NXT :: descendant of Bitcoin - Updated Information

[Come-from-Beyond]

OK, guys, this is important, please don’t skip over.

This is in relation to https://bitcointalk.org/index.php?topic=345619.msg4278460#msg4278460 (14699 NXT were sent to an erroneous account number).


1. After a lot of thinking and recalling, I am now 99.9% sure this wasn't my mistake:

a) I am a programmer with OCD, most of you here know what I mean: we obsess about tiniest details and double, triple check everything, especially something as important as sending a big chunk of money.

b) I have a 2-monitor machine, so backend form was on one screen and NXT client on the other. I moved my eyes at least 3-4 times between these two forms to make sure everything is correct. And the address is the most important part.

c) The address is long and starts with 1 (easily noticeable digit), erroneous account is shorter and starts with 4. I would have definitely noticed it by comparing 2 forms side-by-side.

d) I couldn't find any source from where this erroneous number could have gotten into my clipboard. All my passwords and passphrases are alphanumeric. There are no transactions in my history with this hash.

e) Other people apparently reported similar behavior.

This brings me to my second point:


2. This was most probably the software error. Come to think of it, it was silly to start using the system for real money this early in development! We should have all been on a testnet!

Now, this wouldn't be such a problem if I were one of the original stakeholders. Then I would have plenty of these monopoly money to cover any glitches.

But I missed out on that by like a week. So now these monopoly money turns into very real $1200 for me, which I simply cannot afford to pay, at least not right now. And not for something I am not responsible for. I am already paying for everything out of my own pocket: server, withdrawal fees, etc.

If this person thought it was Ok to send $1200 worth of money to an exchange 2 days old, built on top of a beta system, which haven’t even released the source code yet – then they must have prepared to take any possible losses. That’s what I do, except in my case the amounts are approximately two orders of magnitude smaller!

I thought about closing the exchange, but it’s a nice project and people seem to like it.

So the exchange stays operational. From now on I will save a screenshot right before I click “send” to make absolutely sure this wasn't my mistake if this ever happens again.

Also, if you deposit any money, you are on your own, no guarantees. This is a “best effort” service, because it’s built on top of such an unstable technology.

That said, if my exchange ever starts to bring serious money, here is my public promise to repay this erroneous transaction.

And this brings me to my final point:


3. This has to stop. There must be CRC added into addresses ASAP! Imagine the amount of grief this would cause, when the system hits the wild and people start losing money due to glitches or typos!

Allowing to send money to an arbitrary number is ridiculous! What if some guy buys a car and his money are now forever locked, due to a simple typo or a glitch?

Or there should be an easy mechanism to return these unclaimed funds back into account.

CRC will also protect against bugs, because other nodes will reject an erroneous address, even if one node thinks it is Ok.

Send me NRS u used to send the money.

Edit: Also PM me with the address u was going to send it to and the address it went.

[nxtuser]

isn't a password, that is generated by such a tool, insecure?

Why would you think so? Every time you run the tool OpenSSL RNG is properly seeded and 16-character random prefix is generated, which becomes part of the account password. I personally do not see any issue with this.

I'm also planning to add some minor features and release the source code so anyone can audit.

[lr127]

There must be CRC added into addresses ASAP!

I agree. I thought about this recently and not found any reasons why we can't add the "check digit" to verify the account (as example GS-1, IBAN, etc).

[lophie]

What is this passphrase thing in 0.4.8?

[kunibopl]

There must be CRC added into addresses ASAP!

I agree. I thought about this recently and not found any reasons why we can't add the "check digit" to verify the account (as example GS-1, IBAN, etc).

isn't it the same with BTC?

[Come-from-Beyond]

There must be CRC added into addresses ASAP!

I agree. I thought about this recently and not found any reasons why we can't add the "check digit" to verify the account (as example GS-1, IBAN, etc).

Use Alias System.

[Zahlen]

Wouldn't aliases still be vulnerable to single-char typo errors?

EDIT: This kind of error is ok for URLs, you see a wrong site, just retype. But not ok for things that can cause big changes, like transaction addresses. Bitcoin client GUIs partially solve (or maybe go around is a better way of describing it) this by letting the user set up addresses in advance (and assigning readable labels to those addresses), so that checking accuracy of address only needs to be done one for each unique address.

[timmyd]

T- 2hrs 40mins 

[Come-from-Beyond]

Wouldn't aliases still be vulnerable to single-char typo errors?

No, if u register alias that contains CRC.

[lr127]

isn't it the same with BTC?

I don't know how BTC works.

Use Alias System.

It's crutch (kostyl)
If i want to send money to dgex how i can use alias system?

[mcjavar]

Just a friendly reminder...

There will be a Bitcoin Conference in February held in Berlin.

http://www.mediabistro.com/insidebitcoins/

I am not from Berlin, but would love to represent Nxt on this venue. I decided to take 3 days off and fly over to Germany and use the opportunity to spread the word, let others know about Nxt and it´s features.
I am sure that we all will benefit from having someone around at a venue like this. I am asking the community to support these efforts by donating to help fund the journey and the purchase of marketing materials like T-Shirts & pendrives with Nxt logo/slogan on them, printing some cool Nxt bills, and so on.

I will document all the expenses and will make the spending of the fund transparent. I will also broadcast from the venue and post some pictures

I received donations from 3 persons so far... I am asking community members, escpeially with big stakes to support this and help with funds AND ideas how to make Germany aware of Nxt. Even a couple of hundred Nxts will help.

11433600460445633305

Thank you!

[laowai80]

If i want to send money to dgex how i can use alias system?

Need to ask client devs to implement 'send money to alias' feature asap.

[Jean-Luc]

isn't a password, that is generated by such a tool, insecure?

Why would you think so? Every time you run the tool OpenSSL RNG is properly seeded and 16-character random prefix is generated, which becomes part of the account password. I personally do not see any issue with this.

I'm also planning to add some minor features and release the source code so anyone can audit.

Please, do release the source of your vanity generator. I was about to warn people not to use it, because it is a closed source tool posted by a new user with 5 posts only. Can't be too paranoid after the incident we already had. Without the source, how does one know if your random prefix is really random?

[bitcoinpaul]

...
Bitcoin client GUIs partially solve (or maybe go around is a better way of describing it) this by letting the user set up addresses in advance (and assigning readable labels to those addresses), so that checking accuracy of address only needs to be done one for each unique address.

This is a client problem. We have a nice client soon...

[Come-from-Beyond]

Use Alias System.

It's crutch (kostyl)
If i want to send money to dgex how i can use alias system?

It's by design. DGEX must support the same URI scheme for CRCed aliases as u.

[Jean-Luc]

I have a question related to all security issues we could see today. Should I be worried about my Chrome cache and that with the help of the cache someone will steal my password? Seems to me that I read somewhere in the last pages that we should delete cache as well..

So I have downloaded new client from the  first page and checked the SHA, created new account and transfered my next to the new account with new passphrase. I cleared my cache and started using Chrome in incognito mode(I don't know if this is even necessary).. I also instaled a anti key-logger. After doing all this, am I well protected?
Thanks everyone..

With 0.4.8 and earlier, URLs containing your secret phrase were being cached by the browser in the disk cache. So yes, you should delete that cache, and if you are ever worried about a situation like your laptop being stolen, confiscated by the authorities, at the US border, and so on, whoever has access to it can examine your hard disk and find that password.

With 0.4.9e, those URLs are not cached on disk, but firefox still keeps them in the memory cache. I haven't tested other browsers. And I don't know how easy it is for other websites to exploit and try to fish out what is in your memory cache. So, to be safe, use a separate browser profile, or incognito mode, when accessing your Nxt node at localhost.
 

[Zahlen]

Wouldn't aliases still be vulnerable to single-char typo errors?

No, if u register alias that contains CRC.

This makes the alias harder to remember though, which subtracts from the main purpose of aliases.

There are still 192 reserved bits in addresses right? Maybe can spare some as check bits?

...
Bitcoin client GUIs partially solve (or maybe go around is a better way of describing it) this by letting the user set up addresses in advance (and assigning readable labels to those addresses), so that checking accuracy of address only needs to be done one for each unique address.

This is a client problem. We have a nice client soon...

Yeah, looking forward to it I hope it improves on Bitcoin clients way of handling this. Even checking once is not that great, considering addresses are 64 chars long!

(Sorry if I'm being annoying. I'm just trying to make useability aspects more visible.)

[landomata]

I have a question about colored coins.
Will it be possible to generate let's say 3 turtlecoins (each with the value of 10 NXT), print a QR-code for each of them, go to the next petshop, give the 3 QR-codes to the petshop and get 3 turtles?
petshop redeems QR-codes and can exchange turtlecoins to NXT within his account?

as long as Turtle coin is traded in the Asset exchange....& the merchant accepts it should be fine...i think...

[mnightwaffle]

whoever has access to it can examine your hard disk and find that password.

With 0.4.9e, those URLs are not cached on disk, but firefox still keeps them in the memory cache. I haven't tested other browsers. And I don't know how easy it is for other websites to exploit and try to fish out what is in your memory cache. So, to be safe, use a separate browser profile, or incognito mode, when accessing your Nxt node at localhost.
 

That cache can be perm. deleted with ccleaner or something similar to http://eraser.heidi.ie/ right?

[NxtChg]

If I understand correctly, Bitcoin address has an embedded checksum.