8 ms·

Key quote from Fred Wilson: “If Bitcoin really becomes the global currency that every country and every business accepts, and Coinbase becomes the JP Morgan Cha

Key quote from Fred Wilson: “If Bitcoin really becomes the global currency that every country and every business accepts, and Coinbase becomes the JP Morgan Chase of Bitcoin, that could be worth a lot of money.”

blantonl 14y ago
The JP Morgan Chase of Bitcoin could also become the single largest target of technical and crypto attacks that the technology industry has ever seen. Ever. Advances in cryptography which once were targeted to breaking encrypted messages could be focused on breaking the entire world economy in one fell swoop (provided Bitcoin gets real market traction)
- patio11 14y ago
  It's highly unlikely that high-profile Bitcoin busts will require meaningful advances in cryptography: they're far, far more likely to be appsec work -- perhaps inspired appsec work -- of the kind routinely conducted by intermediate programmers with weeks of specialized training. Let me put some round numbers on the cost of various attacks: Major result in cryptography: $X0 million to $X00 million+ (nation-state adversary) Subtle bug in the Satoshi client C code: $100,000 (trivially within the reach of organized crime or a single highly motivated attacker) Bust any Bitcoin-using Ruby on Rails (&tc) application: $20k probably, upper bounded by $100k where you'd produce (as an industrial biproduct) a RCE on any arbitrary Rails site Compromise the security of a non-trivial number of Bitcoin users via spearphishing / targeted malware / etc: $1,000 If you're a thief who doesn't have access to any computer skills or the above sums of money, have no fear, it is likely that the Bitcoin economy still has multiple options for you to get in on the ground floor of exciting new ways to steal things. [P.S. I'm routinely pessimistic about Bitcoins for a lot of reasons, but the software security angle keeps coming back to me because it's so easy to explain. If you think I'm overly pessimistic, consider the track record on HN of "people who know what the threat environment banks operate in looks like" versus "Bitcoin advocates" has been in predicting observable future outcomes of e.g. Bitcoin bucket shops in advance.]
  - wslh 14y ago
    Sorry, I don't understand your reasoning. What is the difference of running a bitcoin app to, say, a forex site in terms of security? and what do you mean with major result in cryptography? Other cryptographic protocols can be broken too. What makes bitcoin special?
    - ISL 14y ago
      SHA256 underpins Bitcoin. Break SHA256, and you win.
      - nadaviv 14y ago
        Break SHA256, and you can cause hash collisions that allows you to easily mine blocks until 51% of the network switches to a better hashing algorithm (which should happen pretty quick, because it'll be obvious that someone broke it). To steal users money, you'd have to break ECDSA. Edit: I wasn't 100% exact. It gives you more [1] than easily mining blocks, but still not that much power so that I would call it "Winning". [1] https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_computing_power https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_...
        tptacek 14y ago
        And you're more confident in ECDSA why?
        betterunix 14y ago
        Compute hashes faster than the rest of the network and you win. The "51% attack" is a polynomial time attack, which is not an acceptable security margin in cryptography.
        reedlaw 14y ago
        It seems the "51% attack" can be mitigated simply by waiting for 6 or more confirmations before sending off merchandise or in the case of an exchange, allowing withdrawal of funds. Those who can't wait that long can rely on 3rd parties who attempt to take on fraud in exchange for transaction fees, similar to the current credit card system.
- drumdance 14y ago
  Well, that's part of the risk-reward calculation, right? In Founders at Work Max Levchin talks at length about how Paypal essentially had to become a fraud detection company disguised as a payment processing company. Best of luck to Brian & Coinbase in cracking a very tough nut. Would love to see them succeed. Edit: This also fits Anderson's quasi-thesis around investing in laughable ideas.
- dsaber 14y ago
  You can argue, even without Bitcoin, the motivation still equally exists for breaking cryto algorithms. Break SHA256 for example, and now the attacker can potentially break into many high-profile systems. So, bitcoin doesn't really change the potential risk that much. Unless, one can suddenly solve NP-complete problems, I don't think that's gonna happen.
- piggity 14y ago
  Monocultures are "bad" (plenty of other issues too!)
lingben 14y ago
if
pbreit 14y ago
Chances of that: zero. Not slim, not infinitesimal, not a fraction of a percent. Zero. Regular money works better for the nearly all situations.
- sillysaurus 14y ago
  Repeating your words three times won't necessarily make them true forever. EDIT: Nor one time, in fact.
  - pbreit 14y ago
    Good point. Edited.
paulhauggis 14y ago
It's funny how Bitcoin is supposed to be a P2P currency and we are essentially going back to using banks.
- sneak 14y ago
  c.f. SMTP/GMail The big difference is that there's nothing stopping anyone from running their own server, or starting up a new/competing service.

blantonl 14y ago

The JP Morgan Chase of Bitcoin could also become the single largest target of technical and crypto attacks that the technology industry has ever seen. Ever. Advances in cryptography which once were targeted to breaking encrypted messages could be focused on breaking the entire world economy in one fell swoop (provided Bitcoin gets real market traction)

patio11 14y ago
It's highly unlikely that high-profile Bitcoin busts will require meaningful advances in cryptography: they're far, far more likely to be appsec work -- perhaps inspired appsec work -- of the kind routinely conducted by intermediate programmers with weeks of specialized training. Let me put some round numbers on the cost of various attacks: Major result in cryptography: $X0 million to $X00 million+ (nation-state adversary) Subtle bug in the Satoshi client C code: $100,000 (trivially within the reach of organized crime or a single highly motivated attacker) Bust any Bitcoin-using Ruby on Rails (&tc) application: $20k probably, upper bounded by $100k where you'd produce (as an industrial biproduct) a RCE on any arbitrary Rails site Compromise the security of a non-trivial number of Bitcoin users via spearphishing / targeted malware / etc: $1,000 If you're a thief who doesn't have access to any computer skills or the above sums of money, have no fear, it is likely that the Bitcoin economy still has multiple options for you to get in on the ground floor of exciting new ways to steal things. [P.S. I'm routinely pessimistic about Bitcoins for a lot of reasons, but the software security angle keeps coming back to me because it's so easy to explain. If you think I'm overly pessimistic, consider the track record on HN of "people who know what the threat environment banks operate in looks like" versus "Bitcoin advocates" has been in predicting observable future outcomes of e.g. Bitcoin bucket shops in advance.]
- wslh 14y ago
  Sorry, I don't understand your reasoning. What is the difference of running a bitcoin app to, say, a forex site in terms of security? and what do you mean with major result in cryptography? Other cryptographic protocols can be broken too. What makes bitcoin special?
  - ISL 14y ago
    SHA256 underpins Bitcoin. Break SHA256, and you win.
    - nadaviv 14y ago
      Break SHA256, and you can cause hash collisions that allows you to easily mine blocks until 51% of the network switches to a better hashing algorithm (which should happen pretty quick, because it'll be obvious that someone broke it). To steal users money, you'd have to break ECDSA. Edit: I wasn't 100% exact. It gives you more [1] than easily mining blocks, but still not that much power so that I would call it "Winning". [1] https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_computing_power https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_...
      - tptacek 14y ago
        And you're more confident in ECDSA why?
      - betterunix 14y ago
        Compute hashes faster than the rest of the network and you win. The "51% attack" is a polynomial time attack, which is not an acceptable security margin in cryptography.
        reedlaw 14y ago
        It seems the "51% attack" can be mitigated simply by waiting for 6 or more confirmations before sending off merchandise or in the case of an exchange, allowing withdrawal of funds. Those who can't wait that long can rely on 3rd parties who attempt to take on fraud in exchange for transaction fees, similar to the current credit card system.
drumdance 14y ago
Well, that's part of the risk-reward calculation, right? In Founders at Work Max Levchin talks at length about how Paypal essentially had to become a fraud detection company disguised as a payment processing company. Best of luck to Brian & Coinbase in cracking a very tough nut. Would love to see them succeed. Edit: This also fits Anderson's quasi-thesis around investing in laughable ideas.
dsaber 14y ago
You can argue, even without Bitcoin, the motivation still equally exists for breaking cryto algorithms. Break SHA256 for example, and now the attacker can potentially break into many high-profile systems. So, bitcoin doesn't really change the potential risk that much. Unless, one can suddenly solve NP-complete problems, I don't think that's gonna happen.
piggity 14y ago
Monocultures are "bad" (plenty of other issues too!)

lingben 14y ago

pbreit 14y ago

Chances of that: zero. Not slim, not infinitesimal, not a fraction of a percent. Zero. Regular money works better for the nearly all situations.

sillysaurus 14y ago
Repeating your words three times won't necessarily make them true forever. EDIT: Nor one time, in fact.
- pbreit 14y ago
  Good point. Edited.

paulhauggis 14y ago

It's funny how Bitcoin is supposed to be a P2P currency and we are essentially going back to using banks.

sneak 14y ago
c.f. SMTP/GMail The big difference is that there's nothing stopping anyone from running their own server, or starting up a new/competing service.