Comment by nullc | Hacker News Reader

Comment by nullc | Hacker News Reader

Parent Full thread

I think it's an unambiguous ethical failure that Bitcoin's traffic isn't opportunistically encrypted. As protocol developers we have an obligation to provide for users at least a basic level of protection and because of known threats on the modern internet that protection almost always needs to include encryption.

In particular, due to material published by Edward Snowden we know for a fact that nation state attackers have exploited this weakness to compromise the privacy of Bitcoin users, but even if before we knew that-- it's a reasonable assumption for any protocol which handles private information.

Unfortunately, Erik Voskuil (maintainer of "libbitcoin", a bitcoin node implementation used by virtually no one) has aggressively argued against any implementation of encryption with arguments that it would create a false sense of security and ultimately convert Bitcoin to a permissioned network. (e.g. https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2016... and the surrounding thread; note that this was in _2016_. The same fruitless discussion repeated in subsequent years.)

I don't think any of Bitcoin's regular contributors have found his arguments persuasive in the slightest. Personally, I believe the arguments are outright incoherent. Never the less, these arguments are repeated every time its discussed.

After years of vicious abuse many Bitcoin contributors simply no longer have sufficient will remaining to proceed in the face of even more drama. It would be perfectly possible for Bitcoin Core to deploy encryption and for software like libbitcoin to not do so-- it doesn't have to be universally supported... but even so, the drama remains and no one wants to deal with it.

As a result little progress has been made in bringing the encryption functionality to completion and users are left needlessly exposed as a result.

How is it possible that a single person, however vocal, can affect the morale and peer review process so much? I would say, ignore and happily move on with the implementation.

How is it possible that a single straw could break the back of a mighty camel? :)

If you're up for it-- jump on in! Other people, ... apparently aren't.

I emailed the primary bitcoin maintainer Wladimir J. van der Laan when the Snowden slides came out, asking specifically for this. The hand-wavey rationale then for not doing it was basically along the lines of “well, anyone can MITM it and people who care about privacy should already be using it over Tor, so it isn’t important”.

I disagreed then and I disagree now, but my C isn’t up to the task (I can read it well enough, but I doubt I could securely implement a network crypto server the first try). Perhaps I will look into adding this to the golang bitcoin implementation, although I doubt it will go much of anywhere without bitcoind/bitcoin-core (the main canonical implementation) supporting it.

FWIW, Wladimir was fine in support of the work, see e.g. this discussion from a year ago: http://www.erisian.com.au/meetbot/bitcoin-core-dev/2019/bitc...

I didn't become aware of those snowden docs until a year and a half after the article about them... :( but the need was obvious enough before they came out (as you can see from the 2016 discussion on the subject).

Sitting down and coding is probably not the limiting reagent in getting the work completed. Review, herding cats, building positive momentum, etc. would all add a lot if you're willing and able to provide it. Collaborating on a second implementation would probably also be useful (though not so much in isolation, but it would be useful for testing and validation). (Heck, even just cheering work along to distract from drama and haters would probably accomplish a lot).

The Snowden drop was in 2013.

A functioning implementation goes a long way toward herding cats and building positive momentum. Amongst hackers, working code trumps a lot of objections; moreso if it is simply opportunistic and doesn't break anything for old clients, and can be disabled by the fearful pedants.

It's also a great starting point for other practical objections: with a working prototype, you can always counter "but what about edge case $x, huh smart guy?!" with a "well, here's a small patch to address $x, it's in the PR now", which is a great way to achieve forward progress.

The edge cases should all be addressed by the spec. :P

I don't recall any objections raised that would be addressed by code. (though also, there have been at various points in time implementations, just not merge ready ones...)

In 2013 there were more serious privacy problems in the bitcoin software which probably would have made the encryption less relevant. Most of the known ones were addressed by 2016. I still didn't hear about the bitcoin tie in until Oct 2019, though, sadly.

I find the argument quite valid. I have been always running bitcoin through tor, it is trivial actually, takes like 2 extra minutes on normal linux system. Why reinvent the wheel?

The vast majority of people who use bitcoin do not run bitcoind.

Those people deserve privacy too.

No amount of P2P encryption will create strong privacy for those people, unfortunately.

Any MITM'able protocol should at least keep a record of hashes of the shared secrets used for the connection.

Then, it would be possible after the fact to identify a MITM by checking those logs on both ends of the connection. Services could even exist to do this automatically.

The risk of being caught, even if small, would put most three letter agencies off sniffing this kind of thing.

That was what was proposed w/ BIP151 in Bitcoin.

We also came up with a strongly zero-knowledge authentication system where the connection receiver learns absolutely nothing about if authentication is being used by the connection initator. This prevents a MITM from adaptively "Opps, looks like that TCP connection failed" when they notice authentication being attempted in order to avoid detection.

This idea fits pretty nicely with how we manual connections work in Bitcoin... A normal node will make 8 automatic (random) outgoing connections plus up to another 8 connections to manually specified connections. Our thought was that if a manually specified connection was authenticated for partitioning resistance, and the auth failed it could just get treated as a random connection (and, of course, sound klaxons). The end result should be a phenomenal amount of herd immunity where even a small percentage using authentication should totally stop MITM attacks by attackers who really don't want to get detected.

Reply on news.ycombinator.com