Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zerocoin implementation bug

zcoin.io

Post reply on HN
Print view View original

121–130 of 142 posts

Re: Zerocoin implementation bug

#121

Post by daira »

wuschel wrote: post #110
skolsuper wrote: post #89

Earlier quoted context omitted.

Another major bug caused by copy+paste. I seem to remember a security researcher article months (years?) ago that identified this theme, showed a way to grep a codebase for likely c+p errors and found a load of bugs in real production code that had remained hidden for years. I think I landed there from HN, but my google-fu is failing me now, can anyone else remember it?

Interesting. How would you minimize these type of errors by design or best practice? I guess languages with a lack of higher order abstractions and no strong type system might be more prone to this type of errors.

This isn't a subtle or difficult-to-find case. It's a case of "why the heck would anyone write code like that, in any language, in the first place?" The only language-level abstraction needed to avoid this particular kind of duplicated code, is a loop.

Re: Zerocoin implementation bug

#122

Post by hueving »

mrb wrote: post #98
rtpg wrote: post #71

Earlier quoted context omitted.

wait a sec. Someone steals my credit card, and if I notice within 2 months, I can get everything back. Another advantage is that it doesn't take several hours (and huge amounts of wasted electricity) for a transaction to go through. My bank hasn't been siphoning my funds either. I wouldn't trust any cryptocurrency exchange with holding even 10% of my monthly salary. Sure, governments can get my bank records. But my b…

"Someone steals my credit card, and if I notice within 2 months, I can get everything back." No. You may still be liable for $500 if you fail to report it within 48 HOURS: http://consumer.findlaw.com/credit-banking-finance/are-you-l... "Another advantage is that it doesn't take several hours" You hold a common misconception of how transactions work. Bitcoin transactions are transmitted/notified instantly (like credit…

>No. You may still be liable for $500 if you fail to report it within 48 HOURS

"may" is much different than "are". I've had it happen 3 different times and didn't realize until many days later and was never asked to pay for any of it.

Guess how much you lose if someone steals $50,000 of bitcoin from you and you don't notice for 48 hours?

>Transactions will be confirmed and spendable by the recipient within 10min on average

Almost nobody gives two shits about how long it takes for the recipient to be able to spend it in the majority of credit card transactions.

>Finally transactions are considered irreversible/definitely non-fraudulent after 6 blocks or 60min on average (with CCs it takes 60 days since charge backs are possible for 60 days).

Worse for the consumer, better for the merchant. But again, nobody cares about the merchant in these cases. Merchants already hate credit cards so you don't need to convince them. You need to convince consumers, who drove the credit card adoption in the first place.

Re: Zerocoin implementation bug

#123

Post by hueving »

mrb wrote: post #99
rtpg wrote: post #77

Earlier quoted context omitted.

I am not 100% sure, but my understanding is that the bank is liable for those losses unless they can prove gross negligence on your part. I've heard that legal argument, at least. [0] Though this is not worse from your cryptocurrency. If they get a hold of your private keys, you lose everything. At least in the classical banking system you have some legal recourse. [0]: I might just be thinking of this comedy sketch…

"they get a hold of your private keys, you lose everything." Hardware wallets solve this (Trezor, Keepkey, etc.) This makes Bitcoin more secure than cash. Most people accept the (imperfect) level of security of cash, so they would be OK with the higher level of security of hw wallets.

They would be okay with higher security, but not higher risk of it breaking. Cash doesn't rely on advanced circuitry so I don't have to risk losing $50,000 because of some static electricity.

Re: Zerocoin implementation bug

#124

Post by daira »

kobeya wrote: post #118
daira wrote: post #117

Earlier quoted context omitted.

The crypto used in Confidential Transactions, or any implementation of it, does not only rely on ECDLP. There's plenty of scope for potential protocol or implementation errors. (The Zcoin issue, remember, is an implementation error.)

The CRYPTO relies only on ECDLP. That word, as it is usually used as a term of art, indicates the underlying mathematical assumptions. to say "it does not only rely on ECDLP" is to indicate that there are other trusted mathematical security assumptions, such as harness of EC pairing or the knapsack problem. This is not the case with confidential transactions, whose Pedersen commitments and Back-Maxwell rangeproofs re…

I'm not aware of any proof that Borromean signatures, relied on by CT, are secure assuming only ECDLP. There is certainly no such proof in the paper https://github.com/Blockstream/borromean_paper/blob/master/b... .

[Edit: updated paper link to the most recent version, which still doesn't have any proofs.]

Re: Zerocoin implementation bug

#125

Post by hueving »

alvarosevilla95 wrote: post #109
oh_sigh wrote: post #35

Earlier quoted context omitted.

It's not really a tiny bit... ~30% of the networks value was fabricated.

And every coin owner took a tiny bit of that loss.

I wouldn't call 30% a tiny bit. The presence of 30% more coins robbed everyone 30% the value of their holdings via dilution.

Re: Zerocoin implementation bug

#126

Post by daira »

emmelaich wrote: post #65
epmatsw wrote: post #64

Earlier quoted context omitted.

== vs = perhaps?

Yeah that seems quite possible. (And people mock me for putting constants first! i.e. if (someconstant == somevar) { ... [edit: nope, looks like this is it] https://github.com/zcoinofficial/zcoin/commit/b20c177032de3c...

No, that is not the bug. See Ian Miers' comments.

Re: Zerocoin implementation bug

#127

Post by petre »

wcummings wrote: post #114
dwaltrip wrote: post #82

Earlier quoted context omitted.

Have you checked the charts? Usage and price are essentially at all time highs, and are creeping higher.

People like drugs.

Or the Chinese, Venezuelans and Indians are buying BTC because either somebody else is in control of their currency or their currency is out of control.

Re: Zerocoin implementation bug

#128

Post by petre »

matt4077 wrote: post #49
X86BSD wrote: post #22

Earlier quoted context omitted.

That's NO different than what the "Federal reserve" does. Creates paper money out of thin air.

Considering programmers almost exclusively deal in abstract ideas, and even their manifestation is in the realm invisible to the naked eye, it's surprising how hard it appears for many to grasp concepts such as "law", "culture", or "trust". So here we have a bunch crypto-anarchists with their usual "fiat is fiction"-spiel. Let me ask you to put your worthless paper money[0] where your mind is: I have drawn this wonde…

Well money wouldn't really work without trust. A currency without confidence is worth nothing. So if Zerocoin got hacked and someone created money out of thin air, confidence drops and zcoin is now worth less. The principle is the same as with state backed fiat.

Re: Zerocoin implementation bug

#129

Post by mrb »

hueving wrote: post #123
mrb wrote: post #99

Earlier quoted context omitted.

"they get a hold of your private keys, you lose everything." Hardware wallets solve this (Trezor, Keepkey, etc.) This makes Bitcoin more secure than cash. Most people accept the (imperfect) level of security of cash, so they would be OK with the higher level of security of hw wallets.

They would be okay with higher security, but not higher risk of it breaking. Cash doesn't rely on advanced circuitry so I don't have to risk losing $50,000 because of some static electricity.

Hardware wallets can be backed up. You can even have 2 hardware wallets using the same cryptographic seed and both able to spend the same BTC. You won't lose any BTC if a wallet gets destroyed.

Re: Zerocoin implementation bug

#130

Post by mrb »

hueving wrote: post #122
mrb wrote: post #98

Earlier quoted context omitted.

"Someone steals my credit card, and if I notice within 2 months, I can get everything back." No. You may still be liable for $500 if you fail to report it within 48 HOURS: http://consumer.findlaw.com/credit-banking-finance/are-you-l... "Another advantage is that it doesn't take several hours" You hold a common misconception of how transactions work. Bitcoin transactions are transmitted/notified instantly (like credit…

>No. You may still be liable for $500 if you fail to report it within 48 HOURS "may" is much different than "are". I've had it happen 3 different times and didn't realize until many days later and was never asked to pay for any of it. Guess how much you lose if someone steals $50,000 of bitcoin from you and you don't notice for 48 hours? >Transactions will be confirmed and spendable by the recipient within 10min on a…

""may" is much different than "are""

Which is why I corrected the poster who made it sound like credit cards "always" protect you, when it's not true. "Often" and "mostly", but not "always".

"Guess how much you lose if someone steals $50,000 of bitcoins"

Hardware wallets solve the theft problem. To date there have been no verifiable incidents of Bitcoins stolen from hardware wallets.

Credit cards as they are implemented will NEVER solve the theft problem without constant anti-fraud efforts. Bitcoin uses cryptography to authorize a specific transaction. Credit cards rely blindly on the merchant's good will and security to charge for the right amount and to prevent the CC info from being stolen. The more you transact the more merchants the CC info circulate through, and the higher the risk of fraud. Which is why CC fraud has been rising and rising for many years.

"Almost nobody gives two shits about how long it takes"

Listen, I was just pointing out people who say "CCs transactions are quicker than Bitcoin transactions" are wrong. Accepting a zero-conf Bitcoin transaction is similar ("as risky as") accepting a CC transaction after swiping/chip-and-pin. Therefore that's what should be compared, and both Bitcoin and CC transactions are just as fast as each other (seconds).

I actually agree that the immutability of a Bitcoin transaction is a negative for the consumer. (But I don't think it is a cons big enough to seriously hamper Bitcoin's adoption.)

Post reply on HN