4 ms·

I hate that there still hasn't been a thorough security / plausibility review on Nano; at least I haven't seen one. No one seems to take it very seriously. Mayb

by Geee 6y ago

I hate that there still hasn't been a thorough security / plausibility review on Nano; at least I haven't seen one. No one seems to take it very seriously. Maybe it's too good to be true.

onelastjob 6y ago
A security audit of Nano was completed by Red4Sec in July of 2019. You can find an overview of the audit here[1] and the full Red4Sec report here[2]. "Red4Sec has been able to determine that the overall security level of the asset is optimal." [1]https://medium.com/nanocurrency/nano-protocol-security-audit-summary-and-full-report-48760be8ab3d https://medium.com/nanocurrency/nano-protocol-security-audit... [2]https://content.nano.org/Nano_Final_Security_Audit_v3.pdf https://content.nano.org/Nano_Final_Security_Audit_v3.pdf
- Geee 6y ago
  This seems to be an vulnerability analysis of the Nano source code. I meant the monetary security and game theoretic plausibility of the protocol itself. E.g. how do we know which blocklattice is the correct one? (in Bitcoin it's the longest chain, which contains most energy and thus can't be created from thin air). Are there enough incentives to keep the network running and decentralized? Etc.
  - onelastjob 6y ago
    Each Nano account is its own blockchain. These accounts interacting form the block lattice. So it's not as though there are competing block lattices in Nano. In Bitcoin there can be a sidechain that can overtake the main chain (if the sidechain becomes longer than the main chain) and then cause a reorg of some blocks. But I don't think anything like this is possible in Nano. You'd have to ask the devs though to know for sure on the official Nano forum at forum.nano.org In terms of the incentives to keep the network running without mining fees or proof of stake rewards, the Nano community and devs think that merchants and other services using Nano will save significant amounts of money by not having to pay credit card processing fees. This will incentivize those merchants and service providers to run their own node (which only costs around $60 per month) in order to keep the network healthy and decentralized. The lack of mining fees and proof of stake actually disincentivizes the kind of centralization we are seeing with Bitcoin mining.
manjalyc 6y ago
Security wise Nano is DOA. Currently any attacker can effectively DDOS the network with trivial resources. I’ve personally proposed a complete solution to this problem over a year ago but it’s implementation is complex and would require a network split and my proposal has effectively been ignored in favor of other mitigation’s that fall far short of protecting the network. I’m not a security researcher and hell I’m not even in the CS field anymore so if I could figure out and implement an network wide attack on my own the barrier to entry is low (to be clear I have not executed any such attack). If you want to read further, the issue is a precomputed PoW attack. Nano’s very benefit - speed - is it’s biggest pitfall.
- onelastjob 6y ago
  I'd be interested to know more about your proposal to solve the precomputed work attack vector. Also, I think if you can easily create an attack that would DDOS network, you should absolutely try it on the Nano test net. That's what the test net is there for. To my knowledge, the precomputed spam attack has been mitigated by the Dynamic PoW feature that was added in v19. See my other reply with more details on that. I would like to know more about your proposal. You can email me at purplewumpus@protonmail.com
  - manjalyc 6y ago
    I simply do not have the time nor motivation to conduct an attack on the Nano testnet. I've responded to your other reply with the technical shortcomings of the mitigation, my proposal is still open somewhere in github's issues but I've since moved on from cryptocurrency as a whole.

by Geee 6y ago

I hate that there still hasn't been a thorough security / plausibility review on Nano; at least I haven't seen one. No one seems to take it very seriously. Maybe it's too good to be true.

onelastjob 6y ago

A security audit of Nano was completed by Red4Sec in July of 2019. You can find an overview of the audit here[1] and the full Red4Sec report here[2]. "Red4Sec has been able to determine that the overall security level of the asset is optimal." [1]https://medium.com/nanocurrency/nano-protocol-security-audit-summary-and-full-report-48760be8ab3d https://medium.com/nanocurrency/nano-protocol-security-audit... [2]https://content.nano.org/Nano_Final_Security_Audit_v3.pdf https://content.nano.org/Nano_Final_Security_Audit_v3.pdf

Geee 6y ago
This seems to be an vulnerability analysis of the Nano source code. I meant the monetary security and game theoretic plausibility of the protocol itself. E.g. how do we know which blocklattice is the correct one? (in Bitcoin it's the longest chain, which contains most energy and thus can't be created from thin air). Are there enough incentives to keep the network running and decentralized? Etc.
- onelastjob 6y ago
  Each Nano account is its own blockchain. These accounts interacting form the block lattice. So it's not as though there are competing block lattices in Nano. In Bitcoin there can be a sidechain that can overtake the main chain (if the sidechain becomes longer than the main chain) and then cause a reorg of some blocks. But I don't think anything like this is possible in Nano. You'd have to ask the devs though to know for sure on the official Nano forum at forum.nano.org In terms of the incentives to keep the network running without mining fees or proof of stake rewards, the Nano community and devs think that merchants and other services using Nano will save significant amounts of money by not having to pay credit card processing fees. This will incentivize those merchants and service providers to run their own node (which only costs around $60 per month) in order to keep the network healthy and decentralized. The lack of mining fees and proof of stake actually disincentivizes the kind of centralization we are seeing with Bitcoin mining.

manjalyc 6y ago

Security wise Nano is DOA. Currently any attacker can effectively DDOS the network with trivial resources. I’ve personally proposed a complete solution to this problem over a year ago but it’s implementation is complex and would require a network split and my proposal has effectively been ignored in favor of other mitigation’s that fall far short of protecting the network. I’m not a security researcher and hell I’m not even in the CS field anymore so if I could figure out and implement an network wide attack on my own the barrier to entry is low (to be clear I have not executed any such attack). If you want to read further, the issue is a precomputed PoW attack. Nano’s very benefit - speed - is it’s biggest pitfall.

onelastjob 6y ago
I'd be interested to know more about your proposal to solve the precomputed work attack vector. Also, I think if you can easily create an attack that would DDOS network, you should absolutely try it on the Nano test net. That's what the test net is there for. To my knowledge, the precomputed spam attack has been mitigated by the Dynamic PoW feature that was added in v19. See my other reply with more details on that. I would like to know more about your proposal. You can email me at purplewumpus@protonmail.com
- manjalyc 6y ago
  I simply do not have the time nor motivation to conduct an attack on the Nano testnet. I've responded to your other reply with the technical shortcomings of the mitigation, my proposal is still open somewhere in github's issues but I've since moved on from cryptocurrency as a whole.