Category Archives: Technology

ProtonMail: la empresa que quiere llevar el cifrado al correo para las masas frente al “viejuno” PGP

¿Has intentado alguna vez cifrar tu correo con desarrollos como PGP? Si lo has hecho probablemente te hayas dado cuenta de que el proceso no era ‘apto para principiantes’. Proteger la privacidad del correo parecía hasta no hace mucho una opción solo abierta a usuarios avanzados.

Afortunadamente hay alternativas: ProtonMail quiere cambiar esto con un servicio de correo electrónico web que garantiza la privacidad de nuestros mensajes. El objetivo es tan simple como llamativo: que solo lea tu correo quien tiene que leerlo.

PGP era estupendo salvo cuando no lo era

El descubrimiento de cómo la NSA lleva años dedicándose a espiarnos todo lo que puede fue una revelación para muchos, pero no para los que también llevaban mucho tiempo tratando de proteger sus comunicaciones.

Mail

Parte de esa labor estaba centrada en la protección de nuestras cuentas de correo electrónico, que a menudo se basan en servicios gratuitos como los que ofrece Google con Gmail. Es cierto que las prestaciones del servicio son fantásticas, pero al usarlo nos convertimos un poco en fuente inagotable de datos para Google (y para otros muchos proveedores), que suelen recolectar esos datos para servir publicidad contextual en el navegador.

Para atajar ese problema —para los que lo consideran como tal— hace mucho que surgieron plataformas como PGP que permitían proteger la privacidad de las comunicaciones y, en concreto, del correo electrónico. El problema es que la plataforma, fantástica en su concepción, no lo era tanto en experiencia de usuario: ponerla en marcha en nuestro cliente de correo no era nada sencillo, algo que frenó su potencial expansión.

Alternativas como GPG (GNU Privacy Guard) planteaban teóricas mejoras y además eran interoperables, y aunque aparecieron clientes con soporte para estas plataformas —o nativos como Claws Mail o Evolution o a través de extensiones, como las que aparecieron para Thunderbird—, su configuración y uso echaba para atrás a los usuarios sin conocimientos avanzados. La alternativa es precisamente la que dan servicios como ProtonMail —aunque hay otros—, que desde su creación tiene como objetivo la protección de la privacidad de sus usuarios.

¿Para quién es la privacidad que ofrece ProtonMail?

La mayoría de empresas que proporcionan servicios de correo electrónico son susceptibles de tener que responder ante las autoridades (siempre con la aprobación de un juez) si éstas necesitan tener acceso a ciertas cuentas por motivos diversos.

Inbox

En ProtonMail, en cambio, no solo se centran en proporcionar seguridad y privacidad a nivel tecnológico, sino también a nivel legal y judicial: sus creadores situaron su base de operaciones en Suiza, un país que no forma parte de la Unión Europea y que tampoco depende en modo alguno del gobierno de los Estados Unidos, aunque sí tenga un acuerdo con ese país si hay peticiones legales legítimas. Han colaborado en el pasado, pero también han rechazado algunas de esas peticiones, como demuestra el informe de transparencia publicado por los responsables del servicio periódicamente.

Las leyes de privacidad son especialmente fuertes en dicho país, y de hecho los creadores de ProtonMail afirman en su sitio web que “creemos que la seguridad total solo se puede conseguir con una combinación de protecciones tecnológicas y legales, y Suiza proporciona la combinación óptima de ambas“.

Esa protección legal parece especialmente adecuada si el usuario está especialmente preocupado por si ciertos gobiernos pueden acceder a sus correos. Más delicada es la cuestión de si esa protección es mayor frente a posibles hackers. Aquí nos enfrentamos a otro riesgo, y es al de que un ciberatacante trate de acceder a nuestro correo desde la raíz, no logrando acceso a la empresa que proporciona el servicio.

Decrypt

En este caso la seguridad que ofrece ProtonMail es muy fuerte para los que tratan de acceder a los datos mientras se están transfiriendo —el cifrado a extremo a extremo protege bien ese ámbito— pero no necesariamente tanto en el acceso al servicio, que se basa en el uso de un usuario y una contraseña.

Es el mismo método que usamos en otros tantos servicios de correo como Gmail o Outlook (hace unas semanas ProtonMail hizo más fácil aún interactuar con Outlook, Thunderbird o Apple Mail), y de hecho tanto en unos como en otros es posible (y muy recomendable) activar la verificación o autenticación en dos pasos que nos permite usar por ejemplo nuestro móvil para que nos llegue un SMS cuando queramos entrar en nuestra cuenta.

A diferencia de ProtonMail, no obstante, en Gmail hace tiempo que es posible usar tokens físicos, llaves de seguridad hardware que hacen que solo podamos acceder al correo si tenemos conectado un dispositivo físico como un pendrive USB específico o un dispositivo Bluetooth que aprovechando la tecnología FIDO.

También hay que señalar por ese lado que ProtonMail no usa verificación en dos pasos con SMS, algo que sí hace Gmail y que desde hace algún tiempo no es tan buena idea: en su servicio hacen uso del protocolo Secure Remote Password (SRP), una evolución de la idea que evita los problemas que plantea ese sistema basado en SMS.

Un cifrado punto a punto con letra pequeña

Si hay una característica destacada de ProtonMail, esa es la del cifrado punto a punto que este servicio de correo electrónico ofrece a sus usuarios. Ni siquiera los propios desarrolladores pueden acceder a esos mensajes, que como ocurre en el caso de algunas aplicaciones de mensajería como WhatsApp o Telegram, protegen el contenido del mensaje antes de enviarlo.

Esa apuesta de ProtonMail se extiende también a cómo registra nuestra actividad, o más bien, a cómo no la registra. A diferencia de Gmail, por ejemplo, no se monitoriza la actividad del usuario y tampoco su dirección IP.

Los responsables de ProtonMail destacan cómo en su servicio no hay conflictos de interés: otros servicios usan la actividad de los usuarios para recolectar información y utilizarla para ofrecer publicidad contextual, pero en ProtonMail evitamos esa filosofía porque básicamente estamos pagando por proteger nuestra privacidad.

Bob Alice

Eso si pagamos, claro, porque ofrecen una cuenta gratuita con 500 MB de almacenamiento, una forma óptima de probar el servicio. A esa opción se le suma la del anonimato (al menos parcial, porque tenemos que confirmar la apertura de la cuenta con un código enviado por SMS): ProtonMail no nos pide datos personales para abrir cuenta, y de hecho podemos ir más allá en la protección del anonimato si usamos la red Tor. La posibilidad de enviar mensajes que se “autodestruyen” también es útil, aunque la utilidad de esa función es discutible sobre todo cuando uno puede acabar sacando capturas de pantalla de esos mensajes.

Es importante recalcar que ese cifrado de ProtonMail ## solo funciona de forma nativa en un caso: si tanto el usuario que manda el correo como el que lo recibe hacen uso de una cuenta de ProtonMail. En otros casos hay una matización importante, aunque ese cifrado nativo del servicio sigue siendo funcional. Es perfectamente posible enviar un correo cifrado desde ProtonMail a un usuario con Gmail, por ejemplo.

Si lo hacemos, eso sí, el destinatario no recibirá el contenido de nuestro correo como lo hemos escrito, sino que en lugar de eso recibirá un enlace “seguro” para poder abrir el mensaje cirrado e incluso una pista para que el destinatario averigue la contraseña (algo que solo ellos dos sepan) y la introduzca para leer por fin el mensaje.

Críticas razonables a ProtonMail

Los argumentos con los que los responsables del servicio defienden las ventajas de ProtonMail son interesantes, pero en muchas de esas afirmaciones hay también espacio para el debate.

Protonmail 0

Por ejemplo, en ProtonMail presumen de no estar sujetos a las obligaciones de otros servicios gracias a tener su sede en Suiza. Como indicaba un usuario en StackExchange, “los electrones no tienen nacionalidad”, y las transferencias de datos no tienen siempre una posición geográfica definida.

Los problemas sufridos por empresas como Lavabit, que tuvo que cerrar por las presiones gubernamentales —ha vuelto a resurgir de sus cenizas—, demuestran lo difícil que pueden llegar a tenerlo estos servicios para seguir operando. Tenemos también casos como el de Hushmail, que a pesar de sus promesas sobre proteger la privacidad de sus usuarios acabó cediendo datos en una investigación gubernamental.

Otra de las críticas razonables y razonadas la plantearon varios expertos e incluso fue valorada por los creadores del servicio. El llamado “Modelo de Amenaza” (Threat Model) de ProtonMail trata de aclarar para quién y para quién no está destinado ProtonMail, y aquí esos responsables explicaban como una de las bases del servicio es “ser usable”.

Protonmail 3

Esa usabilidad hace que tengan que hacerse ciertos sacrificios, y uno de ellos está precisamente en ese cliente web y en una criptografía en los que el uso de JavaScript plantea potenciales ataques. Los creadores planteaban cómo han implementado “numerosos mecanismos de seguridad para evitar ataques a nuestros servidores”, pero aún así dejaban claro algo peculiar:

Si eres Edward Snowden, o el próximo Edward Snowden, y estás ante una situación de vida o muerte que requiere privacidad, no te recomendamos usar ProtonMail. Para situaciones extremadamente sensibles, usar el correo electrónico para comunicarte simplemente no es buena idea.

Las mismas dudas plantea esa promesa de que no pueden acceder a tus mensajes: cuando usas ProtonMail te conectas a sus servidores y escribes el mensaje con su cliente webmail, lo que hace posible (no necesariamente fácil o factible, pero la opción existe) que pudieran usar código malicioso para leer esos mensajes mientras los escribes.

Esas críticas se suman a las que indicaban hace tiempo en Wired, donde explicaban cómo no es fácil saber si un mensaje enviado a un usuario está cifrado con la clave pública correcta para cada usuario, que está almacenada en el servidor de claves de ProtonMail.

“Por ejemplo, si Alice envía a Bon un mensaje cifrado a su clave pública, es difícil que otras personas lean ese mensaje. Pero como ProtonMail distribuye las claves de cifrado a sus usuarios, tiene la capacidad técnica de darle a Alice tanto sus propias claves como las de Bob, lo que haría que los mensajes cifrados fueran susceptibles de ser espiados.

El problema afecta a otros servicios (WhatsApp incluido), mientras que servicios como el de Silent Circle permiten verificar esas claves para asegurar que tienen las adecuadas en cada momento. Aunque ProtonMail te permite exportar tu clave pública y enviarsela a otra persona, no puedes verificar de forma sencilla si esos mensajes se envían a la misma clave pública.

Protonmail 2

Hay otras desventajas que pueden ser molestas para ciertos usuarios: por ejemplo, no se da soporte al acceso IMAP o POP, lo que hace que no podamos utilizar ProtonMail para “centralizar” nuestras direcciones de correo alternativas (las “no-protonmail”) en su cliente webmail.

De hecho el problema fundamental de ProtonMail es que ofrece las ventajas que planteaba PGP, pero lo hace centralizándolo todo en la web de ProtonMail cuando precisamente una de las ventajas de PGP era el estar totalmente descentralizado.

La transparencia y el hecho de utilizar la filosofía Open Source (el cliente web y las librerías criptográficas tienen su código fuente disponible en GitHub) desde luego aportan un voto de confianza. Una cosa está clara: con sus luces y sus sombras, ProtonMail es una alternativa claramente más segura que el Gmail de turno para proteger la privacidad de tu correo electrónico.

Más información | ProtonMail

Este  artículo apareció originalmente en  xataka.com

 

 

WTF is The Blockchain?

The ultimate 3500-word guide in plain English to understand Blockchain.

Unless you’re hiding under the rock, I am sure you’d have heard of Bitcoins and Blockchain. After all, they are the trending and media’s favorite topics these days — the buzzwords of the year. Even the people who’ve never mined a cryptocurrency or understand how it works, are talking about it. I have more non-technical friends than technical ones. They have been bugging me for weeks to explain this new buzzword to them. I guess there are thousands out there who feel the same. And when that happens, there comes a time to write something to which everyone can point the other lost souls to — that’s the purpose of this post — written in plain english that any regular internet user understands.

By the way, I am curator of a weekly newsletter, Unmade, which delivers one idea from the future to your inboxes.

Blockchain: why do we even need something this complex?

“For every complex problem there is an answer that is clear, simple, and wrong.” — H. L. Mencken

Unlike every other post on the internet, instead of first defining the Blockchain, we’ll understand the problem it solves.

Imagine, Joe is your best friend. He is traveling overseas, and on the fifth day of his vacation, he calls you and says, “Dude, I need some money. I have run out of it.”

You reply, “Sending some right away,” and hung up.

You then call your account manager at your bank and tell him, “Please transfer $1000 from my account to Joe’s account.”

Your account manager replies, “Yes, sir.”

He opens up the register, checks your account balance to see if you have enough balance to transfer $1000 to Joe. Because you’re a rich man, you have plenty; thus, he makes an entry in the register like the following:

The Transaction Register

Note: We’re not talking about computers only to keep things simple.

You call Joe and tell him, “I’ve transferred the money. Next time, you’d go to your bank, you can withdraw the $1000 that I have just transferred.”

What just happened? You and Joe both trusted the bank to manage your money. There was no real movement of physical bills to transfer the money. All that was needed was an entry in the register. Or more precisely, an entry in the register that neither you nor Joe controls or owns.

And that is the problem of the current systems.

To establish trust between ourselves, we depend on individual third-parties.

For years, we’ve depended on these middlemen to trust each other. You might ask, “what is the problem depending on them?”

The problem is that they are singular in number. If a chaos has to be injected in the society, all it requires is one person/organization to go corrupt, intentionally or unintentionally.

  • What if that register in which the transaction was logged gets burnt in a fire?
  • What if, by mistake, your account manager had written $1500 instead of $1000?
  • What if he did that on purpose?

For years, we have been putting all our eggs in one basket and that too in someone else’s.

Could there be a system where we can still transfer money without needing the bank?

To answer this question, we’ll need to drill down further and ask ourselves a better question (after all, only better questions lead to better answers).

Think about it for a second, what does transferring money means? Just an entry in the register. The better question would then be —

Is there a way to maintain the register among ourselves instead of someone else doing it for us?

Now, that is a question worth exploring. And the answer is what you might have already guessed. The blockchain is the answer to the profound question.

It is a method to maintain that register among ourselves instead of depending on someone else to do it for us.

Are you still with me? Good. Because now, when several questions have started popping in your mind, we will learn how this distributed register works.

Yes, but tell me, how does it work?

The requirement of this method is that there must be enough people who would like not to depend on a third-party. Only then this group can maintain the register on their own.

“It might make sense just to get some Bitcoin in case it catches on. If enough people think the same way, that becomes a self-fulfilling prophecy.” — Satoshi Nakamoto in 2009

How many are enough? At least three. For our example, we will assume ten individuals want to give up on banks or any third-party. Upon mutual agreement, they have details of each other’s accounts all the time — without knowing the other’s identity.

1. An Empty Folder

Everyone contains an empty folder with themselves to start with. As we’ll progress, all these ten individuals will keep adding pages to their currently empty folders. And this collection of pages will form the register that tracks the transactions.

2. When A Transaction Happens

Next, everyone in the network sits with a blank page and a pen in their hands. Everyone is ready to write any transaction that occurs within the system.

Now, if #2 wants to send $10 to #9.

To make the transaction, #2 shouts and tells everyone, “I want to transfer $10 to #9. So, everyone, please make a note of it on your pages.”

Everyone checks whether #2 has enough balance to transfer $10 to #9. If she has enough balance, everyone then makes a note of the transaction on their blank pages.

First transaction on the page

The transaction is then considered to be complete.

3. Transactions Continue Happening

As the time passes, more people in the network feel the need to transfer money to others. Whenever they want to make a transaction, they announce it to everyone else. As soon as a person listens to the announcement, (s)he writes it on his/her page.

This exercise continues until everyone runs out of space on the current page. Assuming a page has space to record ten transactions, as soon as the tenth transaction is made, everybody runs out of the space.

When page gets filled

It’s time to put the page away in the folder and bring out a new page and repeat the process from the step 2 above.

4. Putting Away The Page

Before we put away the page in our folders, we need to seal it with a unique key that everyone in the network agrees upon. By sealing it, we will make sure that no one can make any changes to it once its copies have been put away in everyone’s folder — not today, not tomorrow and not even after a year. Once in the folder, it will always stay in the folder — sealed. Moreover, if everyone trusts the seal, everyone trusts the contents of the page. And this sealing of the page is the crux of this method.

[Jargon Box] It is called ‘mining’ on the page to secure it, but for the simplicity of it, we’ll keep calling it ‘sealing.’

Earlier the third-party/middleman gave us the trust that whatever they have written in the register will never be altered. In a distributed and decentralized system like ours, this seal will provide the trust instead.

Interesting! How do we seal the page then?

Before we learn how we can seal the page, we’ll know how the seal works, in general. And as a pre-requisite to it is learning about something that I like to call…

The Magic Machine

Imagine a machine surrounded by thick walls. If you send a box with something inside it from the left, it will spit out a box containing something else.

[Jargon Box] This machine is called ‘Hash Function,’ but we aren’t in a mood to be too technical. So, for today, these are ‘The Magic Machines.’

The Magic Machine (aka Hashing Function)

Suppose, you send the number 4 inside it from the left, we’d find that it spat out the following word on its right: ‘dcbea.’

How did it convert the number 4 to this word? No one knows. Moreover, it is an irreversible process. Given the word, ‘dcbea,’ it is impossible to tell what the machine was fed on the left. But every time you’d feed the number 4 to the machine, it will always spit out the same word, ‘dcbea.’

hash(4) == dcbea

Given the word, ‘dcbea,’ it is impossible to tell what the machine was fed on the left. But every time you’d feed the number 4 to the machine, it will always spit out the same word, ‘dcbea.’

Let’s try sending in a different number. How about 26?

hash(26) == 94c8e

We got ‘94c8e’ this time. Interesting! So, the words can contain the numbers too.

What if I ask you the following question now:

“Can you tell me what should I send from the left side of the machine such that I get a word that starts with three leading zeroes from the right side of it? For example, 000ab or 00098 or 000fa or anything among the others.”

Predicting the input

Think about the question for a moment.

I’ve told you the machine has a property that we cannot calculate what we must send from the left after we’re given the expected output on the right. With such a machine given to us, how can we answer the question I asked?

I can think of one method. Why not try every number in the universe one by one until we get a word that starts with three leading zeroes?

Try everything to calculate the input

Being optimistic, after several thousand attempts, we’ll end up with a number that will yield the required output on the right.

It was extremely difficult to calculate the input given the output. But at the same time, it will always be incredibly easy to verify if the predicted input yields the required output. Remember that the machine spits out the same word for a number every time.

How difficult do you think the answer is if I give you a number, say 72533, and ask you the question, “Does this number, when fed into the machine, yields a word that starts with three leading zeroes?”

All you need to do is, throw the number in the machine and see what did you get on the right side of it. That’s it.

The most important property of such machines is that — “Given an output, it is extremely difficult to calculate the input, but given the input and the output, it is pretty easy to verify if the input leads to the output.”

We’ll remember this one property of the Magic Machines (or Hash Functions) through the rest of the post:

Given an output, it is extremely difficult to calculate the input, but given an input and output, it is pretty easy to verify if the input leads to the output.

How to use these machines to seal a page?

We’ll use this magic machine to generate a seal for our page. Like always, we’ll start with an imaginary situation.

Imagine I give you two boxes. The first box contains the number 20893. I, then, ask you, “Can you figure out a number that when added to the number in the first box and fed to the machine will give us a word that starts with three leading zeroes?”

This is a similar situation as we saw previously and we have learned that the only way to calculate such a number is by trying every number available in the entire universe.

After several thousand attempts, we’ll stumble upon a number, say 21191, which when added to 20893 (i.e. 21191 + 20893 = 42084) and fed to the machine, will yield a word that satisfies our requirements.

In such a case, this number, 21191 becomes the seal for the number 20893. Assume there is a page that bears the number 20893 written on it. To seal that page (i.e. no one can change the contents of it), we will put a badge labeled ‘21191’ on top of it. As soon as the sealing number (i.e. 21191) is stuck on the page, the page is sealed.

The sealed number

[Jargon Box] The sealing number is called ‘Proof Of Work,’ meaning that this number is the proof that efforts had been made to calculate it. We are good with calling it ‘sealing number’ for our purposes.

If anyone wants to verify whether the page was altered, all he would have to do is — add the contents of the page with the sealing number and feed to the magic machine. If the machine gives out a word with three leading zeroes, the contents were untouched. If the word that comes out doesn’t meet our requirements, we can throw away the page because its contents were compromised, and are of no use.

We’ll use a similar sealing mechanism to seal all our pages and eventually arrange them in our respective folders.

Finally, sealing our page…

To seal our page that contains the transactions of the network, we’ll need to figure out a number that when appended to the list of transactions and fed to the machine, we get a word that starts with three leading zeroes on the right.

Note: I have been using the phrase ‘word starting with three leading zeroes’ only as an example. It illustrates how Hashing Functions work. The real challenges are much more complicated than this.

Once that number is calculated after spending time and electricity on the machine, the page is sealed with that number. If ever, someone tries to change the contents of the page, the sealing number will allow anyone to verify the integrity of the page.

Now that we know about sealing the page, we will go back to the time when we had finished writing the tenth transaction on the page, and we ran out of space to write more.

As soon as everyone runs out of the page to write further transactions, they indulge in calculating the sealing number for the page so that it can be tucked away in the folder. Everyone in the network does the calculation. The first one in the network to figure out the sealing number announces it to everyone else.

Immediately on hearing the sealing number, everyone verifies if it yields the required output or not. If it does, everyone labels their pages with this number and put it away in their folders.

But what if for someone, say #7, the sealing number that was announced doesn’t yield the required output? Such cases are not unusual. The possible reasons for this could be:

  • He might have misheard the transactions that were announced in the network
  • He might have miswritten the transactions that were announced in the network
  • He might have tried to cheat or be dishonest when writing transactions, either to favor himself or someone else in the network

No matter what the reason is, #7 has only one choice — to discard his page and copy it from someone else so that he too can put it in the folder. Unless he doesn’t put his page in the folder, he cannot continue writing further transactions, thus, forbidding him to be part of the network.

Whatever sealing number the majority agrees upon, becomes the honest sealing number.

Then why does everyone spend resources doing the calculation when they know that someone else will calculate and announce it to them? Why not sit idle and wait for the announcement?

Great question. This is where the incentives come in the picture. Everyone who is the part of the Blockchain is eligible for rewards. The first one to calculate the sealing number gets rewarded with free money for his efforts (i.e. expended CPU power and electricity).

Simply imagine, if #5 calculates the sealing number of a page, he gets rewarded with some free money, say $1, that gets minted out of thin air. In other words, the account balance of #5 gets incremented with $1 without decreasing anyone else’s account balance.

That’s how Bitcoin got into existence. It was the first currency to be transacted on a Blockchain (i.e. distributed registers). And in return, to keep the efforts going on in the network, people were awarded Bitcoins.

When enough people possess Bitcoins, they grow in value, making other people wanting Bitcoins; making Bitcoins grow in value even further; making even more people wanting Bitcoins; making them grow in value even further; and so on.

The rewards make everyone keep working in the network.

And once everyone tucks away the page in their folders, they bring out a new blank page and repeat the whole process all over again — doing it forever.

[Jargon Box] Think of a single page as a Block of transactions and the folder as the Chain of pages (Blocks), therefore, turning it into a Blockchain.

And that, my friends, is how Blockchain works.


Except that there’s one tiny thing I didn’t tell you. Yet.

Imagine there are five pages in the folder already — all sealed with a sealing number. What if I go back to the second page and modify a transaction to favor myself? The sealing number will let anyone detect the inconsistency in the transactions, right? What if I go ahead and calculate a new sealing number too for the modified transactions and label the page with that instead?

To prevent this problem of someone going back and modifying a page (Block) as well as the sealing number, there’s a little twist to how a sealing number is calculated.

Protecting modifications to the sealing numbers

Remember how I told you that I had given you two boxes — one containing the number 20893 and another empty for you to calculate? In reality, to calculate the sealing number in a Blockchain, instead of two boxes, there are three — two pre-filled and one to be calculated.

And when the contents of all those three boxes are added and fed to the machine, the answer that comes out from the right side must satisfy the required conditions.

We already know that one box contains the list of transactions and one box will contain the sealing number. The third box contains the output of the magic machine for the previous page.

With this neat little trick, we have made sure that every page depends on its previous page. Therefore, if someone has to modify a historical page, he would also have to change the contents and the sealing number of all the pages after that, to keep the chain consistent.

If one individual, out of the ten we imagined in the beginning, tries to cheat and modify the contents of the Blockchain (the folder containing the pages with the list of transactions), he would have to adjust several pages and also calculate the new sealing numbers for all those pages. We know how difficult it is to calculate the sealing numbers. Therefore, one dishonest guy in the network cannot beat the nine honest guys.

What will happen is, from the page the dishonest guy tries to cheat, he would be creating another chain in the network, but that chain would never be able to catch up with the honest chain — simply because one guy’s efforts and speed cannot beat cumulative efforts and speed of nine. Hence, guaranteeing that the longest chain in a network is the honest chain.

Longest chain is the honest chain.

Longest chain is the honest chain.

When I told you that one dishonest guy cannot beat nine honest guys, did it ring any bell in your head?

What if, instead of one, six guys turn dishonest?

In that case, the protocol will fall flat on its face. And it is known as “51% Attack”. If the majority of the individuals in the network decides to turn dishonest and cheat the rest of the network, the protocol will fail its purpose.

And that’s the only vulnerable reason why Blockchains might collapse if they ever will. Know that, it is unlikely to happen but we must all know the vulnerable points of the system. It is built on the assumption that the majority of a crowd is always honest.

And that, my friends, is all there is about Blockchains. If you ever find someone feeling left behind and wondering, “WTF is the Blockchain?” you know where you can point them to. Bookmark the link.

Can think of someone right now who should read this? The ‘Share’ button is all yours.

About the author

Mohit Mamoria is the curator of a weekly newsletter, Unmade, which delivers one idea from the future to your inboxes.

This article originally appeared on Hackernoon