5 ms·

I love the idea, but... > Zcash is launching as a for-profit company. That's their downfall right there. With someone visible to track they've given up the ga

I love the idea, but... > Zcash is launching as a for-profit company. That's their downfall right there. With someone visible to track they've given up the game before they started. Real people running real companies are really vulnerable. The real test of a security system is its weakest link. And that link is almost always a person. Right? IMHO the subtle political reason Bitcoin has gotten as far as it has is because it's creator has remained anonymous, and not tried to visibly profit from it. Why do I think that? Because governments are very territorial about their money. Banks too. The regulations for banks are pretty tough, as you may know, Know-Your-Customer edicts and such.

sarciszewski 11y ago
> That's their downfall right there. With someone visible to track they've given up the game before they started. Real people running real companies are really vulnerable. The real test of a security system is its weakest link. And that link is almost always a person. Right? The company that is launching this consists of a team of brilliant cryptographers and security engineers. How does "their identity is known" translate into an attack? How does "they're a for-profit company" weaken the security guarantees of a zero-knowledge proof?
- deleted 11y ago
  [deleted]
- rogerbinns 11y ago
  > How does "their identity is known" translate into an attack? They can be coerced into actions based on threats to themselves or relatives.
  - ewillbefull 11y ago
    Virtually everyone involved in Bitcoin's development is also well-known and presumably "coerceable." The company makes no difference as far as I can see.
    - nickpsecurity 11y ago
      They don't need to target Bitcoin developers to track use of Bitcoin or conversions. So, they don't. End of story?
    - DickingAround 11y ago
      When someone has a legitimate claim to be an owner, that person will have sway to do crazy things like make it closed-source or change the critical constants. Not saying it's a deal-breaker, but it's more risk than if no one can claim to own it (if bitcoiners are angry about the excessive power of the people with admin permissions to the github repo, just imagine how difficult it would be to wrench control from a company that invented the product and has copyright claims to it). I guess what I'm saying is you don't get much leverage if you convert a bitcoin dev but if you convert the owners of this company you'll get a lot of leverage.
    - bduerst 11y ago
      The miners could always revert from a hard fork that was put out under coercion, right?
  - sarciszewski 11y ago
    Good luck pulling that off.
    - themartorana 11y ago
      I presume this is sarcasm, since governments have been pulling this off since time immemorial?
      - sarciszewski 11y ago
        Pulling off a massive, international, targeted attack on several individuals of varying degrees of stubbornness to coerce them to do something unspecified and malicious to the code base of an open source software project and not get detected isn't exactly a practical goal for even intelligence agencies.
        nickpsecurity 11y ago
        How about they just ask three payment networks (VISA/MC/Paypal) to cut off their payments then watch them wither and die? That's how Wikileaks was destroyed by Bank of America and Co when they threatened to leak on the big banks. All that OPSEC can't help without money to support it. Worked like a charm and not a single shot fired.
        kleer001 11y ago
        The code base is not the only vulnerable part.
      - toolz 11y ago
        Couldn't reply to your child comment, so I'll put it here. You don't seem to realize how easy it is to discredit someone that the general public doesn't recognize. The cryptographers are one false planting of child porn away from no influential majority of people believing a word they say. You won't defend them, because you'll question the authenticity of the child porn claims and you'll have no evidence to the contrary. Overnight these kinds of people can be taken down and made into nothing.
- nickpsecurity 11y ago
  Depends. Do they live or host in a country with, say, FBI-coerced "SIGINT-enabling" or something similar? And they be held indefinitely without trial? And are the foreign nationals subject to rendition? Can their assets be frozen by tax authorities and their datacenter equipment seized like some colos? Are they creating something that's straight-up designed to piss those organizations off in many countries and/or aid their opponents? Most proposals succeeding wouldn't bring this risk up: very specific to this project's goals given it ties in anonymity and money. We actually have no idea what they'll do outside some surveillance, court-ordered searches or seizures. Hopefully, it doesn't get popular among their targets. The closest thing is Tor but it's unusual: a tech used and funded by U.S. organizations including military, LEO's and propaganda teams (conflict of interest); anti-censorship getting it special treatment for exports; non-profit; extra smart and dedicated people. Quite a combo. The rest of the carriers and projects fell to FBI, NSA, or both when they became important enough to target with the big guns. If not immediately, then eventually. We know some were paid off but the coercive techniques are unknown. So, yes, centralizing control of something for untraceable money into few, known hands is a huge risk depending where you're at. A risk of what I can't tell you as they won't tell me. ;) The other commenter wisely added the for-profit angle as another dimension of the risk. Most of those screw their users, get hacked, or fail for business reasons. So, that should probably be No 1. EDIT: Conflict of interest on Tor is meant to indicate that, internal to U.S. government, there would be battling over doing something to weaken or end it. Not the Tor team or organization itself.
rdl 11y ago
It's a risk, but I've known the people behind this for 20 years. They are more at risk of putting the technology/principles/etc. ahead of business than the other way around. Of the set of people I'd want building this, Zooko is in the top 3. It's open source, so even if the company fails (likely -- it's a startup, after all, although if successful it will be huge), the project lives. But a company gives them the resources to work on this which wouldn't otherwise be available.
ewillbefull 11y ago
I don't understand this complaint. If the company that is launched fails or is attacked, the currency and the code can live on without it. Its development probably wouldn't be as well-financed but that's about it.
- kleer001 11y ago
  Technically yes, the code could live on, but the thing about currency/money is that people need to believe in it to be valuable when it's not backed by precious metals or coupons for wine or meals or drinks or violence. And people are skittish and emotional and paranoid. Sure, the project could live on, but it would be more of a toy for ivory tower CS gods (like us) than a tool for world wide remittance and purchasing power and a store of value for clever people with minimal understanding of the tool. It's late and I fear my point may be muddled. But yea, the soft squidgy part of it would die and wither away.
MCRed 11y ago
I think they are counting on Open Source being the protection. Any changes to the code can be scrutinized, and the code can be forked (already has).
zbyte64 11y ago
To me the bigger draw back is how much they are going to tax mining: > Wilcox says that he plans for 1 percent of Zcash’s currency to ultimately go towards that non-profit, and 10 percent to be paid to the for-profit startup. 11% is allot when compared to credit card transaction rates.
mtgx 11y ago
Also this could expose them to "they are profiting from crime" type of attacks from politicians and governments.
- hellbanner 11y ago
  Oh, you mean like this giant bank which laundered money from the Mexican mafia? http://www.theguardian.com/world/2011/apr/03/us-bank-mexico-drug-gangs http://www.theguardian.com/world/2011/apr/03/us-bank-mexico-...

sarciszewski 11y ago

> That's their downfall right there. With someone visible to track they've given up the game before they started. Real people running real companies are really vulnerable. The real test of a security system is its weakest link. And that link is almost always a person. Right? The company that is launching this consists of a team of brilliant cryptographers and security engineers. How does "their identity is known" translate into an attack? How does "they're a for-profit company" weaken the security guarantees of a zero-knowledge proof?

deleted 11y ago
[deleted]
rogerbinns 11y ago
> How does "their identity is known" translate into an attack? They can be coerced into actions based on threats to themselves or relatives.
- ewillbefull 11y ago
  Virtually everyone involved in Bitcoin's development is also well-known and presumably "coerceable." The company makes no difference as far as I can see.
  - nickpsecurity 11y ago
    They don't need to target Bitcoin developers to track use of Bitcoin or conversions. So, they don't. End of story?
  - DickingAround 11y ago
    When someone has a legitimate claim to be an owner, that person will have sway to do crazy things like make it closed-source or change the critical constants. Not saying it's a deal-breaker, but it's more risk than if no one can claim to own it (if bitcoiners are angry about the excessive power of the people with admin permissions to the github repo, just imagine how difficult it would be to wrench control from a company that invented the product and has copyright claims to it). I guess what I'm saying is you don't get much leverage if you convert a bitcoin dev but if you convert the owners of this company you'll get a lot of leverage.
  - bduerst 11y ago
    The miners could always revert from a hard fork that was put out under coercion, right?
- sarciszewski 11y ago
  Good luck pulling that off.
  - themartorana 11y ago
    I presume this is sarcasm, since governments have been pulling this off since time immemorial?
    - sarciszewski 11y ago
      Pulling off a massive, international, targeted attack on several individuals of varying degrees of stubbornness to coerce them to do something unspecified and malicious to the code base of an open source software project and not get detected isn't exactly a practical goal for even intelligence agencies.
      - nickpsecurity 11y ago
        How about they just ask three payment networks (VISA/MC/Paypal) to cut off their payments then watch them wither and die? That's how Wikileaks was destroyed by Bank of America and Co when they threatened to leak on the big banks. All that OPSEC can't help without money to support it. Worked like a charm and not a single shot fired.
      - kleer001 11y ago
        The code base is not the only vulnerable part.
    - toolz 11y ago
      Couldn't reply to your child comment, so I'll put it here. You don't seem to realize how easy it is to discredit someone that the general public doesn't recognize. The cryptographers are one false planting of child porn away from no influential majority of people believing a word they say. You won't defend them, because you'll question the authenticity of the child porn claims and you'll have no evidence to the contrary. Overnight these kinds of people can be taken down and made into nothing.
nickpsecurity 11y ago
Depends. Do they live or host in a country with, say, FBI-coerced "SIGINT-enabling" or something similar? And they be held indefinitely without trial? And are the foreign nationals subject to rendition? Can their assets be frozen by tax authorities and their datacenter equipment seized like some colos? Are they creating something that's straight-up designed to piss those organizations off in many countries and/or aid their opponents? Most proposals succeeding wouldn't bring this risk up: very specific to this project's goals given it ties in anonymity and money. We actually have no idea what they'll do outside some surveillance, court-ordered searches or seizures. Hopefully, it doesn't get popular among their targets. The closest thing is Tor but it's unusual: a tech used and funded by U.S. organizations including military, LEO's and propaganda teams (conflict of interest); anti-censorship getting it special treatment for exports; non-profit; extra smart and dedicated people. Quite a combo. The rest of the carriers and projects fell to FBI, NSA, or both when they became important enough to target with the big guns. If not immediately, then eventually. We know some were paid off but the coercive techniques are unknown. So, yes, centralizing control of something for untraceable money into few, known hands is a huge risk depending where you're at. A risk of what I can't tell you as they won't tell me. ;) The other commenter wisely added the for-profit angle as another dimension of the risk. Most of those screw their users, get hacked, or fail for business reasons. So, that should probably be No 1. EDIT: Conflict of interest on Tor is meant to indicate that, internal to U.S. government, there would be battling over doing something to weaken or end it. Not the Tor team or organization itself.

rdl 11y ago

It's a risk, but I've known the people behind this for 20 years. They are more at risk of putting the technology/principles/etc. ahead of business than the other way around. Of the set of people I'd want building this, Zooko is in the top 3. It's open source, so even if the company fails (likely -- it's a startup, after all, although if successful it will be huge), the project lives. But a company gives them the resources to work on this which wouldn't otherwise be available.

ewillbefull 11y ago

I don't understand this complaint. If the company that is launched fails or is attacked, the currency and the code can live on without it. Its development probably wouldn't be as well-financed but that's about it.

kleer001 11y ago
Technically yes, the code could live on, but the thing about currency/money is that people need to believe in it to be valuable when it's not backed by precious metals or coupons for wine or meals or drinks or violence. And people are skittish and emotional and paranoid. Sure, the project could live on, but it would be more of a toy for ivory tower CS gods (like us) than a tool for world wide remittance and purchasing power and a store of value for clever people with minimal understanding of the tool. It's late and I fear my point may be muddled. But yea, the soft squidgy part of it would die and wither away.

MCRed 11y ago

I think they are counting on Open Source being the protection. Any changes to the code can be scrutinized, and the code can be forked (already has).

zbyte64 11y ago

To me the bigger draw back is how much they are going to tax mining: > Wilcox says that he plans for 1 percent of Zcash’s currency to ultimately go towards that non-profit, and 10 percent to be paid to the for-profit startup. 11% is allot when compared to credit card transaction rates.

mtgx 11y ago

Also this could expose them to "they are profiting from crime" type of attacks from politicians and governments.

hellbanner 11y ago
Oh, you mean like this giant bank which laundered money from the Mexican mafia? http://www.theguardian.com/world/2011/apr/03/us-bank-mexico-drug-gangs http://www.theguardian.com/world/2011/apr/03/us-bank-mexico-...