Ian Miers

CS Prof. Security and applied cryptography.
Some highlights: Zerocash (zcash, et al. ), Zexe (Aleo, Aztec, etc ), zk-creds/zk-promises(...)

[Ian Miers @secparam]

@supersat they are not. https://t.co/avyr9Oma0T

[Ian Miers @secparam]

If Telegram was encrypted, maybe Durov would have better luck getting the honeypot attention he wants.

[Ian Miers @secparam]

If Telegram was encrypted, maybe Durov would have better luck getting the honeypot attention he wants.

[Pavel Durov @durov]

Unfair that CEOs who aren’t into Asian girls get fewer dating options from spy agencies.

Where are the French/Russian/Iranian honeypots? Not one spy girl sent my way. Are they even trying?

France is excused — their decision-makers aren’t into girls. Everyone else: try harder!

[Ian Miers @secparam]

Arguably, threshold sigs should die for blockchains, and we can use a migration to hash sigs/lattice sigs as an option to replace them with executable policies.

If you assume zk proofs, which likely need to anyway, you can program more realistic policies at low cost on-chain.

At the same time, we know from many of the bridge hacks that simple k of n sigs is not a major roadblock to an attacker.

[Ian Miers @secparam]

Because you need more sophisticated access policies anyway. Rate limits, white listed addresses, etc. And for PQ, you need aggregation of signatures. If you end up doing aggregation with SNARKs, which is likely for hash based sigs and maybe likely for lattices, then you get better policies for free. No need for specialized threshold sigs.

[Ian Miers @secparam]

@zkproofs @kobigurk I still can't figure out, why would you prove this in zk instead of a TEE. Or rather, how much more of a premium for security would you pay over a TEE proof of inference.

[Ian Miers @secparam]

@zkproofs @levs57 Right, I read that. What I was asking about was why the reduction gets you anything.

[Ian Miers @secparam]

@zkproofs @levs57 You got any intuitive description of the core insight ( ideally not defined in terms of interactive oracles)?

[Peter Van Valkenburgh @valkenburgh]

Today in Peer to Peer, @secparam and I take on policy issues surrounding AI Agents.
How they can rebalance power between internet platforms and their users, and how their abuse could be an excuse to impose KYC/AML style controls across the internet.

https://t.co/CNHo7XMV36

[Ian Miers @secparam]

Frenchman who wrench attacks gets wrench attacked again. Glock bests wrench, gendarmes best man.

[Jameson Lopp @lopp]

This French wrench attack has some unique twists.

The victim had already been kidnapped before in 2022.

This time, the victim managed to fire a Glock at the attackers and scare them off.

The victim received 2.5 years in prison for using the gun.

https://t.co/YMkASVZq4h

[Ian Miers @secparam]

Yes, but it very well could be more than that. hard to know (and i just edited me tweet to make that clear).
This looks like it was a sophisticated attacker, so they probably wanted to get more. If chainalysis managed to limit it to just that, and the credentials weren't used to access anything, this this is just a good warning.

[Ian Miers @secparam]

Crypto is speed running the lessons of both finance and cybersecurity. Today’s lesson from the Chainalysis breach: “there’s no such thing as a NOBUS (no one but us) surveillance capability.”

Chainalysis is, in effect, the blockchain search engine for banks, police, and spies. It’s used to analyze and annotate what’s on chain. Hard to know what was exposed at this point. Hopefully not much, so this is simply a warning.
https://t.co/BIGLNY4i6b

[Ian Miers @secparam]

quick, someone set up a commercial freezer honeypot running go.

[Thomas H. Ptacek @tqbf]

I'm calling it right now: the X-Prize for AI-assisted vulnerability research is a general, widely-exploitable, non-contrived, non-situational memory corruption vulnerability class in Golang, presumably stemming from induced data races.

[Ian Miers @secparam]

Breaches like this are why on-chain activity has to be actually private if it touches economic reality. A few throwaway addresses or decoys don’t cut it. Bitcoin and Ethereum are Twitter for your bank account. It needs to be fixed.

[Lefteris Karapetsas @LefterisJP]

At this point I really don't know what to say @gnosispay

- Full home, name and address details
- Card number
- All wallet addresses linked to the account

Extremely disappointed. You had already lost me as a user but you could have at least protected my data ....

Damn shame, really.

[Ian Miers @secparam]

@zkDragon @Justin_Bons Zcash, encrypting what Bitcoin was meant to be.

[Ian Miers @secparam]

@zkDragon @Justin_Bons "A pet rock with privacy" is a great description of a failure mode.
Yes, "Peer to Peer Electronic cash" always was the point.
The subtlety is cash also includes dollars and stablecoins. "Encrypted Bitcoin" narrows that down a bit, even though yes it comes with baggage.

[Ian Miers @secparam]

The UK really doesn't like free speech. And if you think porn doesn't matter, the next thing they are coming for is VPNs.

Free speech, crushed under a boot heel they are too busy l[the rest of this sentence may also be illegal in the UK].

[Joseph Cox @josephfcox]

UK sex workers woke up to multiple platforms deleting or restricting their content because of the UK's new porn law, despite many of the videos actually not being illegal or having anything to do with the law https://t.co/uLOeNF8DyK

[Ian Miers @secparam]

@nikitab You think double blind also goes way? Can you really get rid of one and keep the other?

[Ian Miers @secparam]

Independent price and inflation data from Bloomberg.
Would be interesting to make this cryptographically verifiable. Minimally you can commit to data as it's collected. But for prices taken off websites, you can go slightly further and get some evidence it was actually from the site via zk tls or attestations.
Thanks @austincampbell finding this.

[Anna Wong @AnnaEconomist]

An announcement that is as personal as professional:

18 months ago, we started collecting online prices in real time to track how Liberation Day tariffs were feeding into inflation.

A lot has happened since. The BLS commissioner was fired. The longest government shutdown in US history meant CPI wasn’t published for the first time. And the case for an independent measure of inflation became much stronger.

What started as a tariff inflation tracker has since grown into something much bigger:

The Bloomberg Price Project (BPP), our attempt to build the US CPI from the ground up using alternative data.

Today, BPP covers 87% of the CPI basket, across both goods and services (more new data will be added in coming weeks). Every month, we collect millions of prices from card transactions, e-commerce sites, grocery stores, pharmacies, rental listings, corporate data, Bloomberg Terminal market prices and government records. And more data are coming.

The payoff is detail. Official CPI data let you drill down to categories such as “uncooked beef steaks.” BPP goes much deeper — breaking the CPI basket into almost 700 line items, compared with roughly 200 in the official data.

Brought to you by: myself, Troy Durie, Daniel Ripperger-Suhler, Joshua Danial and Scott Johnson from across Bloomberg Economics.

Explore the Bloomberg Price Project at BECO MODELS BPP <GO>, or download the data at ECAN US BPI <GO>.

I believe the paywall on https://t.co/XYp4l1nBLn is coming down briefly so you can read this without a subscription (but you should subscribe!)

https://t.co/8Mp1itYHR7