Top all-time · #5409
Joseph Bonneau
Personal blog · jbonneau.comsecurityeconomics
Joseph Bonneau's personal blog at jbonneau.com covers security and economics. Since 2014, 15 different Hacker News readers have linked it 17 times, most often “Research perspectives and challanges for Bitcoin and cryptocurrencies [pdf]”. No feed was found, so read it on the site itself.
Too few sampled comments (11) to say how often HN recommends it.?
Why HN links it
HN readers link Joseph Bonneau's academic papers, mostly PDFs, on passwords, Bitcoin and cryptocurrencies, key transparency and passphrase analysis. Commenters cite them as overviews and sources.
Summarised by Claude from a sample of 11 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Research perspectives and challanges for Bitcoin and cryptocurrencies [pdf]4 people · 4 mentions · first linked 2015-03-02
- Bribery Attacks on Bitcoin Consensus [pdf]2 people · 2 mentions · first linked 2015-05-21
What Hacker News says?
There's a big difference between what people should do, and what people actually do. Research consistently shows that a large percentage of people reuse passwords across many sites. [1] http://www.jbonneau.com/doc/DBCBW14-NDSS-tangled_web.pdf
Comment linking /doc/DBCBW14-NDSS-tangled_web.pdf
on “Still locked out of my AWS account”Submitted Bribery Attacks on Bitcoin Consensus [pdf] as a story · 30 points
HN discussionI found this to be a good overview paper. Research Perspectives and Challenges for Bitcoin and Cryptocurrencies http://www.jbonneau.com/doc/BMCNKF15-IEEESP-bitcoin.pdf
Comment linking /doc/BMCNKF15-IEEESP-bitcoin.pdf
on “Ask HN: A good primer on cryptocurrencies?”Submitted The Quest to Replace Passwords [pdf] as a story · 21 points
HN discussionFor another example of how Ethereum might be useful for certificate transparency, there's a fascinating paper from 2016 called "EthIKS: Using Ethereum to audit a CONIKS key transparency log" which is probably way ahead of its time. Abstract: https://link.springer.com/chapter/10.1007/978-3-662-53357-4_... PDF: https://jbonneau.com/doc/B16b-BITCOIN-ethiks.pdf
Comment linking /doc/B16b-BITCOIN-ethiks.pdf
on “Pypi.org is running a survey on the state of Python packaging”Submitted Upgrading HTTPS in Mid-Air [pdf] as a story · 8 points
HN discussionRight, this is basically Binary Transparency, with the same sort of social mechanisms in place as Certificate Transparency has for dealing with misbehaving CAs. The idea of storing release hashes (or public keys) in a distributed, permissionless, append-only log actually makes a lot of sense, and there are several serious proposals for how to do this, such as EthIKS: http://www.jbonneau.com/doc/B16b-BITCOIN-ethiks.p…
Comment linking /doc/B16b-BITCOIN-ethiks.pdf
on “Did Australia Poke a Hole in Your Phone’s Security?”Submitted Research perspectives and challanges for Bitcoin and cryptocurrencies [pdf] as a story · 2 points
HN discussionAs seems to be a pattern with this blog, the article is a little too similar to existing materials to not have any citations. Here the tree starts at Wikipedia, bounces through Archive.org and ends up at a Danish blog with some interesting images: http://en.wikipedia.org/wiki/Vertical_loop http://web.archive.org/web/20070827183113/http://fy.chalmers... http://www.matematiksider.dk/vejgeometri.html Nothing is taken d…
Comment linking /publications.html
on “Why are roller coaster loops not circular?”Submitted Research Perspectives and Challenges for Bitcoin and Cryptocurrencies [pdf] as a story · 2 points
HN discussionI am a bit confused by the reaction and commentary. ASICs are kind of the natural next step, so it is not surprising at all for any serious miner to go there. Hence, this appears as a too reactive really short term move and I wonder about the reasoning behind this. The number of units to break even is not that high -- here is one random example, a google search away, that seems right to me -- from what I can recall…
Comment linking /doc/SBBR16-FC-mining_pool_reward_incentive_compatibility.pdf
on “Monero Declares War on ASIC Manufacturers”Submitted Research Perspectives and Challenges for Bitcoin and Cryptocurrencies [pdf] as a story · 1 points
HN discussion> By ensuring that no person could obtain an advantage over others, and by ensuring that anyone could join without exclusion, Satoshi created the Nash equilibrium to permit normally byzantine parties to enter and share safely in the definition of a shared network of contested assets. This is roughly true, although Nakamoto's original paper only proves this for the case where no single entity controls > 50% of the mi…
Comment linking /doc/BFGKN14-bitcoin_bribery.pdf
on “What Satoshi Did”I don't know if you're joking, or if the people downvoting you think that your idea isn't worth hearing, but it's actually a good idea (if we can look past our snobbishness about how over-hyped blockchain technology has become). Part of the threat model around malicious software updates requires that we implement reproducible builds and store the hashes of builds in a distributed permissionless append-only database.…
Comment linking /doc/B16b-BITCOIN-ethiks.pdf
on “The Node.js Ecosystem Is Chaotic and Insecure”If you are interested in this sort of analysis, I recommend reading into works by Joseph Bonneau: http://jbonneau.com/publications.html
Comment linking /publications.html
on “PIN number analysis (2012)”> I understand that the exchange can prove control of a certain amount of bitcoin, but how can they prove the amount of credit they have extended? By definition the credit is uncoupled from any blockchain, right? Solvency has two parts: Assets and liabilities. The 'prove control' is the assets part. The other side of a solvency proof is that they can, without breaking anyone's privacy) show that every user's account…
Comment linking /doc/DBBCB15-CCS-provisions.pdf
on “You don't understand money – and it's a good thing for Bitcoin”Except that then you have a list of common phrases that you can check. How many passpharses would be: "in god we trust" or "I love you". Figure out song titles and book titles, and you have a great list to check. See also: https://jbonneau.com/doc/BS12-USEC-passphrase_linguistics.pd...
Comment linking /doc/BS12-USEC-passphrase_linguistics.pdf
on “On PBKDF2 Iterations”
