[Boards: 3 / a / aco / adv / an / asp / b / bant / biz / c / can / cgl / ck / cm / co / cock / d / diy / e / fa / fap / fit / fitlit / g / gd / gif / h / hc / his / hm / hr / i / ic / int / jp / k / lgbt / lit / m / mlp / mlpol / mo / mtv / mu / n / news / o / out / outsoc / p / po / pol / qa / qst / r / r9k / s / s4s / sci / soc / sp / spa / t / tg / toy / trash / trv / tv / u / v / vg / vint / vip / vp / vr / w / wg / wsg / wsr / x / y ] [Search | Free Show | Home]

>Explaining the ETH wallet collision The nodejs implemen

This is a blue board which means that it's for everybody (Safe For Work content only). If you see any adult content, please report it.

Thread replies: 37
Thread images: 10

File: 2017-05-31-17:25:16-1af.png (53KB, 928x473px) Image search: [Google]
2017-05-31-17:25:16-1af.png
53KB, 928x473px
>Explaining the ETH wallet collision

The nodejs implementation of the wallet generator uses userspace tools to generate entropy instead of getting access to real hardware entropy via the kernel. In this case, NodeJS GetRandomBytes (which is used to generate the ETH wallet) uses OpenSSL to generate entropy on the system.

This is a problem and has caused collisions in crypto before.

https://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/

What needs to happen is for NodeJS to actually use a good RNG algo to make its wallets.

On top of this, the wallet address length is limited to only 155 bits in order to fit IBAN.

The moral of the story is that the wallet collision seen today has NOTHING to do with ethereum, it's simply the result of a shitty third party tool. NodeJS already has a pretty bad reputation, this will only hurt them more.
>>
Fucking lazy/stupid programming man. This is literally idiocy.
>>
>>2244877
It WILL hurt Ethereum too
>>
>>2244877
how can I use this to steal peoples eth?
>>
>>2244954
have a loop generating addresses then checking if they exist, if so alert notify you then you can go in and steal the eth
>>
>>2244954
I would use ethereumjs-wallet to generate wallets on a popular vanilla linux installation of something immutable like Tails linux

The odds are still low since the RNG uses a variety of userspace values but it could happen

The fact that it happened to an extremely well-known dev indicates to me that this was done purposefullly and likely for quite some time
>>
File: Pirate flag Preview .jpg (73KB, 590x332px) Image search: [Google]
Pirate flag Preview .jpg
73KB, 590x332px
>>2244954
this.

It's open season for Ethereum Wallets! ARGH!
>>
File: 170310TerryADavis.jpg (234KB, 1440x1440px) Image search: [Google]
170310TerryADavis.jpg
234KB, 1440x1440px
>>2244877
he tried to warn you and you didn't listen. you only should trust the whitest of the whitest scientists of NIST for your randomness need

>inb4 massachusetts lottery site
>>
>>2244877

More info:

Weaning nodejs off of openssl (never happened):
https://github.com/nodejs/node/issues/5798

OpenSSL realizes userspace /dev/urandom is flawed (not fixed):
https://github.com/openssl/openssl/issues/898

And that's how you get wallet collisions!
>>
>>2244877
So basically it's not a problem with ETH, but a problem with a particular method of generating wallets?

The method of generating wallets is not sufficiently random (due to NodeJS GetRandomBytes), so if conditions are similar, the same wallet will be generated again?
>>
>>2245114
Now the question is how many people actually use Node.js-based wallets
>>
https://github.com/ethereum/go-ethereum/releases/tag/v1.6.2

A FUCKING NONCE
>>
>>2245132
Which wallets are based on nodes?
>>
>>2245146
That's what I'm trying to figure out
>>
>>2245161
>im @ work
pls dont hack my eth
>>
>>2245114
yes, exactly
>>
>>2245000
It takes 3 months to get one wallet code, at that was by luck

U r by far the worst crypto pirate ive ever heard of
>>
>>2245274

but you have heard of him
>>
>>2245013
Did he actually talk about this? I know Templeos has its own RNG / oracle program.
>>
>>2245334
Upvoted
>>
>>2245146

>mfw all ETH wallets are based on node.js

LMFAO, ETH IS FUCKING FINISHED.
>>
>>2245424
gg ETH, bitbean anyone?
>>
You can't do shit and don't even understand the tech.
>>
>>2245477
huh?
>>
Selling my stash and shorting here
>>
File: 1489335397692.jpg (74KB, 800x792px) Image search: [Google]
1489335397692.jpg
74KB, 800x792px
FUD you are all faggots
>>
File: 2017-05-03_09-59-53.png (342KB, 693x406px) Image search: [Google]
2017-05-03_09-59-53.png
342KB, 693x406px
>>2245146
>tfw myetherWallet is running on parity who use node.js
>>
File: prayforusall.png (20KB, 497x369px) Image search: [Google]
prayforusall.png
20KB, 497x369px
Well, eth is sure getting ready to do...something...
>>
File: cantkeepgettingaway.gif (3MB, 480x266px) Image search: [Google]
cantkeepgettingaway.gif
3MB, 480x266px
seems like a good place to drop this.

Last summer after the DAO hack everyone in the tech community thought ethereum was basically dead and a shitty technology.

Did anything change? Just a few exchanges adopted eth and normies started buying shit they don't understand? I'm so confused by this. The entire project and having turing complete smart contracts is a joke. I especially hate when fags say "it's more complex than bitcoin!!!" like that is a good thing. You know nothing about software. This is a horrible thing. Single purpose modules are the key to software. Ethereum seems like a half baked ambitious idea and then they put a blockchain onto it because cryptos were popular and an easy way to raise funds for the project. The entire thing is basically a scam. In a few months they'll launch a crippled poker app (online poker has been around since the late 90s) and claim it a triumph and technological marvel. Fuck this scamcoin and all you pumpfags buying shit you don't understand.
>>
>>2245542
...so all those companies who got on board with the EEA are all getting scammed too?! Really activated my almonds...
>>
so where can i find this github?
>>
>>2245542
>i-it's just a scam guys!

t. someone that didn't get to buy in when ETH was $40
>>
>>2245515
>mfw you're right
>myEthWallet coincidentially had 1.2 ETH out of exchange wallets and different cryptos
>>
File: 1469238023263.jpg (10KB, 234x250px) Image search: [Google]
1469238023263.jpg
10KB, 234x250px
>>2244877
Node is a great thing, so much possibility and flexibility. It just has the whole JavaScript problem, allowing people to do dumb shit. I hate JavaScript, but I love the flexibility of node.

Shame that this problem wasn't caught sooner.
>>
File: stoptheethfud.png (335KB, 1920x1080px) Image search: [Google]
stoptheethfud.png
335KB, 1920x1080px
Please stop falling for the fud guys. I know what he is saying may seem scary, but the randomness that is being used is cryptographically strong. This means that there are no patterns in it that we could use to narrow the key space. OpenSSL's randomness has been audited by both humans and by programs (which test the data to measure how "random" it is).
>>
in b4 ethereum's 2nd colossal failure

how many of you even know about the DAO? and then they forked it undermining the fundamental tenets of crypto.

lmfao yall niggas just punting off stacks into shitcoins without having a clue
>>
File: 1495387609293.png (142KB, 1024x1024px) Image search: [Google]
1495387609293.png
142KB, 1024x1024px
>>2245542
I laugh with the force of a thousand keks at the sight of these butthurt, moronic fucking idiots posting the most obvious FUD in the history of crypto.

Your day of the rope is coming. Until then, keep making me cry laughing
Thread posts: 37
Thread images: 10


[Boards: 3 / a / aco / adv / an / asp / b / bant / biz / c / can / cgl / ck / cm / co / cock / d / diy / e / fa / fap / fit / fitlit / g / gd / gif / h / hc / his / hm / hr / i / ic / int / jp / k / lgbt / lit / m / mlp / mlpol / mo / mtv / mu / n / news / o / out / outsoc / p / po / pol / qa / qst / r / r9k / s / s4s / sci / soc / sp / spa / t / tg / toy / trash / trv / tv / u / v / vg / vint / vip / vp / vr / w / wg / wsg / wsr / x / y] [Search | Top | Home]

I'm aware that Imgur.com will stop allowing adult images since 15th of May. I'm taking actions to backup as much data as possible.
Read more on this topic here - https://archived.moe/talk/thread/1694/


If you need a post removed click on it's [Report] button and follow the instruction.
DMCA Content Takedown via dmca.com
All images are hosted on imgur.com.
If you like this website please support us by donating with Bitcoins at 16mKtbZiwW52BLkibtCr8jUg2KVUMTxVQ5
All trademarks and copyrights on this page are owned by their respective parties.
Images uploaded are the responsibility of the Poster. Comments are owned by the Poster.
This is a 4chan archive - all of the content originated from that site.
This means that RandomArchive shows their content, archived.
If you need information for a Poster - contact them.