5 ms·

Exactly. Ethics is just the wrong way to think about it. It's like the people emptying weak brainwallets. Is it unethical to empty the brainwallet for "passwor

by dcposch 10y ago

Exactly. Ethics is just the wrong way to think about it. It's like the people emptying weak brainwallets. Is it unethical to empty the brainwallet for "password123"? Is it unethical to pick up a quarter lying on the sidewalk? No and no. Saying that strangers on the internet are bound by ethics is unrealistic. Instead, we should build systems that are resilient. For example: * A brainwallet generator should estimate passphrase complexity and warn if it's too low * Tor Browser should show a red lock icon for plain HTTP and warn users clearly that their traffic may be read Blame the program, not the person. Calling the inevitable attacker "unethical" just isn't useful. Saying the user is dumb or Doing It Wrong isn't useful either. Good crypto software should be resistant to both misuse (by Adam) and abuse (by Eve)

not_anit_woman 10y ago
I'm just giddy that Bitcoin is coming into common parlance here :)
brianleb 10y ago
You seem to be completely misunderstanding ethics. Just because you 'can' do something does not mean it should be done or is ethical to do so. You 'can' break into your neighbor's house and steal <whatever>. Just because you have that capacity does not make it suddenly ethical to do so, even if they leave their doors unlocked. GP didn't say that strangers on the internet are bound by ethics. Ethics are not a thing we are 'bound' by. They are a value judgment we make based on whatever social contract we think we have with those around us. If passphrase complexity is "too low", that's also a judgment. There are no universal truths about what is adequate complexity. What you think is adequate today will not be adequate tomorrow. If someone's passphrase was inadequate and was cracked, was it ethical for the cracker to take advantage of it? If the passphrase passed a certain complexity, did it suddenly become unethical?
- ethbro 10y ago
  To talk about ethics completely independent of ability is to divorce philosophy from reality. If I can brute force a password with a TI-83, then that should be a different conversation than if I can do so with a few hundred million dollars, a backbone tap, and a government cluster. To argue otherwise is navel-gazing about whether the red I see is the same red you see. Maybe? But more importantly, what does it matter?
  - marcoperaza 10y ago
    This is totally preposterous logic. It's very easy to commit many very serious crimes, like murder and rape. Ability to carry out an act has nothing to do with its morality.
  - brianleb 10y ago
    So if you murder someone with an assault rifle, you're a monster, but if you did it with your bare hands, your methods should be applauded and studied? I'm not even going for reductio ad absurdum here, this seems to literally be what you're saying.
    - joesb 10y ago
      I think it's more like it's ethical to murder little kids and weak people because it's easier to do than murdering well-built man.
    - ethbro 10y ago
      Did I at any point make a value judgement, as you did? I simply said, as did dcposch, that to talk about ethics independent of ability is useless from a functional perspective. And to go farther, that applying anything other than amorality to internet actors is without functional value. A rebuttal, if you feel otherwise, would take the form of "No, I believe pure ethical evaluation is still useful because..."
  - ownagefool 10y ago
    I can see how you got to the conclusion you did but I think you're making the wrong analogies like the gp. The penny you pick up on the street, despite any argument to the contrary, hasn't been put there for safekeeping. It's lost and it's value is so low that it's immaterial if you return it or not. Actually the loss in productivity and the impossibility of the task is such returning it, unless you saw the person who dropped it, is probably a negative thing. Now if that was $65000 then you might keep it because you can and it benefits you, but the ethical thing to do is to attempt to return it to its owner. Compare that to a weak password though, as far as you know it isn't even lost. You're just assuming that it will be stolen so it might as well be you. Do you feel the same way about the contents of other peoples houses? Pretty much anyone who wants has the ability to enter your home, we don't do that because of ethics.
- zaroth 10y ago
  I think in the case of brainwallets, the actual contract with the network is that anyone who knows the password has authority to transfer the funds. When you send funds to a password-based address that is literally what you are declaring. There is no additional "off-book" requirements for accessing the funds like, you must know the password and also be a specific person. There are similar scenarios but they are also different in important ways. A properly generated private key would have to be first stolen. An improperly generated private key, or an improperly generated signature that reveals the key are technological faults which expose the funds. But when it comes to so-called brain-wallets, if you know the password then I think you have the right to move the funds.
  - vertex-four 10y ago
    Without the law, the actual "contract" you have re ownership of anything is that you can prevent anyone else from owning those things. If someone else can manage to "steal" your thing, they own it now. I think that's not a world anyone wants to live in aside from an-caps.
    - zaroth 10y ago
      I'm not speaking of lawlessness, I mean the actual lawful contract of who owns or can transfer or take possession of the data. Bitcoin introduces all sorts of novel ways to store and assign ownership of the Satoshi. Flags like ANYONE_CAN_PAY and scripts which equate to ANYONE_CAN_SPEND, or in this case a script which equates to SPEND_WITH_PWD. The vast majority of people have zero understanding of the underlying crypto contract they are entering when they use Bitcoin. But there are experts who can explain what these scripts actually mean and who in turn can access the funds and under what conditions. Like buying other commodities electronically, it is best to consult an expert if you don't know what you're doing. That doesn't change the terms of the underlying contract.
      - vertex-four 10y ago
        Back in the real world, contracts have a lot to do with intent. Generally, if you didn't intend to give money to whoever picks it up first, a court would rule that nobody but the intended recipient has the right to pick up the money. Even if you leave a duffel bag full of money beside a motorway, it's not legally the property of whoever picks it up first. That would be a perfectly reasonable legal argument. In order to give it away to whoever picks it up first, you need to create clear intent - a posting in plain English, for example. Making it easy to pick up isn't intent to allow anyone to pick it up. Code isn't contract, and behaviour isn't contract either.
codesterling 10y ago
Brainwallet?
- mhluongo 10y ago
  An insecure type of bitcoin wallet based on a user-generated seed. They were shown to be easily bruteforced.

by dcposch 10y ago

not_anit_woman 10y ago

I'm just giddy that Bitcoin is coming into common parlance here :)

brianleb 10y ago

You seem to be completely misunderstanding ethics. Just because you 'can' do something does not mean it should be done or is ethical to do so. You 'can' break into your neighbor's house and steal <whatever>. Just because you have that capacity does not make it suddenly ethical to do so, even if they leave their doors unlocked. GP didn't say that strangers on the internet are bound by ethics. Ethics are not a thing we are 'bound' by. They are a value judgment we make based on whatever social contract we think we have with those around us. If passphrase complexity is "too low", that's also a judgment. There are no universal truths about what is adequate complexity. What you think is adequate today will not be adequate tomorrow. If someone's passphrase was inadequate and was cracked, was it ethical for the cracker to take advantage of it? If the passphrase passed a certain complexity, did it suddenly become unethical?

ethbro 10y ago
To talk about ethics completely independent of ability is to divorce philosophy from reality. If I can brute force a password with a TI-83, then that should be a different conversation than if I can do so with a few hundred million dollars, a backbone tap, and a government cluster. To argue otherwise is navel-gazing about whether the red I see is the same red you see. Maybe? But more importantly, what does it matter?
- marcoperaza 10y ago
  This is totally preposterous logic. It's very easy to commit many very serious crimes, like murder and rape. Ability to carry out an act has nothing to do with its morality.
- brianleb 10y ago
  So if you murder someone with an assault rifle, you're a monster, but if you did it with your bare hands, your methods should be applauded and studied? I'm not even going for reductio ad absurdum here, this seems to literally be what you're saying.
  - joesb 10y ago
    I think it's more like it's ethical to murder little kids and weak people because it's easier to do than murdering well-built man.
  - ethbro 10y ago
    Did I at any point make a value judgement, as you did? I simply said, as did dcposch, that to talk about ethics independent of ability is useless from a functional perspective. And to go farther, that applying anything other than amorality to internet actors is without functional value. A rebuttal, if you feel otherwise, would take the form of "No, I believe pure ethical evaluation is still useful because..."
- ownagefool 10y ago
  I can see how you got to the conclusion you did but I think you're making the wrong analogies like the gp. The penny you pick up on the street, despite any argument to the contrary, hasn't been put there for safekeeping. It's lost and it's value is so low that it's immaterial if you return it or not. Actually the loss in productivity and the impossibility of the task is such returning it, unless you saw the person who dropped it, is probably a negative thing. Now if that was $65000 then you might keep it because you can and it benefits you, but the ethical thing to do is to attempt to return it to its owner. Compare that to a weak password though, as far as you know it isn't even lost. You're just assuming that it will be stolen so it might as well be you. Do you feel the same way about the contents of other peoples houses? Pretty much anyone who wants has the ability to enter your home, we don't do that because of ethics.
zaroth 10y ago
I think in the case of brainwallets, the actual contract with the network is that anyone who knows the password has authority to transfer the funds. When you send funds to a password-based address that is literally what you are declaring. There is no additional "off-book" requirements for accessing the funds like, you must know the password and also be a specific person. There are similar scenarios but they are also different in important ways. A properly generated private key would have to be first stolen. An improperly generated private key, or an improperly generated signature that reveals the key are technological faults which expose the funds. But when it comes to so-called brain-wallets, if you know the password then I think you have the right to move the funds.
- vertex-four 10y ago
  Without the law, the actual "contract" you have re ownership of anything is that you can prevent anyone else from owning those things. If someone else can manage to "steal" your thing, they own it now. I think that's not a world anyone wants to live in aside from an-caps.
  - zaroth 10y ago
    I'm not speaking of lawlessness, I mean the actual lawful contract of who owns or can transfer or take possession of the data. Bitcoin introduces all sorts of novel ways to store and assign ownership of the Satoshi. Flags like ANYONE_CAN_PAY and scripts which equate to ANYONE_CAN_SPEND, or in this case a script which equates to SPEND_WITH_PWD. The vast majority of people have zero understanding of the underlying crypto contract they are entering when they use Bitcoin. But there are experts who can explain what these scripts actually mean and who in turn can access the funds and under what conditions. Like buying other commodities electronically, it is best to consult an expert if you don't know what you're doing. That doesn't change the terms of the underlying contract.
    - vertex-four 10y ago
      Back in the real world, contracts have a lot to do with intent. Generally, if you didn't intend to give money to whoever picks it up first, a court would rule that nobody but the intended recipient has the right to pick up the money. Even if you leave a duffel bag full of money beside a motorway, it's not legally the property of whoever picks it up first. That would be a perfectly reasonable legal argument. In order to give it away to whoever picks it up first, you need to create clear intent - a posting in plain English, for example. Making it easy to pick up isn't intent to allow anyone to pick it up. Code isn't contract, and behaviour isn't contract either.

codesterling 10y ago

Brainwallet?

mhluongo 10y ago
An insecure type of bitcoin wallet based on a user-generated seed. They were shown to be easily bruteforced.