Hacker News Reader

Comment by akkartik | Hacker News Reader

Is that really true? Could a botnet not conceivably make transactions out of your wallet? Doesn't the distributed ledger have tentacles reaching under your mattress?

View on HN

A valid digital signature gives a recipient reason to believe that the message was created by a known sender, such that the sender cannot deny having sent the message (authentication and non-repudiation) and that the message was not altered in transit (integrity).

http://en.wikipedia.org/wiki/Digital_signature

The purpose of the blockchain is to establish an ordered sequence of transactions.

Sure, but no-one calculates digital signatures in their head. Your bitcoins are worthless without computer systems, and those computer systems are the subject of attack by thieves.

Sure, but this attack is not about that.

This is a DDOS attack on the integrity on the distributed database, which is very bad, but not able to spend Bitcoin that isn't yours.

http://learncryptography.com/51-attack/

I guess it would be possible.

No, even if you successfully achieve a 51% attack, you can't spend coins from arbitrary wallets.

Well, you could control the blockchain, wouldn't that include spending coins from any wallet?

No. Transactions have to be signed by a private key matching the from address.

The double spend attack works by convincing the other party that the transaction has completed (so they release whatever escrow is in place) and then replacing the blockchain.

(But a botnet infection could watch for wallets on a computer and cause the coins in the wallet to be spent)

No. The wallets are protected with public/private key cryptography. Controlling the block-chain simply lets you control whose transactions get processed, and hence potentially allow someone to attempt to double spend their money. You could also prevent other people from spending their money entirely.

You don't "control" the blockchain in the strict sense. To generate a transaction from one address to another, you must know the private key corresponding to the sender's address. Without that, the transaction is invalid, and no sane node will accept block containing such transaction.

When you have 51% of mining power, you can do a lot of nasty things(like stopping confirming transaction at all), but not spend someone else's bitcoins.

No, a botnet can't ever achieve 51%. One modern ASIC rig is equivalent to a few thousand average CPU+GPU computers that make up a botnet.

What about a botnet of modern ASIC rigs?

How would you get one?

ASIC owners are paranoid about their earnings. They would notice they are getting less than they usually do the next day after the infection.

Reply on news.ycombinator.com