5 ms·

How do you prove that the pictures have been deleted once the loan is repaid? Seems like the borrower is exposed to blackmail.

by adgasf 10y ago

csomar 10y ago
I think there can be multiple solutions (and maybe the blockchain can help in that). For example, the image is processed in the browser. The platform/lender only get the nude with the face blurred. The <code/script> to un-blur is available in a bitcoin/ethereum transaction/contract; and the borrower can stop it if he pays on time. But for now, they are exposed to blackmail. ps: it's interesting how the blockchain can come in handy for all these shady uses; and we still struggle to find one legitimate use case for it.
- jerf 10y ago
  Can ethereum be used that way, such that a secret only becomes available after a set period of time, but the release can be aborted? If all the code and data is public what stops anyone from executing the code early? (Note this is more a question about Ethereum than the specific business model under discussion, which is why I use the generic term "secret". It's generally relevant to decrypting things after a certain period of time.)
  - csomar 10y ago
    I'm not a pro when it comes to Ethereum but bitcoin has something kind of close to that: Locked Time transaction. Basically, after a certain time (or block height) a transaction becomes possible unless you act earlier. Now, as far as I know, you can't hide a secret inside that transaction. But it's possible that a blockchain genius can figure out how to make a trick and get it to work.
    - Someone 10y ago
      No, that's not possible. If the assumption is that a secret inserted at time T1 can be retrieved after time T2 without receiving any input not available at time T1, nothing stops Evie from pretending it is T2 and recovering the secret _now_. If the assumption is that extra input is needed that will be supplied at time T2, that extra input is a password/decryption key, and people using this device must trust that this key will not be released early, and will be released at T2 if condition C is not met. The best you can do is to distribute the decryption key at time T1 over a group of people using a method that allows any N people to recover the key and doesn't allow N-1 users to do so. If N is large enough, users might be convinced the secret will not come out early. If it is small relative to the total group having part of the secret, users might be convinced the secret will certainly come out at time T2. Both conditions can be met at the same time, but it still would require trust.
- gwern 10y ago
  You're semi-joking, but blockchains could solve this problem cleanly: releasing secret information unless payment is made. In this case, it's a subcase of time-lock crypto (http://www.gwern.net/Self-decrypting%20files http://www.gwern.net/Self-decrypting%20files) and like time-lock crypto in general, can in theory be solved by 'witness encryption'. Witness crypto lets you create an encrypted file whose decryption key is _X_ Bitcoin blocks (specifically, their SHA hashes which are the PoW); after _X_ blocks have been created after a particular block ID, the file can be decrypted. So that's general time-lock crypto, for public broadcast. The witness could be extended to include the transactions: decrypted iff _X_ blocks pass with <_Y_ bitcoins sent to address _Z_. The _Y_ is the loan, and the address _Z_ is the blackmail counterparty. To render the blackmail file permanently undecryptable, one simply sends _Y_ bitcoins to _Z_ before _X_ blocks pass - that is, repaying the loan on time. Who sets up the file? It could be a third party, who only needs to do a one-time setup & broadcast rather than permanently storing keys & needing to be trusted indefinitely. Alternately, you could imagine applying even more crypto magic: homomorphic encryption in which a CNN verifies the presence of nudity and facial recognition with the borrower. (Witness crypto is currently in the 'magic' realm but homomorphic NNs are surprisingly feasible: https://arxiv.org/abs/1412.6181 https://arxiv.org/abs/1412.6181 ). Then the borrower provides the data, the NN runs over it, verifies it is blackmail, the witness crypto-encoded file gets released, and now you have a public secure blackmail system with no trusted third parties. As always, if crypto isn't solving your problems, you aren't using enough of it. :)
  - nshepperd 10y ago
    Note that the security level of this by design is no more than the proof-of-work cost of N blocks, if you pay back the loan N blocks before the deadline. Proof: If the required key is X bitcoin blocks with no transaction to lender, and you pay it back after X - N blocks, the lender need only mine N blocks, starting from the Xth, to obtain the key (X blocks). They can do this at any time. Therefore, to obtain "acceptable" security, one should probably pay back the loan long enough before the deadline that the economic cost of mining N wasted blocks outstrips the value of the blackmail material itself. (Not considered: the economic calculation probably changes if one entity is giving out multiple such loans, and can therefore mine "fake" witnesses for multiple encrypted materials at once?)

How do you prove that the pictures have been deleted once the loan is repaid? Seems like the borrower is exposed to blackmail.

by adgasf 10y ago

How do you prove that the pictures have been deleted once the loan is repaid? Seems like the borrower is exposed to blackmail.

csomar 10y ago

I think there can be multiple solutions (and maybe the blockchain can help in that). For example, the image is processed in the browser. The platform/lender only get the nude with the face blurred. The <code/script> to un-blur is available in a bitcoin/ethereum transaction/contract; and the borrower can stop it if he pays on time. But for now, they are exposed to blackmail. ps: it's interesting how the blockchain can come in handy for all these shady uses; and we still struggle to find one legitimate use case for it.

jerf 10y ago
Can ethereum be used that way, such that a secret only becomes available after a set period of time, but the release can be aborted? If all the code and data is public what stops anyone from executing the code early? (Note this is more a question about Ethereum than the specific business model under discussion, which is why I use the generic term "secret". It's generally relevant to decrypting things after a certain period of time.)
- csomar 10y ago
  I'm not a pro when it comes to Ethereum but bitcoin has something kind of close to that: Locked Time transaction. Basically, after a certain time (or block height) a transaction becomes possible unless you act earlier. Now, as far as I know, you can't hide a secret inside that transaction. But it's possible that a blockchain genius can figure out how to make a trick and get it to work.
  - Someone 10y ago
    No, that's not possible. If the assumption is that a secret inserted at time T1 can be retrieved after time T2 without receiving any input not available at time T1, nothing stops Evie from pretending it is T2 and recovering the secret _now_. If the assumption is that extra input is needed that will be supplied at time T2, that extra input is a password/decryption key, and people using this device must trust that this key will not be released early, and will be released at T2 if condition C is not met. The best you can do is to distribute the decryption key at time T1 over a group of people using a method that allows any N people to recover the key and doesn't allow N-1 users to do so. If N is large enough, users might be convinced the secret will not come out early. If it is small relative to the total group having part of the secret, users might be convinced the secret will certainly come out at time T2. Both conditions can be met at the same time, but it still would require trust.
gwern 10y ago
You're semi-joking, but blockchains could solve this problem cleanly: releasing secret information unless payment is made. In this case, it's a subcase of time-lock crypto (http://www.gwern.net/Self-decrypting%20files http://www.gwern.net/Self-decrypting%20files) and like time-lock crypto in general, can in theory be solved by 'witness encryption'. Witness crypto lets you create an encrypted file whose decryption key is _X_ Bitcoin blocks (specifically, their SHA hashes which are the PoW); after _X_ blocks have been created after a particular block ID, the file can be decrypted. So that's general time-lock crypto, for public broadcast. The witness could be extended to include the transactions: decrypted iff _X_ blocks pass with <_Y_ bitcoins sent to address _Z_. The _Y_ is the loan, and the address _Z_ is the blackmail counterparty. To render the blackmail file permanently undecryptable, one simply sends _Y_ bitcoins to _Z_ before _X_ blocks pass - that is, repaying the loan on time. Who sets up the file? It could be a third party, who only needs to do a one-time setup & broadcast rather than permanently storing keys & needing to be trusted indefinitely. Alternately, you could imagine applying even more crypto magic: homomorphic encryption in which a CNN verifies the presence of nudity and facial recognition with the borrower. (Witness crypto is currently in the 'magic' realm but homomorphic NNs are surprisingly feasible: https://arxiv.org/abs/1412.6181 https://arxiv.org/abs/1412.6181 ). Then the borrower provides the data, the NN runs over it, verifies it is blackmail, the witness crypto-encoded file gets released, and now you have a public secure blackmail system with no trusted third parties. As always, if crypto isn't solving your problems, you aren't using enough of it. :)
- nshepperd 10y ago
  Note that the security level of this by design is no more than the proof-of-work cost of N blocks, if you pay back the loan N blocks before the deadline. Proof: If the required key is X bitcoin blocks with no transaction to lender, and you pay it back after X - N blocks, the lender need only mine N blocks, starting from the Xth, to obtain the key (X blocks). They can do this at any time. Therefore, to obtain "acceptable" security, one should probably pay back the loan long enough before the deadline that the economic cost of mining N wasted blocks outstrips the value of the blackmail material itself. (Not considered: the economic calculation probably changes if one entity is giving out multiple such loans, and can therefore mine "fake" witnesses for multiple encrypted materials at once?)