The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [security]

For questions relating to the security of IoTA and how to mitigate these issues or avoid them altogether.

Filter by
Sorted by
Tagged with
5
votes
3answers
262 views

Should full nodes be public?

Since part of the security comes from it being hard to find enough nodes to peer with to influence the selected transactions, should full nodes be mostly hidden? Will a IOTA attack consist of botnets ...
2
votes
1answer
114 views

Could a sensor be hacked to steal the money in its wallet?

If there is a sensor with a wallet and someone steals the sensor. Wouldn't it be easy for him to hack the sensor and find the seed?
8
votes
1answer
123 views

Is it safe to expose the API to the public? [duplicate]

I just got a full node up and running, following the guide on here http://iota.partners/. I have a firewall on, so all ports are blocked except for UDP 14600 and TCP 15600. In my iota.ini file I have ...
3
votes
3answers
104 views

Sending seeds to someone securely

If I want to send a seed to someone. How would you do it securely? Is it maybe even possible through the tangle? For example I have a seed with 50Miota and I want to give it away to a friend who ...
2
votes
2answers
57 views

How can I trust a wallet?

as there will be many IOTA wallets in the future. How do I know which one I can trust. I think it would be easy to implement a code that sends your seed to someone else, right?
2
votes
2answers
116 views

Will a specialized chip make IOTA more secure

There are rumors and hints coming directly from the IOTA team about some specialized chip based on the ternary logic being developed somewhat secretly. Because Curl hash function uses ternary logic ...
5
votes
1answer
381 views

What does it mean that “the tangle is network-bound instead of hash-power-bound like blockchain”?

Can someone explain me in a very simple way what should an attacker do to double spend in IOTA? In the whitepaper I read that a double spend transaction should outweigh the legitimate subtangle. ...
9
votes
1answer
257 views

How are addresses calculated from the seed?

I was wondering how addresses are calculated from the seed. Specifically, I thought it was using the hash of the seed plus a nonce to create the address. But I would appreciate if someone could shed a ...
7
votes
1answer
457 views

Can someone explain very simplified how the Winternitz OTS/Lamport OTS works?

I read the Wiki example, but I am still confused to be honest. Could someone provide a really simple example?
5
votes
2answers
79 views

How much of my security is improved using other levels of security when generating the seed?

I had a hard time answering this question because I do not know how much security levels improve security in quantitative terms. Is this right? e.g. (Hashspace increment) 81 trits => 27^81 ^1 (low ...
1
vote
1answer
41 views

How to copy and paste Seed from passwordmanager to light wallet [duplicate]

To confuse a keylogger I don't copy and paste the whole seed into the light wallet, but only part of it and the next part I write by myself before copy and past the next part and so on. Or I write ...
4
votes
1answer
91 views

What does the `security` param for `getNewAddress` do?

When I create addresses in the API library (i.e., using getNewAddress()), there is an optional security parameter. What does this parameter do, and what values does it accept?
4
votes
1answer
75 views

Does reattaching a transaction compromise my private key for the source address?

The answers to this question state that reusing the same address for spending several times seriously compromises my private key so that should never be done. However, isn't this exactly what is ...
6
votes
1answer
66 views

Can I be forced to reuse an address by confirming a transaction that is part of a double-spend attempt?

Imagine somebody injects two transactions d1 and d2 into the network that together represent a double-spend attempt. Having only incomplete information of all latest transactions in the network, I see ...
7
votes
2answers
201 views

What is the difference between “double-spending” and “address-reuse”?

As far as I understood: double-spending: is when you do a second outgoing transaction while another one is still in pending. (this is possible only with Android wallet, because the light wallet [...
7
votes
1answer
90 views

Why are there no safeguards in place to prevent sending a transaction to a used-up address?

I have offered up one of my addresses to be used for donation purposes; I withdrew funds to a different address, and a now a third party has deposited funds to an address that has already been emptied ...
2
votes
3answers
792 views

How can IOTA's proof of work provide sufficient network security?

This is a controversial post I found in the IOTA slack. The concerns are regarding IOTA's security. How does IOTA approach the specific statements? IOTA is fundamentally broken. It's a PoW ...
31
votes
1answer
617 views

How does the system sustain regular low-effort “splitting attacks”?

The whitepaper focuses mainly on attacks in which an attacker tries to double-spend. So the section about the splitting attack examines the case that an attacker tries to effectively create two forks ...
0
votes
2answers
389 views

How can I know if my IOTAs were stolen?

I see that my balance is 0i, yesterday there was a positive balance. I see a transaction confirmed going out that I didn't make. I created my seed using an offline /urandom command and mixing up few ...
-1
votes
1answer
53 views

Why is it insecure to use an address more than once and will/can this be mitigated in future wallets or updates? [duplicate]

Can somebody explain to me why using addresses more than once is insecure and whether this will always be an issue or can it be mitigated in wallet or software updates? Thanks.
6
votes
1answer
102 views

What prevents a malicious node from receiving a transaction and, instead of relaying it, attempting to compromise the now-weakened address?

For example, this scenario: I broadcast a transaction from a previously-unspent-from address, for a large amount, say 1 Ti. The full node I broadcast to is a malicious actor who has been waiting for ...
9
votes
1answer
110 views

Does every pending transaction pose a threat for my remaining funds in the wallet?

A moderator on slack told me that every pending transaction poses a threat for my remaining funds in the wallet. Especially when a transaction stays pending for a long time or never confirms. As far ...
4
votes
1answer
80 views

How do I configure a public node?

How can I configure my node such that it is secure for public access? I am aware that I can use either the --remote-limit-api launch argument, or by setting it in my ini; REMOTE_LIMIT_API=...
14
votes
2answers
176 views

Can a node steal my seed?

Could someone theoretically set up a node to siphon seeds from people who connect to it? Or is the seed always safe? How is it handled internally?
6
votes
2answers
201 views

Authenticated remote IRI API calls. Fullnode startup flags and config

I want to enable API calls to my full node from an host besides localhost. The question is what startup flags or equivalent entries in an .ini config file do I need to make authenticated API calls? ...
6
votes
2answers
270 views

What's with all the pending/unconfirmed transactions with the “STOLEN”?

I've noticed that every few seconds transactions show up on live Tangle trackers with a tag of: 9999STOLEN9IOTAS999F***9YOU Here a pending one valued at $144k which appeared 3 minutes ago: ...
6
votes
1answer
249 views

Why aren't seeds longer than 81 trytes more secure?

From the wallet FAQ: In order to ensure that only you got access to your iotas you ought to create a sufficiently complex seed. This means a randomized 81 character seed consisting of latin letters ...
13
votes
3answers
948 views

What information is leaked if I reuse an address?

Everyone knows that spending from an address multiple times is bad, because Winternitz OTS. But, what does that mean, exactly? What information is leaked in each signature, and how would an attacker ...
6
votes
2answers
300 views

What happens if I receive IOTAs at an address I've already spent from?

Suppose I spend funds from an address, but then there's a software bug, or user error, or somebody sends IOTAs to that address afterward, and now I have a used address with a non-zero balance! What ...
9
votes
3answers
124 views

Secure Way to Copy & Paste Seed into Desktop Wallet

I am afraid of keyloggers or other malware on my computer. What is a secure way to copy and paste the Seed from my password manager into the desktop wallet?
14
votes
2answers
791 views

How does IOTA make itself resistant to quantum computing based attacks?

IOTA has been described as "quantum resistant" (not "quantum secure"). What steps did the developers take to make the protocol resistant, and are there further steps that need to be taken in the ...
6
votes
3answers
286 views

How can I verify whether an address I've created offline is valid?

For security reasons I've created an IOTA address offline. Before I transfer into this address, how can I ensure this address is valid?
4
votes
2answers
364 views

How many full IOTA nodes are there, and how many do there need to be?

How many full nodes are there currently in the network? Are there any sites that track the currently connected nodes in real-time? Leading on from this - which should perhaps be a separate question - ...
4
votes
0answers
121 views

Hosting a Full Node - Best Practice [closed]

Hosting a full node results in some security questions. Which API Parameters (--remote-limit-api) are necessary to accept connections from light wallets without giving them to much permission?
21
votes
1answer
473 views

What can an attacker with 34% of total hash power do?

At the moment the coordinator protects the network from 34% attacks. What exactly can and can't such an attacker do when the coordinator is shut down?
9
votes
1answer
93 views

DB snapshots for the masses - are there any risks?

I have created a tutorial and a slack channel #fullnodes-ger for the installation of a full node (currently only german) and do a DB snapshot of me for many people who follow this tutorial, so that ...
27
votes
9answers
1k views

How to generate a seed safely?

I am sceptical about online generators. How could I generate a IOTA seed safely offline? Does it need to be on a specific format?
19
votes
2answers
381 views

How can I safely store my IOTA seed?

I currently store my seed in a plain text file, backed up on a USB drive, which is a security risk. What is the safest way to store my seed since there is no IOTA hardware wallet available yet?