He probably typed his pass somewhere on the net. Has to be extremely careful these days. |
|
|
|
1. I've decided to join forces with ferment (owner of 22k.io), as it's import to cooperate on one of the best features of Nxt and not confuse users with multiple extensions and what not.
Alright! I think we can go really fast this way. The clock is ticking! 2. Now, there is a bit of a difference between my extensions and what 22k.io currently has. I would like some community input on which approach is best.
- 22k.io extensions are "thin clients".
- My extensions are "thick clients".
Which approach is technically best? I don't know. Perhaps a combination of the two could also be done; if the alias is a simple URI or email address, the client handles it, otherwise it's sent to 22k.io which can then show account info, etc...
I think a hybrid model would be good. Like an option where one could choose "public nxt nodes" or "22k.io" as the source of info. So there will naturally be a trade off on trust vs features. Thick clients (extensions, native apps, mobile apps with code) are more of a long term investment for the community as they require significant overhead of multiple codebases, releases, distribution, etc. Thin clients will allow us to test the functionality and progress rapidly. Both are necessary. 3. We also have to be careful about security. Especially when it comes to aliases that refer to an account.
If a node is compromised, it could return the attacker's ID instead of the real account ID. This could result in stolen coins if you send to that ID.
That's why it's perhaps better to connect to multiple nodes (3 or more, from different geographical ares) and ask all of them for the alias info, and only if all of them return the same information show the user the result. We also have to make sure that 22k.io is not compromised.
A valid point that supports the hybrid thin/thick model. Sensitive information should be handled in the thick client (or javascript in browser). One idea is the thick client could handle "verification" of 22k.io by providing a function to check localhost and public nodes (but not nxtbase nodes!). 4. I think it's best if this entire project would be handled as a community effort, with some kind of official sanctioning so that users know they can trust the extension/website.
I'll respectfully disagree on this point. NXT market adoption doesn't have time to wait this. My strategy is to build cool stuff and address trust issues as they arise. Sanctioning is implicit in adoption. All code, both client side (browser extensions), as well as server side, should also be available for peer review, open-source and hosted on github. I haven't yet got word back from ferment on this.
I'm all for client stuff being open source. However, I would prefer to keep the "special sauce" closed and then open source libraries based on the work. I'm still trying to figure out how to make the NXTs off this work. If the community wants to invest, then open sourcing everything is certainly an option I'd consider. I have a 5 person dev/ops team at my disposal, but I can't pull them off paying gigs without revenue generation. If we follow a model where security related things are always handled on the client side, then this shouldn't be an issue. If we follow a "trust, but verify" approach, the need for open sourcing as test of trustworthiness is not required (besides, I could run different code and not tell anyone). 5. We also need some kind of agreement on the json syntax and other new features.
My strategy is to just start defining stuff and implementing. If someone doesn't like the format, they're free to implement it differently. History has shown that adoption is the best form of "agreement". Let the market decide. So, would I propose, is that we start publishing an API and spec for 22k.io as we implement support for advanced alias features and other things. Exciting stuff! I agree with ferment's bold statement. We need individual initiatives and responsibility. Decentralization just means everyone can take an initiative without a central party's confirmation even it is a collective party. Just do what you think is best and the market will sort out who can be trusted. |
|
|
|
|
Please confirm the last block
29984 9433259657262176905 1/1/2014 8:57:35 AM
2 497 + 2 262 B
1 7194195512915330456 2379 %
re we on a fork ?
update
29988 2382970272294477859 1/1/2014 9:00:34 AM
0 0 + 0 0 B
1 1360612700859448889 590 %
|
|
|
|
Is this a really random pass or a passphrase that you can remember ? While Nxt security is not yeat at a desirable level I think it is an user's issue that your acc got hacked. |
|
|
|
Update regarding Nxt Alias Browser Extensions:
1. I've decided to join forces with ferment (owner of 22k.io), as it's import to cooperate on one of the best features of Nxt and not confuse users with multiple extensions and what not.
2. Now, there is a bit of a difference between my extensions and what 22k.io currently has. I would like some community input on which approach is best.
- 22k.io extensions are "thin clients". The alias entered is immediately sent to 22k.io which then processes the alias; (does a redirect, shows account info, etc.. depending on the alias). This is an advantage because new features can be added easily.
- My extensions are "thick clients". The extension itself processes the alias. It first tries to ask your localhost for the alias URI, if you have the Nxt client running on your computer. If not, it connects to a Nxt node on the internet and asks it for the alias info.
The extension then decides what to do; redirect, open an email, etc..
New features require an update to the extension. I haven't checked yet if auto-update is an option in all browsers.
Which approach is technically best? I don't know. Perhaps a combination of the two could also be done; if the alias is a simple URI or email address, the client handles it, otherwise it's sent to 22k.io which can then show account info, etc...
3. We also have to be careful about security. Especially when it comes to aliases that refer to an account.
If a node is compromised, it could return the attacker's ID instead of the real account ID. This could result in stolen coins if you send to that ID.
That's why it's perhaps better to connect to multiple nodes (3 or more, from different geographical ares) and ask all of them for the alias info, and only if all of them return the same information show the user the result. We also have to make sure that 22k.io is not compromised.
4. I think it's best if this entire project would be handled as a community effort, with some kind of official sanctioning so that users know they can trust the extension/website.
All code, both client side (browser extensions), as well as server side, should also be available for peer review, open-source and hosted on github. I haven't yet got word back from ferment on this.
5. We also need some kind of agreement on the json syntax and other new features.
From user's perspective, I like browser's extension approach better. I still use 24k.io if I wan to check if an alias available or the total number of aliases one account has. But if I want to go directly to one alias's destination, I prefer the ease of just typing in my browser. |
|
|
|
Al, thanks. you got the honor. We need these kind of researches. I will be doing a peer- review article in the economics side soon. |
|
|
|
I still don't understand how to mine this coin. Got absolutely nothing. Any help anywhere in these 600 pages?
Forging is basically not something that is really important in NXT as a way to think about the coin. It's more in the nature of a "perk" when the transactions are going well and you have a significant amount of NXT in your active account. You basically get a chance to "forge" a block in the chain and get all transactionfees associated with that block. However, the chances of forging (when the coin has decentralised a lot) will be very low for most people. I think of it as a nice extra, nót as a way to earn easy money by just having it rest. Hope that clears it up a bit. But why not? I read that top accounts with 50M coins forge appx 35 000 coins a day which means you need 4 years to make another 50M. So even if the price stays the same and number of transactions won't increase you're fine. Four years is a good timing. Open and operate a restaurant for example is much harder and risky. No way you can mine 35k NxT with 50M. It's a lot of less than that. Less than 1k for sure. 50 million account could mine 1K but probaly less than 2K per day. It depends on the amount of traffic that day. A number could be easily calculated using the info from the blockchain explorer. |
|
|
|
If someone creates a forum poll on nextcoin.org and majority votes for this min fee setting ratio (always keep min fee ~$0.10), would the devs implement it or would we still need to wait for the VS to be in place?
Jean-Luc, this is addressed to u. IMO $0.1 is way too much, it should be no more than $0.01 I think it'd be dangerous for the network then, no incentive to forge. Yes you have, keeping the network alive is enough incentive to forge. Otherwise your NxT holdings will become worthless. Charging $0.1 fee for every transaction makes NxT useless for micropayments. Now they can be higher to avoid attacks, but it should be smaller in the future (nearly 0). I completely agree about low transaction cost but also want to note that NXT does not need to be used for micropayments. The load could be too much for the system to handle. It would be better to target Nxt to high value transaction. All the talk about Bitcoin for uses in micro-transaction has not yet materialize. just fancy talk so far. |
|
|
|
If someone creates a forum poll on nextcoin.org and majority votes for this min fee setting ratio (always keep min fee ~$0.10), would the devs implement it or would we still need to wait for the VS to be in place?
Jean-Luc, this is addressed to u. IMO $0.1 is way too much, it should be no more than $0.01 Right at this moment 1 nxt > 5 cent =0.05. But agree to keep the transaction cost low since that's the best way to encourage activities. |
|
|
|
I'm not sure if this is the right place but I did a BTC withdrawing almost 5 days ago and it's still pending..
Anybody else experiencing problems like this one?
That's the problem with the exchange. You have to ask the exchange owner, not us. |
|
|
|
Plan ahead, sure. I think implementing it should wait however. 1NXT is not that much and we already have people worrying about the distribution of NXT as it is. I would prefer to see it tied to volume and transaction total. Not to a fiat or even BTC price.
People don't think in terms of crypto prices yet, they tend to think in fiat terms. When/if fiat currencies do collapse, then it'll make more sense to tie the fee to something else, but now, even from the marketing standpoint, it sounds great when you say that the fee is only 10 cents, all people understand cents, fewer people understand exchange rates and how much it costs in crypto terms. But when you say 10 cents, everyone thinks - wow, so cheap, I gotta have a thorough look into this online currency. This doesn't make any sense. NXT fees should be expressed in NXT. Period. Fee is always in NXT. He means it should not exceed 10 cent. Cos you want to use NXt in the real world, shopping, buying food, coffee, etc. |
|
|
|
the min fee can be set to 0.50, 0.25, etc? can be any number?
Almost any. Minus 1 NXT fee wouldn't be a good decision. ok, so when NXT goes to $0.20, set min fee to 0.50, NXT goes to $0.40 set min fee to 0.25, NXT goes to $1 min fee to 0.1, etc. If someone creates a forum poll on nextcoin.org and majority votes for this min fee setting ratio (always keep min fee ~$0.10), would the devs implement it or would we still need to wait for the VS to be in place? I agree that a fee reduction schedule have to be planned ahead. Need to do it the sooner the better. Plan ahead, sure. I think implementing it should wait however. 1NXT is not that much and we already have people worrying about the distribution of NXT as it is. I would prefer to see it tied to volume and transaction total. Not to a fiat or even BTC price. Yes plan ahead only. 1NXt is good for now. I think laowai's rule is a good one. Fee should not exceed 10 cent (0.1 us$). I don't know why we would want to tie to fiat or limit ourselves by that at all. Plus not everyone uses US$ and it may be more or less expensive based on their local currency. Why not shoot for a goal of 'X' amount of NXT per day (or whatever) should be recirculated as transaction fees to forgers. Like a difficulty adjustment for the transaction fee. The more people that use NXT, the less it costs each person to send NXT. It could be a good idea but it could be difficult to implement and more difficult to know the exact fee at each moment you need to send NXT. We could also tie it to the actual price to buy a cup of coffee or a big Mac for example. If we want NXT to be used in a widespread scale like buying food, gas, coffee then the fee has to be proportional. If a cup of coffee cost generally 2-3$, the minimum should no be over 10 cent. Basically tie the fee to purchasing power. |
|
|
|
the min fee can be set to 0.50, 0.25, etc? can be any number?
Almost any. Minus 1 NXT fee wouldn't be a good decision. ok, so when NXT goes to $0.20, set min fee to 0.50, NXT goes to $0.40 set min fee to 0.25, NXT goes to $1 min fee to 0.1, etc. If someone creates a forum poll on nextcoin.org and majority votes for this min fee setting ratio (always keep min fee ~$0.10), would the devs implement it or would we still need to wait for the VS to be in place? I agree that a fee reduction schedule have to be planned ahead. Need to do it the sooner the better. Plan ahead, sure. I think implementing it should wait however. 1NXT is not that much and we already have people worrying about the distribution of NXT as it is. I would prefer to see it tied to volume and transaction total. Not to a fiat or even BTC price. Yes plan ahead only. 1NXt is good for now. I think laowai's rule is a good one. Fee should not exceed 10 cent (0.1 us$). |
|
|
|
|
Show Posts
