Author

Topic: [ANN][BURST] Burst | Efficient HDD Mining | New 1.2.3 Fork block 92000 - page 355. (Read 2170648 times)

hero member
Activity: 785
Merit: 500
BURST got Smart Contracts (AT)
The address is numeric 20 digits long, so there are max. 99,999,999,999,999,999,999 different burst addresses. Brutforce would be therfore possible.
While you "fill up your database" you can always frequently check if an account of the richlist is in the database, whereby you can simplify it to only accounts who have more than 300 Bursts, or so.
You do not need to find ALL accounts to empty one account.


The numeric address is 64 bits long, your "99,999,999..." is quite a bit off.

And have a look at how a "Public Key" is assigned to an account. Its not just protected by these 64 bits!


Is there a burst address with more than 20 digits numeric?
Does any password (even with one single character) always result in the same burst address?
If so, then there is a simple relationship: password -> burst address = access !!!
However, burst address -> password  has multiple possibilities.

Therefore I think it is possible to access one burst wallet with two (or more) different passwords !!!!!

it is incredible to me you have private phone numbers (seems both land line and mobile) in your signature... no worries I won't call but if you are security oriented.. juuust saying


Is that really your answer to that?
Do you have any question how the relationship between password to burst address is?


weeeeeell no you are right.. let's not drift from the subject.. I have not looked into source code to see exact algorithm.. however I know BURST is derivative of NXT and NXT market cap is $ 13,201,962  , that's a lot of money , there is also rich list and same attack vectors , all safe and appears NXT investors feel safe as well..


Still not the answer!
But first, do you know that VIA is a protected name? Now you know!

Do me a favour. Try to type in a single digit / character as password into your wallet. Does it result into a burst address? Yes/No?
Have you seen a Burst address in numeric format more than 20 digits? Yes/No?
Now you have tried 10 numbers, 26 characters, maybe even some special characters and still you got always a different burst address. Yes/No?

Put all together:
If there are only 20 numerical digits for an burst address, than there must be a possibility of more than one password to result to that address.
The public key is only necessary to get the first payment, which the original owner has needed to get his first payment. After that you do not need it anymore to operate on your wallet.
legendary
Activity: 1792
Merit: 1010
I am actually glad BURST is based on NXT.. for reason of proven security, of course BURST is already very different from NXT.. such as Automated Transactions to which it even beat Ethereum itself..on the timeline

people starting to ask questions such as security and/or double spending ... its time for me to look at the exchanges to see if I can scoop more .. last time it was < 170 sat... but low supply.. maybe someone will unload 2 million at 130 .. let's see....

not yet..

this is a nice chunk on bittrex, someone is recycling free storage again, free thats like 130$ if he can pull this off till block rewards drop some more, he/she better hurry up

0.00000162  268711.12203307    0.4353   1.0300   

130$ even weekly won't retire him/her in Bahamas.. in 1920 maybe
sr. member
Activity: 280
Merit: 250
burst address = access !!!

Not true.

But I´ll let you find out yourself.
legendary
Activity: 1792
Merit: 1010
The address is numeric 20 digits long, so there are max. 99,999,999,999,999,999,999 different burst addresses. Brutforce would be therfore possible.
While you "fill up your database" you can always frequently check if an account of the richlist is in the database, whereby you can simplify it to only accounts who have more than 300 Bursts, or so.
You do not need to find ALL accounts to empty one account.


The numeric address is 64 bits long, your "99,999,999..." is quite a bit off.

And have a look at how a "Public Key" is assigned to an account. Its not just protected by these 64 bits!


Is there a burst address with more than 20 digits numeric?
Does any password (even with one single character) always result in the same burst address?
If so, then there is a simple relationship: password -> burst address = access !!!
However, burst address -> password  has multiple possibilities.

Therefore I think it is possible to access one burst wallet with two (or more) different passwords !!!!!

it is incredible to me you have private phone numbers (seems both land line and mobile) in your signature... no worries I won't call but if you are security oriented.. juuust saying


Is that really your answer to that?
Do you have any question how the relationship between password to burst address is?


weeeeeell no you are right.. let's not drift from the subject.. I have not looked into source code to see exact algorithm.. however I know BURST is derivative of NXT and NXT market cap is $ 13,201,962  , that's a lot of money , there is also rich list and same attack vectors , all safe and appears NXT investors feel safe as well..
hero member
Activity: 785
Merit: 500
BURST got Smart Contracts (AT)
The address is numeric 20 digits long, so there are max. 99,999,999,999,999,999,999 different burst addresses. Brutforce would be therfore possible.
While you "fill up your database" you can always frequently check if an account of the richlist is in the database, whereby you can simplify it to only accounts who have more than 300 Bursts, or so.
You do not need to find ALL accounts to empty one account.


The numeric address is 64 bits long, your "99,999,999..." is quite a bit off.

And have a look at how a "Public Key" is assigned to an account. Its not just protected by these 64 bits!


Is there a burst address with more than 20 digits numeric?
Does any password (even with one single character) always result in the same burst address?
If so, then there is a simple relationship: password -> burst address = access !!!
However, burst address -> password  has multiple possibilities.

Therefore I think it is possible to access one burst wallet with two (or more) different passwords !!!!!

it is incredible to me you have private phone numbers (seems both land line and mobile) in your signature... no worries I won't call but if you are security oriented.. juuust saying


Is that really your answer to that?
Do you have any question how the relationship between password to burst address is?
legendary
Activity: 1750
Merit: 1024
[miner]

new version Burst-miner v1.150314
https://www.dropbox.com/s/luq6te1j8dn61p2/miner-burst-1.150314.zip?dl=0

* Tiny changes in algo for faster interrupt the threads (tnx haitch)
* MaxThreads (Paths) increased to 48

+ Added an option to disable the memory cleaning.
   "UseCleanMem" : false,
   (by default - true)

+ Added an option to disable "Winner info"
  "ShowWinner" : false
   (by default - true)

+ Added options to set the address of the server from which to obtain information about the winner
   "InfoAddr" : "burst.ninja"
    (by default - InfoAddr = UpdaterAddr)

   "InfoPort": 8125
    (by default - InfoPort = UpdaterPort)


also, sometimes may have the crashes  Smiley
PM to me screnshots



Thanks bro, especially the winner information.

Also what does usesorting do? I still haven't been able to figure this out.
legendary
Activity: 1792
Merit: 1010
The address is numeric 20 digits long, so there are max. 99,999,999,999,999,999,999 different burst addresses. Brutforce would be therfore possible.
While you "fill up your database" you can always frequently check if an account of the richlist is in the database, whereby you can simplify it to only accounts who have more than 300 Bursts, or so.
You do not need to find ALL accounts to empty one account.


The numeric address is 64 bits long, your "99,999,999..." is quite a bit off.

And have a look at how a "Public Key" is assigned to an account. Its not just protected by these 64 bits!


Is there a burst address with more than 20 digits numeric?
Does any password (even with one single character) always result in the same burst address?
If so, then there is a simple relationship: password -> burst address = access !!!
However, burst address -> password  has multiple possibilities.

Therefore I think it is possible to access one burst wallet with two (or more) different passwords !!!!!

it is incredible to me you have private phone numbers (seems both land line and mobile) in your signature... no worries I won't call but if you are security oriented.. juuust saying

will social security number be next ?  Cool
hero member
Activity: 785
Merit: 500
BURST got Smart Contracts (AT)
The address is numeric 20 digits long, so there are max. 99,999,999,999,999,999,999 different burst addresses. Brutforce would be therfore possible.
While you "fill up your database" you can always frequently check if an account of the richlist is in the database, whereby you can simplify it to only accounts who have more than 300 Bursts, or so.
You do not need to find ALL accounts to empty one account.


The numeric address is 64 bits long, your "99,999,999..." is quite a bit off.

And have a look at how a "Public Key" is assigned to an account. Its not just protected by these 64 bits!


Is there a burst address with more than 20 digits numeric?
Does any password (even with one single character) always result in the same burst address?
If so, then there is a simple relationship: password -> burst address = access !!!
However, burst address -> password  has multiple possibilities.

Therefore I think it is possible to access one burst wallet with two (or more) different passwords !!!!!
sr. member
Activity: 286
Merit: 250
Can I mine with external HDD ?

Yes! But it's need to be USB 3.0 or eSATA if you want to improve read speed! USB 2.0 works too but it's slow for Burst mining.

PS: I think a F.A.Q. would be good for repeated questions  Smiley

USB 3.0 is faster, but i have several 4 TB USB 3.0 disks on USB 2.0 plugs, essentially making them USB 2.0, and this works fine - just not as fine as 3.0.  with most blocks my computer manages to read all 4TB from an USB 2.0 connected USB 3.0 drive.

I even have a few USB 2.0 drivs on USB 2.0, but they are smaller (like 0.75TB and 0.5TB and 1TB)

If you are buying new equipment or mobo definetly go for SATA 600 and USB 3.0, but if you are hooking up old stuff lying around, you can go 2.0 too, and still make some BURST coins.

I have some fairly decent motherboards ( msi 990xa-gd55  , msi99xa-gd65) both with at least two pci-express 16x GPU slots, both with 6x600 SATA internal plugs, and 2x USB 3.0 external plugs) - and when i add a (2x 600 SATA, 2x USB 3.0 external) controller to one of the pci-express GPU slots, i have a computer with 8 internal sata 600 drives capacity, and 4 external USB 3.0 drives capacity. plus umpteen USB 2.0 plugs if need be.  plug in a 8-core cpu like FX-8150 or FX-8350 , and you've got a pretty decent workstation that mines 12*4TB with no big problems.  On windows, lots of RAM is a good idea. Also windows8.1 or 10 is recommended as 7 seems to be having trouble managing its RAM when a lot of reading is going on.

The computers can be used for normal work and mining at the same time, but when a block arrives, you might feel interrupted for a few seconds as the CPU gets busy reading data in from all the drives. I guess the choice of miner might play a role, you could mine the drives with a little time difference to avoid hammering the cpu with read requests on 12 drives all at once.

i use the original java miner and solo mine, the newer miners out there might be a better choice for me, but i'm lazy and haven't found the need for changing yet.

btw i just bought two internal sata 600 4TB intenso drives for 141 euro each, turns out they were toshiba MD04ACA400 7200 rpm 64MB cache drives - that's pretty good value, it was the cheapest 4TB internal drives i could find. They out-spec the USB 3.0 4TB intenso drives quite a bit.
legendary
Activity: 1792
Merit: 1010
Guys keep in mind, regardless of the length of your passphrase, bruteforcing will eventually find accounts. I'm actually surprised this hasn't become more prevalent. Since each wallet is ONLY a passphrase and not a username and passphrase to authenticate against, and there is not a lockout on accounts for how fast you can check a passphrase (unless the blockchain does it). All someone needs to do is bruteforce continually till it happens upon a account. Since everyone is essentially using one username which is identical for all of us and it's impossibly hard to change it once you have one (replotting).

Luckily mine is huge, but with time it will also be broken by a brute force. I'm not certain of the speed at which you could check passwords, but I assume with scripts and modern GPUs you could do some serious bruteforcing on Burst.

Everything can be bruteforce given enough time, but with a password of +200 char it will take ages.

the length of the password phrase has nothing to do with that. Each password phrase results in one and only one BURST address, however, more than one password phrase can result into the same BURST address.

The address is numeric 20 digits long, so there are max. 99,999,999,999,999,999,999 different burst addresses. Brutforce would be therfore possible.
While you "fill up your database" you can always frequently check if an account of the richlist is in the database, whereby you can simplify it to only accounts who have more than 300 Bursts, or so.
You do not need to find ALL accounts to empty one account.


maybe if you have access to the machine on which BURST passphrase was generated (without knowing passphrase)

the only weakness I see and I am sure is somewhere there to improve it on the roadmap is that BURST does not like PGP for instance use some truly random source of entropy (such as moving mouse around with your hand during key generation phase) so it is feasible one could use sophisticated differential analysis to derive the passphrase

do not even think to gain access to my physical machine



sr. member
Activity: 280
Merit: 250
The address is numeric 20 digits long, so there are max. 99,999,999,999,999,999,999 different burst addresses. Brutforce would be therfore possible.
While you "fill up your database" you can always frequently check if an account of the richlist is in the database, whereby you can simplify it to only accounts who have more than 300 Bursts, or so.
You do not need to find ALL accounts to empty one account.


The numeric address is 64 bits long, your "99,999,999..." is quite a bit off.

And have a look at how a "Public Key" is assigned to an account. Its not just protected by these 64 bits!
hero member
Activity: 785
Merit: 500
BURST got Smart Contracts (AT)
Guys keep in mind, regardless of the length of your passphrase, bruteforcing will eventually find accounts. I'm actually surprised this hasn't become more prevalent. Since each wallet is ONLY a passphrase and not a username and passphrase to authenticate against, and there is not a lockout on accounts for how fast you can check a passphrase (unless the blockchain does it). All someone needs to do is bruteforce continually till it happens upon a account. Since everyone is essentially using one username which is identical for all of us and it's impossibly hard to change it once you have one (replotting).

Luckily mine is huge, but with time it will also be broken by a brute force. I'm not certain of the speed at which you could check passwords, but I assume with scripts and modern GPUs you could do some serious bruteforcing on Burst.

Everything can be bruteforce given enough time, but with a password of +200 char it will take ages.

the length of the password phrase has nothing to do with that. Each password phrase results in one and only one BURST address, however, more than one password phrase can result into the same BURST address.

The address is numeric 20 digits long, so there are max. 99,999,999,999,999,999,999 different burst addresses. Brutforce would be therfore possible.
While you "fill up your database" you can always frequently check if an account of the richlist is in the database, whereby you can simplify it to only accounts who have more than 300 Bursts, or so.
You do not need to find ALL accounts to empty one account.
newbie
Activity: 36
Merit: 0
hello everyboby

I just put online french version of burstcoin site

www.burstcoin.fr

I will translate more stuff in the next days.

my api can be used from www.burstcoin.fr/api (visit to see usage)
but, for now I didn't have time to do big things.

Your market cap is not working Sad

You can use
Code:
json_decode(file_get_contents("https://block.burstcoin.info/api/?request=price&c=usd")); echo $burstData->c->market_cap?>

and your price seems fine Cheesy but for simplicity you can use
Code:
echo $burstData->price?>

I think i'll make a bit of an api upgrade tomorrow....make a nice page to document it all

Whatever I do I get some error like
Code:
Curl error: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
I tried almost every version of ssl I could test but still no luck.
Also tried fopen and file_get_contents without result.
But I fixed that with a temporary solution : call my own API on my own test server, which call yours.
As I'm not in a dedicated, I can't upgrade openSSL nor php version of burstcoin.fr.
sr. member
Activity: 286
Merit: 250

Nice.. though they didn't get it quite right.  The article makes it look like the hard drive space is being used to store files..  I mean I guess that is the eventual plan.  I just don't see it as a priority in my mind or the thing that makes us special.

I read it as a very close description to reality, the article points out that right now, burst has files used for managing the blockchain, but in the future, file storage will be added. The only confusion might be that i think file storage space and blockchain space will be separate, it will not be such that our plot files suddenly contain data.

I found the article very well written, and the best article about burstcoin so far. standing ovation to the guys who wrote it...
sr. member
Activity: 286
Merit: 250
I am confused on one thing with HDD mining. What is the disk space being used for? (what service is it providing and to who)?
Only for data generated by you, that is needed to mine burst.

Let me try again. I don't understand. If I mine Burst with my harddrive space, who is using my harddrive?

The whole community I think.

incorrect. "No one" is the right answer.


As of yet, the space dedicated to BURST mining, is solely for mining. it is not "made use of" in any other way.

However, down the line (it's in the roadmap) we will be adding filestorage to the coin. THEN you will be sharing your drive with others. At that point I will be able to explain to you how it works better.

I think the idea is that you will tell your burst system that it can use, say, 1TB on your drive C and 2TB on your drive D (or whatever) and then burst will make a directory on those two drives that is then used by the burst system. Yor harddisk is not shared as such, only the contents inside those two directories is accessed by the burst system. Much the same as today, but instead of plot files, the miners will create files with information in them, some of it hopefully used for an anonymouns distributed file system.

i think the features and capabilities are still out in the open, but as burst already has users with thousands of terabytes of storage dedicated to burst, that userbase can be turned into a giant cloud service pretty easily.

i imagine the following features would be practical :
anonymous decentralized (government intervention) safe file system :
- user cannot deduct which miners hold parts of his files
- miner cannot deduct which users files he holds
- miner cannot deduct what is in the files he holds
- intermediaries between someone requesting a file, and someone storing a part of it, cannot see what file is being transferred or what the contents are

- files are stored in a tree like structure, perhaps with an addition of a tag cloud per file
- files and directories can be password protected with some sort of key (not transferred, but needed to reveal contents)
- files can be stored such that neither tree placement or filename or contents can be known by other than the person storing

- people storing files, and people reading files pay some transaction fee, and people mining collect this fee as payment for the space they rent out

- files are stored in many places in many small blocks, so a lot of nodes have to drop out of the network at once before a file gets lost. The individual seeder himself of course always has his own local copy too.

- the network somehow detects if a block is getting scarce and then creates more copies of it.

Whoever creates this, will have to read up on a lot of research into distributed file systems, read up on how torrents work, read up on basic cryptology, and be a bit smart and creative on top of that.

I think it should be optional if a user wants to offer filesystem resources with his harddrive space or just plain mine for the blockchain.

the filesystem as described above will do to storage what bitcoin did to finance.
sr. member
Activity: 280
Merit: 250
Guys keep in mind, regardless of the length of your passphrase, bruteforcing will eventually find accounts. I'm actually surprised this hasn't become more prevalent. Since each wallet is ONLY a passphrase and not a username and passphrase to authenticate against, and there is not a lockout on accounts for how fast you can check a passphrase (unless the blockchain does it). All someone needs to do is bruteforce continually till it happens upon a account. Since everyone is essentially using one username which is identical for all of us and it's impossibly hard to change it once you have one (replotting).

Luckily mine is huge, but with time it will also be broken by a brute force. I'm not certain of the speed at which you could check passwords, but I assume with scripts and modern GPUs you could do some serious bruteforcing on Burst.

Burst uses 256 bit keys to protect accounts. When your passphrase has 256 bits or more entropy, the account is protected by 256 bits.
256 bits ~ 1.15 * 1078 ~ about the number of atoms in the observable universe.

Bitcoin addresses are "only" protected by 160 bits, which is more than a billion billion times easier to brute force, but even thats out of reach.

At the moment even 64 bits are - kind of - safe.

Take a look at this address:
http://burstcoin.eu/address/17139770934297222142

3 Million burst protected by 64 bits. Still not stolen. I highly recommend this guy to protect his address!
sr. member
Activity: 416
Merit: 250
[miner]

new version Burst-miner v1.150314
https://www.dropbox.com/s/luq6te1j8dn61p2/miner-burst-1.150314.zip?dl=0

* Tiny changes in algo for faster interrupt the threads (tnx haitch)
* MaxThreads (Paths) increased to 48

+ Added an option to disable the memory cleaning.
   "UseCleanMem" : false,
   (by default - true)

+ Added an option to disable "Winner info"
  "ShowWinner" : false
   (by default - true)

+ Added options to set the address of the server from which to obtain information about the winner
   "InfoAddr" : "burst.ninja"
    (by default - InfoAddr = UpdaterAddr)

   "InfoPort": 8125
    (by default - InfoPort = UpdaterPort)


also, sometimes may have the crashes  Smiley
PM to me screnshots

sr. member
Activity: 462
Merit: 250
Guys keep in mind, regardless of the length of your passphrase, bruteforcing will eventually find accounts. I'm actually surprised this hasn't become more prevalent. Since each wallet is ONLY a passphrase and not a username and passphrase to authenticate against, and there is not a lockout on accounts for how fast you can check a passphrase (unless the blockchain does it). All someone needs to do is bruteforce continually till it happens upon a account. Since everyone is essentially using one username which is identical for all of us and it's impossibly hard to change it once you have one (replotting).

Luckily mine is huge, but with time it will also be broken by a brute force. I'm not certain of the speed at which you could check passwords, but I assume with scripts and modern GPUs you could do some serious bruteforcing on Burst.

Everything can be bruteforce given enough time, but with a password of +200 char it will take ages.
legendary
Activity: 1792
Merit: 1010
Guys keep in mind, regardless of the length of your passphrase, bruteforcing will eventually find accounts. I'm actually surprised this hasn't become more prevalent. Since each wallet is ONLY a passphrase and not a username and passphrase to authenticate against, and there is not a lockout on accounts for how fast you can check a passphrase (unless the blockchain does it). All someone needs to do is bruteforce continually till it happens upon a account. Since everyone is essentially using one username which is identical for all of us and it's impossibly hard to change it once you have one (replotting).

Luckily mine is huge, but with time it will also be broken by a brute force. I'm not certain of the speed at which you could check passwords, but I assume with scripts and modern GPUs you could do some serious bruteforcing on Burst.

brute force BURST passphrase ? best of luck

thats 10^77  (that's 100 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000)
of permutations to go thru

it has to be hell of a GPU rig from here to Andromeda Galaxy

not even quantum computing will of help at most (1/2 of O) halving by Grove algorithm , maybe CTC (closed timelike curve ) but then we will have time machine and crypto will become less of an excitement  

1/2 O is significant yes.. so BURST will simply double passphrase size (as will NXT)
sr. member
Activity: 462
Merit: 250
Come on now! The PR Team needs BTC, which everyone has. Don't you the best for BURST...?

There are a huge amount of people here, still we only got six donations and are no where near to be able to use http://bitcoinprbuzz.com/services/ for the next press release.

Please, don't free ride, we are building this coin together: donate some satoshis now. Are do simply not care...?



How do a news spread? Well, if you Apple it's easy - you just announce a press conference and 800 reporters show up. For smaller businesses it's much harder, where you basically have to identify the agent whom can spread the news you have and hope for them to pick it up and the customers.

For the first press releases, Burst chose the latter with quite good results. However, doing it manually is terribly time-consuming and wont cover the whole relevant area.


There is a third alternative:

Companies specializing in distributing and getting PR published. We have used one such service with amazing results. We're featured at both Yahoo finance, Bloomberg and a number of key media sites for crypto. They were way better than us.

Of course these companies charge for their services, either in dollars or in established crypto currencies. The price for Bitcoin PR Buzz' service that we used last time is $429, but they also have a premium service for $779.

We could do this as a standard CF case but that would require that we dump the Bursts for BTC. So another way to do this is do it as a standard BTC donation case; we provide a BTC address to collect the money from the.

Here is the site: http://bitcoinprbuzz.com/services/

I promise to provide $50/0.2 in BTC to get things started. If you want an escrow or someone else in charge of the fund, we'll be happy to go with that.

For now the address is: 1AxtsE2ciNmY8Y9Rt9UBude6i1iW176oQB


What do you think? Can we count for you support...? If we could do this in a week or so it would be great, as we then would have the means to act when dev news hit us. If you donate, PM me the tx, nick and sum (we are planning a Hall of Contributers/Fame for community members supporting development!)


***EDIT: 0,227BTC ($65) donated by mmmaybe. https://blockchain.info/sv/tx/fa9f80a46e328e20e8653d7f21da83cadc0e29bf6c331dbb6a6b2706cbf0b074

https://blockchain.info/sv/address/1AxtsE2ciNmY8Y9Rt9UBude6i1iW176oQB

Just sent you 0.198 BTC for PR https://blockchain.info/tx/6882b7b20ac4896c01e53796d32ca0c9c218f95de020cd2c4ce34eb8017a7cee

I´m very exited about the upcomming update for burst and the new features....


Thank you, boba! I confirm your btc has arrived. Cheesy

Who is the third contributer besides me and boba...? Total amount is now 0,679 BTC/$200 with the anonymous donor, about half of what we need.


Should we interpret this as several thousand holders do not think spreading a press release is important...?



Please, everyone have btc change - donate them Wink They WILL make a difference!

Just PM me the tx, sum and nick. 0.02 is perfectly fine if 30 ppl does it, it's just important that you show that you support BURST and Team can spend our money on other BURST related thing Smiley

Address:
1AxtsE2ciNmY8Y9Rt9UBude6i1iW176oQB
Jump to: