Slightly wrong section, this thread should probably be in "Meta" or "Beginners & Help"

Posting a link to an article is fine as long as you add a bit of context to it, eg. what aspect specifically you are wondering about. If you just throw in a link without any additional thoughts it comes off as rather spammy.

Just don't copy / paste articles or content without referencing the source, otherwise you'll get banned for plagiarism.

Yes. I think actually most combos won't be valid. However there's little to be done besides brute forcing the available combinations and then 1) checking whether the checksum is correct, and if the checksum is correct 2) whether it's associated with any transactions.

It's right above the Timeline in the Technical Details section:


I don't think disclosure timelines usually include the "release date" of the bug, as the introduction of exploitable code can not always be easily pin-pointed (and in some cases it's been there all along and becomes exploitable as technology progresses). Heartbleed [1] and Cloudbleed [2] are other good examples of well documented timelines. (Bonus timeline: Remote installation of the original Doom on network enabled Canon printers [3])

[1] https://www.smh.com.au/technology/heartbleed-disclosure-timeline-who-knew-what-and-when-20140414-zqurk.html
[2] https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/
[3] https://www.contextis.com/en/blog/hacking-canon-pixma-printers-doomed-encryption

Have you tried accessing their website via Tor on their onion address? ( http://chipmixerwzxtzbw.onion/ )

I've occasionally had problems accessing their clearnet address as well, but their onion address seems to be unaffected by whatever is causing this occasional issue.

A bug that was known for 10 hours

The bug was introduced with 0.15 [1] which was released in September 2017 [2], so the bug was around for about a year. Excellent response time nonetheless.

[1] https://bitcoincore.org/en/2018/09/20/notice/
[2] https://github.com/bitcoin/bitcoin/releases/tag/v0.15.0

I meant for writing the code (or maintaining a project) As far as reading the code is concerned I fully agree with you.

Honestly? If you want to attain the skills of working on your own cryptocurrency (or whatever else you want to build around a blockchain or distributed ledger) knowing your way around consensus algorithms, cryptographic standards and general application security is much more important than the question of which programming language too choose. Knowing c++ inside out won't prevent disaster if your security knowledge is lacking, especially in this field. And in the right hands even JavaScript can become an incredibly powerful tool.

In terms of getting started with programming I'd probably recommend JavaScript or Python, as both are relatively easy to get into, with JavaScript being ubiquitous to boot. Especially for anything web related (eg. block explorers) you won't get around using JavaScript (unless you fork an existing solution with little to no changes). While there are wallet clients that are written using JavaScript / Node.js, getting deep into the matter will likely nonetheless require solid c/c++ knowledge though (or Go or Rust if you feel especially fancy today).

But to repeat -- choosing the "right" programming language is secondary to having a firm grip on the theory. Also keep in mind that starting in one language won't keep you from specializing in another, so try not to overthink your starting point.


Here's some fun crypto related programming challenges to get you started, by the way. Regardless of which language you choose:

https://cryptopals.com/

I think phone based messengers such as WhatsApp also rely on SMS verification though?

https://faq.whatsapp.com/en/android/20970873/

Which would put us back to the problem of centralized SMS gateways.

Good point nonetheless, maybe there's a way to associate a phone number to a user via SIM card access. I have no idea what SIM data is available to apps however.



Got any experience with Namecoin? I remember this project trying to solve the problem of decentralized name-derivation vs human readability but I never looked into the technical aspects to be honest.

I don't think phone / email verification / association is possible without some form of centralized oracle.

Both phone numbers and SMS gateways are centrally controlled, so there's no way to decentralize phone verification in an automated manner (similar to how converting crypto- to fiat-currencies requires cooperation with the classical banking system).

Decentralized email verification should be possible in theory, as anyone can run an email server; but good luck reaching any inboxes without being whitelisted by major providers.

I guess one could create a decentralized public-key cryptography based messenger system, similar to BitMessage, but without needing the private key for deriving the recipient's address? Ie. some form of decentralized storage for messages encrypted using public keys associated with Bitcoin addresses. I'm not sure if that would be all that useful though, at least for the use case as described by OP.

Well I'll be damned.

@OP keep us posted whether this solved your issue, the solution provided by Robot1982 is far simpler and preferable to what I suggested above.

13 word seed phrases where the standard for Electrum 2.0 - 2.6.4:

https://bitcoinelectrum.com/frequently-asked-questions/#why-wont-electrum-accept-my-seed-when-i-attempt-to-restore-my-wallet-from-it

They switched to 12 word seed phrases with 2.7.0.


You should be able to restore your wallet with the 13 seed words by downloading one of the older Electrum versions from the official archives:

https://download.electrum.org/


2.6.4 should do the job:

https://download.electrum.org/2.6.4/


Once you've successfully recovered your old wallet you'll want to send your coins to a new wallet, generated using the latest version of Electrum, as there are some known issues / exploits with the older versions. Don't forget to backup the seed words of the new wallet (should be 12 words) before sending your coins there!

Assuming you haven't moved those coins since before the Bitcoin hard forks (August 2017) you'll also have some forked coins to claim. There are plenty of threads that should help with that, but if anything be extra careful with fork wallets because there have been many cases of malware surrounding those (ie. clear out your Bitcoins before trying to claim fork coins and don't install any fork coin wallets on your main PC -- use a VM or an old laptop that you aren't using anymore).

Also actual usage of any such exploit would have been fairly obvious to an outside observer. It's not like anyone could have covertly inflated the coin supply.

Critical bug? Sure. Swept under the rug? Hardly. The exploit was widely publicized with information readily available to anyone keeping track of crypto.

It's pretty much a miracle that a passphrase like this went untouched for nearly 4 years.

Looking at how both the BTC and the BCH transaction where made in parallel within minutes, forwarding the coins to identical addresses on both chains, I get a feeling that automation may have been in play though -- the kind of automation that scans for brainwallets and steals them, unfortunately.

Of course not, and no one ever said that. But if applied correctly they make coins lose your taint (note: taint in the neutral sense of tracked coins, not in a criminal sense). And that's the one you want to get rid of.

Tumblers and coinjoins are important for both fungibility and privacy because they make the concept of taint pretty much useless. And you want the concept of taint to be pretty much useless, because otherwise you couldn't accept Bitcoin payments for fear of receiving tainted coins -- even if coins would look untainted to you, they could still look tainted to someone else. And a currency you can't accept is a currency you can't spend is a useless currency.

@All: Sorry for having derailed the thread, I hope you enjoy the show.

To be more precise, the transaction fee is implicitly stated -- it's the difference between the sum of all inputs and the sum of all outputs Still easy to mess up though

Good point about using Electrum's preview window!




Is Antpool's accelerator free though? The only free transaction accelerator I'm aware of that actually is working is the one from ViaBTC and that one requires a minimum transaction fee.

Do not manually create or manipulate Bitcoin transactions unless you absolutely know what you are doing (and think twice even then).

You don't want to end up as the guy spending 10 BTC in mining fees on a zero BTC transaction...

Not using an exchange that is trigger happy in freezing accounts beyond what is legally required of them is a solution however.

There's plenty of alternatives that are not quite as restrictive while still sticking to global and local regulations -- even amongst centralized exchanges. Additionally using a centralized service as wallet is leading the concept of cryptocurrencies ad absurdum anyway.

I absolutely respect if an exchange freezes an account because they are subpoenaed to do so based on concrete suspicions by law enforcement. But if Coinbase starts getting PayPal on people's asses it's time to move out.



So does this make you a drug dealer, money launderer or thieve? It doesn't. And neither does wanting some privacy on public blockchains.



0.15% of 1 BTC is 0.0015 BTC

Most Bitcoin ATMs and Local Bitcoin sellers charge around 2% - 5%. Even Coinbase charges 1.49% [1] which is literally an order of magnitude more expensive.

[1] https://support.coinbase.com/customer/en/portal/articles/1826294-how-are-fees-applied-when-i-buy-or-sell-digital-currency-



As long as it's not their own "tainted" coins their privacy is prevailed. You can't be held accountable for crimes you didn't commit.

If you're worried about using privacy enhancing methods because it may make you look suspious, you might be already be living in an oppressive regime. The only antidote against privacy enhancing methods becoming suspicious, is privacy enhancing tools becoming the norm.

Keep in mind, only a couple decades back, secure internet connections where deemed technology that should not be available to the regular citizen -- because what would they have to hide? Nowadays a world without HTTPS would be unthinkable, with ecommerce and ebanking being an impossibility.

---

Anyway, it's hard to objectively discuss something that is mostly a matter of personal philosophy. Luckily Bitcoin and other cryptocurrencies offer possibilities to be as private or as transparent as personally preferred. Just remember that equating "privacy" with "crime" is not a slippery slope, but the ditch at the end of it.

I wouldn't recommend any wallet where you need to be registered (ie. any online wallet). Some of these services may not even give you full access to your coins, potentially even freezing or confiscating your coins at their whim.

For most cases Electrum (electrum.org) should be fine. For more secure storage, purchase a Trezor (trezor.io) or Ledger (ledger.com) hardware wallet. For a more detailed overview, follow the links posted by LoyceV above.

One more reason to not use Coinbase then. Any exchange that goes beyond the necessities of KYC / AML should be avoided like the plague. If you get your account frozen on the likes of Coinbase you should have stuck with PayPal. Same difference, but without the extra steps of going through crypto.



Would you, personally, post your bank statements publicly on the internet?



Wasabi Wallet charges 0.003% per anonymity set which apparently comes down to 0.15% per transaction [1]. ChipMixer relies on donations and can thus be used to mix for free, but will keep any amount smaller than 0.001 BTC as donation [2]. Other options likely fall within similar fee ranges.

[1] https://www.reddit.com/r/Bitcoin/comments/9sziy5/privacy_wasabi_wallet_10_is_finally_released/e90mlvu/
[2] https://chipmixer.com/faq



Not being able to keep private from governments is a threat to democracy. Heck, to any free society that relies on a centralized, hierarchical government.

As is the thinking that only "people with something to hide" want privacy.

Remember East Germany. I don't even want to imagine what a modern day Stasi could do with modern technology and data at hand.

Regarding Bitcoin (blockchain) hard forks, there's a comprehensive family tree over here:

https://bitcointalk.org/index.php?topic=2597083.0

Apart from that the mapofcoins as posted by AdolfinWolf should provide you with a good overview. While not quite up-to-date I don't think any relevant alt directly forked off the Bitcoin codebase after 2017 anyway (apart from the blockchain hard forks), with many recent alts being built upon different codebases.