From: Peter Todd <pete@petertodd•org>
To: naman naman <namanhd@gmail•com>
Cc: bitcoin-development@lists•sourceforge.net
Subject: Re: [Bitcoin-development] MtGox blames bitcoin
Date: Mon, 10 Feb 2014 14:40:32 -0500 [thread overview]
Message-ID: <20140210194032.GD17359@savin> (raw)
In-Reply-To: <CA+SxJWBbWH_amgpst9N7nfT4twvfreAhGaxVWZYfTiLjyN8m3g@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 1512 bytes --]
On Tue, Feb 11, 2014 at 01:00:21AM +0530, naman naman wrote:
> Hi guys,
>
> Please check this thread
> https://bitcointalk.org/index.php?topic=458608.0for a possible attack
> scenario.
>
> Already mailed Gavin, Mike Hearn and Adam about this :
>
> See if it makes sense.
That's basically what appears to have happened with Mt. Gox.
Preventing the attack is as simple as training your customer service
people to ask the customer if their wallet software shows a payment to a
specific address of a specific amount at some approximate time. Making
exact payment amounts unique - add a few satoshis - is a trivial if
slightly ugly way of making sure payments can be identified uniquely
over the phone. That the procedure at Mt. Gox let front-line customer
service reps manually send funds to customers without a proper
investigation of why the funds didn't arrive was a serious mistake on
their part.
Ultimately this is more of a social engineering attack than a technical
one, and a good example of why well-thought-out payment protocols are
helpful. Though the BIP70 payment protocol doesn't yet handle busines to
individual, or individual to indivudal, payments a future iteration can
and this kind of problem will be less of an issue.
Similarly stealth addresses have an inherent per-tx unique identifier,
the derived pubkey, which a UI might be able to take advantage of.
--
'peter'[:-1]@petertodd.org
0000000076654614e7bf72ac80d47c57bca12503989f4d602538d3cd7892ca7d
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 685 bytes --]
next prev parent reply other threads:[~2014-02-10 19:41 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-02-10 11:28 Drak
2014-02-10 11:54 ` sickpig
2014-02-10 12:25 ` Gregory Maxwell
2014-02-10 14:40 ` Isidor Zeuner
2014-02-10 16:30 ` Troy Benjegerdes
2014-02-10 16:45 ` Gregory Maxwell
2014-02-10 18:25 ` Troy Benjegerdes
2014-02-10 18:45 ` Jameson Lopp
2014-02-10 18:53 ` Gavin Andresen
2014-02-10 19:07 ` Troy Benjegerdes
2014-02-10 19:23 ` Peter Todd
2014-02-10 19:30 ` naman naman
2014-02-10 19:40 ` Peter Todd [this message]
[not found] ` <52F9377D.9010405@gmail.com>
2014-02-11 20:42 ` naman naman
2014-02-11 20:49 ` Gregory Maxwell
2014-02-11 20:56 ` naman naman
2014-02-13 12:20 ` naman naman
2014-02-10 16:49 ` Drak
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140210194032.GD17359@savin \
--to=pete@petertodd$(echo .)org \
--cc=bitcoin-development@lists$(echo .)sourceforge.net \
--cc=namanhd@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox