The TRUTH about Darkcoin: ZERO Anonymity, EASY DOS attacks, & Amateur code base!

[toknormal]

The biggest weakness of Darkcoin I think is if the regime decides that coin tumbling is illegal and akin to money laundering and all it will take is a quick court order to go yank all those Amazon cloud servers hosting the Masternodes real fast.

...and the biggest strength is that masternodes are decentralised so they can be set up in 5 minutes on any other of 1-2 billion computing units around the world. The critical thing that secures a masternode isn't a poxy Amazon cloud server, it's a blockchain address containing 1000 coins (which isn't hosted on a cloud server   ).

[G2M]

The biggest weakness of Darkcoin I think is if the regime decides that coin tumbling is illegal and akin to money laundering and all it will take is a quick court order to go yank all those Amazon cloud servers hosting the Masternodes real fast.

...and the biggest strength is that masternodes are decentralised so they can be set up in 5 minutes on any other of 1-2 billion computing units around the world. The critical thing that secures a masternode isn't a poxy Amazon cloud server, it's a blockchain address containing 1000 coins (which isn't hosted on a cloud server   ).

So, the actual capacity of DRK to fill these computing units is .0011% as an absolute maximum of number of computing units (2 billion) that will be a masternode.

Your argument would have better off just mentioning that there are 1-2 billion units capable of decentralizing the network, if we were to agree on the fact that likely 90% of those 1-2 billion computing units are easily compromised by air gaps, numerous hardware backdoors, and then even more software vulnerabilities and backdoors.

So really, the critical thing is that theres a blockchain hosted by a node...because the actual chances of a single masternode ending up on non compromized software based on chance would be 10% x .0011% I'd wager. So .00011% of all masternodes, which are fairish odds of about 1 in 91k masternodes would end up on noncompromised hardware and software with 1-2 billion users and other numbers pulled totally out of my ass.

I mean if 1-2 billion people were to use darkcoin, they're just not all gonna host masternodes. It would probably be from them that the network remained decentralized, rather than a few ten thousand masternodes at that point.

[ArticMine]

The biggest weakness of Darkcoin I think is if the regime decides that coin tumbling is illegal and akin to money laundering and all it will take is a quick court order to go yank all those Amazon cloud servers hosting the Masternodes real fast.

...and the biggest strength is that masternodes are decentralised so they can be set up in 5 minutes on any other of 1-2 billion computing units around the world. The critical thing that secures a masternode isn't a poxy Amazon cloud server, it's a blockchain address containing 1000 coins (which isn't hosted on a cloud server   ).

So, the actual capacity of DRK to fill these computing units is .0011% as an absolute maximum of number of computing units (2 billion) that will be a masternode.

Your argument would have better off just mentioning that there are 1-2 billion units capable of decentralizing the network, if we were to agree on the fact that likely 90% of those 1-2 billion computing units are easily compromised by air gaps, numerous hardware backdoors, and then even more software vulnerabilities and backdoors.

So really, the critical thing is that theres a blockchain hosted by a node...because the actual chances of a single masternode ending up on non compromized software based on chance would be 10% x .0011% I'd wager. So .00011% of all masternodes, which are fairish odds of about 1 in 91k masternodes would end up on noncompromised hardware and software with 1-2 billion users and other numbers pulled totally out of my ass.

I mean if 1-2 billion people were to use darkcoin, they're just not all gonna host masternodes. It would probably be from them that the network remained decentralized, rather than a few ten thousand masternodes at that point.

The theoretical limit to the number of DRK masternodes at this point in time is 5157 and then there would only be 101 DRK in total left to be used as a currency. http://coinmarketcap.com/currencies// I fail to see where people are getting a few ten thousand masternodes from.

[G2M]

estimated coins max, is 22,000,000 at some unknown point in the future.

Obviously if all of them were in use for masternodes, it likely wouldn't be a currency at that point, but I'd say it's still a maximum.

So, maybe, an estimated maximum of 22k masternodes then?

add: the odds I was referring to were just that, odds. We can imagine that there are "one in a trillion odds" for someone, though there are not that many people in the world. sorry if that was taken to indicate there would be >90k masternodes ever, because there won't.

[illodin]

Darkcoin is prone to several cost-less DOS attacks that can destroy the whole network.

If its true do it and I'll pay you. I hold a certain interest in dark coin competition. Also it would be better for everyone involved if this monster was killed before it becomes any bigger and hurts even more people. But lets just say ill believe its THIS easy when i see it myself.

Cool, hiring someone to do criminal activities for your benefit - check with your momma first if she thinks it's a good idea.

Criminal? How? I mean if its some sort of crime than never mind. What law are you referencing?

In my country it's called "telecommunication interference" (word-for-word translation), which is a crime. Depends on the country where the affected party is I suppose.

[Anon136]

Darkcoin is prone to several cost-less DOS attacks that can destroy the whole network.

If its true do it and I'll pay you. I hold a certain interest in dark coin competition. Also it would be better for everyone involved if this monster was killed before it becomes any bigger and hurts even more people. But lets just say ill believe its THIS easy when i see it myself.

Cool, hiring someone to do criminal activities for your benefit - check with your momma first if she thinks it's a good idea.

Criminal? How? I mean if its some sort of crime than never mind. What law are you referencing?

In my country it's called "telecommunication interference" (word-for-word translation), which is a crime. Depends on the country where the affected party is I suppose.

Well in that case what do we even need byzantine fault tolerance for? Lets just make it illegal to interfere with the network! That's got to be cheaper than all this "mining" nonsense.

No but seriously legality aside, if it really was easy to destroy the network it would be in everyone's best interest for someone to do this. That would make w/e value it had bubble value and its better to pop a small bubble than a big one.

[zsp]

I always thought Darkcoin is a good one.

[illodin]

Darkcoin is prone to several cost-less DOS attacks that can destroy the whole network.

If its true do it and I'll pay you. I hold a certain interest in dark coin competition. Also it would be better for everyone involved if this monster was killed before it becomes any bigger and hurts even more people. But lets just say ill believe its THIS easy when i see it myself.

Cool, hiring someone to do criminal activities for your benefit - check with your momma first if she thinks it's a good idea.

Criminal? How? I mean if its some sort of crime than never mind. What law are you referencing?

In my country it's called "telecommunication interference" (word-for-word translation), which is a crime. Depends on the country where the affected party is I suppose.

Well in that case what do we even need byzantine fault tolerance for? Lets just make it illegal to interfere with the network! That's got to be cheaper than all this "mining" nonsense.

No but seriously legality aside, if it really was easy to destroy the network it would be in everyone's best interest for someone to do this. That would make w/e value it had bubble value and its better to pop a small bubble than a big one.

Yes, I agree - obviously a coin should be tolerant even to illegal attacks.

OP's original claim that "Darkcoin is prone to several cost-less DOS attacks that can destroy the whole network" is not true though. I don't know if it was true back when the claim was made, but I know that after OP was posted the dev team went bug hunting and fixed several bugs that could've been used to stall some of the functionality or game the masternode payments to benefit a dishonest masternode. When developing new technology problems are bound to happen, and that has been priced in as we can remember from the fork issues and the subsequent price drop last summer. Nevertheless, it was a good thing that the OP was posted back then as it motivated the team to set developing new features aside for a moment and go through the codebase and clean out all bugs they could find.

[mullick]

I normally stay well clear of these debates, for obvious reasons, but I do get frustrated when I see well-articulated responses from people who are clearly intelligent advocating this obviously broken architecture, mostly through much hand-waving and placating each other.

Masternodes have to be available and connected to in real time in order to be used. Mixing is based entirely on their availability. Thus, in order to control a substantial number of masternodes one merely has to own a handful, and make the rest of the masternode network unreachable.

For even a script-kiddie-level attacker these techniques and funds are easily found.

Need to render 1100 masternodes unreachable? No problem - SNMP amplification attacks will let you use a handful of boxes to amplify the bandwidth under your control. When a datacenter sees a clear flood of traffic for a particular IP address at the datacenter their response is always automatic and the same - their upstream data provider blackholes that IP address at the upstream bordergate. This means that you can use SNMP or DNS amplification attacks to render a dedicated machine (never mind a VPS) inoperable and unreachable to the outside world.

The most critical take away for you today is that this problem is unsolvable at the userland level. In other words, no matter how much dev worship there is there isn't a magical line of code that can be written that can prevent amplification attacks from devices and servers that are unrelated to and unconnected to the Darkcoin network. It is something that cannot be controlled or influenced.

The solution would literally be for Darkcoin to scrap masternodes and go back to the proverbial drawing board to find an architecture that uses passive blockchain mixing or similar, but I suspect it is too late and there are too many stubborn heads for that.

The problem I see with this is.

Say there are 1,240 master nodes on the network. Lets say they are each feeding off a 1Gb pipe

In order to take out 1,240 masternodes you would need at least 1,240Gbps sustained ddos attack. Pretty hard to pull off

You would also have to own a few masternodes to pull off the attack. Therefore making an sizeable investment. And then attempting to destory the value of that investment

Your essentially saying the bitcoin network is just as vulnerable. If thats the case you could ddos 1,240 pools and gain 51% hashing power. Its just not as easy as your making it seem I dont think

do you really think so? If someone wanted to destroy darkcoin's anonymity to say, catch someone whos engaging in illegal activity, then they(law enforcement) would probably have no issue ddosing all the masternodes, and what makes it even easier is that all the masternode's ip's are in the open.

There are currently too many barriers for this kind of attack to even make sense. Even governments have spending oversight (lax as it is)
I'd like to see the agent in charge try to explain expenditure in the 10 million range , just to catch one or three traders of 50k worth of DRK.  

A better way to phrase my point

If this attack were this easy. Would you rather....

1. Attack bitcoin nodes and double spend for profit

2. Attack darkcoin nodes to unmask masked transactions

[stonehedge]

Just a quick note on the usage of AWS for masternodes.  AWS accounts for less than half of masternode hosting now.  The community started to branch out some months ago.

[fluffypony]

The problem I see with this is.

Say there are 1,240 master nodes on the network. Lets say they are each feeding off a 1Gb pipe

In order to take out 1,240 masternodes you would need at least 1,240Gbps sustained ddos attack. Pretty hard to pull off

You would also have to own a few masternodes to pull off the attack. Therefore making an sizeable investment. And then attempting to destory the value of that investment

Your essentially saying the bitcoin network is just as vulnerable. If thats the case you could ddos 1,240 pools and gain 51% hashing power. Its just not as easy as your making it seem I dont think

You are incorrect for several reasons.

Firstly, when a server is DDoS'd the reaction of the data centre is almost always to block all data destined for the server's IP at the upstream data provider. Normally this is done on a BGP level. The thing with these BGP requests is that they cannot happen on a minute-by-minute basis, because massive routing changes are potentially dangerous and normally go through a change control process. Typically speaking, a dedicated server would be blackholed upstream on a BGP-level for ~4 hours. A VPS maybe longer by virtue of how cheap it is.

Thus if a sustained attack of 10 minutes is required to shut down a server for 4 hours, how much simultaneous bandwidth is required to kill your proverbial 1 240 masternodes? Well, basically it means you have to attack ~52 servers simultaneously. Now bear in mind that there are plenty of VPS and dedicated hosts that have 100mbps limits, I'd hazard less than 40% have 1gbps on tap, and fewer still with unmetered ports. In the VPS space especially bandwidth is shared between all guests on the host machine, so the actual available bandwidth is far from promised. Thus we can't take your 1gbps theoretical as being valid for all but a handful of masternodes. But let's be generous and pretend that 50% have unmetered 1gbps ports, and 50% have unmetered 100mbps ports, which means the total bandwidth required to knock the 52 servers off the grid is 28.6gbps.

Assuming you're Joe Scriptkiddie and don't have access to a botnet, how much would it cost to launch such an attack? Well I used Str3ssed (one of the many so-called "booter" or "stresser", basically a DDoS-on-demand service pretending to be a network stress tester) to price it out. With their 250gbps of "stresser" capacity a 28.6gbps requirement is trivial. So if we just wanted to attack the network once we'd need to use their "1 Month Ultimate" package, which allows us to attack 1 target at a time for a total of 60 minutes within the month (of course you can change targets and start/stop attacks whenever you want, it's just a total of 60 minutes in the month). Because of that restriction we have to attack 207 masternodes simultaneously for 10 minutes, and then switch to the next group of 207 masternodes, and so on for an hour. After an hour we will have knocked the masternode network offline at least for the following 3 hours, some for even longer. The total cost of doing this once-off attack would be 207 x $50 = $10 350. Not cheap, but certainly not out of reach.

The larger problem is that an attacker only slightly more sophisticated or enabled than Joe Scriptkiddie can pull off a sustained attack without spending a cent. SNMP amplification attacks, for instance, are no longer uncommon. Since SNMP provides a ~650x amplification, it means that a savvy attacker can turn a 1gbps VPS into a 650gbps DDoS device.

Literally the only reason that ludicrous amateur cryptography like this survives is because of the vast technical incompetence of many altcoin proponents. The time will come when someone more proficient sees an opportunity to short a coin or stands to benefit from a downturn, and they will decimate the house-of-cards infrastructure that has been built up.

Oh and your last point is, unfortunately, also not true: if you DDoS all the pools difficulty would not retarget quickly enough for you to have 51% of the hashing power, as the majority of miners have a fallback, sometimes to private pools etc. Also, things like p2pool and solo miners make an attack like this unreliable.

[fluffypony]

Yes, I agree - obviously a coin should be tolerant even to illegal attacks.

OP's original claim that "Darkcoin is prone to several cost-less DOS attacks that can destroy the whole network" is not true though. I don't know if it was true back when the claim was made, but I know that after OP was posted the dev team went bug hunting and fixed several bugs that could've been used to stall some of the functionality or game the masternode payments to benefit a dishonest masternode. When developing new technology problems are bound to happen, and that has been priced in as we can remember from the fork issues and the subsequent price drop last summer. Nevertheless, it was a good thing that the OP was posted back then as it motivated the team to set developing new features aside for a moment and go through the codebase and clean out all bugs they could find.

No, you're misunderstanding what a DDoS attack is. DDoS attacks are tangential to the software running on the server.

I can DDoS a server that has every port closed off to the outside world; the minute I send enough multi-packet traffic bound for that IP that the server / router / bordergate / network appliance has to reassemble packets I'm going to cause devastating congestion, forcing the datacenter to block packets bound for that IP at their upstream data provider.

This has nothing to do with the very excellent Bitcoin software or any cryptocurrency cloned from it, it is merely the nature of IP traffic routing. No amount of "bug fixing" in the software can prevent these attacks since the attack doesn't even require the software to be running.

[fluffypony]

do you really think so? If someone wanted to destroy darkcoin's anonymity to say, catch someone whos engaging in illegal activity, then they(law enforcement) would probably have no issue ddosing all the masternodes, and what makes it even easier is that all the masternode's ip's are in the open.

There are currently too many barriers for this kind of attack to even make sense. Even governments have spending oversight (lax as it is)
I'd like to see the agent in charge try to explain expenditure in the 10 million range , just to catch one or three traders of 50k worth of DRK.  

A better way to phrase my point

If this attack were this easy. Would you rather....

1. Attack bitcoin nodes and double spend for profit

2. Attack darkcoin nodes to unmask masked transactions

I've already pointed out that 1. is nonsensical and not possible, and 2. makes the assumption that deobfuscation is the aim.

The third option that you're missing is: continuously attack Darkcoin masternodes in order to increase the profit of my masternode. Malice doesn't need to come from law enforcement, nor does it have to care about the longevity of the network.

[stonehedge]

The third option that you're missing is: continuously attack Darkcoin masternodes in order to increase the profit of my masternode. Malice doesn't need to come from law enforcement, nor does it have to care about the longevity of the network.

Masternode gaming was identified as a risk in a security review and a lot of strengthening against this was done.

However, its virtually impossible to attack the masternode network to increase payments to your node.  Thats just not how payment selection works.

[illodin]

Yes, I agree - obviously a coin should be tolerant even to illegal attacks.

OP's original claim that "Darkcoin is prone to several cost-less DOS attacks that can destroy the whole network" is not true though. I don't know if it was true back when the claim was made, but I know that after OP was posted the dev team went bug hunting and fixed several bugs that could've been used to stall some of the functionality or game the masternode payments to benefit a dishonest masternode. When developing new technology problems are bound to happen, and that has been priced in as we can remember from the fork issues and the subsequent price drop last summer. Nevertheless, it was a good thing that the OP was posted back then as it motivated the team to set developing new features aside for a moment and go through the codebase and clean out all bugs they could find.

No, you're misunderstanding what a DDoS attack is. DDoS attacks are tangential to the software running on the server.

I can DDoS a server that has every port closed off to the outside world; the minute I send enough multi-packet traffic bound for that IP that the server / router / bordergate / network appliance has to reassemble packets I'm going to cause devastating congestion, forcing the datacenter to block packets bound for that IP at their upstream data provider.

This has nothing to do with the very excellent Bitcoin software or any cryptocurrency cloned from it, it is merely the nature of IP traffic routing. No amount of "bug fixing" in the software can prevent these attacks since the attack doesn't even require the software to be running.

He said DOS, not DDoS. When he said DOS, he meant stuff like agreeing to participate in mixing, and then stalling the process by not signing, and so on. Bugs that allowed that sort of DOS attacks were fixed.

Wrt DDoS however, I posted this earlier:

do you really think so? If someone wanted to destroy darkcoin's anonymity to say, catch someone whos engaging in illegal activity, then they(law enforcement) would probably have no issue ddosing all the masternodes, and what makes it even easier is that all the masternode's ip's are in the open.

Problem for trying to deanonymize DRK by ddos'ing is that the coins are pre-anonymized before they can be used.

So people will have anonymous coins in their wallet, and someone starts the attack and manages to take out every masternode except their own. People will send their anonymous coins to purchase whatever, and the attacker will be none the wiser as the coins and transactions are already anonymous. At that point people would notice the number of masternodes dropping from > 2000 to 20 for example, and realize what's going on, and wouldn't try to anonymize their standard coins. I've suggested earlier that the wallet would automatically detect this and prevent the user from mixing their coins while the attack is going on, and I believe it's a feature that will come at some point. So, the outcome would be that someone has just spent a lot of time and resources for no gain.

And there are plans to hide the masternode IPs so you can't find them and DDoS them (this will also help the masternode owners stay anonymous if they so prefer) - the development is still going on. What we have now doesn't mean it's what we'll have in a year or two. The fact that Darkcoin is not fully complete and perfected yet is priced in by the markets, otherwise it would have 10x to 100x the market cap it has now.

[Piston Honda]

[microchoveur]

I'd also like everyone to know the truth about the best scam ever made.

[Polycoin]

I'd also like everyone to know the truth about the best scam ever made.

truth is out there. this cryptoshit is scam haven 101.

[GTO911]

Seems to be the truth

[iCEBREAKER]

Darkcoin is such a shitty fake-anon coin and blatantly illegal HYIP scheme.

No wonder they want desperately to steal Dash's name for their rebrand.