Hmm... I had an impression that I have to use seed to generate addresses by certain derivation path. But it is possible to use just bip44 public key to generate addresses by derivation path as well?
Yes, the master public key (xpub / ypub / zpub depending on the address type you want) is enough to derive all public keys and therefore also addresses. To derive the corresponding private key, you'll need the master private key (xpriv). The addresses can be derived safely on an online machine while the private keys never touch any online device at all (for example). The derivation 'hierarchy' is: Seed -> master private key -> master public key -> public key -> address. |
|
|
|
You are talking about RBF case? If so, please provide the info how the situation can be handled properly. Personally, I cannot see how.
You should wait for at least one confirmation before inserting it into your database. In order to avoid 51% attack on blockchain? What is the reason behind it? 51% attack ? That's not related to a 51% attack. The transaction did not take place until it has been confimed. They are kinda revoked from my perspective. The idea that one transaction can replace another one because it has a higher fee is a mess.  Broadcasting a transaction does not mean that it will be confirmed. Therefore replacing such a transaction is not revoking. You also don't need to use RBF to get a different transactoin confirmed. There are multiple ways of double spending, mostly with 1 actor believing only 1 transactions will confirm, while in fact a different one confirms making the first one invalid. A transaction did only happen, if it has been included into a block. Anything else is just expressing the intention to transact. Was there a case when the signed transaction that appeared in the mempool wasn't mined I wonder?
For sure. Especially transactions with a low fee (during a time with a lot of transactions) which then either got replaced or entirely dropped by the mempool. That would require two servers to be online in order for the service to accept the payments - the one with Bitcoin Core and another one with the DB of a service. And if, for some reason the server with Bitcoin Core goes down, ... I will not be able to accept the payments?
You can still accept payments, simply use the master public key to derive addresses. Once your core-server goes back up, all your payments (received when it was down) will get processed again. * Of course I can't hold Bitcoin Core on the same server with the payment service itself - that would be a huge security flaw.
Not necessarily. You shouldn't run your website / webserver and core on the same machine. But your implementation of the payment service and core can run on the same server. Or are you - with "payment service" - referring to your web server ? Then yes, it would be better to use 2 different server. |
|
|
|
I can't believe Electrum is such an irresponsible and crappy organization.
There is no organization. It is an open-source project without any company/organization behind it. They have let scam messages to be displayed on an officially installed software and are allowing the website electrumproject.org to be operated without doing anything about it.
They allowed the server you are connected to to display a message. There are countless fake-sites which are impersonating the electrum site. They can file a complaint for each they find. And they don't have to. This wouldn't have happened at all if you would have verified the signature, which everyone recommends you to do. Additionally, everyone recommends you to not download electrum from anywhere else than the original site. So, to summarize: - You didn't check the website you downloaded electrum from
- You didn't verify the signature of the file
- You didn't update electrum for more than 6 months
- You clicked on a random link and installed a software without checking the internet (which takes less than 1 minute to find out version 4.0 is scam)
But.. electrum is at fault ? I wouldn't be surprised if people behind Electrum were behind this scam.
 |
|
|
|
The issue is only with coins that don't have native support in Ledger Live... and tbh, if it isn't natively supported, chances are it's most likely worthless anyway  That's a weird way to distinguish between worthy and worthless coins. I wouldn't regard Monero as worthless. It is the only coin which offers a decent anonymity. It is not natively supported by ledger live. On the other hand, Pivx and Dash claim to be private (which is plain wrong), their transactions an easily be deanonymized. They are natively supported by ledger live. |
|
|
|
Wobei sich ja eben die Software genau mit einer Fehlermeldung, die auf eine nicht originale Hardware hindeutet, nicht installieren lässt.
Welche Fehlermeldung meinst du denn ? Die Firmware kann nicht wissen ob was an der Hardware manipuliert wurde. Die Meldung "Device not genuine" oder so ähnlich, deutet auf eine nicht-originale Firmware hin, hat aber nichts mit der Hardware an sich zu tun. Der einzige Weg die Hardware zu überprüfen ist das Gehäuse zu öffnen und nach "Unregelmäßigkeiten" Ausschau zu halten. |
|
|
|
You are talking about RBF case? If so, please provide the info how the situation can be handled properly. Personally, I cannot see how.
You should wait for at least one confirmation before inserting it into your database. The node should provide some kind of pool of revoked transactions, but I cannot find it anywhere.
There are no 'revoked' transactions. Transactions are only final once they got included into a block. Afterwards they can not be 'revoked'. Transactions which aren't confirmed yet, are by far not final. They also don't have to confirm at all. They just have been broadcasted which basically means "i want to do the following: send X from A to B". And, actually, I am using this tool for the shop. At least by now it is much better than it was before - relying on third party to get the balance.
Why do you need to check the balance of 1.000.000 pregenerated addresses ? To me, it seems like that is the first design flaw. Usually, you don't need to pregenerate so much addresses. Just generate them whenever needed. And then just use walletnotify and blocknotify to get notified whenever the status changes (i.e. transaction received / transaction got 1st confirmation). You can take a look at this thread, where someone used core for their shop. |
|
|
|
So what is safe or what would you rely on? Please enlight me
Depends on your thread model. What do you want to protect against ? And how much inconvenience are you accepting to take in order to secure your coins ? A simple password protected hardware wallet already is much more secure than a 'biometric' wallet could ever be. There are a lot of possibilities and different ways to do so, while something biometric-like is one of the worst. |
|
|
|
|
I hope you are using that tool just as a personal project without much more use.
You should - under no circumstances - rely on this tool if you are running a webshop or any other kind of service where the payments are automatically handled.
Adding something to your DB first, and later checking whether it really confirmed is highly error-prone. It for sure is good enough for a personal research project, but is definitely not suited for a business / something business-like.
|
|
|
|
But I suppose I should clarify: I'm saying this in the context of the fact we're on the Bitcointalk forum. If there's anyone who needs the incentive to take charge of their computer's security, instead of letting someone else do it for them, it's people who use Bitcoin. We should be making that loud and clear, for the sake of newbies who just don't have such a need for a secure computer.
Well, theoretically you are right. But in reality, the majority of bitcoin users on this forum aren't people who want to break free from the financial system, but want to get rich..quick. They don't even understand how BTC works in a very shallow way. They don't care much about their computer. They use cracked software on their windows, are still using windows 7 and click "yes" on every pop-up which appears. You really can't protect them from themselves. Even with a linux distro they would get their coins stolen through simple phishing. If someone is willing to learn and wants to have his coins secured and actually cares about information security, then yes. Such a person should know that linux is superior to windows and should definitely switch. (as an aside; what you're inadvertently highlighting is, that most Windows users only use 1 application, period: web browser. which works much better on Linux, and exactly the same, so no-one needs to learn anything new to do it  ) Well.. that's true. But they also need to write letters. And you know.. libreoffice writer is soooo much different from microsoft word. It is not the original one. And what about their plug&play hardware devices ? While quite a lot of distros are making a good job and being plug&play, some intervention is still need from time to time. And for people who are extremely far aways from technology, this simply is too much. |
|
|
|
um nochmal auf mein Problem zurück zu kommen, ich habe 2x einen Ledger Live gekauft, beide über eBay (Hersteller war mir zu teuer)
Ich hoffe du bist dir aller Risiken bewusst bei Hardware Wallets welche nicht direkt vom Hersteller oder offiziellen Resellern kommen. Mit einem offiziellen Update der Firmware hättest du zwar eine bösartige Software ausgeschlossen, jedoch bleibt da noch das Risiko manipulierter Hardware. Um auf Nummer sicher zu gehen, könntest du das Gerät öffnen und dir die Hardware anschauen. Ledger hat diesbezüglich einen Guide veröffentlicht: https://support.ledger.com/hc/en-us/articles/115005321449Musst du selbstverständlich nicht machen, vor allem da das Gehäuse verklebt ist und man vorsichtig sein sollte, wäre aber nötig um sicher zu sein, dass es sich nicht um ein manipuliertes Gerät handelt. |
|
|
|
Do we really want someone, who has not given at least two years to this forum, at DT1? I dont know...
Nowadays it is not enough to accumulate enough activity to get legendary. If a user is very helpful in exposing scams and doesn't post much helpful stuff, he won't get his merits needed for legendary fast enough. But such a user is still worth being included into a trust list, which basically means that you trust this users judgement and feedback. I don't think it is necessary to be legendary to be able to get into DT1. Good judgement and trust is. |
|
|
|
He is not recommending to not use an AV. He was saying that - under some circumstances - an AV is not necessary, which is absolutely correct.
well, I'm saying that it's really never necessary. You are making it really really hard to help defending your point of view. To be correct.. it is never necessary IF you know what you are doing. But how many people know what they are doing ? Like 3-5% ? even if you need a Windows only application, if you spend a little more on RAM for your computer, you could run it in a virtual machine and keep it isolated from the source of viruses (i.e. webpages & other internet activity would be separate, no anti virus needed if virus attack vectors are kept separate)
The problem is not that people need 'a windows only application', but they need windows because it has become their habit and they are too stubborn to learn something new. And exactly these people need an AV. You don't need one. I don't need one. And probably 98% of all Unix user don't need one. But the remaining 95%+ (almost) of people need one. interesting how this user has to attack me, apparently because I've been on bitcointalk for a long time?
He is attacking you because you have a different point of view. It is like if you would say you'd believe the earth is a globe.. in that case you'd get a way bigger shitstorm  |
|
|
|
He can trivially bypass that by double-checking the database entries periodically until there are multiple confirmations.
If he would be checking confirmations of transactions, he also could simply just get the transactions from each received block. But OP is having the issue that it is too slow. And i doubt this approach would be faster. |
|
|
|
|
What version of electrum are you running ?
And how many inputs/outputs does your transaction have ?
Can you create the transaction as you want it to be sent, then click on 'preview' please. How many inputs/outputs are there ? How large is the transaction (size) ?
|
|
|
|
Once the transaction is in mempool, it is going to be mined sooner or later regardless of the fee. Correct?
No. Transactions can be dropped out of the mempool without being confirmed. For example if RBF is enabled. For example: Transaction A sends 1 BTC to address X. Transaction B sends the same input (1 BTC) to address Y. Transaction A reaches your mempool, with RBF enabled. You would then add that balance to address X in your database. Then transaction B is being broadcasted and will be included. Your database would then show both (address X and Y) to have received 1 BTC each, which is not the case. You need to wait for at least 1 confirmation before adding/updating balances in your database or you risk having a wrong entries in your database. RBF-transactions are quite common. Not necessarily with different addresses, but that doesn't change much. If i send a transaction with a low fee, you would add it in your database. Then i'll bump the fee and send a new transaction to the same address. You would have twice the amount credited in the database. This would happen quite often. If you regard transactions as final or confirmed while they are not included in a block yet, you will end up with wrong entries. |
|
|
|
According to bitcoin (BTC) node stats reported on the website of bitcoin core developer Luke Dashjr, 60.22% of the coin’s full-nodes are running software still vulnerable to the inflation bug at press time. - Source : https://finance.yahoo.com/news/research-60-bitcoin-full-nodes-154800366.html ( Cointelegraph May 6, 2019 ) I would have hoped that people running full nodes would have reacted quicker when a bug like this was found and that they would have updated their client software a lot faster. According to https://coin.dance/nodes, 90%+ of all publicly accessible nodes are running a version > 0.16.2 which is not vulnerable with the majority being >= 0.17.0 And 60%+ running a vulnerable version indeed sounds too high. |
|
|
|
You can find keys from multiple persons here: https://bitcointalk.org/verify_pubkeys.txtThis page contains keys from Maxwell, theymos, achow101 and more.. It also contains Wladimir J van der Laan's signing key: # Wladimir's signing key 0x01EA5486DE18A882D4C2684590C8019E36C2E964
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBFWKlBcBEACgZJd/6LrSgNSVxiyq5N9h0E7zgSHG/ahuWAnWeFtxaxHeukH+
Q2Zq6F8FLbq40PphyroRylMBpzPBcyxjee7mDj1DpJ9ayv6GGPTyQzOImhChEV8p
bA42dvXnB5ju0rPh2GxctbiZZD1kiPH4jlmDIgomvupAj9OFntA5jfkuSFBekZrw
QyZowz/paMBIe24YH2LyaZjC2DqLy8Znh78OfAZxZsWSdZxK5LsbkCE9l8Li3gQa
rxm4aEMBHhvns+s8Ufa47sdJAYAfVnAWb5Dfe4oVFh70PvB8GSGFS9qeib0eEQBD
71c9MN+REDTSOYO2VnUSFbu7IrKsPsClqwfT9KzI/uz5fpHSKdCp5AO7oDZiU36s
LsSOBbukTmFQfVrAniFEZxHLCBufXCsAwp07xtUH9ytbW0Y/eHYlZojoWJJPT//1
cQ/A2Ix/nxbSkSPq8wpCUhBxvTQoU9BXeQIbSy0yUmj5nS+3DR7IK2Q7ACyVClr7
LVQOGxgZhHr9Kq87RDqc1wlvbCxb+KTJQhJySpOVoiaME6jLBzgE7G+5N6IXTK5u
OriOsQwcLdeBu7TPgft79uBYnmYeaNVdovlBB//7H7UvY0kAxAg4NPgK6eYRdzn+
8ZtbntNXi/23RJvzeZJVBqQ7bYt4fjmHmRYrbM4jWKJEoJOE6wzpmELUowARAQAB
tFVXbGFkaW1pciBKLiB2YW4gZGVyIExhYW4gKEJpdGNvaW4gQ29yZSBiaW5hcnkg
cmVsZWFzZSBzaWduaW5nIGtleSkgPGxhYW53akBnbWFpbC5jb20+iQI+BBMBAgAo
AhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAUCWKLo+AUJBtq73QAKCRCQyAGe
NsLpZI/uD/sGG/o6nSNFvgnvC9o9k4SK/JHXyupo1VFpVUMCHNb3i6x0a+Dymrua
VsMVCzy85lAaoALQIq3X/3Tjqr8HbE5wzQQ/4XFAZZOwy6ncibgaVX4h3eMdMXm+
kSU1CLP72QRJEPxU89RPMbkxH+VArP/RyP35hec/qX51Ywm8dX5BjB/6Wj03X2sw
wEw9QvGLPmGzXaJrzL8LlHx04Fk1wZ0NorKlffxNSB/NP8NTKEFp0h9e1xvR8Q5q
OxM2ZARLwPK+xxk4povyKRWqxuesh5p1LSDvh+S9Cie3+GD57ZA1dQSjyCaPQZUi
0yZlctyekgK3qEdQKGMva1/AD1trhQbp4mdnNsOjgo+YzJLxPif41nSqelkzDRwH
JYYtIYnDAbO27d97ios+E3H/NXmn5GeCcx2RuBA4V0RTvJHpRlXFJdvV5HShXvTE
UduOr8fCwc7Bi58dWy/YHAjjPsEpSJQEeKo0hgaRrj3pfvLJG9w4AvI/AqeOdxYW
1xhCi+MoIrfMHIYZ3NY65Kz6r2rLLtuR9oy5qOGawDcb3sfAmf3xh6N5RSakDRhF
/9aJtxH6OiyicLUBTt50wgNWYx/3jMjLpPt7EWQgT23qQvNI3s8W702JWPHrPOi7
t8cqGZIhcokW3DPhs4RRW6FLnbp48PhtVRtPAwNwzKKLoEvaQu8fZA==
=2Kph
-----END PGP PUBLIC KEY BLOCK-----
The best would be to confirm this information by looking at other independent sources. If you trust bitcointalk.org (and its moderators!), you are fine to use it. The best would be still to verify it using other sources. |
|
|
|
Is he preaching or recommending not to use anti-virus, if that's the case people should never listen to this guy, even if he is a legendary guy, it doesn't prove that this guy is a techie guy, our computer is our bank and since this is our bank we must employ the best security you can find to prevent intrusion.
If he is ok without using an anti-virus then it's up to him but don't tell that antivirus is a waste of money and space, this is deception.
You should start to properly read the thread before replying in it. He is not recommending to not use an AV. He was saying that - under some circumstances - an AV is not necessary, which is absolutely correct. You have to realize that not everyone is using the least secure operating system on this planet. And not everyone is clicking on every shiny button which promises free money. Just because you are one of them, who can not stay safe without an AV, this doesn't mean that people with a proper risk management can't. So, please. Instead of spamming threads just to get your signature payment, read them and bring value to it. |
|
|
|
Many people still think that the crypto space is unsafe, full of scammers and just one bubble. They need more safety and trust and less bad news about scammed people, hacks and exit scams such things scare new people off.
The problem with scammers is that the amount of them will increase as long as it is profitable. And the major point why it is profitable is because all of the victims have almost no knowledge regarding crypto at all. They hear something in the mainstream media, or from a friend and also want to invest / make a quick buck. This leads to easily manipulable people who believe everything they get told just to have the chance to invest in BTC or the 'next BTC'. As long as these people don't research first on how to buy, store and use crypto securely, there will be a huge amount of scams going on. And that's the biggest problem. |
|
|
|
What promotion are you talking about? I'm quite confused about what you're saying. Did ledger promote having two wallets?
When they introduced the nano x, there was an offer to buy 2 wallets at a discount (nano x + nano s). They promoted is as the 'backup pack', to always have a backup in case your first device gets lost or breaks. That's quite handy, but not necessary IMO. I haven't tried recovering my seed in Ledger, and I'm just curious with how you are going to input the seed. Too lazy to search unless I need to.
It is horrible. You have to go through each word and select each letter using the 'left' and 'right' button, then choosing it by clicking with both buttons. This can take quite some time until you have entered your 24 words. You don't need to enter the complete word, it will suggest you words which are in the wordlist and match with what you have entered, but it still an annoying process. |
|
|
|
|
Show Posts
