Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I find IOTA alarming

medium.com

Post reply on HN
Print view View original

21–30 of 130 posts

Re: Why I find IOTA alarming

#21

Post by etunity »

berberous wrote: post #12
lgierth wrote: post #8

Earlier quoted context omitted.

> 1. There have no vulnerabilities in the past. I don't know man, the MIT Digital Currency Initiative found a pretty bad one last August: https://medium.com/@neha/cryptographic-vulnerabilities-in-io... > the IOTA developers had written their own hash function, Curl, and it produced collisions (when different inputs hash to the same output). Once we developed our attack, we could find collisions using commodity hardwa…

What’s even worse is that they claimed the flaws were deliberate, and a method of ‘copy protection’, where the flaws were somehow avoided in their full codebase but would cause any competitor that copied their open source code to suffer the flaws. Smells like a BS excuse to me, and if true, perhaps an even bigger red flag as it strikes me as a very unethical move that is antithetical to open source ideology.

Just to be clear, for the vulnerabilities DCI found to be exploited, the victim has to practically give away their private key at which point the descibed attack is moot.

IOTAs developer CFB has used this kind of copy protection for hen he developed NXT and his entire history is littered with arguing for putting a copy protection in place. His argument for putting that in place is any legitimate developer would review the code for vulnerabilities and kinks b fore implementation and only those trying to plagiarize the work would literally copy paste the code. That seems a rational argument to me and I am not entirely sure if the copy protection in IOTA’s case is deliberate or not but they say it is and his historical work seems to be in line with that

Re: Why I find IOTA alarming

#22

Post by minxomat »

berberous wrote: post #9
simias wrote: post #2

I feel like I'm missing one side of the story. I don't know much about IOTA but from what I learned reading articles linked on HN today IOTA: - Uses custom "ternary" crypto which has been shown to have vulnerabilities in the past. - Has software that doesn't include the basic function of generating wallet addresses, instead having some users rely on shady 3rd party websites and getting their coins stolen. - Does away…

BitConnect, a literal Ponzi scheme that was repeatedly flagged to newbies as a Ponzi scheme they should avoid, had a $2.5 billion market cap last month before collapsing. While IOTA boosters probably have a story they believe that justifies the hype in their mind, just because it’s worth $6 billion in this market doesn’t mean they necessarily have a good one. For what it’s worth, of all the crypto people I follow tha…

Experienced the immaturity first hand, see https://news.ycombinator.com/item?id=15860968

Re: Why I find IOTA alarming

#24

Post by thisisit »

raitucarp wrote: post #17

I just copy paste from CfB's response, in case you missed it: Thank you. This article was useful for me, it showed what details of IOTA haven’t been highlighted yet. Below I list incorrect things from the article, if you find time it would be great if you paid more attention to them and shared your thoughts: “IOTA has no limit on transactions and therefore, it has no limit on bandwidth requirements or disk space.” —…

As simias notes in another post on this thread, most of IOTA's "response" is about things which are not there yet. "In the future", "current state of things is temporary", "IOTA will be", etc.

Re: Why I find IOTA alarming

#25

Post by tauntz »

raitucarp wrote: post #17

I just copy paste from CfB's response, in case you missed it: Thank you. This article was useful for me, it showed what details of IOTA haven’t been highlighted yet. Below I list incorrect things from the article, if you find time it would be great if you paid more attention to them and shared your thoughts: “IOTA has no limit on transactions and therefore, it has no limit on bandwidth requirements or disk space.” —…

This is a very.. immature and amateurish response at best, purposely deceptive at worst.

OP talks about what IOTA _is_. The response is: "You are wrong because we _hope that IOTA will be different in the future_". How does this response make any sense at all?

Re: Why I find IOTA alarming

#26

Post by asymmetric »

berberous wrote: post #9
simias wrote: post #2

I feel like I'm missing one side of the story. I don't know much about IOTA but from what I learned reading articles linked on HN today IOTA: - Uses custom "ternary" crypto which has been shown to have vulnerabilities in the past. - Has software that doesn't include the basic function of generating wallet addresses, instead having some users rely on shady 3rd party websites and getting their coins stolen. - Does away…

BitConnect, a literal Ponzi scheme that was repeatedly flagged to newbies as a Ponzi scheme they should avoid, had a $2.5 billion market cap last month before collapsing. While IOTA boosters probably have a story they believe that justifies the hype in their mind, just because it’s worth $6 billion in this market doesn’t mean they necessarily have a good one. For what it’s worth, of all the crypto people I follow tha…

OT: who are the crypto people you follow? And on which channels?

Twitter seems sadly popular among this crowd. Sadly because it lends itself to flamewars.

Re: Why I find IOTA alarming

#27

Post by fabian2k »

lgierth wrote: post #16
vvangemert wrote: post #13

Earlier quoted context omitted.

You should really read my first link and https://twitter.com/c___f___b/status/956445618381246464 The MIT-DCI are not credible..

I value the MIT Media Lab and its DCI group pretty highly. There is nothing about the Media Lab or the DCI in that first link of yours. [1] So what were you trying to say? What I did find in that first link of yours [1] is this gem though: > The IOTA hash function, Curl-P, was designed to allow for practical collisions. The IOTA protocol’s security depends solely upon the one-wayness of the function, not its collisio…

Part 4 explains the Curl-P part in more detail, and it doesn't inspire any confidence. They are claiming that they intentionally inserted a known bad hash function in the open source part of the code, so that anyone "fraudulent" clones would be useless. The closed source coordinator is claimed to avoid this problem by some way, so they claim that the IOTA network is not affected.

I'm having a very hard time believing that explanation, but even if I do, it's still something that shows bad judgement in my opinion.

Re: Why I find IOTA alarming

#28

Post by etunity »

simias wrote: post #2

I feel like I'm missing one side of the story. I don't know much about IOTA but from what I learned reading articles linked on HN today IOTA: - Uses custom "ternary" crypto which has been shown to have vulnerabilities in the past. - Has software that doesn't include the basic function of generating wallet addresses, instead having some users rely on shady 3rd party websites and getting their coins stolen. - Does away…

Their argument for using ternary is that it is 8 times more efficient than binary and it is very important for iot devices which need to be have low energy consumption and a long life. Whereas the conversation from ternary to binary would add only a 10 % additional usage.

They are trying to push the ternary to see if adoption can take off. All it needs is a few thousand logic gates on any traditional chip.if it doesn’t get adopted,they said they can always go back to binary.

Re: Why I find IOTA alarming

#29

Post by asymmetric »

api wrote: post #14
simias wrote: post #2

I feel like I'm missing one side of the story. I don't know much about IOTA but from what I learned reading articles linked on HN today IOTA: - Uses custom "ternary" crypto which has been shown to have vulnerabilities in the past. - Has software that doesn't include the basic function of generating wallet addresses, instead having some users rely on shady 3rd party websites and getting their coins stolen. - Does away…

Custom crypto primitives (ciphers, hashes, etc.) is a big red flag to me unless the designers are cryptographers. I know a fair bit about crypto. I would implement (and have implemented) higher order constructions like encrypted and authenticated protocols according to design patterns and principles put forward by competent cryptographers. I would never ever even attempt to design a cipher or a cryptographically stro…

> Actual deep cryptography such as cipher design is an area where truly extreme and very esoteric expertise is required to even get started

I hear this every time cryptography is brought up. I think I get that it's hard, but people make it sound like it's the hardest thing ever. Where does this extreme complexity stem from? And what's the field of knowledge required? (Mathematics I imagine)

Re: Why I find IOTA alarming

#30

Post by whataretensors »

ryan-c wrote: post #20
vvangemert wrote: post #6

Earlier quoted context omitted.

1. There have been no vulnerabilities in the past. Please read: https://blog.iota.org/official-iota-foundation-response-to-t... 2. If people are unable to generate a simple seed (password) on their own. How can they even begin to understand cryptocurrency or even new tech based on IoT? Still, yes it should be in the wallet and it will be added, but only for investors, I guess?! 3. Please read the following from their…

Requiring users to choose a password as a seed for their keys is a catastrophically bad vulnerability. Is that really how IOTA works?

Sort of. You have to generate a seed(like a private key) and use that to log in. The seed has to be random. Some used a dice, others /dev/random.

I fully expect a wave of stolen IOTA to come from people who typed a 'random' code.

Post reply on HN