Live data from Hacker News

A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

medium.freecodecamp.org

11–20 of 440 posts

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#11

"smart contracts can also do things that normal contracts can’t, such as enforce a set of rules entirely through unbreakable cryptography." Isn't "unbreakable" a bit of a dirty word in the security community? Is there really such a thing as "unbreakable cryptography"?

> Isn't "unbreakable" a bit of a dirty word in the security community

"Dirty" is one way to put it, yes. I'd personally use something like "false god" or "blasphemy" :). "Unbreakable" is a naive way of describing cryptographic algorithms, because it preempts conversations about intractability assertions or complexity analysis...modern cryptography accepts as a premise that "unbreakable" is not a reasonable goal, which is why we work by quantifying computational cost.

When I see someone use the phrase, "unbreakable cryptography", I mentally discount their authority to speak about cryptography and become more skeptical (this also applies to people who write things like "bank-grade security" or who tell me "AES-256" when I ask them how they're encrypting data, as if the key size is more important than the block cipher mode or confidentiality/authentication construction).

> Is there really such a thing as "unbreakable cryptography"?

A one-time pad, with the following provisos:

1. It has a truly random seed, not a pseudorandom one;

2. It is at least as long as the plaintext;

3. It is never reused (for the same plaintext, in whole or part).

It's straightforward to see why this guarantees information-theoretic security - you have no way of knowing when you've recovered the correct plaintext. There's nothing to brute-force.

In the security community we don't use one-time pads because we dare not touch the sun: they are extremely difficult to implement correctly, and even if you do implement them correctly you have traded off an inordinate amount of practical usability for a relatively small improvement in information theoretic security.

Asking people to 1) use true randomness to seed keys, 2) generate a new secret key for every message, 3) never reuse the same secret key and 4) keep each secret key securely confidential is extremely prone to error. It's often a fetishized ideal among people who first read about it, but in practice it's just not worth it.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#12
Stories like this make me consider whether programmers that engage in commerce should be forced (yes, by law) into guilds that have rigid journeyman and apprenticeship stages before the programmer gets to touch the production environment. Specialized, official, bonded developer roles need to be established.

Our community cannot continue operating in the hacker mode wherever money is involved.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#13
post #11

"smart contracts can also do things that normal contracts can’t, such as enforce a set of rules entirely through unbreakable cryptography." Isn't "unbreakable" a bit of a dirty word in the security community? Is there really such a thing as "unbreakable cryptography"?

> Isn't "unbreakable" a bit of a dirty word in the security community "Dirty" is one way to put it, yes. I'd personally use something like "false god" or "blasphemy" :). "Unbreakable" is a naive way of describing cryptographic algorithms, because it preempts conversations about intractability assertions or complexity analysis...modern cryptography accepts as a premise that "unbreakable" is not a reasonable goal, whic…

One thing I've never understood about the one-time pad:

How do you guarantee the third condition? Wouldn't you eventually run into the birthday problem if you sent enough messages?

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#14

Stories like this make me consider whether programmers that engage in commerce should be forced (yes, by law) into guilds that have rigid journeyman and apprenticeship stages before the programmer gets to touch the production environment. Specialized, official, bonded developer roles need to be established. Our community cannot continue operating in the hacker mode wherever money is involved.

That just makes the price of a "programmer" go up. And the normal people responsible for putting together said requirements know that in the end it would just make their IT costs go up, so therefore they don't (which is fine with me)

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#15
post #13
post #11

Earlier quoted context omitted.

> Isn't "unbreakable" a bit of a dirty word in the security community "Dirty" is one way to put it, yes. I'd personally use something like "false god" or "blasphemy" :). "Unbreakable" is a naive way of describing cryptographic algorithms, because it preempts conversations about intractability assertions or complexity analysis...modern cryptography accepts as a premise that "unbreakable" is not a reasonable goal, whic…

One thing I've never understood about the one-time pad: How do you guarantee the third condition? Wouldn't you eventually run into the birthday problem if you sent enough messages?

Use a new one time pad for every message.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#16

Stories like this make me consider whether programmers that engage in commerce should be forced (yes, by law) into guilds that have rigid journeyman and apprenticeship stages before the programmer gets to touch the production environment. Specialized, official, bonded developer roles need to be established. Our community cannot continue operating in the hacker mode wherever money is involved.

[deleted]

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#17

Stories like this make me consider whether programmers that engage in commerce should be forced (yes, by law) into guilds that have rigid journeyman and apprenticeship stages before the programmer gets to touch the production environment. Specialized, official, bonded developer roles need to be established. Our community cannot continue operating in the hacker mode wherever money is involved.

It is a very interesting thought.

Any Germans care to comment? They have the closest systems, I would think.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#19
post #15
post #13

Earlier quoted context omitted.

One thing I've never understood about the one-time pad: How do you guarantee the third condition? Wouldn't you eventually run into the birthday problem if you sent enough messages?

Use a new one time pad for every message.

Are you suggesting we use the one time pad only one time?

Well if it's that important maybe they should put that right in the name...

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#20
post #14

Stories like this make me consider whether programmers that engage in commerce should be forced (yes, by law) into guilds that have rigid journeyman and apprenticeship stages before the programmer gets to touch the production environment. Specialized, official, bonded developer roles need to be established. Our community cannot continue operating in the hacker mode wherever money is involved.

That just makes the price of a "programmer" go up. And the normal people responsible for putting together said requirements know that in the end it would just make their IT costs go up, so therefore they don't (which is fine with me)

Darn right, it's costly!

But how else will we rope in foolish devs from doing foolish things like eval() in the context of a user's wallet except by policing our community?

You can expect businesses to do it...

Post reply on HN