|
it would be nice to also explain some of the reasoning, why this step is necessary.
so if you download bitaddress.org how do you know that the version you have saved is correct? is there a sha1sum posted somewhere?
so what exactly is the point in "going offline" - if bitaddress or any MITM wanted to scam you, they'll serve your a faulty RNG that has lower entropy, and you take it offline.
how do you know you have not been MITM'd? is the ssl cert fingerprint posted somewhere?
how do you know the printer is not storing the documents in a cache? some printers come with a built-in HDD.
some laser printers will have a residue on it's drums. it should be enough to print a second unrelated barcode.
|
|
|
|
|
I could see the drool on their mouths because of campaign contributions in Bitcoin from this side of the Atlantic.
|
|
|
|
try Mycelium. we specifically support this usecase. With the cold storage spend wizard one keysweep takes about 10 seconds. see this video demonstration: https://www.youtube.com/watch?v=1pDSzOiFgIkif you want to import keys in bulk, you can have up to 10 keys imported in the "active" section at once and send 1 transaction from those keys. |
|
|
|
I just wanted to know the pros. I think the question isn't answered. What's the pro of relying on a centralized service for getting unspent outputs and transaction history?
This is your thread so i really hate to turn this into an advertisement for our software, but since you insist i cannot refuse  Well, syncing is much faster, basically instant, if you don't need to scan the blockchain. It would be nice if we could get that from P2P nodes, but since this is not possible we have to be pragmatic. Also, the amount of possible error states is simpler. In our code, we can assume cooperating peers (so no half-open tcp connections, stalling connections, etc). Syncing once and closing the connection immediately afterwards is much friendlier to the battery than maintaining a background process. That said, i think it is possible that we can achieve "best of both worlds" by implementing a P2P network where you can efficiently query an UTXO-set in near-constant time, with POW, as outlined here: https://bitcointalk.org/index.php?topic=88208.0. But since this is not implemented yet, it is not an option so far. |
|
|
|
The downside is that it depends on its servers. If they all went down, Mycelium would cease to function. Take your pick.
Right now, if the Mycelium servers would go down, you can import a key into any other client easily. The quickest way would be to export a single key in SIPA format (as qr code, or via clipboard) and import it into bitcoin-qt or any other client. so your money is not "locked" like with a web-wallet or a wallet where an encrypted wallet is stored in the cloud. it is all on YOUR phone and in YOUR backups. Also, if you need to decrypt the 2-factor backup key without a Smartphone, the code is Apache Licensed at https://raw.github.com/mycelium-com/wallet/master/public/bitlib/src/main/java/com/mrd/bitlib/crypto/MrdExport.java and a textual decription of the algorithm is in the pdf. |
|
|
|
Thanks everyone for their constructive feedback! 1) We did not think anyone would notice autopay gone, so you have proved us wrong. With some security enhancements it can make a comeback. One particular problem was the fix in fiat. What do you think about a limit set in btc/mBtc/uBtc ? That would make the process more secure, faster (because it does not need to wait for up-to-date exchagne rate), and ready for offline payments. 2) Save-to-sdcard/phone is an important feature, as well as "show as qr code" for encrypted backups, like the "single key export". IMO, an "airgap" as an optical link between camera+smartphone has excellent security and privacy properties. 3) Having this backup verification is very important. What good is a backup if you don't know if you will be able to use it? And yes, if the user wants, he can still shoot himself in the foot. Maybe we should add a textbox where you enter "IGNORE BACKUP WARNING" to disable the nagging? but i have to fundamentally disagree with this statement: Smartphone wallets aren't supposed to be the wallets where you keep large amounts anyway, so I don't see why it should even be a goal for you to make it "ultra secure".
Security isn't the top focus of a smartphone wallet, usability is. What you've done now is add annoying security features and removed the killer usability feature. Downhill development while i recommend keeping funds on paper (like the encrypted pdf, or a paperwallet) all bitcoin software must be taken to the highest standards. for example, if you keep a private key unecrypted on your phone sdcard on a well-known location, this will invite malware to take it. this is one of the reasons we decided to discontinue JPG backups. |
|
|
|
the new version has solved the scrambled screen problem on my huawei :-)
good to hear! i disabled screenshot protection for all 2.3 devices. eventually we can build a list of known-positive devices where i can re-enable it (for example my HTC DHD on CM7 does support it) |
|
|
|
Great work on the new version! I had a problem with verifying my backup. Tried to use the clipboard method, and no matter how many times I copied it to the clipboard, the button remained "gray". Besides that, great update.
does importing the key from clipboard work? |
|
|
|
IŽd like to be able to simply save the pdf backup on my sdcard in order to manually transfer it to my pc.
Is that going to be an option?
yes, it will be in one of the next releases. hours after release this is already one of the more frequent requests. |
|
|
|
anyone has an idea where this might come from, we've had two of them: java.lang.ArithmeticException: divide by zero
at android.widget.Editor.updateShowAsAction(Editor.java:4807)
at android.widget.Editor.access$300(Editor.java:126)
at android.widget.Editor$SelectionActionModeCallback.onCreateActionMode(Editor.java:3055)
at com.android.internal.policy.impl.PhoneWindow$DecorView.startActionMode(PhoneWindow.java:2497)
at com.android.internal.policy.impl.PhoneWindow$DecorView.startActionModeForChild(PhoneWindow.java:2429)
at android.view.ViewGroup.startActionModeForChild(ViewGroup.java:624)
at android.view.ViewGroup.startActionModeForChild(ViewGroup.java:624)
at android.view.ViewGroup.startActionModeForChild(ViewGroup.java:624)
at android.view.ViewGroup.startActionModeForChild(ViewGroup.java:624)
at android.view.ViewGroup.startActionModeForChild(ViewGroup.java:624)
at android.view.ViewGroup.startActionModeForChild(ViewGroup.java:624)
at android.view.View.startActionMode(View.java:4301)
at android.widget.Editor.startSelectionActionMode(Editor.java:1690)
at android.widget.Editor.performLongClick(Editor.java:982)
at android.widget.TextView.performLongClick(TextView.java:8292)
at android.view.View$CheckForLongPress.run(View.java:17168)
at android.os.Handler.handleCallback(Handler.java:615)
at android.os.Handler.dispatchMessage(Handler.java:92)
at android.os.Looper.loop(Looper.java:137)
at android.app.ActivityThread.main(ActivityThread.java:4950)
at java.lang.reflect.Method.invokeNative(Native Method)
at java.lang.reflect.Method.invoke(Method.java:511)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:1004)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:771)
at dalvik.system.NativeStart.main(Native Method) someone clicked an item - "startActionMode" happens when you select a key or entry in the address book or transactions. but why a "division by zero" ? also someone long-pressed a TextView.. hmm |
|
|
|
update 1.0.5 pushed to play store, github, and mycelium.com which fixes the "scrambled screen issue" for all 2.3.x devices. direct link until google activates it in 2-3 hours: http://mycelium.com/mbw-v1.0.5.apk(this is the exact binary as pushed to play store, sha1sum 389743784a5629e591779abf33e68d498f1d697f ) , signed with the release key though now it is possible to take a screenshot on those devices (which is unfortunate) |
|
|
|
If it cannot be fixed, could you please make an option in the settings to disable that protected screen mode? I have tested the previous testnet version a few days ago and the key backup process worked just fiine (I assume this was without the new anti-screengrabber function?), I would very much like to keep this device for a while longer, although its at the lowest end in terms of performance and resources of the currently available devices I like it quite much, it does what I need and it is really small (unlike most of the other monstrous Android phones nowadays).
for now, i am disabling the secure screen feature for all 2.3.x devices, and enabling it only after it is verified that it would work. for that i need a setting and some data points from users, which will be added later. |
|
|
|
regarding the scrambled screen issue: see here: https://github.com/mycelium-com/wallet/blob/master/public/mbw/src/main/java/com/mycelium/wallet/Utils.java#L766public static void preventScreeshots(Activity activity) {
if (android.os.Build.VERSION.SDK_INT == android.os.Build.VERSION_CODES.GINGERBREAD
&& android.os.Build.MANUFACTURER.equalsIgnoreCase("samsung")) {
// On some Samsung devices using android 2.3 we cannot use the secure
// flag, as it makes the display scrambled.
return;
}
activity.getWindow().setFlags(WindowManager.LayoutParams.FLAG_SECURE, WindowManager.LayoutParams.FLAG_SECURE);
}we need to insert your phone model in this code to fix it. but what are your android.os.Build.MANUFACTURER and android version ? some people suggested it is a problem on all 2.3 devices, but it works on my HTC with 2.3 |
|
|
|
@Jan - what model of phone did you demo this on in the video?
AFAIK, he recoded that on a S3 mini (stock firmware) |
|
|
|
Why did you remove the abiliy to swipe addys sideways, to quickly scan unaggregated balances? I really liked that recently added feature.
you can now swipe sideways into "keys" and achive the same, with one more tap. this would conflict with swiping between keys. (both are sideways swiping gestures) also, keys show the individual balances more accurately than before. so if you want to have an overview over your balances you can simply go there. |
|
|
|
|
thanks for the feedback, prof7bit.
this screen is supposed to be "protected" against screengrabbers, so apps that could make screenshots cannot do so.
apparently, some devices have trouble with that.
do you have the same issue if you try to export a single private key?
on what android version/phone model are you on, exactly?
|
|
|
|
KNOWN BUGS: Some PDF viewers don't display the QR codes, for example the Windows 8 built-in viewer. we are working on fixing that, until then please install any of the capable pdf viewers.
version 1.0 was going Out Of Memory on some older devices, when doing the export backup. a fix (version 1.0.4) has been submitted to the play store.
Some devices (S3 Cyanogenmod) have trouble with portrait mode QR code scanning. As a workaround, start the scanning from landscape mode.
we appreciate creative fix suggestions:) |
|
|
|
YOU GUYS ROCK!
Thank you so much for this amazing wallet!
Thanks so much. If you like it, give it an intelligent 5 star review on Google Play, we really appreciate that. In the meantime, we are very busy fixing the leftover bugs we were not able to detect during the weeks of testnet- and beta-releases. if you discover anything, even small - let us know. |
|
|
|
|
Show Posts
