Hacker News Reader

Comment by RyanZAG | Hacker News Reader

Premise here is pure madness - I'm sure I could ask a random security researcher to hack Chrome and he would surely fail. But at the next Hack-a-day or similar, Chrome WILL be cracked wide open when the whole world gets a shot. So no - your inability to hack Bitcoin is not some grand statement of security on Bitcoin, only a statement that you didn't manage to hack it. I'm sure you didn't manage to hack thousands of other things that other did manage to hack, too (unless you've somehow hacked just about everything else including Ruby - not RoR?).

His point about how easy it is to monitor Bitcoin is unfortunately turning out to be true, which is incredibly unfortunate as Bitcoin is currently being used to purchase illegal drugs and similar. Once the FBI/NSA gets in on it, we're probably going to see a bunch of pointless arrests.

View on HN

Dan may be random, but he's no "random security researcher". And he has, in fact, hacked "just about everything" a time or two by discovering and exploiting common mode vulnerabilities.

His point of view is worth listening to.

His point of view is certainly worth listening to, but Dan should know better than anyone that the fact that even he can't break something is still not an argument for (or even a suggestion of) its security.

A skilled auditor finding no flaws in something is evidence in favor of there being few flaws in it.

He never says there aren't any. He says there are surprisingly few.

If an audit by a talented, experienced, and motivated security consultant isn't "even a suggestion of its security", than what is?

He didn't say "it's is perfectly 100% secure", he said "BitCoin surprised me" and "the core technology actually works [] to a degree not everyone predicted".

Isn't that overstating his accomplishments a bit? Unless by "just about everything", you mean the DNS bug and the media, sure...

None of his published work seems consistent with the skillset that would qualify one to thoroughly audit bitcoin. He tends to stick to higher-level, less technical vulnerabilities.

In fact, there was actually a really interesting vulnerability he'd missed which was discovered by the developers shortly afterwards. Due to a flaw in the merkle tree Bitcoin used to calculate block hashes, you could trivially create a new invalid block with the same hash as almost any valid one. If you managed to feed the bad block to a node before it heard the good version, that node wouldn't ever accept the correct version because it "knew" that block was invalid. Do that to an exchange or wallet and maybe a couple of big mining pools and you could fork the exchange onto a different version of the blockchain, convincing them you'd sent them bitcoins when you hadn't. I don't think it would have required much in the way of resources to pull off either.

http://en.wikipedia.org/wiki/Dan_Kaminsky

He found serious flaws in DNS and SSL. Of course one code review is not authoritative, but he is pretty credible.

But BitCoin doesnt need a sponsored hackathon for people to start finding flaws in it. As the author pointed out, there is a huge reward already waiting for anyone who can cheat bitcoin. That should guarantee that many have already tried and failed along with the author.

Unless of course they succeeded but kept it to themselves for strategic reasons.

Reply on news.ycombinator.com