Search content
Sort by
Showing 12 of 12 results by cr1pton00b
Re: [ANN][XRB]Cryptocurrency's killer app: RaiBlocks micropayments
To update you:
Me and Lukealonso found a fix to strongly mitigate the MITM attack (luckily with no hard-fork) and we are publishing it to the repo today. I will keep an eye on other vulnerabilities both in the protocol and the code.
Me and Lukealonso found a fix to strongly mitigate the MITM attack (luckily with no hard-fork) and we are publishing it to the repo today. I will keep an eye on other vulnerabilities both in the protocol and the code.
Re: [ANN][XRB]Cryptocurrency's killer app: RaiBlocks micropayments
Why RaiBlocks is not secure.
[...]
5. The Man in the Middle attack.
If an attacker succeeds to put himself between a merchant and the RaiBlocks network he can just filter the double spending payment packets, and the merchant will never know that he is receiving a double spending. The Raiblocks network will discard that payment while the merchant will accept it.
https://s18.postimg.org/7pnm6yweh/doublespend.png
[...]
[...]
5. The Man in the Middle attack.
If an attacker succeeds to put himself between a merchant and the RaiBlocks network he can just filter the double spending payment packets, and the merchant will never know that he is receiving a double spending. The Raiblocks network will discard that payment while the merchant will accept it.
https://s18.postimg.org/7pnm6yweh/doublespend.png
[...]
This kind of FUD can be done to every cryptocurrency. So once and for all :
Every cryptocurrency, every online bank is vulnerable to Mitm attacks, if such attack successfully happens.
Example for bitcoin: If a hacker successfully performs a Mitm attack between a buyer and seller, he can just give to the buyer his own bitcoin address instead of the seller's. End of the story. And there are a myriad of more sophisticated attacks depending on whether you have a temporary or persistant Mitm attack.
Fortunately, Mitm attacks (over ssh) are rare, difficult and simply not accessible to the vast majority. They can still happen though and countermeasures (such as ssl pinning) are outside of the scope of crypto currencies underlying technology.
Basically if you are afraid of Mitm attacks, don't open a bank account, don't use any crypto currency, or better, don't use internet (or LANs) and make payments only in cash.
This is 100% correct. It is a common FUD technique to state extreme "edge cases" like they are common occurrences so you have posts like "this coin is not secure - all an attacker has to do is gain control of the majority of the voting delegates". LMFAO
If it is so easy, why hasn't it happened yet? It would be much easier for this kind of attack to occur early on in a coin's life before more nodes come online. Raiblocks has been running for over 2 years straight - why hasn't anyone exploited these "flaws" yet?
Because the time, money and resources required to do so make it impossible.
Imagine you are storing money in one of those Swiss vaults deep inside a mountain. The idiots on this thread trying to scare people with their FUD would make an argument such as:
"Your money is at great risk! All someone has to do is pay off every single guard inside the mountain, circumvent the alarm system and walk straight out the door with your funds". Their arguments are laughable. In fact, they aren't even arguments at all, they are just straight up talking out their asses
Well BTC is not vulnerable to the same attack, because of the blockchain and 6 confirmations. What rail is essentially is BTC without the blockchain. That's where the double spend protection has been lost.
And no, it's not that hard to pull a MITM attack. With some DNS poisoning you could do this to an exchange and to empty their wallet. No wonder good exchanges won't accept railblock. They'd have to be crazy to do so.
You don't understand. You take the "confirmation" angle since XRB and BTC have different approaches on this aspect. But if you successfully performed a Mitm attack, there are a myriad of other ways to exploit [insert your favorite crypto currency or bank] system. A simple example for BTC is : the attacker intercepts deposit BTC addresses and replaces them with his own addresses. Same with any crypto. And every online bank is vulnerable AFTER a successful Mitm attack. That's why they place countermeasures such as SSL pinning, not to be vulnerable to Mitm attacks in the first place. But even then, this is not always enough. For example : https://thehackernews.com/2017/12/mitm-ssl-pinning-hostname.html
As I said earlier, if you successfully performed a Mitm attack, you have already won, no matter the crypto currency or bank.
You cannot replace any address in a BTC tx. BTC tx are signed (every crypto has signed tx) which doesn't permit tx forging. BTC is currently not vulnerable to MITM.
You intercept the bitcoin address before any transaction has been made. The victim sends his funds to the attacker address and a correct tx is done.
Yes with the exception that every website uses SSL and you cannot break it.
Re: [ANN][XRB]Cryptocurrency's killer app: RaiBlocks micropayments
Why RaiBlocks is not secure.
[...]
5. The Man in the Middle attack.
If an attacker succeeds to put himself between a merchant and the RaiBlocks network he can just filter the double spending payment packets, and the merchant will never know that he is receiving a double spending. The Raiblocks network will discard that payment while the merchant will accept it.
https://s18.postimg.org/7pnm6yweh/doublespend.png
[...]
[...]
5. The Man in the Middle attack.
If an attacker succeeds to put himself between a merchant and the RaiBlocks network he can just filter the double spending payment packets, and the merchant will never know that he is receiving a double spending. The Raiblocks network will discard that payment while the merchant will accept it.
https://s18.postimg.org/7pnm6yweh/doublespend.png
[...]
This kind of FUD can be done to every cryptocurrency. So once and for all :
Every cryptocurrency, every online bank is vulnerable to Mitm attacks, if such attack successfully happens.
Example for bitcoin: If a hacker successfully performs a Mitm attack between a buyer and seller, he can just give to the buyer his own bitcoin address instead of the seller's. End of the story. And there are a myriad of more sophisticated attacks depending on whether you have a temporary or persistant Mitm attack.
Fortunately, Mitm attacks (over ssh) are rare, difficult and simply not accessible to the vast majority. They can still happen though and countermeasures (such as ssl pinning) are outside of the scope of crypto currencies underlying technology.
Basically if you are afraid of Mitm attacks, don't open a bank account, don't use any crypto currency, or better, don't use internet (or LANs) and make payments only in cash.
This is 100% correct. It is a common FUD technique to state extreme "edge cases" like they are common occurrences so you have posts like "this coin is not secure - all an attacker has to do is gain control of the majority of the voting delegates". LMFAO
If it is so easy, why hasn't it happened yet? It would be much easier for this kind of attack to occur early on in a coin's life before more nodes come online. Raiblocks has been running for over 2 years straight - why hasn't anyone exploited these "flaws" yet?
Because the time, money and resources required to do so make it impossible.
Imagine you are storing money in one of those Swiss vaults deep inside a mountain. The idiots on this thread trying to scare people with their FUD would make an argument such as:
"Your money is at great risk! All someone has to do is pay off every single guard inside the mountain, circumvent the alarm system and walk straight out the door with your funds". Their arguments are laughable. In fact, they aren't even arguments at all, they are just straight up talking out their asses
Well BTC is not vulnerable to the same attack, because of the blockchain and 6 confirmations. What rail is essentially is BTC without the blockchain. That's where the double spend protection has been lost.
And no, it's not that hard to pull a MITM attack. With some DNS poisoning you could do this to an exchange and to empty their wallet. No wonder good exchanges won't accept railblock. They'd have to be crazy to do so.
You don't understand. You take the "confirmation" angle since XRB and BTC have different approaches on this aspect. But if you successfully performed a Mitm attack, there are a myriad of other ways to exploit [insert your favorite crypto currency or bank] system. A simple example for BTC is : the attacker intercepts deposit BTC addresses and replaces them with his own addresses. Same with any crypto. And every online bank is vulnerable AFTER a successful Mitm attack. That's why they place countermeasures such as SSL pinning, not to be vulnerable to Mitm attacks in the first place. But even then, this is not always enough. For example : https://thehackernews.com/2017/12/mitm-ssl-pinning-hostname.html
As I said earlier, if you successfully performed a Mitm attack, you have already won, no matter the crypto currency or bank.
You cannot replace any address in a BTC tx. BTC tx are signed (every crypto has signed tx) which doesn't permit tx forging. BTC is currently not vulnerable to MITM.
Re: [ANN][XRB]Cryptocurrency's killer app: RaiBlocks micropayments
- https://raiblocks.net/page/representatives.php (the Official Representatives control 56% of the representation of all RaiBlocks)
Encourage users to make your account representative. Sometimes one pool had more than 50% of hashrate in Bitcoin network = Bitcoin is centralizedPlease read the whole post to understand the flaw
Quote
Why RaiBlocks is not secure.
In this article I will try to explain why RaiBlocks is not secure and why its technology is any better neither comparable than the Bitcoin technology.
1. Decentralized payments
Decentralized payment networks are, in opposite of centralized payment network like banks, a way to secure your money without having the risk that a central authority could steal your money or manipulate the money in the market. Decentralized payment networks use asymmetric cryptography to ensure that you are the only one who can spend your money.
When you create a cryptocurrency wallet you are given a public key and a private key. The public key allows other people to send you money, while the private key allows you to spend them.
But how other users know how many money do you have?
To accomplish this, every user of a decentralized payment network must download the entire transaction database which is replicated on the entire network. When you send a payment over the network, it is received by all the users connected on the network allowing them to know your updated wallet balance and allowing them to discard that payment if you dont own enough funds.
2. Double Spending
The main problem that afflicts decentralized payment networks is double spending: the ability of an user to spend his money multiple times. In the real world, when you pay someone you give him the real cash. In a centralized payment network, like VISA, the central database is updated every time you make a payment, and they will not allow you to spend more money than your balance.
In a decentralized payment network what happens if you send the same amount of money on two users of the network in the same time? Since their database takes time to update for a small amount of time they both will receive the payment and accept it. In a later moment, when the network tells them that you double spent your money, they will cancel the payment, this is possible because every payment is broadcasted to the entire network, not only the receiver.
Without any other security layer, if a malicious user double spends his money and succeeds to block a payment receiver to know that he sent the same money to someone else (or even better, to another wallet of his own), the payment receiver will accept the payment and ship the good. This is so bad, since even a network connection problem could temporarily lead a payment receiver to undetect double spendings.
3. The Bitcoin Solution
To solve this problem, Bitcoin relays on the fact that after you receive a payment you need to wait a confirmation block, the confirmation block tells you that the payment you have received has been accepted by the entire network and you are allowed to spend it. To create a confirmation block, the miners create a list of all the pending unconfirmed transactions and solve a very difficult mathematical puzzle. The miner who solves the puzzle first, sends the block he found with all the list of confirmed transaction and the solved puzzle to the network, the users of the network will check if the puzzle solution is valid and then reward him with some free coins plus the sum of all the payment fees of each transaction in the block. The miners must create a valid list of payments to be accepted by the network, so double spend attempts are just discarded.
In Bitcoin an attacker, to make a succesful double spending, should not just stop you from receiving a double spend attempt message, but he should also solve the puzzle to create a confirmation block in a reasonable time frame. Currently solving that puzzle with a single computer would take years; at writing time to solve that puzzle a network of thousands dedicated hardware is used, an attacker would require a billionaire investment to replicate that network. Moreover, it would not only need to create one confirmation block but six of them (6 confirmation blocks are required in the Bitcoin network to trust a payment).
Critics of Bitcoin say that all the computation power used to make the Bitcoin network secure is just a waste of energy because there are other reliable and better technologies. Is that true?
4. What is RaiBlocks?
RaiBlocks is a crypto currency that advertises itself as a fast, fee-less and secure currency, unlikely Bitcoin which is currently slow and high-fee (usually requires 1 hour to a full payment confirmation).
But the key point is that Bitcoin has been made that way to guarantee his users a certain amount of security to prevent double spendings.
RaiBlocks completely ignores the Bitcoin technology and relies on a special version of the Proof Of Stake concept.
When you receive a payment in the RaiBlocks network you have to wait a certain amount of time to be sure that a double spending has not been attempted (and remember the first problem, if an attacker stops you from receiving the double spend you would never know!)
When a double spent is detected, the RaiBlocks network starts a vote. Every peer connected to the network vote to accept the payment A or payment B; every user vote is weighted with the amount of his balance. Usually each peer votes for the first transaction he receives. The transaction which the sum of votes reaches the 51% of online amount of currency wins. The winning transaction is accepted by the network and the other one is discarded. (Reference https://github.com/clemahieu/RaiBlocks/wiki/Double-spending-and-confirmation)
The payment receiver, if his network has not been compromised, will then know if he can trust the payment or not, and will ship the good accordingly. This system leads to an unsolvable problem.
5. The Man in the Middle attack.
If an attacker succeeds to put himself between a merchant and the RaiBlocks network he can just filter the double spending payment packets, and the merchant will never know that he is receiving a double spending. The Raiblocks network will discard that payment while the merchant will accept it.
https://s18.postimg.org/7pnm6yweh/doublespend.png
6. Solutions proposed by the RaiBlocks team
a) The merchant should ask a vote for each payment he receives and wait for the confirmation.
The problem is that the attacker could manipulate the vote by telling the merchant that only his peers are connected to the network thus he will win the vote by filtering only his votes. Plus, asking a vote for each payment would cause a huge increment of bandwidth usage that many peers could not handle.
b) The merchant should have a remote node verifying the payment.
The attacker could just attack that network too.
c) The merchant should ask the RaiBlocks.net website if the payment has been accepted.
The attacker can hack the RaiBlocks.net website. Also if you have to rely on a website you can no longer consider RaiBlocks a decentralized network.
Other solutions
1) A payment to be accepted should require a vote with a minimum weight quorum.
It's difficult to establish a correct quorum, and if that quorum is offline no payments will be processed.
2) A payment need to be accepted by some trusted representatives.
This will stop the network on being decentralized. Also, if those representatives are offline the payments are not processed.
7. Why Bitcoin is not vulnerable to this type of attack
Simply because an attacker, to be trusted by a merchant, would require to solve a very difficult puzzle for six times. An attacker cannot alter the difficulty of that puzzle.
8. Other observations
a) RaiBlocks is just Bitcoins without the Bitcoin securing algorithm. The creator of Bitcoin, Satoshi Nakamoto, describes the double spending problem in the original Bitcoin paper: https://Bitcoin.org/Bitcoin.pdf. The developer of RaiBlocks just thinks to solve the problem by ignoring the problem.
b) The official representatives of the RaiBlocks network own more than 52% of total voting weight, allowing the developer to manipulate every vote on his will.
Source: https://dev.RaiBlocks.net/page/representatives.php
9. References
https://RaiBlocks.net/media/RaiBlocks_Whitepaper__English.pdf
https://github.com/clemahieu/RaiBlocks/wiki/Double-spending-and-confirmation
In this article I will try to explain why RaiBlocks is not secure and why its technology is any better neither comparable than the Bitcoin technology.
1. Decentralized payments
Decentralized payment networks are, in opposite of centralized payment network like banks, a way to secure your money without having the risk that a central authority could steal your money or manipulate the money in the market. Decentralized payment networks use asymmetric cryptography to ensure that you are the only one who can spend your money.
When you create a cryptocurrency wallet you are given a public key and a private key. The public key allows other people to send you money, while the private key allows you to spend them.
But how other users know how many money do you have?
To accomplish this, every user of a decentralized payment network must download the entire transaction database which is replicated on the entire network. When you send a payment over the network, it is received by all the users connected on the network allowing them to know your updated wallet balance and allowing them to discard that payment if you dont own enough funds.
2. Double Spending
The main problem that afflicts decentralized payment networks is double spending: the ability of an user to spend his money multiple times. In the real world, when you pay someone you give him the real cash. In a centralized payment network, like VISA, the central database is updated every time you make a payment, and they will not allow you to spend more money than your balance.
In a decentralized payment network what happens if you send the same amount of money on two users of the network in the same time? Since their database takes time to update for a small amount of time they both will receive the payment and accept it. In a later moment, when the network tells them that you double spent your money, they will cancel the payment, this is possible because every payment is broadcasted to the entire network, not only the receiver.
Without any other security layer, if a malicious user double spends his money and succeeds to block a payment receiver to know that he sent the same money to someone else (or even better, to another wallet of his own), the payment receiver will accept the payment and ship the good. This is so bad, since even a network connection problem could temporarily lead a payment receiver to undetect double spendings.
3. The Bitcoin Solution
To solve this problem, Bitcoin relays on the fact that after you receive a payment you need to wait a confirmation block, the confirmation block tells you that the payment you have received has been accepted by the entire network and you are allowed to spend it. To create a confirmation block, the miners create a list of all the pending unconfirmed transactions and solve a very difficult mathematical puzzle. The miner who solves the puzzle first, sends the block he found with all the list of confirmed transaction and the solved puzzle to the network, the users of the network will check if the puzzle solution is valid and then reward him with some free coins plus the sum of all the payment fees of each transaction in the block. The miners must create a valid list of payments to be accepted by the network, so double spend attempts are just discarded.
In Bitcoin an attacker, to make a succesful double spending, should not just stop you from receiving a double spend attempt message, but he should also solve the puzzle to create a confirmation block in a reasonable time frame. Currently solving that puzzle with a single computer would take years; at writing time to solve that puzzle a network of thousands dedicated hardware is used, an attacker would require a billionaire investment to replicate that network. Moreover, it would not only need to create one confirmation block but six of them (6 confirmation blocks are required in the Bitcoin network to trust a payment).
Critics of Bitcoin say that all the computation power used to make the Bitcoin network secure is just a waste of energy because there are other reliable and better technologies. Is that true?
4. What is RaiBlocks?
RaiBlocks is a crypto currency that advertises itself as a fast, fee-less and secure currency, unlikely Bitcoin which is currently slow and high-fee (usually requires 1 hour to a full payment confirmation).
But the key point is that Bitcoin has been made that way to guarantee his users a certain amount of security to prevent double spendings.
RaiBlocks completely ignores the Bitcoin technology and relies on a special version of the Proof Of Stake concept.
When you receive a payment in the RaiBlocks network you have to wait a certain amount of time to be sure that a double spending has not been attempted (and remember the first problem, if an attacker stops you from receiving the double spend you would never know!)
When a double spent is detected, the RaiBlocks network starts a vote. Every peer connected to the network vote to accept the payment A or payment B; every user vote is weighted with the amount of his balance. Usually each peer votes for the first transaction he receives. The transaction which the sum of votes reaches the 51% of online amount of currency wins. The winning transaction is accepted by the network and the other one is discarded. (Reference https://github.com/clemahieu/RaiBlocks/wiki/Double-spending-and-confirmation)
The payment receiver, if his network has not been compromised, will then know if he can trust the payment or not, and will ship the good accordingly. This system leads to an unsolvable problem.
5. The Man in the Middle attack.
If an attacker succeeds to put himself between a merchant and the RaiBlocks network he can just filter the double spending payment packets, and the merchant will never know that he is receiving a double spending. The Raiblocks network will discard that payment while the merchant will accept it.
https://s18.postimg.org/7pnm6yweh/doublespend.png
6. Solutions proposed by the RaiBlocks team
a) The merchant should ask a vote for each payment he receives and wait for the confirmation.
The problem is that the attacker could manipulate the vote by telling the merchant that only his peers are connected to the network thus he will win the vote by filtering only his votes. Plus, asking a vote for each payment would cause a huge increment of bandwidth usage that many peers could not handle.
b) The merchant should have a remote node verifying the payment.
The attacker could just attack that network too.
c) The merchant should ask the RaiBlocks.net website if the payment has been accepted.
The attacker can hack the RaiBlocks.net website. Also if you have to rely on a website you can no longer consider RaiBlocks a decentralized network.
Other solutions
1) A payment to be accepted should require a vote with a minimum weight quorum.
It's difficult to establish a correct quorum, and if that quorum is offline no payments will be processed.
2) A payment need to be accepted by some trusted representatives.
This will stop the network on being decentralized. Also, if those representatives are offline the payments are not processed.
7. Why Bitcoin is not vulnerable to this type of attack
Simply because an attacker, to be trusted by a merchant, would require to solve a very difficult puzzle for six times. An attacker cannot alter the difficulty of that puzzle.
8. Other observations
a) RaiBlocks is just Bitcoins without the Bitcoin securing algorithm. The creator of Bitcoin, Satoshi Nakamoto, describes the double spending problem in the original Bitcoin paper: https://Bitcoin.org/Bitcoin.pdf. The developer of RaiBlocks just thinks to solve the problem by ignoring the problem.
b) The official representatives of the RaiBlocks network own more than 52% of total voting weight, allowing the developer to manipulate every vote on his will.
Source: https://dev.RaiBlocks.net/page/representatives.php
9. References
https://RaiBlocks.net/media/RaiBlocks_Whitepaper__English.pdf
https://github.com/clemahieu/RaiBlocks/wiki/Double-spending-and-confirmation
I want to say that the core developers of RaiBlocks have admitted the problem in chat. If you want you can join the discussion on discord.
Re: [ANN][XRB]Cryptocurrency's killer app: RaiBlocks micropayments
5. The Man in the Middle attack.
If an attacker succeeds to put himself between a merchant and the RaiBlocks network he can just filter the double spending payment packets, and the merchant will never know that he is receiving a double spending. The Raiblocks network will discard that payment while the merchant will accept it.
https://s18.postimg.org/7pnm6yweh/doublespend.png
If an attacker succeeds to put himself between a merchant and the RaiBlocks network he can just filter the double spending payment packets, and the merchant will never know that he is receiving a double spending. The Raiblocks network will discard that payment while the merchant will accept it.
https://s18.postimg.org/7pnm6yweh/doublespend.png
Couldn't the same MitM attack be used in a bitcoin transaction? Connect to all the peers of a merchant and mine 6 blocks containing the double spend while filtering out all longer blocks so the merchant accepts the transaction as valid.
No, because if you MITM a bitcoin merchant, you still have to mine 6 blocks with the difficulty bit set by the real network. And the difficulty only decrease by 1/4 every 2015 blocks. It will be impossible for an attacker to have such power.
Of course an attacker can mine 6 blocks. It will take more than an hour but it doesnt matter because all longer block chains are being filtered out. With 5% hashpower, an attacker could do it in a reasonable amount of time.
No. Try to solve a block by yourself with your PC. It will take years. You cannot change the difficulty of the blockchain even if you MITM
Re: [ANN][XRB]Cryptocurrency's killer app: RaiBlocks micropayments
Actually it took me a single read of the paper and some reading in the source code to notice the flaw. Some people in the development section of discord proposed to store a trusted set of nodes hardcoded in the client. This makes the voting system useless, since you need the approval of only the trusted nodes. I repeat, this is just bitcoin without the bitcoin secure algorithm, you are believing in a false god.
Percocet and Cyra, i bet you are one of those few people who own more than 1M coins and could potentially ezploit the network : >
Percocet and Cyra, i bet you are one of those few people who own more than 1M coins and could potentially ezploit the network : >
Re: [ANN][XRB]Cryptocurrency's killer app: RaiBlocks micropayments
I ask the moderator to remove the posts by percocet and CyraMax to continue with the technical discussion without being interrupted by fanboys. I don't fucking care of the bug hunt reward, i'm the developer of a succesful gaming company and I'm already good with what I'm earning.
Re: [ANN][XRB]Cryptocurrency's killer app: RaiBlocks micropayments
5. The Man in the Middle attack.
If an attacker succeeds to put himself between a merchant and the RaiBlocks network he can just filter the double spending payment packets, and the merchant will never know that he is receiving a double spending. The Raiblocks network will discard that payment while the merchant will accept it.
https://s18.postimg.org/7pnm6yweh/doublespend.png
If an attacker succeeds to put himself between a merchant and the RaiBlocks network he can just filter the double spending payment packets, and the merchant will never know that he is receiving a double spending. The Raiblocks network will discard that payment while the merchant will accept it.
https://s18.postimg.org/7pnm6yweh/doublespend.png
Couldn't the same MitM attack be used in a bitcoin transaction? Connect to all the peers of a merchant and mine 6 blocks containing the double spend while filtering out all longer blocks so the merchant accepts the transaction as valid.
No, because if you MITM a bitcoin merchant, you still have to mine 6 blocks with the difficulty bit set by the real network. And the difficulty only decrease by 1/4 every 2015 blocks. It will be impossible for an attacker to have such power.
Re: [ANN][XRB]Cryptocurrency's killer app: RaiBlocks micropayments
Everything I posted is real, there is no fud. MiTm attack has been never addressed and is not listed in the possible scenarios by the dev team.
When I pointed the flaw to the dev team they admitted the problem and asked to open a bug report and no, I,m not interested in bringing down the price. That is just ridiculous.
The main problem here is that a merchant must trust all the incoming data, while Bitcoin PoW makes sure that the incoming data is secure. Raiblocks code is poorly designed. And yeah, hackers hacked yahoo, sony, twitter, linkedin, do you really think it will be difficult to make a MITM attack? You are totally blind.
UDP packets are just welcoming attackers to join the party.
Please note that asking the vote for each traansaction has been proposed by the dev team as a solution to this, but other than the network usage you still have to trust the incoming data, infact you have to reach the 51% of online balance, and who tells you how much is this 51%? YOUR PEERS THAT ARE CONTROLLED BY THE ATTACKER.
And yeah, many people will just be blind and continue with their speculation, but money from the sky doesn't change what you are.
When I pointed the flaw to the dev team they admitted the problem and asked to open a bug report and no, I,m not interested in bringing down the price. That is just ridiculous.
The main problem here is that a merchant must trust all the incoming data, while Bitcoin PoW makes sure that the incoming data is secure. Raiblocks code is poorly designed. And yeah, hackers hacked yahoo, sony, twitter, linkedin, do you really think it will be difficult to make a MITM attack? You are totally blind.
UDP packets are just welcoming attackers to join the party.
Please note that asking the vote for each traansaction has been proposed by the dev team as a solution to this, but other than the network usage you still have to trust the incoming data, infact you have to reach the 51% of online balance, and who tells you how much is this 51%? YOUR PEERS THAT ARE CONTROLLED BY THE ATTACKER.
And yeah, many people will just be blind and continue with their speculation, but money from the sky doesn't change what you are.
LOOLL, yeah, forgot to mention you. Join the other 3 please and show yourself out
You are not funny, you should explain us how this attack is not possible if you want to shut we up.
Re: [ANN][XRB]Cryptocurrency's killer app: RaiBlocks micropayments
Everything I posted is real, there is no fud. MiTm attack has been never addressed and is not listed in the possible scenarios by the dev team.
When I pointed the flaw to the dev team they admitted the problem and asked to open a bug report and no, I,m not interested in bringing down the price. That is just ridiculous.
The main problem here is that a merchant must trust all the incoming data, while Bitcoin PoW makes sure that the incoming data is secure. Raiblocks code is poorly designed. And yeah, hackers hacked yahoo, sony, twitter, linkedin, do you really think it will be difficult to make a MITM attack? You are totally blind.
UDP packets are just welcoming attackers to join the party.
Please note that asking the vote for each traansaction has been proposed by the dev team as a solution to this, but other than the network usage you still have to trust the incoming data, infact you have to reach the 51% of online balance, and who tells you how much is this 51%? YOUR PEERS THAT ARE CONTROLLED BY THE ATTACKER.
And yeah, many people will just be blind and continue with their speculation, but money from the sky doesn't change what you are.
When I pointed the flaw to the dev team they admitted the problem and asked to open a bug report and no, I,m not interested in bringing down the price. That is just ridiculous.
The main problem here is that a merchant must trust all the incoming data, while Bitcoin PoW makes sure that the incoming data is secure. Raiblocks code is poorly designed. And yeah, hackers hacked yahoo, sony, twitter, linkedin, do you really think it will be difficult to make a MITM attack? You are totally blind.
UDP packets are just welcoming attackers to join the party.
Please note that asking the vote for each traansaction has been proposed by the dev team as a solution to this, but other than the network usage you still have to trust the incoming data, infact you have to reach the 51% of online balance, and who tells you how much is this 51%? YOUR PEERS THAT ARE CONTROLLED BY THE ATTACKER.
And yeah, many people will just be blind and continue with their speculation, but money from the sky doesn't change what you are.
Why RaiBlocks is not secure.
In this article I will try to explain why RaiBlocks is not secure and why its technology is any better neither comparable than the Bitcoin technology.
1. Decentralized payments
Decentralized payment networks are, in opposite of centralized payment network like banks, a way to secure your money without having the risk that a central authority could steal your money or manipulate the money in the market. Decentralized payment networks use asymmetric cryptography to ensure that you are the only one who can spend your money.
When you create a cryptocurrency wallet you are given a public key and a private key. The public key allows other people to send you money, while the private key allows you to spend them.
But how other users know how many money do you have?
To accomplish this, every user of a decentralized payment network must download the entire transaction database which is replicated on the entire network. When you send a payment over the network, it is received by all the users connected on the network allowing them to know your updated wallet balance and allowing them to discard that payment if you dont own enough funds.
2. Double Spending
The main problem that afflicts decentralized payment networks is double spending: the ability of an user to spend his money multiple times. In the real world, when you pay someone you give him the real cash. In a centralized payment network, like VISA, the central database is updated every time you make a payment, and they will not allow you to spend more money than your balance.
In a decentralized payment network what happens if you send the same amount of money on two users of the network in the same time? Since their database takes time to update for a small amount of time they both will receive the payment and accept it. In a later moment, when the network tells them that you double spent your money, they will cancel the payment, this is possible because every payment is broadcasted to the entire network, not only the receiver.
Without any other security layer, if a malicious user double spends his money and succeeds to block a payment receiver to know that he sent the same money to someone else (or even better, to another wallet of his own), the payment receiver will accept the payment and ship the good. This is so bad, since even a network connection problem could temporarily lead a payment receiver to undetect double spendings.
3. The Bitcoin Solution
To solve this problem, Bitcoin relays on the fact that after you receive a payment you need to wait a confirmation block, the confirmation block tells you that the payment you have received has been accepted by the entire network and you are allowed to spend it. To create a confirmation block, the miners create a list of all the pending unconfirmed transactions and solve a very difficult mathematical puzzle. The miner who solves the puzzle first, sends the block he found with all the list of confirmed transaction and the solved puzzle to the network, the users of the network will check if the puzzle solution is valid and then reward him with some free coins plus the sum of all the payment fees of each transaction in the block. The miners must create a valid list of payments to be accepted by the network, so double spend attempts are just discarded.
In Bitcoin an attacker, to make a succesful double spending, should not just stop you from receiving a double spend attempt message, but he should also solve the puzzle to create a confirmation block in a reasonable time frame. Currently solving that puzzle with a single computer would take years; at writing time to solve that puzzle a network of thousands dedicated hardware is used, an attacker would require a billionaire investment to replicate that network. Moreover, it would not only need to create one confirmation block but six of them (6 confirmation blocks are required in the Bitcoin network to trust a payment).
Critics of Bitcoin say that all the computation power used to make the Bitcoin network secure is just a waste of energy because there are other reliable and better technologies. Is that true?
4. What is RaiBlocks?
RaiBlocks is a crypto currency that advertises itself as a fast, fee-less and secure currency, unlikely Bitcoin which is currently slow and high-fee (usually requires 1 hour to a full payment confirmation).
But the key point is that Bitcoin has been made that way to guarantee his users a certain amount of security to prevent double spendings.
RaiBlocks completely ignores the Bitcoin technology and relies on a special version of the Proof Of Stake concept.
When you receive a payment in the RaiBlocks network you have to wait a certain amount of time to be sure that a double spending has not been attempted (and remember the first problem, if an attacker stops you from receiving the double spend you would never know!)
When a double spent is detected, the RaiBlocks network starts a vote. Every peer connected to the network vote to accept the payment A or payment B; every user vote is weighted with the amount of his balance. Usually each peer votes for the first transaction he receives. The transaction which the sum of votes reaches the 51% of online amount of currency wins. The winning transaction is accepted by the network and the other one is discarded. (Reference https://github.com/clemahieu/RaiBlocks/wiki/Double-spending-and-confirmation)
The payment receiver, if his network has not been compromised, will then know if he can trust the payment or not, and will ship the good accordingly. This system leads to an unsolvable problem.
5. The Man in the Middle attack.
If an attacker succeeds to put himself between a merchant and the RaiBlocks network he can just filter the double spending payment packets, and the merchant will never know that he is receiving a double spending. The Raiblocks network will discard that payment while the merchant will accept it.
https://s18.postimg.org/7pnm6yweh/doublespend.png
6. Solutions proposed by the RaiBlocks team
a) The merchant should ask a vote for each payment he receives and wait for the confirmation.
The problem is that the attacker could manipulate the vote by telling the merchant that only his peers are connected to the network thus he will win the vote by filtering only his votes. Plus, asking a vote for each payment would cause a huge increment of bandwidth usage that many peers could not handle.
b) The merchant should have a remote node verifying the payment.
The attacker could just attack that network too.
c) The merchant should ask the RaiBlocks.net website if the payment has been accepted.
The attacker can hack the RaiBlocks.net website. Also if you have to rely on a website you can no longer consider RaiBlocks a decentralized network.
Other solutions
1) A payment to be accepted should require a vote with a minimum weight quorum.
It's difficult to establish a correct quorum, and if that quorum is offline no payments will be processed.
2) A payment need to be accepted by some trusted representatives.
This will stop the network on being decentralized. Also, if those representatives are offline the payments are not processed.
7. Why Bitcoin is not vulnerable to this type of attack
Simply because an attacker, to be trusted by a merchant, would require to solve a very difficult puzzle for six times. An attacker cannot alter the difficulty of that puzzle.
8. Other observations
a) RaiBlocks is just Bitcoins without the Bitcoin securing algorithm. The creator of Bitcoin, Satoshi Nakamoto, describes the double spending problem in the original Bitcoin paper: https://Bitcoin.org/Bitcoin.pdf. The developer of RaiBlocks just thinks to solve the problem by ignoring the problem.
b) The official representatives of the RaiBlocks network own more than 52% of total voting weight, allowing the developer to manipulate every vote on his will.
Source: https://dev.RaiBlocks.net/page/representatives.php
9. References
https://RaiBlocks.net/media/RaiBlocks_Whitepaper__English.pdf
https://github.com/clemahieu/RaiBlocks/wiki/Double-spending-and-confirmation
In this article I will try to explain why RaiBlocks is not secure and why its technology is any better neither comparable than the Bitcoin technology.
1. Decentralized payments
Decentralized payment networks are, in opposite of centralized payment network like banks, a way to secure your money without having the risk that a central authority could steal your money or manipulate the money in the market. Decentralized payment networks use asymmetric cryptography to ensure that you are the only one who can spend your money.
When you create a cryptocurrency wallet you are given a public key and a private key. The public key allows other people to send you money, while the private key allows you to spend them.
But how other users know how many money do you have?
To accomplish this, every user of a decentralized payment network must download the entire transaction database which is replicated on the entire network. When you send a payment over the network, it is received by all the users connected on the network allowing them to know your updated wallet balance and allowing them to discard that payment if you dont own enough funds.
2. Double Spending
The main problem that afflicts decentralized payment networks is double spending: the ability of an user to spend his money multiple times. In the real world, when you pay someone you give him the real cash. In a centralized payment network, like VISA, the central database is updated every time you make a payment, and they will not allow you to spend more money than your balance.
In a decentralized payment network what happens if you send the same amount of money on two users of the network in the same time? Since their database takes time to update for a small amount of time they both will receive the payment and accept it. In a later moment, when the network tells them that you double spent your money, they will cancel the payment, this is possible because every payment is broadcasted to the entire network, not only the receiver.
Without any other security layer, if a malicious user double spends his money and succeeds to block a payment receiver to know that he sent the same money to someone else (or even better, to another wallet of his own), the payment receiver will accept the payment and ship the good. This is so bad, since even a network connection problem could temporarily lead a payment receiver to undetect double spendings.
3. The Bitcoin Solution
To solve this problem, Bitcoin relays on the fact that after you receive a payment you need to wait a confirmation block, the confirmation block tells you that the payment you have received has been accepted by the entire network and you are allowed to spend it. To create a confirmation block, the miners create a list of all the pending unconfirmed transactions and solve a very difficult mathematical puzzle. The miner who solves the puzzle first, sends the block he found with all the list of confirmed transaction and the solved puzzle to the network, the users of the network will check if the puzzle solution is valid and then reward him with some free coins plus the sum of all the payment fees of each transaction in the block. The miners must create a valid list of payments to be accepted by the network, so double spend attempts are just discarded.
In Bitcoin an attacker, to make a succesful double spending, should not just stop you from receiving a double spend attempt message, but he should also solve the puzzle to create a confirmation block in a reasonable time frame. Currently solving that puzzle with a single computer would take years; at writing time to solve that puzzle a network of thousands dedicated hardware is used, an attacker would require a billionaire investment to replicate that network. Moreover, it would not only need to create one confirmation block but six of them (6 confirmation blocks are required in the Bitcoin network to trust a payment).
Critics of Bitcoin say that all the computation power used to make the Bitcoin network secure is just a waste of energy because there are other reliable and better technologies. Is that true?
4. What is RaiBlocks?
RaiBlocks is a crypto currency that advertises itself as a fast, fee-less and secure currency, unlikely Bitcoin which is currently slow and high-fee (usually requires 1 hour to a full payment confirmation).
But the key point is that Bitcoin has been made that way to guarantee his users a certain amount of security to prevent double spendings.
RaiBlocks completely ignores the Bitcoin technology and relies on a special version of the Proof Of Stake concept.
When you receive a payment in the RaiBlocks network you have to wait a certain amount of time to be sure that a double spending has not been attempted (and remember the first problem, if an attacker stops you from receiving the double spend you would never know!)
When a double spent is detected, the RaiBlocks network starts a vote. Every peer connected to the network vote to accept the payment A or payment B; every user vote is weighted with the amount of his balance. Usually each peer votes for the first transaction he receives. The transaction which the sum of votes reaches the 51% of online amount of currency wins. The winning transaction is accepted by the network and the other one is discarded. (Reference https://github.com/clemahieu/RaiBlocks/wiki/Double-spending-and-confirmation)
The payment receiver, if his network has not been compromised, will then know if he can trust the payment or not, and will ship the good accordingly. This system leads to an unsolvable problem.
5. The Man in the Middle attack.
If an attacker succeeds to put himself between a merchant and the RaiBlocks network he can just filter the double spending payment packets, and the merchant will never know that he is receiving a double spending. The Raiblocks network will discard that payment while the merchant will accept it.
https://s18.postimg.org/7pnm6yweh/doublespend.png
6. Solutions proposed by the RaiBlocks team
a) The merchant should ask a vote for each payment he receives and wait for the confirmation.
The problem is that the attacker could manipulate the vote by telling the merchant that only his peers are connected to the network thus he will win the vote by filtering only his votes. Plus, asking a vote for each payment would cause a huge increment of bandwidth usage that many peers could not handle.
b) The merchant should have a remote node verifying the payment.
The attacker could just attack that network too.
c) The merchant should ask the RaiBlocks.net website if the payment has been accepted.
The attacker can hack the RaiBlocks.net website. Also if you have to rely on a website you can no longer consider RaiBlocks a decentralized network.
Other solutions
1) A payment to be accepted should require a vote with a minimum weight quorum.
It's difficult to establish a correct quorum, and if that quorum is offline no payments will be processed.
2) A payment need to be accepted by some trusted representatives.
This will stop the network on being decentralized. Also, if those representatives are offline the payments are not processed.
7. Why Bitcoin is not vulnerable to this type of attack
Simply because an attacker, to be trusted by a merchant, would require to solve a very difficult puzzle for six times. An attacker cannot alter the difficulty of that puzzle.
8. Other observations
a) RaiBlocks is just Bitcoins without the Bitcoin securing algorithm. The creator of Bitcoin, Satoshi Nakamoto, describes the double spending problem in the original Bitcoin paper: https://Bitcoin.org/Bitcoin.pdf. The developer of RaiBlocks just thinks to solve the problem by ignoring the problem.
b) The official representatives of the RaiBlocks network own more than 52% of total voting weight, allowing the developer to manipulate every vote on his will.
Source: https://dev.RaiBlocks.net/page/representatives.php
9. References
https://RaiBlocks.net/media/RaiBlocks_Whitepaper__English.pdf
https://github.com/clemahieu/RaiBlocks/wiki/Double-spending-and-confirmation
Re: [ANN][XRB]Cryptocurrency's killer app: RaiBlocks micropayments
Why RaiBlocks is not secure.
In this article I will try to explain why RaiBlocks is not secure and why its technology is any better neither comparable than the Bitcoin technology.
1. Decentralized payments
Decentralized payment networks are, in opposite of centralized payment network like banks, a way to secure your money without having the risk that a central authority could steal your money or manipulate the money in the market. Decentralized payment networks use asymmetric cryptography to ensure that you are the only one who can spend your money.
When you create a cryptocurrency wallet you are given a public key and a private key. The public key allows other people to send you money, while the private key allows you to spend them.
But how other users know how many money do you have?
To accomplish this, every user of a decentralized payment network must download the entire transaction database which is replicated on the entire network. When you send a payment over the network, it is received by all the users connected on the network allowing them to know your updated wallet balance and allowing them to discard that payment if you dont own enough funds.
2. Double Spending
The main problem that afflicts decentralized payment networks is double spending: the ability of an user to spend his money multiple times. In the real world, when you pay someone you give him the real cash. In a centralized payment network, like VISA, the central database is updated every time you make a payment, and they will not allow you to spend more money than your balance.
In a decentralized payment network what happens if you send the same amount of money on two users of the network in the same time? Since their database takes time to update for a small amount of time they both will receive the payment and accept it. In a later moment, when the network tells them that you double spent your money, they will cancel the payment, this is possible because every payment is broadcasted to the entire network, not only the receiver.
Without any other security layer, if a malicious user double spends his money and succeeds to block a payment receiver to know that he sent the same money to someone else (or even better, to another wallet of his own), the payment receiver will accept the payment and ship the good. This is so bad, since even a network connection problem could temporarily lead a payment receiver to undetect double spendings.
3. The Bitcoin Solution
To solve this problem, Bitcoin relays on the fact that after you receive a payment you need to wait a confirmation block, the confirmation block tells you that the payment you have received has been accepted by the entire network and you are allowed to spend it. To create a confirmation block, the miners create a list of all the pending unconfirmed transactions and solve a very difficult mathematical puzzle. The miner who solves the puzzle first, sends the block he found with all the list of confirmed transaction and the solved puzzle to the network, the users of the network will check if the puzzle solution is valid and then reward him with some free coins plus the sum of all the payment fees of each transaction in the block. The miners must create a valid list of payments to be accepted by the network, so double spend attempts are just discarded.
In Bitcoin an attacker, to make a succesful double spending, should not just stop you from receiving a double spend attempt message, but he should also solve the puzzle to create a confirmation block in a reasonable time frame. Currently solving that puzzle with a single computer would take years; at writing time to solve that puzzle a network of thousands dedicated hardware is used, an attacker would require a billionaire investment to replicate that network. Moreover, it would not only need to create one confirmation block but six of them (6 confirmation blocks are required in the Bitcoin network to trust a payment).
Critics of Bitcoin say that all the computation power used to make the Bitcoin network secure is just a waste of energy because there are other reliable and better technologies. Is that true?
4. What is RaiBlocks?
RaiBlocks is a crypto currency that advertises itself as a fast, fee-less and secure currency, unlikely Bitcoin which is currently slow and high-fee (usually requires 1 hour to a full payment confirmation).
But the key point is that Bitcoin has been made that way to guarantee his users a certain amount of security to prevent double spendings.
RaiBlocks completely ignores the Bitcoin technology and relies on a special version of the Proof Of Stake concept.
When you receive a payment in the RaiBlocks network you have to wait a certain amount of time to be sure that a double spending has not been attempted (and remember the first problem, if an attacker stops you from receiving the double spend you would never know!)
When a double spent is detected, the RaiBlocks network starts a vote. Every peer connected to the network vote to accept the payment A or payment B; every user vote is weighted with the amount of his balance. Usually each peer votes for the first transaction he receives. The transaction which the sum of votes reaches the 51% of online amount of currency wins. The winning transaction is accepted by the network and the other one is discarded. (Reference https://github.com/clemahieu/RaiBlocks/wiki/Double-spending-and-confirmation)
The payment receiver, if his network has not been compromised, will then know if he can trust the payment or not, and will ship the good accordingly. This system leads to an unsolvable problem.
5. The Man in the Middle attack.
If an attacker succeeds to put himself between a merchant and the RaiBlocks network he can just filter the double spending payment packets, and the merchant will never know that he is receiving a double spending. The Raiblocks network will discard that payment while the merchant will accept it.
https://s18.postimg.org/7pnm6yweh/doublespend.png
6. Solutions proposed by the RaiBlocks team
a) The merchant should ask a vote for each payment he receives and wait for the confirmation.
The problem is that the attacker could manipulate the vote by telling the merchant that only his peers are connected to the network thus he will win the vote by filtering only his votes. Plus, asking a vote for each payment would cause a huge increment of bandwidth usage that many peers could not handle.
b) The merchant should have a remote node verifying the payment.
The attacker could just attack that network too.
c) The merchant should ask the RaiBlocks.net website if the payment has been accepted.
The attacker can hack the RaiBlocks.net website. Also if you have to rely on a website you can no longer consider RaiBlocks a decentralized network.
Other solutions
1) A payment to be accepted should require a vote with a minimum weight quorum.
It's difficult to establish a correct quorum, and if that quorum is offline no payments will be processed.
2) A payment need to be accepted by some trusted representatives.
This will stop the network on being decentralized. Also, if those representatives are offline the payments are not processed.
7. Why Bitcoin is not vulnerable to this type of attack
Simply because an attacker, to be trusted by a merchant, would require to solve a very difficult puzzle for six times. An attacker cannot alter the difficulty of that puzzle.
8. Other observations
a) RaiBlocks is just Bitcoins without the Bitcoin securing algorithm. The creator of Bitcoin, Satoshi Nakamoto, describes the double spending problem in the original Bitcoin paper: https://Bitcoin.org/Bitcoin.pdf. The developer of RaiBlocks just thinks to solve the problem by ignoring the problem.
b) The official representatives of the RaiBlocks network own more than 52% of total voting weight, allowing the developer to manipulate every vote on his will.
Source: https://dev.RaiBlocks.net/page/representatives.php
9. References
https://RaiBlocks.net/media/RaiBlocks_Whitepaper__English.pdf
https://github.com/clemahieu/RaiBlocks/wiki/Double-spending-and-confirmation
In this article I will try to explain why RaiBlocks is not secure and why its technology is any better neither comparable than the Bitcoin technology.
1. Decentralized payments
Decentralized payment networks are, in opposite of centralized payment network like banks, a way to secure your money without having the risk that a central authority could steal your money or manipulate the money in the market. Decentralized payment networks use asymmetric cryptography to ensure that you are the only one who can spend your money.
When you create a cryptocurrency wallet you are given a public key and a private key. The public key allows other people to send you money, while the private key allows you to spend them.
But how other users know how many money do you have?
To accomplish this, every user of a decentralized payment network must download the entire transaction database which is replicated on the entire network. When you send a payment over the network, it is received by all the users connected on the network allowing them to know your updated wallet balance and allowing them to discard that payment if you dont own enough funds.
2. Double Spending
The main problem that afflicts decentralized payment networks is double spending: the ability of an user to spend his money multiple times. In the real world, when you pay someone you give him the real cash. In a centralized payment network, like VISA, the central database is updated every time you make a payment, and they will not allow you to spend more money than your balance.
In a decentralized payment network what happens if you send the same amount of money on two users of the network in the same time? Since their database takes time to update for a small amount of time they both will receive the payment and accept it. In a later moment, when the network tells them that you double spent your money, they will cancel the payment, this is possible because every payment is broadcasted to the entire network, not only the receiver.
Without any other security layer, if a malicious user double spends his money and succeeds to block a payment receiver to know that he sent the same money to someone else (or even better, to another wallet of his own), the payment receiver will accept the payment and ship the good. This is so bad, since even a network connection problem could temporarily lead a payment receiver to undetect double spendings.
3. The Bitcoin Solution
To solve this problem, Bitcoin relays on the fact that after you receive a payment you need to wait a confirmation block, the confirmation block tells you that the payment you have received has been accepted by the entire network and you are allowed to spend it. To create a confirmation block, the miners create a list of all the pending unconfirmed transactions and solve a very difficult mathematical puzzle. The miner who solves the puzzle first, sends the block he found with all the list of confirmed transaction and the solved puzzle to the network, the users of the network will check if the puzzle solution is valid and then reward him with some free coins plus the sum of all the payment fees of each transaction in the block. The miners must create a valid list of payments to be accepted by the network, so double spend attempts are just discarded.
In Bitcoin an attacker, to make a succesful double spending, should not just stop you from receiving a double spend attempt message, but he should also solve the puzzle to create a confirmation block in a reasonable time frame. Currently solving that puzzle with a single computer would take years; at writing time to solve that puzzle a network of thousands dedicated hardware is used, an attacker would require a billionaire investment to replicate that network. Moreover, it would not only need to create one confirmation block but six of them (6 confirmation blocks are required in the Bitcoin network to trust a payment).
Critics of Bitcoin say that all the computation power used to make the Bitcoin network secure is just a waste of energy because there are other reliable and better technologies. Is that true?
4. What is RaiBlocks?
RaiBlocks is a crypto currency that advertises itself as a fast, fee-less and secure currency, unlikely Bitcoin which is currently slow and high-fee (usually requires 1 hour to a full payment confirmation).
But the key point is that Bitcoin has been made that way to guarantee his users a certain amount of security to prevent double spendings.
RaiBlocks completely ignores the Bitcoin technology and relies on a special version of the Proof Of Stake concept.
When you receive a payment in the RaiBlocks network you have to wait a certain amount of time to be sure that a double spending has not been attempted (and remember the first problem, if an attacker stops you from receiving the double spend you would never know!)
When a double spent is detected, the RaiBlocks network starts a vote. Every peer connected to the network vote to accept the payment A or payment B; every user vote is weighted with the amount of his balance. Usually each peer votes for the first transaction he receives. The transaction which the sum of votes reaches the 51% of online amount of currency wins. The winning transaction is accepted by the network and the other one is discarded. (Reference https://github.com/clemahieu/RaiBlocks/wiki/Double-spending-and-confirmation)
The payment receiver, if his network has not been compromised, will then know if he can trust the payment or not, and will ship the good accordingly. This system leads to an unsolvable problem.
5. The Man in the Middle attack.
If an attacker succeeds to put himself between a merchant and the RaiBlocks network he can just filter the double spending payment packets, and the merchant will never know that he is receiving a double spending. The Raiblocks network will discard that payment while the merchant will accept it.
https://s18.postimg.org/7pnm6yweh/doublespend.png
6. Solutions proposed by the RaiBlocks team
a) The merchant should ask a vote for each payment he receives and wait for the confirmation.
The problem is that the attacker could manipulate the vote by telling the merchant that only his peers are connected to the network thus he will win the vote by filtering only his votes. Plus, asking a vote for each payment would cause a huge increment of bandwidth usage that many peers could not handle.
b) The merchant should have a remote node verifying the payment.
The attacker could just attack that network too.
c) The merchant should ask the RaiBlocks.net website if the payment has been accepted.
The attacker can hack the RaiBlocks.net website. Also if you have to rely on a website you can no longer consider RaiBlocks a decentralized network.
Other solutions
1) A payment to be accepted should require a vote with a minimum weight quorum.
It's difficult to establish a correct quorum, and if that quorum is offline no payments will be processed.
2) A payment need to be accepted by some trusted representatives.
This will stop the network on being decentralized. Also, if those representatives are offline the payments are not processed.
7. Why Bitcoin is not vulnerable to this type of attack
Simply because an attacker, to be trusted by a merchant, would require to solve a very difficult puzzle for six times. An attacker cannot alter the difficulty of that puzzle.
8. Other observations
a) RaiBlocks is just Bitcoins without the Bitcoin securing algorithm. The creator of Bitcoin, Satoshi Nakamoto, describes the double spending problem in the original Bitcoin paper: https://Bitcoin.org/Bitcoin.pdf. The developer of RaiBlocks just thinks to solve the problem by ignoring the problem.
b) The official representatives of the RaiBlocks network own more than 52% of total voting weight, allowing the developer to manipulate every vote on his will.
Source: https://dev.RaiBlocks.net/page/representatives.php
9. References
https://RaiBlocks.net/media/RaiBlocks_Whitepaper__English.pdf
https://github.com/clemahieu/RaiBlocks/wiki/Double-spending-and-confirmation