Great read. Thanks!
A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
41–50 of 440 posts
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#42This is a very pro-Ether take on what happened, but ultimately it comes to the right conclusion:
> The problem is that his programming toolchain allowed him to make these mistakes.
Damn straight. The problem is that the model of 'public by default, opt in for security' is fundamentally daft in this context. There's quite a good read on that particular topic here too http://hackingdistributed.com/2017/07/20/parity-wallet-not-a....
...but hey, if this ends up making Ethereum better, more secure and more robust as a result, then that's a good thing; it probably does need a different better language to express code in.
Just remember...
> certainly you should not store any money in a hot wallet that you’re not comfortable losing.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#43Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#44"smart contracts can also do things that normal contracts can’t, such as enforce a set of rules entirely through unbreakable cryptography." Isn't "unbreakable" a bit of a dirty word in the security community? Is there really such a thing as "unbreakable cryptography"?
"Is there really such a thing as "unbreakable cryptography"?" Yes. One time pads are unbreakable. "Even after the aliens from Andromeda land with their massive spaceships and undreamed-of computing power, they will not be able to read the Soviet spy messages encrypted with one-time pads (unless they can also go back in time and get the one-time pads)." (Bruce Schneier, Applied Cryptography)
Only if they're really random. See Venona.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#45"smart contracts can also do things that normal contracts can’t, such as enforce a set of rules entirely through unbreakable cryptography." Isn't "unbreakable" a bit of a dirty word in the security community? Is there really such a thing as "unbreakable cryptography"?
"Is there really such a thing as "unbreakable cryptography"?" Yes. One time pads are unbreakable. "Even after the aliens from Andromeda land with their massive spaceships and undreamed-of computing power, they will not be able to read the Soviet spy messages encrypted with one-time pads (unless they can also go back in time and get the one-time pads)." (Bruce Schneier, Applied Cryptography)
One could envision that the transportation of one-time pads as the only objects worth shipping between inhabited solar systems. Value per gram could be enormous.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#46"smart contracts can also do things that normal contracts can’t, such as enforce a set of rules entirely through unbreakable cryptography." Isn't "unbreakable" a bit of a dirty word in the security community? Is there really such a thing as "unbreakable cryptography"?
> Isn't "unbreakable" a bit of a dirty word in the security community "Dirty" is one way to put it, yes. I'd personally use something like "false god" or "blasphemy" :). "Unbreakable" is a naive way of describing cryptographic algorithms, because it preempts conversations about intractability assertions or complexity analysis...modern cryptography accepts as a premise that "unbreakable" is not a reasonable goal, whic…
Those are not sufficient conditions for a one-time pad. The entire pad, not just some "seed" has to be random. The pad cannot ever be reused even with a different plaintext. Breaking a one-time pad that's been used twice is not very hard. It's equivalent to recovering two texts which have been XORed together, which is not hard for English.
One time pad systems are used regularly for high-security embassy-to-State Department communications. Since there are also secure couriers between those locations, there's a way to distribute key material. With today's storage densities, carrying key material around is easy.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#47Earlier quoted context omitted.
And, how do you build one time pad encryption into ethereum?
You can't. Or, well, you can , but it's redundant. One-time pads make sense in the Cold War, Vernam Square era of cryptography. But now that we have the internet and public key cryptography, a one-time pad implemented in Ethereum would be inane and frivolous. Take Alice and Bob, who want to communicate confidentially. Alice doesn't know Bob personally, so she can't securely communicate the one-time pad to Bob in pers…
My question was more: how do you ensure a system that has true secrecy for its one time pad data when all the source is open?
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#48Do we have any idea if the wallets that were stolen from were individuals, companies? How angry would you be if you lost millions and there was nothing you can do.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#49Earlier quoted context omitted.
> I know I'm this situation the dev made a simple mistake, but I wonder if Ethereum is safe as a system assuming developers will make many mistakes, and those mistakes will happen more often as more complicated contracts are written. This will probably come off as being assholish, but I honestly don't mean it to be: you should read the rest of the article. It actually covers this topic in depth and has good thoughts…
The rest of the article amounts to a few points: - Humans make mistakes, the tools should have been better - The technology to make Ethereum safe doesn't really exist - We should work to make that technology exist - We should be happy this happened since it raises awareness about the problem > In the end, attacks like this are good for the community. They call you to your senses and force you to keep your eyes open.…
> We're not even close to a world where tools can offer amazing protection.
I wonder how do you ride your plane then?
> The tools that will save us from this madness don't exist.
These tools do exist(not with ethereum ofc). They are harder to work with, which should be a non-issue for writing contracts.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#50"smart contracts can also do things that normal contracts can’t, such as enforce a set of rules entirely through unbreakable cryptography." Isn't "unbreakable" a bit of a dirty word in the security community? Is there really such a thing as "unbreakable cryptography"?
Hey, author here. I tried to write this article to be accessible to people with little background in security and cryptography (hence its publication on FreeCodeCamp), and to be friendly to non-developers. I took a few liberties with the crypto explanations (like calling a private key to a "secret password") in the hopes of making things more understandable for a general audience. Definitely didn't use rigorous language in just about anything here. :)