14

The current voting process is anonymous. It will be impossible to prevent any major ADA holders from influencing voting to favor a particular project proposal and take money from Treasury. However, robust safeguards are in place. These are as follows:- The proposal goes through an open assessment process. Most probably, a pure money-draining proposal will ...


9

The 51% attack is used by an attacker to take over the blockchain. Usually, the community of a blockchain has to reach consensus, which means that once someone mints a new block, other nodes validate it. The majority has to agree that the new block is valid and thus the blockchain has grown one block. All other nodes accept the new block and all it's content ...


7

I would argue the Yoroi browser extension is much safer than the iOS application. Browser extensions provides double-sandboxing and is considered safer than most of the desktop applications. The browser itself is sandboxed from the rest of your computer and the extensions itself is sandboxes from talking directly to other extensions or to other websites ...


5

2FA (in the traditional sense) relies on a shared secret. By design, this can only work in a centralized environment like an exchange or an online wallet, not with a wallet that interacts directly with the blockchain. But there are other ways to achieve this, and a multi-sig would be possible and kind of the blockchain equivalent of 2FA. Multi-sig means, for ...


5

One of the biggest security threats right now is malware and key loggers. That is why offline backup and hardware wallets are so important, as you try to shield your signing keys from your day to day computer. You could use the method you have described on a dedicate laptop that has been airgapped (no network or outside world connection). However, hardware ...


5

As much as I'm voting to close this question as it is opinion based, I'm going to provide my insight as it can save people money. For me, they are not trustworthy because: The initial team and most of the team is anonymous They have no track record of previous projects They have a plan to take millions of dollars from the community but they do not have a ...


5

The Haskell reference implementation of the Cardano node, leaves no such decisions to the slot leader, and most (if not all) are using that node implementation. As far as the Cardano protocol is concerned, however, the slot leader could cherry pick transactions and for example prefer those with higher fees.


4

The 51% number would imply the attacker controlled 51% of the STAKED ADA. Not necessarily 51% of all ADA. Of course the closer we get to 100% of all ADA staked the closer those two numbers get to each other.


4

No that is a scam! No one is ever going to "return ada to your wallet". There will never be an ada giveaway from IOG or Charles Hoskinson.


3

Not at the moment, as the fund rounds are still small. But in the very near future, in order to vote in Catalyst, you would have to freeze your funds for the period of voting. This will prevent larger regulated entities such as binance, eToro or Kraken to participate, as it is against their regulation to prevent customer's liquidity.


3

The pool keys control the pool and can never be changed. If your pool keys are exposed, then you have lost control of your pool (this doesn't necessarily mean your pledge, but control of the fees, where the rewards go, the deposit, etc.). If you create these keys on an online machine there is increased risk of the keys being exposed, for example from things ...


3

The risk is the same as storing the encrypted login details of your bank account in a password manager. However, the bank may have their own controls that limit withdrawal amounts, monitor/block suspicious activity etc. So, although the risk is the same, the consequences can be different. The primary vulnerability moves from the password manager to the ...


3

Can you run a stake pool pseudonymously? Yes you can. The only things I can think of that could be used to identify you would be your public IP address or, DNS records (at least at a public knowledge level of anonymity.) And there are ways to mask those. Would this be preferred to prevent hacks, enhance DevSecOp, and potentially avoid future KYC requirements ...


2

Keep in mind that in the future IOG is planning to have lightweight version of Daedalus. For now Yoroi is very convinient and in terms of security is in the same level as Daedalus. In fact Charles Hoskinson discussed that is debatable if they did a mistake by going in the current direction with Daedalus instead of implementing mobile lightweight solution as ...


2

Some specific answers to your questions. I don't know that there is a great answer to this. Your options range from putting it on paper and in a safe deposit box in a bank, to storing it one word at a time in random places (like an escape room scenario). There are some very cool physical devices for storing seed words that are made if metal to be fire ...


2

I'd take a look at this answer It seems a very well resourced attacker would be able to find a used private key for 128bit seed. This would be an attack on all keys in the network, not yours specifically. For 256bit seed, it should be infeasible.


2

128 bit for 11 seed word and 256 for 27 seed word for 128 bit 1.02 x 10^18 years.


2

I found another answer in this article about Cardano (from 2019). This paragraph in particular: In Cardano, exchanges will get special enterprise exchange addresses that cannot participate in network consensus and governance. Although there is no technical way to enforce exchanges to use these, social pressure by the exchanges’ customers could push them to ...


2

I have reported this Telegram Channel. This was an important security question in my opinion


2

Ledger live doesn't have a google add-on, you were only scammed. There isn't a way to get hacked with ledger live unless you accept a transaction. I've been using Ledger since 2017 it works as long as you pay attention to what transaction you're accepting on your ledger device. Those people who got hacked via a sim swap didn't understand basic cyber ...


2

About password and physical access First of all, your wallet must be password-protected and then, as you already said, it will be encrypted. You also need a strong OS password to protect your computer from physical access. And yes, remote attacks are highly possible (in case you installed Daedalus on a machine that's used for web surfing). So Firewall is a ...


2

Each of your Cardano nodes needs a static IP address to communicate between each other. You can use IP or domain names. Block Producer (BP) node For better security, you can choose to set a private IP to your BP node to communicate with your relays (on the same private network) since your BP is hosting sensitive data you don't really want to expose. Relay ...


2

Cardano uses the Hierarchical Deterministic key generation scheme (specifically that of BIP44-ed25519), which is an offline process that can be done without an internet connection. As such, there is no way to know that your master key has been compromised unless it is used to submit a transaction. However, clever use of NFTs and Plutus scripts enable us to ...


1

The off-chain code is executed by a single node to construct the transaction which is then disseminated to the other nodes. I think it is indeed possible to keep this node busy with a never ending loop in the off-chain code. The thing is that - to my knowledge - there are no public entry points for the nodes to execute arbitrary off-chain code. You must ...


1

Cryptography is the science of secret writing with the intention of keeping the data secret. Cryptography is classified into symmetric cryptography, asymmetric cryptography and hashing. Private Key: In Private key, the same key (secret key) is used for encryption and decryption. In this key is symmetric because the only key is copy or share by another party ...


1

for the sake of potential loss of your balance i wold say dont untill your absolutely sure but you would assume yes seeing as its called a public key meaning its publicly visible


1

I tried to start a conversation about this here, remains to be seen whether I'll be successful in generating dialogue. But outside of Cardano internals like Ouroboros or the plutus metatheory, the task of formally verifying contracts and dapps built on top of / with those artefacts doesn't appear to me to have a unified solution we can point to yet. I will ...


1

I built a fully offline Raspberry Pi solution on another coin years ago using QR codes, and cameras as readers. Cardano is similar in the fact that you 1. build a transaction, 2. sign a transaction and then 3. broadcast a transaction. Only the signing part needs access to your keys. As an early step just transferring the data from step 1 to the computer, ...


1

I've done something similar on a Virtual Machine. I have a Linux based operating system for additional security. Doing as you propose is basically the same as using a Ledger/Trezor. The additional risk with your setup is that you have your wallet on a computer that can run additional code that a hardware wallet can not. Every time you connect it to the ...


1

The question is, is it worth the trouble instead of spending $70 for a warranted and battle tested hardware wallet? My answer to your post is that is probably not, if you are not doing anything specific that a hardware wallet can't do (like minting NFTs).


Only top voted, non community-wiki answers of a minimum length are eligible