Being certified in risk management (CRISK), in information system audits (CISA) and security systems (ISO27002), I see many potential threats not covered in Stellar network. I believe everyone that invest his/her own money here in this network (like myself) must care about it. Those who who invest their customer money (again me) must care even more ?. If we see any tiniest risk that parts might fall apart - those must be addressed and compensated via tools, protocols or controls. But so few of those are implemented or enforced so far. I've rissen some of my concerns in Dev thread - https://galactictalk.org/d/550-consensus-talk . So what could be right place to talk about it?

I like the topic you started, but at the moment I don't know what to contribute to that. I'm currently working on solution for another widespread problem - many Stellar websites / wallets ask you for secret key. It's a heaven for phishing.

Hi AigarsStaks I can't think of any serious threat. Can you elaborate more on the ones you think are out there?

[unknown] well, that current one I can't call a phishing attempt, it's too obvious. But making a new service and collecting user keys is not that hard to do, just because people are getting used to entering it everywhere

umbrel I am very interested in what you are doing, we have identified this as one of the biggest risks as we are preparing to move stellar into mainstream customers that have little to no exposure to anything blockchain. Please keep us updated on your progress

umbrel Yes, agree this latest one was very obvious, BUT to most of the consumers we are now bringing into this brave new world of blockchain would have taken that hook line and sinker! So, yes, its a problem and any solution in that direction will be great. Looking forward to hear more....

[unknown] I don't believe the solution is or will ever be technical, its got to be non-technical, as @AigarsStaks mentioned in his original post. With Clic.World we have taken a non technical approach from the beginning wrt the whole issue of identity and KYC and also security. I will post a write-up over the weekend to give an example on how we are incorporating two Stellar wallets into our social banking app where we allow members to use XLM as security against a loan, as well as adding extra security on their wallet using Personal Cluster Authentication (PCA). We will add that into the eSACCO Plus app next week so that you can see how it works - hope this will help to contribute to this discussion.....

[unknown] Sure, will connect over the weekend....

General security and specifically the problem @umbrel mentions where websites ask for a secret key was the motivation behind my browser extension project ( https://galactictalk.org/d/505-comments-requested-secure-browser-extension ) and adding support for the Trezor. Users should never have to enter their private key into a random website to use the Stellar network, but having all of these tools available as websites is really powerful and makes it easy to get started with Stellar. I'm hoping that the browser extension would be a good compromise for non-technical users.

Introducing the concept of Personal Cluster Authentication (PCA) Here’s our approach at Clic.World to add a non-technical security layer. To understand this, first a bit of background and context around the basic principle behind the Clic.World eco-system. (To get a better understanding I would also recommend reading the eSACCO ICO Prospectus here - https://esacco.co.ug/index/details/launch/ ) In short, Clic.World are busy building an eco-system of social financial clusters based on the traditional savings and credit cooperative model that is found all over Africa and in many other developing economies. The basis of these clusters is the joint management of their finances by a group of people, based on mutual trust, with the financial rewards shared by the group. (Side note - the reality of the so called “unbanked” and “financial excluded” sectors of the emerging economic world is that the sector does in fact have very organized social financial structures that have survived many obstacles in the past due to being social in nature. It may not be “traditionally” banked as in developed countries - and while primitive and unsophisticated and open to abuse - it does exist and having survived wars, genocides and natural disasters, are handling more money in most countries than the “traditional” banks by a large margin!) In these trust based clusters we found for instance that loan default rates are very low, less than 2% is common and this include asset funding and trade financing for merchants. Clic.World provides a modern fully integrated micro banking platform to enable theses clusters to provide a seamless and transparent financial service to their members and across the wider ecosystem at a low to no cost, while building revenue streams that will turn financial services from a cost to an income. Its against this background that we are introducing the concept of Personal Cluster Authentication (PCA). We are planning to use it across a number of areas in the eco-system in conjuction with the Stellar based OneClic ID function and will provide a more detailed write-up in the weeks ahead. Using it with the eSACCO Plus Stellar investment wallet is the first use case and we are learning a lot. Here’s a summary of what PCA is:- (See multi sig matrix at the bottom) Personal Cluster Authentication (PCA) is an enhancement over traditional 2FA (2 Factor Authentication) - which have either serious flaws (sms) or are expensive to implement - by using a person’s existing “real life” relationships as authentication for any changes to their digital identity or for specific transaction authorizations. To enable PCA a user designate up to 4 of their OneClic ID relationships as authenticators, which will act as Primary Authenticators. Where the user has been designated as an authenticator by another user, other than his Primary authenticators, that user will act as Secondary authenticator. The Primary and Secondary authenticators form the Relationship Authentication Cluster (RAC) for the user. Authentication actions in the RAC can be set with different levels and authentication thresholds using a combination of Primary and/or Secondary authenticators. Authenticators will receive an authentication message; users typically will then call the originator to confirm and then approve by entering their passphrase which will sign the message with their private key, or they can arrange for any other form of verification between themselves to ensure the request is authentic. The user will pay a small fee (in CLIC’s) for each authentication to reward authenticators. We are busy incorporating a second Stellar Investment account into the eSACCO Plus application, in addition to the one used as an operating account as part of the digital wallet. The idea is that you only keep a small amount of Stellar assets in the operating account and the rest of your wealth in the investment account where PCA authentication (Default) is mandatory. For the operating account PCA authentication is optional but it will not have the Clic.World escrow signing facility. We believe that 3rd party escrow service (like we see in OpenBazaar for example) will be more practical for escrow related to trading in the operating account in the future. The Clic escrow signing facility in the investment account serves two purposes - 1) as an additional security layer and 2) as a facilitator to allow the Stellar assets to be used as security against a loan. (Before Clic.World sign it checks is there’s any outstanding loans against the Stellar assets) I trust this gives you an idea of where we are going and look forward to more constructive discussions around this topic as we are all pushing to take Stellar from the current largely technical communities to mainstream users. PCA Security Levels Default Pro Vault Signing Weights Master Key 10 9 8 Clic.World Escrow Signer 5 5 5 PCA 1 Signer 1 1 1 PCA 2 Signer 0 1 1 PCA 3 Signer 0 0 1 PCA 4 Signer - - - Low Threshold 10 9 8 Medium Threshold 16 16 16 High Threshold 15 14 13 Escrow time delay option 0 6 24 (hours) Looking forward to your comments.....

andre Ok, tried my best but could not get the matrix to format!!!

Ecosystem in general

dzham

We definitely need tools to monitor network health.

As to legal contracts between nodes, if we had that, we wouldn't need as complex a consensus mechanism as we have already. It's this complex, because it doesn't rely on nodes behaving "good".

Putting nodes in a qset is your node stating that you trust these nodes to not collude against you. You're not trusting any individual node to behave in a certain way, you're trusting a set of nodes to not work against you.

AigarsStaks

dzham Thank for reply.
You are referring trust in particular transaction. Legal framework does not help because it cannot handle messaging conflicts. So distributed ledger is invention to handle it technically.

But here is also trust in whole network. Every network handles it differently.
If you work out model, especially financial model, it cannot be built on "good weather expectations".

bitcoingold1234

The point is: wallet protection or phishing can't be more significant problem in Stellar that anywhere else, there's need of tools to monitor the network in general

CryptoPlanet

Phishing is a big problem in general, I would appreciate any advice how to avoid in in everyday life

Crypt0Pro

Hi CryptoPlanet!You should take measures for the security of your wallet and all the transactions.

VladEx

You can check this http://www.phishing.org/10-ways-to-avoid-phishing-scams. It is a good guide on how to avoid phishing

CryptoPlanet

VladEx yeah, interesting tips

Crypt0Pro

Hey VladEx, thanks for the useful link!

« Previous Page