Bitcoin Forum

Suppose I create an online wallet with https://blockchain.info/ in Tor browser and keep a small stash of BTC in there. It's an anonymous stash, right? So long as I only access via Tor browser, use change addresses and send BTC wisely.

But I've recently read about people running Tor exit nodes and maliciously sniffing the data through them, so I was wondering if this is a safe way of having an online wallet without anyone gaining access to my password/BTC.

Any thoughts?

not sure...  ???

Tor data is encrypted. So I'm not sure how sniffing can expose you to vulnerability.

On the other hand, blockchain.info wallet scripting is client side. So, I think, even if u use Static IP, still you are secure...

Every once in a while there will be a exploit at exit nodes.

I would not trust it myself for anything important.

There have been multiple exploits at exit node.  On exit node it actually pulls up site so it is visible when there is a operational exploit.

The nodes in the middle you are correct they dont see end traffic.

Thanks for the replies. I keep most in paper wallets, which use BIP38 encryption.

I was just wondering about small, shopping transactions in https://blockchain.info/ for convenience sake, since it's very easy to fire up Tor browser and access your account.

I will bear in mind that there is a slight risk of exploiting Tor exit nodes and give it a try.

Is this how Julian Assange got secured information ? I heard he and his accomplishes used to run Tor.


Why dont u use your normal connection to access blockchain.info ?

I just figured that Tor was secure and recently learned about exit nodes being hacked. It's not really as good a system as I thought it was.

A cold wallet is the most secure.

 ;D

i read 4x topic
where people say this danger ::) :'( 8)

1 guy in china lost big bitcoins and a lot in this scene
i am read and etc... :o

same i think
bad idea ::)

I think using the blockchain.info wallet in the Tor browser is compromised and one person here in the community have posted an issue about stealing his coins. I think the reason is about the exit nodes? I'm not sure but yeah, the security is vulnerable and is prone to hacks.

I guess I will have to keep using electrum through SOCKS5 proxy then. I thought that blockchain.info over Tor would be a simpler solution.

Only as safe as you are. If you use a dodgy site or the documents are saved in your printer that's two ways you could lose coins.


Several people have lost coins due to compromised nodes. I wouldn't bother logging in via it to be safe. Why must you use tor to have an account?

I thought it might be handy in case I ever want to open up one of my BIP38 paper wallets, since blockchain.info accepts a BIP38 private key import automatically. Then send some of the remaining balance back to a new cold (paper) wallet.

I like to use electrum with SOCKS5 to send tumbled coins to an offline paper wallet to ensure that they're not traceable in future.

Why would you need to use tor though for that? You could also use a proxxy if you wish but make sure that isn't compromised or saves your data.

As long as tor uses exit nodes there is a chance off bad things.  (It HAS to use exit nodes so you are always at risk).   

You can use it and it will be rolling the dice on if you get compromised.   

BTC wallet security is very important and not easy. There are a lot cases with trojans and so on. In fact I you want serious wallet security, PM me - even here in forum are different people - I have really good knowledge how to prevent your computer and wallet at best possible way.

In a perfect world you use cold storage. 

Can I ask is it ok to show IP for security?  Or do you have to be anonymous completely.

sometimes  bugs are discovered in the encryptation protocol, like the last time the forum advised everyone to change password

using an online wallet with Tor is never safe, just do a quick google search on this matter and you'll see lot of people complaining about losing their hard earned bitcoins this way

who do you think operates the majority of the unsafe exit nodes.. the bad guys, or the "good' guys ?

It would still have the exit nodes.  I think it leads to possible tor problems.   I could be wrong, but look at past exit nodes have had multiple problems in past.

ALERT ! SCAMMER !

https://www.reddit.com/r/Bitcoin/comments/2nrt2n/dear_blockchaininfo_users_hackers_are_smart_your/cmgn09h

Its not secure.

Those runnng Tor exit nodes can get your password. Highly recommended to use blockchain on its own with a IP lock.

Some more info:

http://www.btcfeed.net/news/rogue-tor-node-hijacked-blockchain-info-accounts/

It looks like blockchain.info are blocking users from visiting the site using the main url via tor. They now have a .onion url

http://blockchatvqztbll.onion

Original tweet: https://twitter.com/blockchain/status/538719868292706304

I tested it just now with Tor browser. It still allows me to visit blockchain.info and use its block explorer function.
But when I try to access the wallet page, it doesn't allow me to do so and it gives me a message "A number of users have reported having their wallet stolen when connecting over TOR. Until the situation is resolved please use our onion URL http://blockchatvqztbll.onion".

I will not trust Tor with anything these days... Exploits on exit nodes growing by the day.

Use naked browsing with blockchain, just keep VERY small amounts online. {Why do you really need to have eg. 5 Bitcoins online all the time anyways}

When you want to buy something, just sweep it from cold storage and use it.

Strictly speaking, blockchain.info wallet is not an online wallet. The blockchain is online but the details stay local. The risk comes from sending the password which can be used to determine the key.

Stolen twice!
And now my balance zero and reset my all history after the site upgrade!

Exactly. All those attacks on Tor have made it less and less usable, especially when you need to log in a site. :(

Its likely they have your private keys. There may be malware on your computer so do a clean format. Otherwise you will lose even if you use a different wallet.

Currently, blockchain.info have a tor onion address, http://blockchatvqztbll.onion/. When accessed using tor, the security risk of MITM is minimal compared to accessing blockchain.info using tor.

Maybe.
now i use different wallet. But still question is why my all history and balance is reset.

if TOR is compromised, what would that mean for the rest of the encrypted world..?

What about moving hidden services to i2p?

I understand it's a lot harder to set up. Is there any work going on to just download an "i2p browser bundle"? Or is it more complicated than that?

I don't know much about Tor, so here is my question. If I use the .onion site to access my blockchain.info wallet, is my bitcoin safe against attacks on exit nodes?

Yes if you use .onion address the real site cant be spoofed by an exit node

It still risks the exit node being able to see traffic (including sensitive data).   Tor is just had enough exploits I would be afraid to use it for logging into something important.

Yeah I'd be careful using blockchain.info with Tor, even with small amounts of bitcoins.

Heard way too many horror stories of people losing btc 

Just use an offline wallet to keep your bitcoin safe. If you want to hide your IP, you can push your raw transactions on blockchain.info/pushtx with Tor.

No it doesn't. Hidden servers do not involve exit nodes at all, and all traffic to hidden servers is encrypted with that hidden server's public key, so no Tor nodes can see it. Please stop posting false information.

Absolutely not i won't trust TOR with that kinda stuff. If you need it but a vpn it's better than using tor nodes.

I think it can be (I wouldnt) trusted as blockchain.info has gotten an SSL cert for tor, the second .onion site after facebook!

It should be safe to use the .onion to access your blockchain.info wallet, but if you are looking for ultimate security, it is better to use an offline wallet or Trezor.

i warn you to stay away from using Blockchain.info with Tor. my friend lost his hard earned bitcoins this way.