The term "Sybil Attack" comes up often when discussing network security with researchers. What is it? How much of a concern is it to the Ethereum network? What are some effective ways to prevent it?
A Sybil attack occurs when one actor acts as multiple separate entities. Because many distributed systems have no form of identity management beyond accounts, and because accounts are trivially created, any actor can create an unbounded number of accounts.
This is a problem if, for instance, you want to implement a voting system, or in other situations where who someone is, or whether two different identifies refer to the same person matters, such as an auction (where allowing the seller to bid on their own items would give them an unfair advantage).
There are several ways to mitigate this, depending on your constraints:
- Use a mutually trusted external identity provider to determine who can do things.
- Manually authorize which identities are allowed to do things using some out-of-band mechanism.
- Require participants to stake something there's a limited quantity of, such as ether, so that they gain no advantage by pretending to be multiple different participants at once.
Option 3 is the easiest to implement in many cases, but isn't universally applicable; for instance, in a system like Quadratic Voting, 100 ether pledged by one person holds less weight than 10 ether pledged by each of 10 people, so an attacker still has an incentive to use multiple identities.
From Sybil attack - Wikipedia:
The Sybil attack in computer security is an attack wherein a reputation system is subverted by forging identities in peer-to-peer networks. It is named after the subject of the book Sybil, a case study of a woman diagnosed with dissociative identity disorder.
In a Sybil attack the attacker subverts the reputation system of a peer-to-peer network by creating a large number of pseudonymous identities, using them to gain a disproportionately large influence.
Ethereum switched to POS.
A Sybil attack is a type of attack where a single adversary creates a large number of nodes with fake identities on the network, which are used to gain influence over the network. This attack is also prevented in Bitcoin by using PoW, where miners are required to consume a considerable amount of computing power to earn rewards.
If fake nodes try to add fake blocks to the Bitcoin blockchain, they will be rejected because those blocks will not have the required amount of work, that is, the PoW, associated with them. For an adversary to add a fake block, they will have to work at the same difficulty level as the other honest miners and compete honestly; otherwise, their work (as long as they do not control more than 51% of the network) will always be rejected by the network due to the insufficient amount of work performed to create blocks.