August 2018 - cypherpunks - lists.cpunks.org

Bug in cryptocurrency platform Augur meant users could be duped into losing money
by jim bell 08 Aug '18

08 Aug '18

https://thenextweb.com/hardfork/2018/08/07/augur-fake-data-bug/ A massive vulnerability has been discovered in the decentralized betting platform Augur. Hackers have been able to feed users incorrect data and game the system. Everything shown by the app was susceptible to faking, from transactions to wallet addresses – even the markets could have been forgeries. Augur is a wonderful place where you can place wetwork orders for high-profile figures like US President Donald Trump and Amazon boss Jeff Bezos. It’s a next-generation betting platform that allows wagers on pretty much anything. Users buy shares in the outcome of a specific event, like a sports match or political election. Buy shares in the right outcome and you win, with prizes being paid in Ethereum. This brand of attack is called frame-jacking, which exploits and manipulates HTML code that controls how data is displayed when it is syndicated from external sources. A user being frame-jacked will be viewing the ‘correct’ domain, but the data shown will be incorrect and misleading, funnelled in from a different location – not directly from Augur. The security researcher who submitted the vulnerability report to HackerOne described its effects quite simply: “User visits a link from internet, his Augur application data is replaced by an attacker then – market data, Ethereum addresses, everything.” Augur’s native cryptocurrency, REP, is even distributed for settling outstanding bets by confirming their outcome. Truly, from top to bottom, the entire platform relies on having accurate, up-to-date information, users need to be able to trust the data they’re being fed. The decentralized design of its back-end is supposed to maintain trust. In this case, though, users have been let down by the developers choice to store certain files related to its UI locally, leading to their exposure. Such design choices often breed single points of failure. Hackers were able to access sensitive code as it was stored locally, something usually avoided for the security concerns it raises. The researcher also explored possible consequences of such bugs, after disagreeing with its medium-grade severity classification by the Augur team. In the case it is discovered by someone not participating in bug bounty program. What would he do? Well, the logical step in the case someone wanted to exploit it would be, for example, sending out phishing links to Augur users … replacing all the Ethereum addresses with his own, [leading to] fund loss. Someone could find it and just create post a Medium or somewhere else, describing how is it easy to hijack Augur’s UI data. […] This stupid, simple, small, and critical bug was found in Augur’s bug bounty program, the one with very high bonuses for critical bugs and very low expectations of such bugs being actually found. In the end, though, the developers invariably maintained their position, primarily due to it being an error in the UI, not the underlying platform. Usually, these types of bugs are worth around $1,500 – but a spokesperson later clarified the researcher received $5,000. The vulnerability has since been patched, so users are urged to update their Augur client. Really, though, this is just more proof that HackerOne’s white-hat ecosystem has become quite lucrative. Bug bounties are being paid out almost every day – we recently reported on one set of bounties distributed to those finding kinks in the code of anonymous cryptocurrency Monero. Update 19:09 UTC, August 7: A spokesperson from Forecast Foundation, which built and maintains Augur, has since reached out. They clarified that, in the end, the security researcher was paid $5,000, diverting from the prices set by its bug bounty program. “This is done on a discretionary basis, and this payout was double the bug bounty program’s max payout for UI issues of $2,500.” Published August 7, 2018 — 16:09 UTC

1 0

Re: [Cryptography] Krugman blockchain currency skepticism
by grarpamp 08 Aug '18

08 Aug '18

On Mon, Aug 6, 2018 at 7:24 PM, Bill Frantz <frantz(a)pwpconsult.com> wrote: > OK, I can't resist any longer. Let's look at some payment and store of value > systems: Ok... > Gold metal: > Terrible for electronic payment. Transferring electronic stock in GLD, or other forms of gold securities, works fine, is slow and a lot of paperwork, but most would be terribly happy to receive it instead of being stiffed. > Likely to be accepted anywhere fiat currencies are weak. Like Venezuela, Greece, Zimbabwe, etc... anyplace undergoing any volatility or inflation event, now or past, since gold was removed / banned from standard worldwide... anyone have links to news articles where any economically significant fraction of the affected populous in such places was carrying around and using gold instead of wheelbarrows full of fiat? None? > Can be converted to fiat currencies where they are strong Everything is convertible to any other thing, wherever and whenever, doesn't mean you or your counterparty will want to, at times it might be best to drop it in the rubbish, or keep it. > Can be converted to fiat currencies, but the transaction may have to be reported. "Have to" vs "is" vs "you volunteered" info are different things. > If you become a refugee, gold can be carried with you. Up to your limited capacity to securely carry weight and bulk. > Can be stolen at gunpoint. Carry a gun. > Doesn't earn interest. It can. > The gold standard. :-) Though fair a meme nonetheless, with cryptocurrency a challenger approaching from a distance. > Dollar, Euro, Pound Sterling (well regarded fiat currencies): > Can be used with electronic payment systems. Not before converting that paper / metal / poly physical into something entirely different... digits in a database. > Likely to be accepted anywhere. > Easy to convert to other currencies Not really, it's a pain to convert back, assuming you even knew how to authenticate and wanted the foreign physical in the first place.. > If you become a refugee, notes are transportable and accounts can be accessed > if not frozen. (Pick a good jurisdiction for that account.) They don't let you bring in "good" fiats, they keep it for themselves. You're not funding that account electronically through the tight regime you have to refugee from. Nor are you transporting their junk it past all their checkpoint thieves on the way out, nor is it useful on the other side. > gunpoint, accounts can be protected from that attack. Thug points to your / bankers dome. Govt thugs do same, civil forfeiture, etc. > Relatively stable in value over the long term Nice smooth steady loss and redistribution, lovely. Case Shiller Index... 2007 deja vu and pop before long. > Accounts can earn interest. But don't, not enough to even beat inflation these days, a terrible SOV and investment. > What world commerce runs on. Can run on cryptocurrencies. > Bitcoin: > Not accepted everywhere. Can be. > the transaction is recorded in the blockchain, leaving a record. Which if using cryptographically private ZKP blockchain like Zcash (ZEC), is currently thought to be entirely private thus off the record. > Can be converted to fiat currencies for > wide acceptance everywhere In the future, Neo, you won't have to. > If you become a refugee, transport is limited by the electronic devices you can > take with you. False. Memorize your brainwallet passphrase. Encode keys on or in your body, clothing, luggage, books. Ship ahead, or shard among people, or stash online. Limitless secure options. > Wildly changing value over the recent short term FUD from anti's who don't understand introduction of new things, decentralized cryptocurrencies into free markets, all covered before. And Impressive increasing value over any long term window beyond a year. > and no long-term track record. Nine years and counting, impressive for something that's pissing off and disrupting fiat govt / banks worldwide. Hardly Pokemon or Linden Dollars. > Can't earn interest Value on "deposit" is value invested. Investments can earn. Unless you invest them in shitty things like Lehman Brothers. While cryptocurrency rising in adoption phase, it eats all others, so no sane person can or will pay returns denominated in it, until there are entirely cryptocurrency based businesses, investment vehicles and cycles, or if its rate of rise falls below other vehicles. Better to just buy / sell / short it directly. > Not widely used in commerce. Nothing stopping that but you. > Eggs: > (from the Economist Buttonwood column 7/21/2018 on hyperinflation in > Venezuela): Not usable for electronic payment. Generally accepted for > payment in Venezuela. Can be sold as a commodity in most locations and > converted to other currencies. Not normally tracked by governments. Hard > boiling recommended should you become a refugee to improve transportability. > Destroyed by fire, but small fires may help them make a good meal. > Relatively stable value over the long term, but individual eggs spoil in a > matter of weeks to months. Can't earn interest. Used in commerce in limited > locations suffering hyperinflation. Can directly provide human nourishment. Can earn interest... give recently fertilized eggs to someone to hatch under contract, you make eggs in return. I'd peg / tether your price in cryptocurrency for a dozen eggs to each of every one of today's hundreds of cryptocurrencies, at today's exchange rate, provided you buy all the eggs you eat each month, from me, at the aforementioned static crypto/egg peg, using the cryptocurrency of my choice at each purchase, for the rest of your life. You'll always pay the same amount of whichever crypto for your eggs, zero volatility, guaranteed. I reserve the right to add any new cryptocurrency at any time pegging it for you at that time, and to terminate contract at any time by delivering a dozen hens a laying to you. Feel free to hedge your backend with Tether (USDT)... https://tether.to/ "Every day that goes by and [Cryptocurrency] hasn't collapsed due to legal or technical problems, that brings new information to the market. It increases the chance of [Cryptocurrency's] eventual success and justifies a higher price." -- Hal Finney Most people are simply closed minded old dog programmed statist sheeple incapable of free thought outside their box (TV box too). That's why they can't offer any debate sustainable reason why decentralized cryptocurrencies *cannot* be used as money. And why the cryptocurrency crowd, having made that leap, offers numerous reasons, designs, updates, and ways in which they *can*. For that matter, seems it'd be a lot more fun crypto coding completely novel decentralized cryptocurrencies, than off in a corner trying to digitize some crusty old fiat under orders from a government / banks with no freedom to change that model :) [bcc cypherpunks]

1 1

Innovation in Crypto Gambling and the Potential Legislation Nightmare
by jim bell 08 Aug '18

08 Aug '18

https://coincentral.com/crypto-gambling-legislation-nightmare/ Digital currencies and their underlying blockchain technology have created new possibilities in a world where almost all online trends have become potential monetization ventures. And now, crypto gambling has enabled gamblers to participate in markets never realized before, such as placing assassination bets on celebrities and political candidates. Such is the level of potential and democratization offered by Augur, a market prediction platform that utilizes cryptocurrencies and runs on the blockchain. It enables users to place bets on an infinite range of betting outcomes only limited by one’s imagination. It also places no geographical restrictions and provides the added value of anonymity. Right now, Jeff Bezos, Donald Trump, and Warren Buffett are three individuals who already have assassination bets placed on them on the Augur platform. The Trump assassination wager, for example, reads, “Will Donald Trump (President of The USA) be killed at any point during 2018?” Developed by the Forecast Foundation, Augur allows you to create an event to predict, build a market for it, and then trade shares based on the outcome. The events range from election predictions to natural disasters to market crashes. Once a user wins an outcome, he can create a report based on the bet, and other users can agree or disagree with it. Winning bets are paid out after the market is resolved. The gambling platform uses the Ethereum cryptocurrency for trading. Of course, there is the real fear that bets on outcomes such as assassinations could trigger related events in reality. However, these types of wagers have garnered insignificant funding, and offer little incentive for someone to get inspiration from the bets.Legislative Issues That said, the prediction platform does cause another problem. It blurs the difference between online gambling and prediction markets. The former is particularly popular on Augur and based on event predictions, but is prohibited by numerous countries such as China, the United Arab Emirates, Brunei, Japan, Cyprus, and others. The problem lies in the fact that even if Augur is found to have broken the law by facilitating gambling, or other illegal activities, there are few ways to enforce it. There are also fears based on the platform’s highly unregulated nature, given that Forecast Foundation, its developer, has actually distanced itself from ownership of the protocol, which it describes as open-source software. Its developers also highlight that they have no control of the peer to peer platform, and have no access to user private keys or personally identifying information. This includes legal names, national ID numbers, email addresses, and wallet balances. The situation highlights the jurisdictional powerlessness that can be brought on by such a platform in the face of a burgeoning gambling market, catalyzed by popular events like the World Cup. In regard to the United States, the Commodity Futures Trading Commission is investigating whether Augur’s activities fall under its jurisdiction. STAY IN THE KNOW The Crypto Gambling World The crypto gambling world has been growing steadily over the years, as more and more people become acquainted with cryptocurrencies. In 2013, 50 percent of all bitcoin transactions involved gambling, and since 2014 over 3.7 million BTC valued at $26 billion have been used on betting platforms. And during the months of June and July this year, there was a significant uptick in crypto gambling activity. This was especially true in countries where online gambling is illegal, spurred on by the World Cup. However, the trend also revealed the potential for abuse given cryptocurrencies’ and their blockchain technology’s unregulated nature. In China, authorities arrested six suspects suspected of running a World Cup gambling ring based in Guangdong province that had about $1.5 billion in cryptocurrency bets. This is according to a statement released by Chinese authorities. The scheme, based on the dark web, had been accepting Ethereum, Bitcoin, and Litecoin for 8 months before its operators were nabbed. It lured in more than 300,000 players from different countries and had about 8,000 affiliate marketers to support the network. The growth of such an operation is an indicator of just how huge a platform such as Augur can become, based on the marginalized market it targets. In countries such as China, for example, both cryptocurrency trading and gambling are illegal. As such, a decentralized betting platform such as Augur requires a regulator. However, it markets itself as a ‘prediction market’, which is a grey area for many countries where gambling is deemed illegal, and so a few legislative issues related to this are bound to crop up. Moreover, it allows a user to create an event, bet on it, and build a market for it. As such, the user can be a creator, marketer and potential beneficiary as the gambler, all at the same time. This requires a whole new set of complex legislation. In Britain, for example, the U.K. Gambling Commission (UKGC) classifies a peer-to-peer protocol such as Augur as a remote betting intermediary. However, the classification is not comprehensive enough to conclusively categorize it as such. This is considering the evolved nature of user participation, its underpinning technology, and when the regulations were first set, which was in 2013. Crowd Wisdom Potential According to Nolan Bauerle, Director of Research at Coindesk, prediction markets have the potential to tap crowd wisdom in a way few platforms can and have been largely been misunderstood. According to the executive, they would be an invaluable resource if they were allowed to grow to a global scale, and could potentially provide rare insight on industry trends.

1 0

Re: [Cryptography] Krugman blockchain currency skepticism
by grarpamp 08 Aug '18

08 Aug '18

On Mon, Aug 6, 2018 at 4:11 PM, Benjamin Kreuter <brk7bx(a)virginia.edu> wrote: > On Mon, 2018-08-06 at 14:11 +0800, jamesd(a)echeque.com wrote: > As others have asked, what is the problem we want to solve? The > beginning of this thread was a proposal that the problem is that the > government might target an activist group's finances. Now it sounds > like you are talking about the government trying to attack the entire > payment system. That is indeed a valid problem. Among many others in many sectors and applications. >> A crypto currency needs to be centerless - it needs to able to >> survive the seizure of key servers by a hostile powerful party. True, a properly decentralized cryptocurrency has no such seizable / sueable servers. Decentralization is under attack in more ways than most people realize, not just by the purposeful noise deluge of junk / centralized coins, tokens, ico's... but also by very insidious methods. As an example... https://www.youtube.com/watch?v=UYHFrf5ci_g https://www.youtube.com/watch?v=0BZoKH-hX_o https://www.youtube.com/watch?v=tKYEQVPklLI https://www.youtube.com/results?search_query=bitcoin+censorship https://www.reddit.com/r/BitcoinMarkets/comments/6rxw7k/informative_btc_vs_… Whether you're a user, code / crypto developer, business, whatever... you need to understand these things and be able to spot them, call them out, and exchange and adopt away from them once they happen. In the cryptocurrency space, there is no birthright, let alone against treason, or any other lesser offense. A bit more from the series... https://www.youtube.com/watch?v=pOZaLbUUZUs https://www.youtube.com/watch?v=rgts1qb0hLY https://www.youtube.com/watch?v=yGrUOLsC9cw > Get back to me when the Internet itself cannot be shut down by the > government. For so long as free speech, encryption, and overlay networks exist, cryptocurrency and the internet cannot be shutdown. If you accept, either personally or as a populace, the shutting of your connection and or the disablement of your crypto, for mere agnostic tool use, and for no provable reason otherwise, then you're fucked. If the Four Hoursemen of the Infocalypse didn't do it already, then the only thing left is a bonafide threat to the existance of government itself... to its taxes collected by force. Once people worldwide start to figure out they can bypass the redundancy, inefficiency, non choice, war, etc of governments by moving their transactions onto the encrypted blockchain networks... that's the last game... you either sheeple out forever into a questionable existance, or make your stand. Don't be a sheeple.. https://www.youtube.com/results?search_query=banks+fear+bitcoin https://www.youtube.com/results?search_query=governments+fear+bitcoin [bcc cypherpunks]

1 1

Re: [Cryptography] threat models, was Krugman blockchain currency skepticism
by grarpamp 08 Aug '18

08 Aug '18

On Mon, Aug 6, 2018 at 6:05 PM, John Levine <johnl(a)iecc.com> wrote: > In article <CAD2Ti29oru2WUyQ01gr+UL1M-cAAvj0ZuVraPGeULnYz7TqtvQ(a)mail.gmail.com>, > grarpamp <grarpamp(a)gmail.com> wrote: >> Cryptocurrency value moved every month is 30x paypal's and growing. >> Ten more years and those 200 million users will be on cryptocurrency. > > Paypal's current transaction volume is about $40 billion/month, > growing at a modest rate. Can you tell us where you get your number > of $1.2 trillion/month for cryptocurrencies? > https://www.statista.com/statistics/277841/paypals-total-payment-volume/ That should have been ~3x (2.7x) coming from just the BTC value volume moved, and ~385B$/mo for the entire cryptocurrency space, both using today's coinmarketcap rates. Paypal is also doing ~295 tx/s, which might just be eclipsed by even early iterations of below stress work with a single cryptocurrency (even more when summing the current capabilities of top 10 decentralized cryptos for example representing and carrying the market space for tx / tps)... https://stresstestbitcoin.cash/ ~25.6M tx/d will beat Paypal, with perhaps only 33% of that needed to make news waves. Paypal claims ~245M "active" users, or 3.2% of world pop, which smells a little fishy. BTC alone has ~55M utxo's, consolidated down into owned wallets at recent oppurtunity from peak of ~68M, some study estimates try taking that down further to approx body count. Cryptocurrency has no worries there either, and again, starts making waves before then. And Paypal has never made the world's daily syndicated TV and print news like cryptocurrency has. Regardless of which sources you choose, cryptocurrency is close at the heels of Paypal, already biting off chunks in some areas, including philosophical ones. Expect Paypal to be completely eclipsed by cryptocurrency in five years or less. >>> If an issuer doesn't redeem a bill >>> what recourse do you have other than to denounce him? >> Cryptocurrency... you either have the keys and value or you don't. > I don't want a wallet hash That's smart, because whoever told you you could spend such a construct is a fraud. > these were bills redeemable in real assets. > I want my kilo of platinum or whatever. > What's my recourse when the platinum doesn't show up? Precisely, such bills are a risk with variable recourse. "Bills of exchange by different issuers" The blockchain takes care of issues with "issuers" "bills" and reputation, you either have the confirmed spend or you don't, and you're stupid if you walk off before you do. And the market takes care what other "assets" one can get in "exchange" for the UTXO's you're about to spend. You're of course free to make and sign whatever other contracts / bills you want, call them private pegs / tethers if it makes you happy, and accept all their risks. This is basically arguing volatility again, and what cryptocurrency is saying, Neo, is that you won't need to. [1] Those who argue volatility against decentralized cryptocurrency shouldn't do so as what they're saying is they... - really want centralized regulated fiat equivalents - clearly don't get that *of course* by their very nature decentralized cryptocurrencies are *expected* to be "volatile" early on. This is an innate feature, not a bug. But hey while people are on the "volatility" tip, look at all the other *volatile* central regulated fiats out there both new and old... https://wikipedia.org/wiki/List_of_sovereign_states_by_date_of_formation https://wikipedia.org/wiki/List_of_currencies And lots of other reasons you might not want them... https://wikipedia.org/wiki/List_of_former_sovereign_states https://wikipedia.org/wiki/Timeline_of_historical_geopolitical_changes All that pegging, tethering, backing, and government guns people say gives [nonvolatile] value... doesn't seem to be doing a very good job of it. Perhaps it's time the world, and you, tries something truly different, for once, in like thousands of years, of not doing so, lol. It's out there, and could be in your wallet today, and spent in some equitable trade tomorrow. # other > Obviously, you can be cut off by governments, payment processors, > exchanges, [etc list of formal entities] Nowhere in those blurbs was the direct P2P functionality of decentralized cryptocurrencies mentioned... much harder to cut that off without nuking the underlying [sneaker] nets, the difficulty of that mentioned in another thread. > Reputation is entirely based upon non-repudiation, and liability (provably > having sufficient real assets to cover their outstanding balance). > Blockchain currency doesn't have either of those properties. Neither does fiat. Try and invent them on top of them if you want. > Manafort is also learning About decentralized cryptocurrencies, and the gold watch, along with the rest of the world's people. [bcc cypherpunks]

1 1

Re: Improvement on the Jim Bell AP
by weroh＠Safe-mail.net 08 Aug '18

08 Aug '18

I want to add that this improvement works because who put the money isn't probably interested on who should die first, every politics should die, the order isn't really important. Another good thing about this way it is that if some politicians have some money shared on their heads, everyone of them will be incentived to kill himself the others, his colleagues, by hoping to lower the money on his own head. -------- Original Message -------- From: weroh(a)Safe-mail.net Apparently from: cypherpunks-bounces(a)lists.cpunks.org To: cypherpunks(a)lists.cpunks.org Subject: Improvement on the Jim Bell AP Date: Sun, 5 Aug 2018 20:26:32 -0400 > I thought about a way to make an "improvement" on the Jim Bell AP. > > I think that this will make it "cheaper", faster and so more effective. > > It starts from the part that as there could be more assassins competing for the prize. > > Some of them can be uncertain that the prize could be too much low for the risk of killing the politician. > > But at the same time, because of the possible competing killers, everyone of them can even be afraid that another assassin could be brave, skilled or just lucky to being able to kill the politician for a lower prize. > > So this is already a good incentive to push all the killers to try to kill the politician for a lower prize. > > What I thought is a way to make this incentive even more effective. > > > "Shared money" > > Everyone should be able (if they want) to put their money on more politicians "contemporary", even on every politicians on the service or others that they can add later. > > Those shared money should be pubblic visible to everyone, so even killers should be able to see them at any time. > > On the possible interface of the service, it should be possible, by clicking on a politician, to see how much money on him are shared with other politicians. > > So what happen when if one of the politicians that has some shared money on him gets killed? > > Those shared money will obviously get removed by all the prize of all the other selected politicians (chosen before by the users that have put their own money) and will go to the winning killer. > > With this, I think that all killers will then know that while they are thinking about killing "Politician A", if the money on his prize is shared with other 4/5 politicians, they will be now even worried that another killer will terminate one of the other politicians, and so then lowering the prize of their selected politician as a possible target. > > Users will still be happy because another politician has been killed anyway. > > Users will then be able to put even 1$ contemporary on every politician of their country (or the entire world), waiting that the first one of them gets killed. > > Then again, 1$ over all the remaining politicians and so on ... > > > What do you think about this idea/improvement? > > Is it clear enough?

2 1

Democracy Going Sideways in Sweden, AT&T Surveillance FirstNet, Project Veritas
by grarpamp 08 Aug '18

08 Aug '18

https://www.thelocal.se/20180807/support-for-democracy-weak-among-swedens-y… https://old.reddit.com/r/worldnews/comments/95c3tq/support_for_democracy_we… https://theintercept.com/2018/07/23/project-veritas-lawsuit-american-federa… https://theintercept.com/2018/07/29/firstnet-att-surveillance/ "it’s more important that that network shut down every citizen" FirstNet has its own “app store.” These applications will incorporate facial recognition, real-time video For decades, local newsrooms and citizen watchdogs have relied on police scanners to monitor first responders and track natural disasters, protests, and emergencies. The migration to data-based communications cuts down on what is communicated over these public frequencies. As FirstNet and its competitors transition voice communications to their encrypted broadband networks in the coming years, even more will be kept from public oversight. FirstNet is already the subject of a transparency lawsuit by two Vermont men who claim that the U.S. government is legally required to perform a Privacy Impact Assessment on the program, since the FirstNet network will presumably be used to transmit personal information about American citizens. The government has argued that this requirement does not apply since the network itself is owned by AT&T, rather than the government. The program’s status as a public-private partnership has created other transparency roadblocks as well: The federal government’s contract with AT&T has not been made public. FirstNet’s most lasting achievement may be the infrastructure it provides for state-of-the-art surveillance technologies to be deployed by law enforcement at every level.

1 0

Cryptocurrency: Critical Thinking re Decentral vs Rest
by grarpamp 08 Aug '18

08 Aug '18

Ultimate Cheat Sheet for Critical Thinking https://i.redd.it/k5fyetg8ooe11.jpg

1 0

I only ordered a hand rolled maduro
by Steven Schear 07 Aug '18

07 Aug '18

Did I miss the Augur wager? https://www.zerohedge.com/news/2018-08-04/explosions-during-maduro-speech-s…

3 2

Great bet for Forecast Foundation Ethereum/Augur betting system:
by jim bell 07 Aug '18

07 Aug '18

"Will this prediction be false?" Jim Bell

1 0