4 ms·

> That's their downfall right there. With someone visible to track they've given up the game before they started. Real people running real companies are really

> That's their downfall right there. With someone visible to track they've given up the game before they started. Real people running real companies are really vulnerable. The real test of a security system is its weakest link. And that link is almost always a person. Right? The company that is launching this consists of a team of brilliant cryptographers and security engineers. How does "their identity is known" translate into an attack? How does "they're a for-profit company" weaken the security guarantees of a zero-knowledge proof?

deleted 11y ago
[deleted]
rogerbinns 11y ago
> How does "their identity is known" translate into an attack? They can be coerced into actions based on threats to themselves or relatives.
- ewillbefull 11y ago
  Virtually everyone involved in Bitcoin's development is also well-known and presumably "coerceable." The company makes no difference as far as I can see.
  - nickpsecurity 11y ago
    They don't need to target Bitcoin developers to track use of Bitcoin or conversions. So, they don't. End of story?
  - DickingAround 11y ago
    When someone has a legitimate claim to be an owner, that person will have sway to do crazy things like make it closed-source or change the critical constants. Not saying it's a deal-breaker, but it's more risk than if no one can claim to own it (if bitcoiners are angry about the excessive power of the people with admin permissions to the github repo, just imagine how difficult it would be to wrench control from a company that invented the product and has copyright claims to it). I guess what I'm saying is you don't get much leverage if you convert a bitcoin dev but if you convert the owners of this company you'll get a lot of leverage.
  - bduerst 11y ago
    The miners could always revert from a hard fork that was put out under coercion, right?
- sarciszewski 11y ago
  Good luck pulling that off.
  - themartorana 11y ago
    I presume this is sarcasm, since governments have been pulling this off since time immemorial?
    - sarciszewski 11y ago
      Pulling off a massive, international, targeted attack on several individuals of varying degrees of stubbornness to coerce them to do something unspecified and malicious to the code base of an open source software project and not get detected isn't exactly a practical goal for even intelligence agencies.
      - nickpsecurity 11y ago
        How about they just ask three payment networks (VISA/MC/Paypal) to cut off their payments then watch them wither and die? That's how Wikileaks was destroyed by Bank of America and Co when they threatened to leak on the big banks. All that OPSEC can't help without money to support it. Worked like a charm and not a single shot fired.
      - kleer001 11y ago
        The code base is not the only vulnerable part.
    - toolz 11y ago
      Couldn't reply to your child comment, so I'll put it here. You don't seem to realize how easy it is to discredit someone that the general public doesn't recognize. The cryptographers are one false planting of child porn away from no influential majority of people believing a word they say. You won't defend them, because you'll question the authenticity of the child porn claims and you'll have no evidence to the contrary. Overnight these kinds of people can be taken down and made into nothing.
nickpsecurity 11y ago
Depends. Do they live or host in a country with, say, FBI-coerced "SIGINT-enabling" or something similar? And they be held indefinitely without trial? And are the foreign nationals subject to rendition? Can their assets be frozen by tax authorities and their datacenter equipment seized like some colos? Are they creating something that's straight-up designed to piss those organizations off in many countries and/or aid their opponents? Most proposals succeeding wouldn't bring this risk up: very specific to this project's goals given it ties in anonymity and money. We actually have no idea what they'll do outside some surveillance, court-ordered searches or seizures. Hopefully, it doesn't get popular among their targets. The closest thing is Tor but it's unusual: a tech used and funded by U.S. organizations including military, LEO's and propaganda teams (conflict of interest); anti-censorship getting it special treatment for exports; non-profit; extra smart and dedicated people. Quite a combo. The rest of the carriers and projects fell to FBI, NSA, or both when they became important enough to target with the big guns. If not immediately, then eventually. We know some were paid off but the coercive techniques are unknown. So, yes, centralizing control of something for untraceable money into few, known hands is a huge risk depending where you're at. A risk of what I can't tell you as they won't tell me. ;) The other commenter wisely added the for-profit angle as another dimension of the risk. Most of those screw their users, get hacked, or fail for business reasons. So, that should probably be No 1. EDIT: Conflict of interest on Tor is meant to indicate that, internal to U.S. government, there would be battling over doing something to weaken or end it. Not the Tor team or organization itself.

deleted 11y ago

[deleted]

rogerbinns 11y ago

> How does "their identity is known" translate into an attack? They can be coerced into actions based on threats to themselves or relatives.

ewillbefull 11y ago
Virtually everyone involved in Bitcoin's development is also well-known and presumably "coerceable." The company makes no difference as far as I can see.
- nickpsecurity 11y ago
  They don't need to target Bitcoin developers to track use of Bitcoin or conversions. So, they don't. End of story?
- DickingAround 11y ago
  When someone has a legitimate claim to be an owner, that person will have sway to do crazy things like make it closed-source or change the critical constants. Not saying it's a deal-breaker, but it's more risk than if no one can claim to own it (if bitcoiners are angry about the excessive power of the people with admin permissions to the github repo, just imagine how difficult it would be to wrench control from a company that invented the product and has copyright claims to it). I guess what I'm saying is you don't get much leverage if you convert a bitcoin dev but if you convert the owners of this company you'll get a lot of leverage.
- bduerst 11y ago
  The miners could always revert from a hard fork that was put out under coercion, right?
sarciszewski 11y ago
Good luck pulling that off.
- themartorana 11y ago
  I presume this is sarcasm, since governments have been pulling this off since time immemorial?
  - sarciszewski 11y ago
    Pulling off a massive, international, targeted attack on several individuals of varying degrees of stubbornness to coerce them to do something unspecified and malicious to the code base of an open source software project and not get detected isn't exactly a practical goal for even intelligence agencies.
    - nickpsecurity 11y ago
      How about they just ask three payment networks (VISA/MC/Paypal) to cut off their payments then watch them wither and die? That's how Wikileaks was destroyed by Bank of America and Co when they threatened to leak on the big banks. All that OPSEC can't help without money to support it. Worked like a charm and not a single shot fired.
    - kleer001 11y ago
      The code base is not the only vulnerable part.
  - toolz 11y ago
    Couldn't reply to your child comment, so I'll put it here. You don't seem to realize how easy it is to discredit someone that the general public doesn't recognize. The cryptographers are one false planting of child porn away from no influential majority of people believing a word they say. You won't defend them, because you'll question the authenticity of the child porn claims and you'll have no evidence to the contrary. Overnight these kinds of people can be taken down and made into nothing.

nickpsecurity 11y ago

Depends. Do they live or host in a country with, say, FBI-coerced "SIGINT-enabling" or something similar? And they be held indefinitely without trial? And are the foreign nationals subject to rendition? Can their assets be frozen by tax authorities and their datacenter equipment seized like some colos? Are they creating something that's straight-up designed to piss those organizations off in many countries and/or aid their opponents? Most proposals succeeding wouldn't bring this risk up: very specific to this project's goals given it ties in anonymity and money. We actually have no idea what they'll do outside some surveillance, court-ordered searches or seizures. Hopefully, it doesn't get popular among their targets. The closest thing is Tor but it's unusual: a tech used and funded by U.S. organizations including military, LEO's and propaganda teams (conflict of interest); anti-censorship getting it special treatment for exports; non-profit; extra smart and dedicated people. Quite a combo. The rest of the carriers and projects fell to FBI, NSA, or both when they became important enough to target with the big guns. If not immediately, then eventually. We know some were paid off but the coercive techniques are unknown. So, yes, centralizing control of something for untraceable money into few, known hands is a huge risk depending where you're at. A risk of what I can't tell you as they won't tell me. ;) The other commenter wisely added the for-profit angle as another dimension of the risk. Most of those screw their users, get hacked, or fail for business reasons. So, that should probably be No 1. EDIT: Conflict of interest on Tor is meant to indicate that, internal to U.S. government, there would be battling over doing something to weaken or end it. Not the Tor team or organization itself.