8 ms·

Would you mind elaborating on this for someone unfamiliar?

by jonahx 8y ago

mikeyouse 8y ago
Most proof of work coins use unique hashing algorithms and the miners are custom-designed ASICs that are extremely efficient at that one specific algorithm. If per chance, your coin uses the same algorithm as Bitcoin [ SHA-256(SHA-256(Block Header)) ], a small portion of the much larger Bitcoin mining community could turn their miners toward the smaller coin and quickly overwhelm their network to perform a 51% attack. The Bitcoin community can perform something like 40 billion gigahashes per second, most 'shitcoins' have total mining capabilities of 0.05x that if not less. It's a quick economic calculation for any miner or group of miners to decide to attack a smaller double-SHA-256 coin, as long as the total hashing power of the smaller coin's network is small enough and the coin valuable enough.
- jki275 8y ago
  Doing the attack tends to drive said shitcoin's value to zero, so the incentive to do it is often not there.
  - sireat 8y ago
    Shitcoin is not going to drop to zero immediately (as in 24hours) giving attackers plenty of time to to cash out.
jancsika 8y ago
Imagine all the Bitcoin miners out there right now using their ASICs to do extremely efficient hashing in the hopes of generating a block reward. Let's didactically suppose there are 100 such miners total. Now imagine Dinkycoin comes along and releases their cryptocurrency that uses the same hashing mechanism for the block reward. Initially they have the block difficulty level pretty low as there aren't that many people participating in it yet. Dinkycoin hopes that eventually enough people will join the network so that the total hashing power will be something approaching Bitcoin's. Great. But atm their total hashing power is a very small fraction of Bitcoin's total hashing power. I don't care enough to go find out how infinitesimal it would be-- enough to say very small. Now suppose one of the Bitcoin ASIC miners gets bored one day and decides they don't like Dinkycoin. If they devote their ASIC to mining Dinkycoin they will immediately have more hashing power that the rest of the Dinkycoin network. That would virtually guarantee they solve every block of Dinkycoin and reap every reward. They'd easily have 100% control of the network at that point. For example-- suppose Dinkycoin says you need 20 confirmations before accepting that a transaction "went through." Well, the Bitcoin miner can use their enormous hashing power to go back 20/30/whatever blocks and build a competing branch from that historical point. And since the miner has 1000% more hashing power (or whatever the number is) than the entire Dinkycoin network, they can build a competing branch from that historical point that will eventually have solved more/more difficult block rewards than the branch the rest of the network builds off the current branch. Once the Bitcoin miner has a competing branch with greater total difficulty than the rest of the network, the network must accept that branch as the winner. Well, the devs can decide to do otherwise for whatever professed reason and roll back/hard fork/whatever. But that kind of "do over" would degrade trust in the cryptocurrency itself. Users would be afraid of another future attack. After all, they were initially told 20 confirmations was enough. How do they know 40 confirmations is any safer? (And again, if the attacker has superior hashing power to the rest of the network it isn't meaningfully safer.) Of course such a miner would be wasting all of their hashing power to screw with Dinkycoin's network. But to screw up most PoW cryptocurrencies you only really need 51% of the total hashing power. Even with that the attacker will eventually always beat the rest of the network to produce the "longest" chain. (Also, I think you can still cause problems for many cryptocurrencies with even less than 51% control.) Anyhow, do the math with the real numbers and you'll see that a real Bitcoin miner could devote a tiny percentage of their mining power and still own fledgling cryptocurrencies like the Dinkycoin example. Moreover, they can trivially collude with the other 99 Bitcoin miners to devote an even smaller part of their hashing power to owning Dinkycoin, or even automate the process of smashing any coin that uses their same hashing scheme, based on any criteria whatsoever. And it gets worse because in the 51% percent attacks I've read about in the real world, it isn't a big time miner with a grudge. Rather, it's someone who saw a weak point in a combination of a dinkycoin, an exchange, and several other moving parts and just rented a hashing rig to pull off an attack. Most PoW cryptocurrencies naively assume miners will choose greed over destructive tendencies without ever investigating whether those two paths are really mutually exclusive. Edit: clarification Edit: what happened to the web site that compares hashing power of the various SHA256-based coins, scrypt, etc.? Those orders-of-magnitude differences are quite instructive. But I can't find a site that lays it out nicely.
- bouncycastle 8y ago
  But if they throw hashpower on Dinkycoin, wouldn't Dinkycoin's difficulty increase? If the difficulty for Dinkycoin re-targets more aggressively, then Dinkycoin would quickly gain more security in the process!
  - ThrustVectoring 8y ago
    The attacks tend to do something like "build a chain based off Dinkycoin's previous blocks, but don't publish it until a later date". The difficulty changes can't help because the chain doesn't know about the attack until the attacker publishes a longer chain.
    - bouncycastle 8y ago
      Yes, of course! And once the damage has been done, it's even harder to reverse. Perhaps if Dinkycoin's devs are fast enough, they could release a fork to undo it?
      - setr 8y ago
        As long as the attacker maintains 51%, he can eventually just repeat the attack, regardless of the number of forks.
        bouncycastle 8y ago
        Ooohchie, yes indeed!
        jki275 8y ago
        You change the POW function in the fork to eliminate the attack.
        bouncycastle 8y ago
        Perhaps if the attack was done using ASICs, but when done with GPUs it can be repeated indefinitely. See discussion https://www.reddit.com/r/ethereum/comments/707h3b/can_anyone_explain_vitaliks_comment_here_about_pos/ https://www.reddit.com/r/ethereum/comments/707h3b/can_anyone...
deleted 8y ago
[deleted]

Would you mind elaborating on this for someone unfamiliar?

by jonahx 8y ago

Would you mind elaborating on this for someone unfamiliar?

Most proof of work coins use unique hashing algorithms and the miners are custom-designed ASICs that are extremely efficient at that one specific algorithm. If per chance, your coin uses the same algorithm as Bitcoin [ SHA-256(SHA-256(Block Header)) ], a small portion of the much larger Bitcoin mining community could turn their miners toward the smaller coin and quickly overwhelm their network to perform a 51% attack. The Bitcoin community can perform something like 40 billion gigahashes per second, most 'shitcoins' have total mining capabilities of 0.05x that if not less. It's a quick economic calculation for any miner or group of miners to decide to attack a smaller double-SHA-256 coin, as long as the total hashing power of the smaller coin's network is small enough and the coin valuable enough.

jki275 8y ago
Doing the attack tends to drive said shitcoin's value to zero, so the incentive to do it is often not there.
- sireat 8y ago
  Shitcoin is not going to drop to zero immediately (as in 24hours) giving attackers plenty of time to to cash out.

jancsika 8y ago

Imagine all the Bitcoin miners out there right now using their ASICs to do extremely efficient hashing in the hopes of generating a block reward. Let's didactically suppose there are 100 such miners total. Now imagine Dinkycoin comes along and releases their cryptocurrency that uses the same hashing mechanism for the block reward. Initially they have the block difficulty level pretty low as there aren't that many people participating in it yet. Dinkycoin hopes that eventually enough people will join the network so that the total hashing power will be something approaching Bitcoin's. Great. But atm their total hashing power is a very small fraction of Bitcoin's total hashing power. I don't care enough to go find out how infinitesimal it would be-- enough to say very small. Now suppose one of the Bitcoin ASIC miners gets bored one day and decides they don't like Dinkycoin. If they devote their ASIC to mining Dinkycoin they will immediately have more hashing power that the rest of the Dinkycoin network. That would virtually guarantee they solve every block of Dinkycoin and reap every reward. They'd easily have 100% control of the network at that point. For example-- suppose Dinkycoin says you need 20 confirmations before accepting that a transaction "went through." Well, the Bitcoin miner can use their enormous hashing power to go back 20/30/whatever blocks and build a competing branch from that historical point. And since the miner has 1000% more hashing power (or whatever the number is) than the entire Dinkycoin network, they can build a competing branch from that historical point that will eventually have solved more/more difficult block rewards than the branch the rest of the network builds off the current branch. Once the Bitcoin miner has a competing branch with greater total difficulty than the rest of the network, the network must accept that branch as the winner. Well, the devs can decide to do otherwise for whatever professed reason and roll back/hard fork/whatever. But that kind of "do over" would degrade trust in the cryptocurrency itself. Users would be afraid of another future attack. After all, they were initially told 20 confirmations was enough. How do they know 40 confirmations is any safer? (And again, if the attacker has superior hashing power to the rest of the network it isn't meaningfully safer.) Of course such a miner would be wasting all of their hashing power to screw with Dinkycoin's network. But to screw up most PoW cryptocurrencies you only really need 51% of the total hashing power. Even with that the attacker will eventually always beat the rest of the network to produce the "longest" chain. (Also, I think you can still cause problems for many cryptocurrencies with even less than 51% control.) Anyhow, do the math with the real numbers and you'll see that a real Bitcoin miner could devote a tiny percentage of their mining power and still own fledgling cryptocurrencies like the Dinkycoin example. Moreover, they can trivially collude with the other 99 Bitcoin miners to devote an even smaller part of their hashing power to owning Dinkycoin, or even automate the process of smashing any coin that uses their same hashing scheme, based on any criteria whatsoever. And it gets worse because in the 51% percent attacks I've read about in the real world, it isn't a big time miner with a grudge. Rather, it's someone who saw a weak point in a combination of a dinkycoin, an exchange, and several other moving parts and just rented a hashing rig to pull off an attack. Most PoW cryptocurrencies naively assume miners will choose greed over destructive tendencies without ever investigating whether those two paths are really mutually exclusive. Edit: clarification Edit: what happened to the web site that compares hashing power of the various SHA256-based coins, scrypt, etc.? Those orders-of-magnitude differences are quite instructive. But I can't find a site that lays it out nicely.

bouncycastle 8y ago
But if they throw hashpower on Dinkycoin, wouldn't Dinkycoin's difficulty increase? If the difficulty for Dinkycoin re-targets more aggressively, then Dinkycoin would quickly gain more security in the process!
- ThrustVectoring 8y ago
  The attacks tend to do something like "build a chain based off Dinkycoin's previous blocks, but don't publish it until a later date". The difficulty changes can't help because the chain doesn't know about the attack until the attacker publishes a longer chain.
  - bouncycastle 8y ago
    Yes, of course! And once the damage has been done, it's even harder to reverse. Perhaps if Dinkycoin's devs are fast enough, they could release a fork to undo it?
    - setr 8y ago
      As long as the attacker maintains 51%, he can eventually just repeat the attack, regardless of the number of forks.
      - bouncycastle 8y ago
        Ooohchie, yes indeed!
      - jki275 8y ago
        You change the POW function in the fork to eliminate the attack.
        bouncycastle 8y ago
        Perhaps if the attack was done using ASICs, but when done with GPUs it can be repeated indefinitely. See discussion https://www.reddit.com/r/ethereum/comments/707h3b/can_anyone_explain_vitaliks_comment_here_about_pos/ https://www.reddit.com/r/ethereum/comments/707h3b/can_anyone...

deleted 8y ago

[deleted]