Quote from: cr1pton00b on January 02, 2018, 05:13:21 PM

Quote from: ex-nihilo on January 02, 2018, 04:47:21 PM

Quote from: cr1pton00b on January 02, 2018, 04:22:56 PM

Quote from: ex-nihilo on January 02, 2018, 12:32:14 PM

Quote from: djpitagora on January 02, 2018, 09:21:00 AM

Quote from: percocet on January 01, 2018, 04:41:58 PM

Quote from: ex-nihilo on January 01, 2018, 03:57:26 PM

Quote from: cr1pton00b on January 01, 2018, 12:37:54 AM

Why RaiBlocks is not secure.

[...]
5. The Man in the Middle attack.

If an attacker succeeds to put himself between a merchant and the RaiBlocks network he can just filter the double spending payment packets, and the merchant will never know that he is receiving a double spending. The Raiblocks network will discard that payment while the merchant will accept it.

https://s18.postimg.org/7pnm6yweh/doublespend.png
[...]

This kind of FUD can be done to every cryptocurrency. So once and for all :
Every cryptocurrency, every online bank is vulnerable to Mitm attacks, if such attack successfully happens.
Example for bitcoin: If a hacker successfully performs a Mitm attack between a buyer and seller, he can just give to the buyer his own bitcoin address instead of the seller's. End of the story. And there are a myriad of more sophisticated attacks depending on whether you have a temporary or persistant Mitm attack.
Fortunately, Mitm attacks (over ssh) are rare, difficult and simply not accessible to the vast majority. They can still happen though and countermeasures (such as ssl pinning) are outside of the scope of crypto currencies underlying technology.
Basically if you are afraid of Mitm attacks, don't open a bank account, don't use any crypto currency, or better, don't use internet (or LANs) and make payments only in cash.

This is 100% correct. It is a common FUD technique to state extreme "edge cases" like they are common occurrences so you have posts like "this coin is not secure - all an attacker has to do is gain control of the majority of the voting delegates". LMFAO

If it is so easy, why hasn't it happened yet? It would be much easier for this kind of attack to occur early on in a coin's life before more nodes come online. Raiblocks has been running for over 2 years straight - why hasn't anyone exploited these "flaws" yet?

Because the time, money and resources required to do so make it impossible.

Imagine you are storing money in one of those Swiss vaults deep inside a mountain. The idiots on this thread trying to scare people with their FUD would make an argument such as:

"Your money is at great risk! All someone has to do is pay off every single guard inside the mountain, circumvent the alarm system and walk straight out the door with your funds". Their arguments are laughable. In fact, they aren't even arguments at all, they are just straight up talking out their asses Grin

Well BTC is not vulnerable to the same attack, because of the blockchain and 6 confirmations. What rail is essentially is BTC without the blockchain. That's where the double spend protection has been lost.

And no, it's not that hard to pull a MITM attack. With some DNS poisoning you could do this to an exchange and to empty their wallet. No wonder good exchanges won't accept railblock. They'd have to be crazy to do so.

You don't understand. You take the "confirmation" angle since XRB and BTC have different approaches on this aspect. But if you successfully performed a Mitm attack, there are a myriad of other ways to exploit [insert your favorite crypto currency or bank] system. A simple example for BTC is : the attacker intercepts deposit BTC addresses and replaces them with his own addresses. Same with any crypto. And every online bank is vulnerable AFTER a successful Mitm attack. That's why they place countermeasures such as SSL pinning, not to be vulnerable to Mitm attacks in the first place. But even then, this is not always enough. For example : https://thehackernews.com/2017/12/mitm-ssl-pinning-hostname.html

As I said earlier, if you successfully performed a Mitm attack, you have already won, no matter the crypto currency or bank.

You cannot replace any address in a BTC tx. BTC tx are signed (every crypto has signed tx) which doesn't permit tx forging. BTC is currently not vulnerable to MITM.

You intercept the bitcoin address before any transaction has been made. The victim sends his funds to the attacker address and a correct tx is done.

Yes with the exception that every website uses SSL and you cannot break it.

1) you can break it, but you need additional side attacks. SSL alone, in a perfect world on a non compromised computer and correct settings, can't be broken. But we don't live in a perfect world and the local truststore of the victim for example can be compromised.
2) You can transmit a btc address via a non encrypted network (for example via some chat apps that don't support end-to-end encryption like google allo).

BUT OK, let's theorise that all communications on all networks are secured by SSL and we live in a perfect world so no Mitm attacks over SSL are possible. Then the sentence "If an attacker succeeds to put himself between a merchant and the RaiBlocks network he can ..." has no chance to happen, because a Mitm is not possible in the first place.

On the other hand, if you successfully performed a Mitm attack, then BTC, XRB or any crypto currency is defenseless.