INSUBCONTINENT EXCLUSIVE:
Cryptocurrencies: a weird agglomerate of fascinating technology built by brilliant engineers; a whole new and potentially important form of
economics; … and hype-machine puffed-up crazy-talk nonsense
So, as you might expect, they also combine state-of-the art resilient engineering and comical clown-car so-called security
Yes, that right — I want to talk about IOTA, and (to an extent) Bitcoin Cash.
Modern security practices include: an understanding of and
commitment to responsible disclosure; making yourself available and accessible to third-party security researchers; offering bug bounties;
fuzzing your code; etcetera
They also include valuable truisms such as &don''t roll your own crypto.& Here that crypto as in cryptography, and it means, always always
always use tried and time-tested cryptographic algorithms and implementations
Do not try to build your own from scratch
You will regret it.
IOTA, currently the world tenth most valuable cryptocurrency, took an … assertively contrarian stance regarding this
They didn''t just roll their own crypto, they rolled their own fundamental units, deciding that binary wasn''t good enough by half, and that
trinary was where it at, that their trits and trytes were so much better than bits and bytes.
I confess part of me has a grudging respect
for the surreality of this kind of whackadoodle performance art
Alas, this half-admiration doesn''t extend to the recent saga in which a) they rolled their own crypto; b) MIT and BU researchers found a
flaw in it; c) IOTA first said that the flaw was intentional, and then, apparently, that it was created by an imperfect AI (!); d) a
spectacular war of words (between those parties and several others) erupted
Then, yesterday, Neha Narula, the director of MIT Digital Currency Initiative, presented last year work in a talk at Black Hat — and even
though that work stemmed from last year …
The interesting bit is this: Iota has been scrambling to remove their broken homemade hash
function (which is still used in their centralized coordinator) before a vulnerability presentation at BlackHat
pic.twitter.com/ofBk3XQyMv
mdash; Matthew Green (@matthew_d_green) August 8, 2018
I interviewed Narula this morning and she said, still
amazed, that it actually seemed to her as if IOTA thought her talk yesterday would reveal a new, previously undisclosed vulnerability
Their fundamental misunderstanding of how software security works, and what responsible disclosure means, is staggering.
You may well think
IOTA is such an extremely ridiculous project that it unfair to use it as an example
But if so, bear in mind that cryptocurrencies remain a very weird field, and many people who have put a lot of money into them are unable to
distinguish ridiculous projects from serious ones
A couple of days ago I visited Las Vegas &cryptocurrency nightclub,& all too appropriately called MORE; the general idea is that people can
both invest in MoreCoin (yes, really) and spend it on better access / parties at Vegas and similar destinations
Whether you think this is a valid concept or a crazy get-rich-quick scheme, it an example of how cryptocurrencies are increasingly aimed at
the unsophisticated public
To its intended audience, there not much difference between MoreCoin and Bitcoin; any technical ludicrousness is no bar to success.
But if
you want to talk about something more serious and higher-profile, fine; let talk about Narula most recent post, this one describing and
regarding a bug in Bitcoin Cash, one of the very few currencies traded on Coinbase
Some months ago, a developer, Cory Fields, discovered that the hard fork which birthed Bitcoin Cash included some refactoring of Bitcoin
consensus code … such that a malicious block could be crafted which would split Bitcoin Cash into two separate blockchains.
This would be
very bad, would almost certainly have drastically diminished Bitcoin Cash value, and could conceivably be used for a double-spend attack;
meaning, given Bitcoin Cash value and liquidity, it was a bug which could conceivably have been used to generate many millions of dollars in
Fortunately Fields is an admirable fellow and decided to do the right thing.
But … how Who to contact The people with commit rights to the
Bitcoin Cash repo, he supposed; but none of them had provided secure methods of public contact
This was information that could be used to bilk many millions of dollars, it couldn''t be emailed in plaintext — and what more, if
somebody else discovered the bug but this Core developer was the only one known to have discovered it, he would be painting a big target on
How can you perform responsible disclosure when there no outlet to disclose to
In the end, Fields found a way
(A very complicated way.) And the bug has been fixed
But the difficulties he had highlights the fact that, as cryptocurrencies mature, their security policies and procedures need to mature
Kudos to those who are already well along this path, such as Ethereum, EOS and Tezos; and brickbats to those who make it hard to disclose
vulnerabilities, and/or those who respond with weaponized ignorance.
