Skip to main content

MLB Team Washington Nationals Partners With Terra Blockchain Community, Ballpark Plans to Accept UST

On February 9, the American professional baseball team based in Washington, D.C., the Washington Nationals, announced the team has partnered with Terra, the open-source blockchain platform and decentralized autonomous organization (DAO). The Washington Nationals detail that the team is a “leading innovator” and is “consistently introducing new technologies to enhance the fan experience.” Washington Nationals Ink Long-Term Deal With Terra Major League Baseball (MLB) team the Washington Nationals has partnered with the blockchain platform and DAO Terra, according to an announcement published by the team on Wednesday. The deal with Terra follows a slew of sports-related deals with crypto firms, but the MLB team will be the first to partner with an open-source blockchain project. In addition to the partnership, the algorithmic stablecoin UST that’s issued on the Terra blockchain will be “accepted as a payment method at Nationals Park as early as next season.” “The Nationals continue t...
Post a Comment

This proof of concept NFT can swipe unsuspecting users' IP addresses

Turns out that some NFTs might be building collections of their own. Their target? Your private data.

Both OpenSea and Metamask have logged cases of IP address leaks associated with transferring nonfungible tokens (NFTs), according to researchers at Convex Labs and OMNIA protocol.

Nick Bax, head of research at NFT organization Convex Labs tested out how NFT marketplaces like OpenSea allow vendors or attackers to harvest IP addresses. He created a listing for a Simpsons and South Park crossover image, entitling it “I just right click + saved your IP address” to prove that when the NFT listing is viewed, it loads custom code that logs the viewer's IP address and shares it with the vendor.

In a Twitter thread, Bax admitted that he "does not consider my OpenSea IP logging NFT to be a vulnerability" because that is simply "the way it works." It's important to remember that NFTs are, at their core, a piece of software code or digital data that can be pushed or pulled. It is quite common for the actual image or asset to be stored on a remote server, while only the asset's URL is on-chain. When an NFT is transferred to a blockchain address, the receiving crypto wallet fetches the remote image from the URL associated with the NFT.

Bax further explained the technical details in a Convex Labs Medium post that OpenSea allows NFT creators to add additional metadata that enables file extensions for HTML pages. If the metadata is stored as a json file on a decentralized storage network, such as IPFS or on remote centralized cloud servers, then OpenSea can download the image as well as an “invisible image” pixel logger and host it on its own server. Thus, when a potential buyer views the NFT on OpenSea, it loads the HTML page and fetches the invisible pixel that reveals a user’s IP address and other data like geolocation, browser version and operating system.

Analyst Alex Lupascu, co-founder of the privacy node service OMNIA Protocol, conducted his own research with the Metamask mobile app with similar effects. He discovered a liability that allows a vendor to send an NFT to a Metamask wallet and obtain a user's IP address.  He minted his own NFT on OpenSea and transferred the ownership of the NFT via airdrop to his Metamask wallet, and concluded finding a "critical privacy vulnerability." 

Related: MetaMask’s new inbuilt multichain institutional custody feature

In a Medium post, Lupascu described the potential consequences of how a "malicious actor can mint an NFT with the remote image hosted on his server, then airdrop this collectible to a blockchain address (victim) and obtain his IP address." His concern is that if an attacker gathers a collection of NFTs, points all of them to a single URL and airdrops them to millions of wallets, then it could result in a large scale distributed denial-of-service, or DDoS attack. Having personal data leaked can also lead to kidpnapping, according to Lupascu. 

He also suggested a potential solution could be requiring explicit user consent when it comes to fetching the remote image of the NFT: Metamask or any other wallet would prompt the user that someone on OpenSea or another exchange is fetching the remote image of the NFT, and informing the user that his or her IP address may be exposed.

Dan Finlay, CEO of Metamask, responded to Lupascu on Twitter stating that even though "the issue has been known for a long time," they are now starting work to fix it and improve user safety and privacy.

That same day, even Vitalik Buterin recognized the challenges of off-chain privacy within Web3. On a recent UpOnly podcast episode, Buterin said that "the fight for more privacy is an important one. People are underestimating the risks of no privacy," adding that the "more crypto-y everything becomes," the more exposed we are.

https://ift.tt/3AENDR5
Labels:

Comments

Post a Comment

Popular posts from this blog

Earn up to 50% APY by Staking $GLQ on GraphLinq App

PRESS RELEASE. The newest utility token to offer staking to its users/holders is GraphLinq Protocol’s $GLQ. As of this article, $GLQ has 4,500+ holders according to etherscan, excluding GLQ holders on CEX like Kucoin, MXC, Gate. This is a great step for the future of the project as it will further incentivize more users to hold. Explore more about GraphLinq, its staking mechanism & steps to stake. What Is GraphLinq? GraphLinq – The No Code protocol for automating actions on-chain & off-chain, launched in just March 2021, has come a long way bringing users in the crypto space a never seen model of integrating blockchain automation on any blockchain-related/non-related task. The goal of the GraphLinq protocol is to allow users to interact blockchains with any connected system as effortlessly as possible without any prior knowledge of coding. GraphLinq ecosystem currently consists of an engine, an integrated development environment ( IDE ) & an app to provide automated...
Post a Comment
Read more

Coinsquare launches Quick Trade mobile app with instant funding

One of Canada's largest crypto exchanges has launched a new mobile application designed to streamline the buying and selling of Bitcoin and Ethereum. Coinsquare , the Toronto-based digital currency platform, has announced a new mobile trading application designed to simplify the buying and selling of cryptocurrencies in Canada.  Quick Trade was officially unveiled Monday, allowing commission-free transactions of Bitcoin ( BTC ), Ethereum ( ETH ), Litecoin ( LTC ) and Bitcoin Cash ( BTC ). A total of 15 trading pairs are available at launch, with “many more digital assets to be onboarded over the coming months,” the company said. The app is available on Android and Apple devices alongside Coinsquare’s existing mobile application, which is an extension of its web-based trading platform. In addition to commission-free trades, the new app allows for instant account funding via Interac e-Transfer – a considerable upgrade from Coinsquare’s current funding window, which can take up t...
Post a Comment
Read more

Blockchain identity market to grow $3.58B by 2025, report claims

A new forecast for the global blockchain identity management market expects growth at a compound annual growth rate of almost 71% during 2021-25. A new report on the potential for blockchain identity management solutions to become integrated across sectors has forecast strong growth for its global market, at a compound annual rate of close to 71%. The report grounds its predictions on a study broken down into segments: by sector – e.g., government, healthcare, banking, financial services and insurance (BFSI) – geography, and applications. It was published by the Lyon-headquartered market research solution provider ReportLinker.  Drawing on an analysis of several existing blockchain identity management market vendors – Accenture, Amazon, Bitfury Group, Civic Technologies, and others – the report expects the total global market to grow by $3.58 billion between 2021 and 2025. Related:  The future of DeFi is spread across multiple blockchains The study’s baseline assumption...
Post a Comment
Read more