Bitcoin Forum

If I build the following web wallet, it will be the most secure web wallet currently on the market. Agree or disagree ?

1. The client will be a 1 page backbone.js app deployed directly from the repository on github. The page would be signed with my PGP public key.

Why?

a. Because it would then be possible to write a chrome or firefox plugin to verify the wallet downloaded to your machine corresponds to the code on the repository. Blockchain.info has a form of this already but without the PGP signing.

b. If any third party such as github/cloudflare tampered with the wallet the user would be able to see and flags would be raised.

2. All javascript in plain text and easy to read. (unobfuscated).

Why ? Because the wallet is then open for peer review. Like all solutions that use cryptography peer review is the way to go.

3. No naked private keys stored on the server. No naked keys ever passed to the server.
Why ?

a. Search for “Bitcoin wallet hacked” on google then come back here.
b. Because there is no technical reason why we should ever do this again. And that includes exchanges too.

4. Users shouldn't pick their own passwords.

Why ?

a. Because a lot of users, pick either very week password or re-use passwords on other sites.
b. Because we can then pick passwords with sufficient entropy to properly encrypt private keys.

5. Users should not be able to send coins to the wallet until 2FA is enabled. All operations requiring spends should also be protected with 2FA.

Why ? To defend against malware such as key loggers.

6. A way for users to recover their wallet if the operator goes away.

Recovery procedure should be quick and simple. i.e. electrum passphrase.

I don't really understand why anybody uses web wallets. 

Use a local wallet.  Keep it encrypted.  Unencrypted keys are never stored, and keys encrypted or not never leave the local machine.  Keep it on removable media and remove it when you're not using it.  Then just run an OS more secure than Windows to keep keyloggers etc off of it.

To become mainstream a simpler solution must be made, to encrypt, save it on external harddisk and use a os securer than windows. This might apply us that are into the technology, but others its to much hasle.

So difference vs. blockchain.info is:

- no sending without 2FA
- GPG encryption of password

?

If you really after a web wallet, then watch out myTREZOR.

It will be as easy to use as any web application with no sign-up. Your keys will be in your hand, literally, in a high security special purpose device, safe from any hacks.

http://www.bitcointrezor.com/news/2014-02-10-mytrezor-bop-bitcoin-server

Here you have its first public demo in Berlin:
http://vimeo.com/90026733

Well you've got my attention and many others will come I'm sure.  Wallet security is always a good thing and if you can outdo the current top wallets in you opinion I'd like to know more about it.  Subscribed.

Use a local wallet is the safest!

If your service can withstand someone stealing your wallet.dat file without losing funds, you are headed in the right direction.

Wallet security is always a problem if more secure than it is now purse, I think is definitely good.

qt can withstands this as far as I know if you use a nice pass-phrase!

+1
Agree with what you said, I also very the attention of the wallet safe.

Agreed. TREZOR and other hardware wallets are strong security made simple, they're what's needed for bitcoin to go mainstream

If you are looking to build a secure wallet, you may take a look at the 2-of-3 multi signature approaches by trustedcoin.com (https://api.trustedcoin.com//#/) and bitgo.com (https://www.bitgo.com/).

I am really looking forward to the Trezor (I ordered 2 last year) but I think it will not be for everyone. The retail price for this thing is yet TBA and I doubt that it will be anything below $100! Not much for total security if you are a "whale" and have lots of bitcoins in your wallet, but too much for the bitcoin starter.

So there is still room for another "middle security" wallet solution, easy to use for the average joe but still secure enough so that it is not easily hacked.

You're right, now the main wallet is safe and simple to use.

Only safe and easy to use in order to be widely used, so you have to consider these two questions.

greenaddress.it is more secure than your suggested method.

I think using of web wallets can never be safe so i prefer just filling mine with the amount needed at a particular time and for that blockchain is doing well so far, so i guess another online wallet is not what's needed right now. Good luck with your project though and hope to see it soon in action.