[FORBES] How Private Are Bitcoin Transactions?

[phillipsjk]

I always thought that self-signed certs were as secure just could not be verified by trusted CAs which would trigger unsigned cert message in browsers other than that they should be functioning same as signed ones or am I misunderstanding?

The problem is that your browser trusts a lot of signing authorities. Many will let you a buy a certificate that in turn lets you sign your own certificates. That means if your attacker has money, they can easily impersonate any website they want by signing a certificate in their name. Source: Certificate Patrol Website

Edit: You also need to be a company with over 5 million in assets, 5 Million in insurance and has clear audited policies on how you use the certificates. For the GeoTrust root anyway.

I've heard that there was some sort of venerability with OpenSSL certs, but other than that are signed certs by well known organizations safe? I mean could a middle man such as an ISP intercept handshake and public keys and eavesdrop inside secure channel passing packets or is it impossible?

I only started caring about ubiquitous encryption over the past 3 months or so. I am dismayed how prudent sending everything is clear-text really appears to be: HTTPS can easily give a false sense of security. I have not had time to tease out a list of best practices. My own website does not support HTTPS at the moment.

Edit: I have an interest in the gopher protocol. I may investigate using IPSec for encryption or authentication. I currently care more about authentication. Authentication can never be automated and easy: That is the situation we have with Certificate authorities. Users need to exchange information out-of-band: over the phone, in person, or by letter mail.

[1715087461]

1715087461

[1715087461]

1715087461

[1715087461]

1715087461

[1715087461]

1715087461

[1715087461]

1715087461

[lettucebee]

When making an outgoing payment, pick a selection of addresses whose balances add up to only slightly more than the sum you wish to pay. Pool those into a new address (with a little left-over in one of the original accounts), and send the whole payment from that new address.

I don't fully understand what is being said here.  How did I end up with a selection of addresses whose balances add up to only slightly more than the sum I wish to pay?  Do I need to spend time sending and receiving to myself to have these?  Also, I thought the client chooses randomly across addresses which ones take the hit for an outgoing payment (true?).  If yes, how do I control which addresses take the hit?

[ctoon6]

the whole https thing seems silly to me. who thought it was a good idea to combine https with verifying who you are talking to is who you are talking to. it makes doing this more difficult for less technically inclined people to think that who they are talking to is automatically bad. I believe these 2 things should be completely separate so we don't have to buy certs from some moron who thinks they have more trust than someone else.

[phillipsjk]

HTTPS includes authentication, because without it man-in-the-middle attacks are trivial.

Encryption isn't magic security pixie dust. Without authentication, the attacker can simply set up two encrypted sessions: one to the user, and one to the server being impersonated.

[error]

HTTPS includes authentication, because without it man-in-the-middle attacks are trivial.

Encryption isn't magic security pixie dust. Without authentication, the attacker can simply set up two encrypted sessions: one to the user, and one to the server being impersonated.

But.... but.... http://www.youtube.com/watch?v=3nbEeU2dRBg !!!

[ctoon6]

But.... but.... http://www.youtube.com/watch?v=3nbEeU2dRBg !!!

i like, i want some.

[Serge]

I always thought that self-signed certs were as secure just could not be verified by trusted CAs which would trigger unsigned cert message in browsers other than that they should be functioning same as signed ones or am I misunderstanding?

The problem is that your browser trusts a lot of signing authorities. Many will let you a buy a certificate that in turn lets you sign your own certificates. That means if your attacker has money, they can easily impersonate any website they want by signing a certificate in their name. Source: Certificate Patrol Website

Edit: You also need to be a company with over 5 million in assets, 5 Million in insurance and has clear audited policies on how you use the certificates. For the GeoTrust root anyway.

With unsigned certificates my question isn't concerning trust unless security is totally depend on 3rd party trusted authorities. So the question is: is unsigned certificate provides same level of security as a signed one?  Whether browser trusts it or not doesn't matter as long as unsigned cert provides same safe encrypted channel for transmitting data.

[error]

With unsigned certificates my question isn't concerning trust unless security is totally depend on 3rd party trusted authorities. So the question is: is unsigned certificate provides same level of security as a signed one?  Whether browser trusts it or not doesn't matter as long as unsigned cert provides same safe encrypted channel for transmitting data.

Yes, as long as you can be sure that the certificate actually belongs to the site that you think it does. But if the certificate is self-signed then you have to figure this out for yourself. Most people do not have the technical expertise (or the patience!) to do this.

[ctoon6]

how can you be sure that your browser was not involved in a man in the middle attack and that its certs were not tampered with. the only way you can know 100% sure the person you talk with on the internet is if you exchange keys in person.

[joulesbeef]

I'm not sure I understand the article completely.

Dont people tend to use multiple addys? I know it seems to be a noob mistake to think that your old addys are no good as it changes right after you receive some coin.

and how can you link someones receive addresses with their send ones?

or is he just saying, if you collect your poker winnings with one address dont use that same address in your forum sigs?

if people only used one address for their questionable activity and then one for everything else, what else would the authories know besides money is traveling between a known illegal addy like silk road and and an address that a user only uses for that purpose? 

I guess their are links between addies and IPs?

[ctoon6]

I'm not sure I understand the article completely.

Dont people tend to use multiple addys? I know it seems to be a noob mistake to think that your old addys are no good as it changes right after you receive some coin.

and how can you link someones receive addresses with their send ones?

or is he just saying, if you collect your poker winnings with one address dont use that same address in your forum sigs?

if people only used one address for their questionable activity and then one for everything else, what else would the authories know besides money is traveling between a known illegal addy like silk road and and an address that a user only uses for that purpose? 

I guess their are links between addies and IPs?

You could get a new "identity" by dumping all your coins in a laundering service and killing all your old addresses. if you needed you could use tor for all BC related stuffs.

[lettucebee]

You could get a new "identity" by dumping all your coins in a laundering service...

That's not entirely true, right? If you have a large sum of money you could overwhelm the launderer and end up receiving some of your own coins back. Even ONE would be enough to trip you up.

[ctoon6]

You could get a new "identity" by dumping all your coins in a laundering service...

That's not entirely true, right? If you have a large sum of money you could overwhelm the launderer and end up receiving some of your own coins back. Even ONE would be enough to trip you up.

http://xuie7qspblyer5ms.onion/