4 ms·

Redirecting auth.minerlink.com to point at 127.0.0.1 is not a permanent way to bypass the issue. If the next patch includes a localhost server that can proxy c

by plart 9y ago

Redirecting auth.minerlink.com to point at 127.0.0.1 is not a permanent way to bypass the issue. If the next patch includes a localhost server that can proxy communication to auth.minerlink.com, the issue returns. If the next patch updates the url to auth2.minerlink.com (or any other domain), the issue returns. If the next patch flips from default-allow to default-deny, all customers will be out of luck until they patch and come back to the central control mechanism. If the next patch implements some form of authentication such that you can't easily spoof a "True", all customers will be out of luck. If the remote code execution is used to patch code without the administrator's knowledge/permission (haakon has a link saying remote code execution is possible) any/all of the above are trivially easy to take advantage of. Lastly - my understanding of bitcoin is a little fuzzy, but I believe with 50% of the computing power, you can rewrite transactions as you please, capturing as many bitcoin as you want. If you had a plan to not centralize those accounts, it would be extremely difficult to sort out.

cookiecaper 9y ago
>Lastly - my understanding of bitcoin is a little fuzzy, but I believe with 50% of the computing power, you can rewrite transactions as you please, capturing as many bitcoin as you want. Close. My understanding is rusty too, but I'll give it a go. Someone more versed in the technicalities of bitcoin, please correct me. "51% attacks" threaten the integrity of the money supply because the network works by consensus. A transaction is considered valid once miners authenticate it by including it in blocks (blocks are issued ~6 times per hour). The network awards new bitcoin with each block. If you control most of the hash power, you can attack the network by including illegitimate transactions in the blocks, effectively creating a new version of the ledger. If you own coin ID A and send it to address B, that transaction gets included in a block and becomes official. You can't spend that coin again because the next miner won't include it in a block, since the previous block said it's already been spent. But if you control most of the hash power, you can teach your miner to skip the spent check for coin ID A and include it in every block that gets computed. This is called a double-spend attack because it lets you respend that coin more than once. This is why bitcoin payment confirmations can take a while. Anyone can submit any transaction they want, but you have to wait for a block to be issued to issued to ensure it matches the ledger's accepted state. To be really careful, you need to wait for more than one block, since a rogue miner may have been able to get a bad block accepted. This is why btc payment processors would wait 3 blocks before an immediate transaction would be confirmed (~30 minutes). The upside of this is that the community can decide to change its mind, and if you get the miners calculating according to the proposal, it becomes the standard. This is why a lot of people consider bitcoin a "consensus protocol". It would be easy to track and untangle double-spends, however, because everyone could see when the invalid blocks started getting included and cut the chain there. The hard part would be moving everyone over to the new version of the blockchain that didn't include the double-spends.
- deweller 9y ago
  > you can attack the network by including illegitimate transactions in the blocks This part is incorrect. Any block with an invalid transaction will be rejected by the rest of the network.
  - cookiecaper 9y ago
    Right ... as long as you don't control "the rest of the network", which is what a 51% attack is. Faced with two competing chains, my understanding is that the bitcoin network chooses the longer one, assuming that the other tangents are dead (either due to a policy change or an invalid block). In practice it would probably help to control more than 51% of the network, but it's called a 51% attack because theoretically, that's all you need to create the longest (that is, the winning) chain.
    - deleted 9y ago
      [deleted]
    - deweller 9y ago
      A 51% attack only beats out the other miners. The network includes all of the individuals and businesses who run nodes but don't mine. They will only accept valid blocks. So say you execute a 51% attack and attempt to include an invalid transaction. No other node on the network will accept that block as valid. So all of the businesses, including the bitcoin exchanges, will reject your block as invalid and not process it. And any block you try to build on that invalid block will also be invalid for the same reason. You cannot include any invalid transactions in a bitcoin block even if you had 99% of the hashing power. The rest of the network will just ignore all of your blocks and will accept the next valid block that comes along.
      - cookiecaper 9y ago
        OK, thanks for clarifying. Is this enforced client-side in the default client? What other types of validations are performed client-side? Where is the limit on the trace up the chain? You'd have to have a full clone of the blockchain to validate all the way up, or it'd terminate at the oldest block. I assume that even if you're one of the few still running a full chain these days, transactions in the block aren't checked against the coin's entire history. Does it reject/ignore the entire block or just the transactions for which it has a conflicting history?
deweller 9y ago
You cannot rewrite or otherwise change transactions with a 51% attack, nor can you capture any bitcoin. You can, however, deny certain (or all) transactions from being mined into a block. And you can exclude past transactions if you can overtake the current longest chain. But rewriting history to exclude past transactions would require more than 51% of the hashing power. The further back you go, the more power it will require to overtake the longest chain.
- tylersmith 9y ago
  With more than 50% you can reject all other blocks and keep the chain to yourself.
- sanswork 9y ago
  Yes you can. Rewriting a transaction is exactly what a double spend is.
  - deweller 9y ago
    Yes - for your own coins. You can re-spend the coins that you own and send them to another location and invalidate one of your own spends. You cannot rewrite or modify any other transactions that you do not hold the private keys for. You can only withhold them from a block.

by plart 9y ago

cookiecaper 9y ago

>Lastly - my understanding of bitcoin is a little fuzzy, but I believe with 50% of the computing power, you can rewrite transactions as you please, capturing as many bitcoin as you want. Close. My understanding is rusty too, but I'll give it a go. Someone more versed in the technicalities of bitcoin, please correct me. "51% attacks" threaten the integrity of the money supply because the network works by consensus. A transaction is considered valid once miners authenticate it by including it in blocks (blocks are issued ~6 times per hour). The network awards new bitcoin with each block. If you control most of the hash power, you can attack the network by including illegitimate transactions in the blocks, effectively creating a new version of the ledger. If you own coin ID A and send it to address B, that transaction gets included in a block and becomes official. You can't spend that coin again because the next miner won't include it in a block, since the previous block said it's already been spent. But if you control most of the hash power, you can teach your miner to skip the spent check for coin ID A and include it in every block that gets computed. This is called a double-spend attack because it lets you respend that coin more than once. This is why bitcoin payment confirmations can take a while. Anyone can submit any transaction they want, but you have to wait for a block to be issued to issued to ensure it matches the ledger's accepted state. To be really careful, you need to wait for more than one block, since a rogue miner may have been able to get a bad block accepted. This is why btc payment processors would wait 3 blocks before an immediate transaction would be confirmed (~30 minutes). The upside of this is that the community can decide to change its mind, and if you get the miners calculating according to the proposal, it becomes the standard. This is why a lot of people consider bitcoin a "consensus protocol". It would be easy to track and untangle double-spends, however, because everyone could see when the invalid blocks started getting included and cut the chain there. The hard part would be moving everyone over to the new version of the blockchain that didn't include the double-spends.

deweller 9y ago
> you can attack the network by including illegitimate transactions in the blocks This part is incorrect. Any block with an invalid transaction will be rejected by the rest of the network.
- cookiecaper 9y ago
  Right ... as long as you don't control "the rest of the network", which is what a 51% attack is. Faced with two competing chains, my understanding is that the bitcoin network chooses the longer one, assuming that the other tangents are dead (either due to a policy change or an invalid block). In practice it would probably help to control more than 51% of the network, but it's called a 51% attack because theoretically, that's all you need to create the longest (that is, the winning) chain.
  - deleted 9y ago
    [deleted]
  - deweller 9y ago
    A 51% attack only beats out the other miners. The network includes all of the individuals and businesses who run nodes but don't mine. They will only accept valid blocks. So say you execute a 51% attack and attempt to include an invalid transaction. No other node on the network will accept that block as valid. So all of the businesses, including the bitcoin exchanges, will reject your block as invalid and not process it. And any block you try to build on that invalid block will also be invalid for the same reason. You cannot include any invalid transactions in a bitcoin block even if you had 99% of the hashing power. The rest of the network will just ignore all of your blocks and will accept the next valid block that comes along.
    - cookiecaper 9y ago
      OK, thanks for clarifying. Is this enforced client-side in the default client? What other types of validations are performed client-side? Where is the limit on the trace up the chain? You'd have to have a full clone of the blockchain to validate all the way up, or it'd terminate at the oldest block. I assume that even if you're one of the few still running a full chain these days, transactions in the block aren't checked against the coin's entire history. Does it reject/ignore the entire block or just the transactions for which it has a conflicting history?

deweller 9y ago

You cannot rewrite or otherwise change transactions with a 51% attack, nor can you capture any bitcoin. You can, however, deny certain (or all) transactions from being mined into a block. And you can exclude past transactions if you can overtake the current longest chain. But rewriting history to exclude past transactions would require more than 51% of the hashing power. The further back you go, the more power it will require to overtake the longest chain.

tylersmith 9y ago
With more than 50% you can reject all other blocks and keep the chain to yourself.
sanswork 9y ago
Yes you can. Rewriting a transaction is exactly what a double spend is.
- deweller 9y ago
  Yes - for your own coins. You can re-spend the coins that you own and send them to another location and invalidate one of your own spends. You cannot rewrite or modify any other transactions that you do not hold the private keys for. You can only withhold them from a block.