Topic: NXT :: descendant of Bitcoin - Updated Information - page 1966. (Read 2761645 times)

Just forget about SMS, email, fingerprint and drone verification is no way to do that, the system would be centralized and easy to break.

The problem is that the "lucky gold strike" loophole for somebody else to hit this new account when miskeying their own password exists just like it exists for the old one.  Psychologically to the public this is always going to be perceived as a flaw because they don't understand how unlikely it is.  You haven't increased security one iota, you have only created a different winning lottery number.  

Publically announcing to the world not to accept withdrawals from an account closes this loophole.  That will make a huge psychological difference to the public.  And I am telling you, for NXT to succeed with the public, irrational psychological issues are going to have to be addressed.

This can be done with existing functionality.
Just create new account, send coins to it and never use this account until NXT costs $500.
This is absolutely the same scheme as yours. And it's free

It's a nightmare I have often.  

I am terrified of keystroke loggers.  The more widespread NXT becomes, the more keystroke loggers are going to be deployed to steal it.  That's a fact.

I am only running my main NXT account on an old XP laptop that I sanitized by doing a zero bit overwrite of the hard drive and reinstalling the OS from a Dell reinstall disk followed by the minimal add-ons like Java etc being brought over on a CD instead of via online downloads.   This laptop is now used for NXT and that's it.  I'm working on creating a second identical sanitized laptop as a backup.  I have a hidden and uncommented local handwritten copy of my random password generated offline on the laptop using Awesome Password Generator 1.4 from Google (you know, the guys that are secretly partnered with the NSA) and another handwritten copy in my bank vault safe deposit box.  

I still worry.

I understand that the user space is unimaginably huge at something like (I think I remember seeing) 10^70 - but still.  One lucky hit by somebody else miskeying their own password under the current scheme, and it's all over for you.  That's a fact, too, mitigated only by just how much luck the thief would need to have.  I've got a degree in math and I understand probability and it still doesn't do much to calm the reptilian fear in my brain.

Is there a separate white paper PDF someplace that goes over in detail from scratch / first principles the entire NXT security scheme and just the security scheme?  If not, there needs to be.  We are going to have to point specifically to that information over and over and over as more and more people come to risk larger and larger sums that the security scheme is adequate - particularly when single colored coins are made that could be worth millions of regular NXT.

So, bottom line, I think we need a security whitepaper PDF and a link to it.

Your account number is public key already. You're constantly trying to create unnecessary entities.
Want to "freeze" some coins with some new private key? Just create new account with this key, trasfer coins to it, and then use this key only when you need to spend this coins.

If you acc got hacked they will take all not leaving you with 100K.

I want to tell the world to never accept a withdrawal from my NXT account.  To do this I click a button on my client and go to a special page.  I pay a NXT fee and the page generates two numbers, a public key and a private key.  I attach the public key to a colored coin.  THis is my announcement to the world to lock my account...

If you acc got hacked they will take all not leaving you with 100K.

Yes, that was me. Just created a new account, though, and sent the remaining 100k there.

Your account number is public key already.

How about this - you can pay a fee to tell the blockchain that no further withdrawals are to be accepted from this account for all future times, and upon payment of the fee you register a second 50+ character password that can be used in the future to inform the blockchain to reauthorize withdrawals from the subject account.

We gotta do something here.  There are multiple reports of people having their NXT wallets emptied when they didn't want it to be during the low volume alpha / beta operations shakedown of NXT.  We have to do more that just say, "Well, if you used a strong password, it wasn't hacked by brute force".

There's no such procedure like opening or closing account. Account is just a number. In decentralized network anyone can view any transactions in any accounts, f.e. using blockchain explorer.
But you need corresponding private key to transfer coins from that account.
Current software ask you to enter private key before you do anything with your account, but it is design flaw of software, wihich can be fixed.
And, yes, this long passphrase can be saved to file. If you name this file "wallet.dat" you make life of troyans easier

I am not taking any position, I am just stating facts.
Crypto currencies will never be for everyone to use, because many people are just lazy to learn to use them properly and safely. Just like guns.

It's not a hole in the system. It is a hole in Average Joe mind. Which can be fixed using banks.
But banks must not be part of system, part of decentralized network.

As a public key on a colored coin?

Register password... register... WHERE?!

How about this - you can pay a fee to tell the blockchain that no further withdrawals are to be accepted from this account for all future times, and upon payment of the fee you register a second 50+ character password that can be used in the future to inform the blockchain to reauthorize withdrawals from the subject account.