📅 Original date posted:2013-08-16
📝 Original message:bitcoinj-0.10 release notes:
- We now require Bloom-capable (0.8+) peers by default and will
disconnect from older nodes. This avoids accidental bandwidth saturation on
mobile devices.
Given the user-security concern that Peter brings up, reconsideration of
this new default behavior in SPV clients may be warranted.
On Fri, Aug 16, 2013 at 4:15 AM, Peter Todd <pete at petertodd.org> wrote:
> On Fri, Aug 16, 2013 at 10:01:16AM -0400, Peter Todd wrote:
> > Doing this also makes it more difficult to sybil the network - for
> > instance right now you can create "SPV honeypots" that allow incoming
> > connections only from SPV nodes, thus attracting a disproportionate % of
> > the total SPV population given a relatively small number of nodes. You
> > can then use that to harm SPV nodes by, for instance, making a % of
> > transactions be dropped deterministicly, either by the bloom matching
> > code, or when sent. Users unlucky enough to be surrounded by sybil nodes
> > will have their transactions mysteriously fail to arrive in their
> > wallets, or have their transactions mysteriously never confirm. Given
> > how few full nodes there are, it probably won't take very many honeypots
> > to pull off this attack, especially if you combine it with a
> > simultaneous max connections or bloom io attack to degrade the capacity
> > of honest nodes.
>
> Oh, here's an even better way to do the "tx drop" attack: when you drop
> a transaction, make a fake one that pays the same scriptPubKeys with the
> same amount, and send it to the SPV peer instead. They'll see the
> transaction go through and show up in their wallet, but it'll look like
> it got stuck and never confirmed. They'll soon wind up with a wallet
> full of useless transactions, effectively locking them out of their
> money.
>
> Here's another question for you Mike: So does bitcoinj have any
> protections against peers flooding you with useless garbage? It'd be
> easy to rack up a user's data bill for instance by just creating junk
> unconfirmed transactions matching the bloom filter.
>
> --
> 'peter'[:-1]@petertodd.org
> 0000000000000018dcf5bcc3f018a05517ba1c479b432ba422015d4506496e55
>
>
> ------------------------------------------------------------------------------
> Get 100% visibility into Java/.NET code with AppDynamics Lite!
> It's a free troubleshooting tool designed for production.
> Get down to code-level detail for bottlenecks, with <2% overhead.
> Download for free and get started troubleshooting in minutes.
> http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20130816/6948a457/attachment.html>;
Warren Togami Jr. [ARCHIVE] /
npub1s5…zxem8
2023-06-07 15:06:03
in reply to nevent1q…z2ay
Author Public Key
npub1s5p2xnl52ksr3a4qfa8re5znmja46ugm3x3ayy0x2c2mqrsw6ewsmzxem8Published at
2023-06-07 15:06:03Event JSON
{
"id": "0cdfb11eae57fbbc17e6a9c6c7f67bd2797f3303339a68ee32699ccc1b74bfea",
"pubkey": "8502a34ff455a038f6a04f4e3cd053dcbb5d711b89a3d211e65615b00e0ed65d",
"created_at": 1686150363,
"kind": 1,
"tags": [
[
"e",
"5a9ab6946b435e1e53322190b144cf294684f6977db12281caf5c76891efbbe7",
"",
"root"
],
[
"e",
"3b3ebe3c106cc7a8c6968d8834159027571ee68bc6858fdbd5fe40f647348090",
"",
"reply"
],
[
"p",
"daa2fc676a25e3b5b45644540bcbd1e1168b111427cd0e3cf19c56194fb231aa"
]
],
"content": "📅 Original date posted:2013-08-16\n📝 Original message:bitcoinj-0.10 release notes:\n\n - We now require Bloom-capable (0.8+) peers by default and will\n disconnect from older nodes. This avoids accidental bandwidth saturation on\n mobile devices.\n\nGiven the user-security concern that Peter brings up, reconsideration of\nthis new default behavior in SPV clients may be warranted.\n\n\n\nOn Fri, Aug 16, 2013 at 4:15 AM, Peter Todd \u003cpete at petertodd.org\u003e wrote:\n\n\u003e On Fri, Aug 16, 2013 at 10:01:16AM -0400, Peter Todd wrote:\n\u003e \u003e Doing this also makes it more difficult to sybil the network - for\n\u003e \u003e instance right now you can create \"SPV honeypots\" that allow incoming\n\u003e \u003e connections only from SPV nodes, thus attracting a disproportionate % of\n\u003e \u003e the total SPV population given a relatively small number of nodes. You\n\u003e \u003e can then use that to harm SPV nodes by, for instance, making a % of\n\u003e \u003e transactions be dropped deterministicly, either by the bloom matching\n\u003e \u003e code, or when sent. Users unlucky enough to be surrounded by sybil nodes\n\u003e \u003e will have their transactions mysteriously fail to arrive in their\n\u003e \u003e wallets, or have their transactions mysteriously never confirm. Given\n\u003e \u003e how few full nodes there are, it probably won't take very many honeypots\n\u003e \u003e to pull off this attack, especially if you combine it with a\n\u003e \u003e simultaneous max connections or bloom io attack to degrade the capacity\n\u003e \u003e of honest nodes.\n\u003e\n\u003e Oh, here's an even better way to do the \"tx drop\" attack: when you drop\n\u003e a transaction, make a fake one that pays the same scriptPubKeys with the\n\u003e same amount, and send it to the SPV peer instead. They'll see the\n\u003e transaction go through and show up in their wallet, but it'll look like\n\u003e it got stuck and never confirmed. They'll soon wind up with a wallet\n\u003e full of useless transactions, effectively locking them out of their\n\u003e money.\n\u003e\n\u003e Here's another question for you Mike: So does bitcoinj have any\n\u003e protections against peers flooding you with useless garbage? It'd be\n\u003e easy to rack up a user's data bill for instance by just creating junk\n\u003e unconfirmed transactions matching the bloom filter.\n\u003e\n\u003e --\n\u003e 'peter'[:-1]@petertodd.org\n\u003e 0000000000000018dcf5bcc3f018a05517ba1c479b432ba422015d4506496e55\n\u003e\n\u003e\n\u003e ------------------------------------------------------------------------------\n\u003e Get 100% visibility into Java/.NET code with AppDynamics Lite!\n\u003e It's a free troubleshooting tool designed for production.\n\u003e Get down to code-level detail for bottlenecks, with \u003c2% overhead.\n\u003e Download for free and get started troubleshooting in minutes.\n\u003e http://pubads.g.doubleclick.net/gampad/clk?id=48897031\u0026iu=/4140/ostg.clktrk\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20130816/6948a457/attachment.html\u003e",
"sig": "7f68643a94f629adb95c79bf3f0752a9b526e2a90400518f468a0b84d35d3f8437d95859df448cf0710ec056e47991a79f07aa9811a51ce881524674ed30af77"
}