I'm aware of the Ledger leak and I will either get a Trezor or if I decide to get a Ledger I will take the precautions you mentioned.
Whichever hardware wallet you decide to get, make sure to check its downsides and potential vulnerabilities (e.g. Trezor seeds can be extracted within a minute or two if no BIP39 passphrase is used). No hardware wallet is perfect. Each has its up- and downsides. It's important to compare them and decide for yourself which matters the most in your specific case. |
|
|
|
Do you still have the original file you have downloaded? If so, you can simply just verify that one. If the signature matches, you don't need to uninstall / delete anything. What I plan to do is uninstall Electrum, eliminate the Electrum folders in the Program Files (x86) folder and the data directory (%appdata%/Electrum).
If the file you have downloaded indeed is malware, removing any folders or files doesn't help you at all. In this case, you should format your hard drive. "Uninstalling" and deleting files won't remove any potential malware. However, the chances are rare if you typed in the url correctly. The best would definitely be if you had the original downloaded file. |
|
|
|
I also used the W7 until the very end when the official support stopped, and I can tell you that there is no reason not to use the W10
You might not see any reason to use Win10 over Win7. But the overall consensus is that Win10 is definitely more secure. That's not a matter of opinion, it is a fact. There are multiple security concepts implemented in Win10 which are not present in Win7. There are multiple known vulnerabilities in Win7 which are not fixed (and also weren't fixed before End-of-Life). I have only ever heard one argument to use Win7 over Win10. And this was "privacy". Well, for privacy you wouldn't want to use Windows in the first place. So that argument isn't really valid too. |
|
|
|
Thanks for that reply. I read about various options such as going directly from Blockchain to Electrum, but it seemed a bit risky to me to try doing it all at once with all my Bitcoin on Blockchain, in case something went wrong.
If I can just transfer like a normal transaction from one wallet to another, I prefer that, as it means I can do a small amount at first.
Since you are referring to the web wallet from blockchain.com as "Blockchain", it indeed might be better to simply create a transaction sending your funds to electrum. Further, the only option to move your funds from Kraken to your own wallet, is to withdraw them. There is no other way. Btw, did you verify the integrity of the software (electrum) you have downloaded? You might want to do this first. |
|
|
|
I don't understand how you could check integrity of hardware wallet by pocking and opening it like that if you are not some repair expert, and you clearly are not one.
Just because you don't know how to check whether the hardware has been tampered with, doesn't mean no one can. It is actually quite easy to verify the hardware integrity. There are multiple guides available on the internet. |
|
|
|
The following experiment with the desktop wallets "Atomic Wallet" and "Exodus":
Yea... no. Don't use any of those two wallets. You should consider using proper wallets, no extreme garbage like exodus, atomic, coinomi, jaxx, etc.. All of them have their downsides which shouldn't be ignored. If you stay with trustworthy and reliable wallets, you'll save yourself some headache later on. |
|
|
|
|
There is literally not a single good reason for something self-made which iterates the words.
If you want to add another layer of security, use encryption.
Either the BIP38 passphrase (for private keys), BIP39 passphrase (for mnemonic codes) or any other provably good encryption algorithm (AES).
Never do crypto yourself. And this includes any self-made algorithms to shuffle words.
Further, an algorithm which doesn't properly encrypt the words, but shuffles them, is a bad algorithm since it leaks information about the secret.
|
|
|
|
A similar approach is implemented through Bloom Filters (BIP 37). But those have been shown to be insecure and to basically not improve your privacy at all. You can add some "decoy addresses" as mentioned by others, but keep in mind that this will barely (if at all) improve your privacy. I honestly wouldn't count on it. If you want to somewhat preserve your privacy, do not use electrum at all. Or at least with your own full node. |
|
|
|
Paper is centred on the method to spoil addresses with tainted coins rather then privacy .
Which is completely irrelevant to CoinJoin. There is literally not a single reason to bring up that paper as a reason to "not use coinjoni". I know that paper very well. This is practically not easily doable anymore. The network has grown significantly. While this still is possible in theory, practically it is irrelevant. Especially if you don't make huge blunder, like allowing to connect via clear net or connect via Tor and clear net from the same node. This might have been a valid attack vector in 2014, but is negligible nowadays. Especially if you know what you are doing. |
|
|
|
~snip~
Nette Grafik. Dadurch wird einem mal klar wie irrelevant der Ledger Leak eigentlich ist. Dass die Mail Adresse geleakt wurde, sollte wohl keinen interessieren. Vor allem nicht die Leute, die wie in deiner verlinkten Grafik zu sehen, ihre Job Position, Social Media Profile, Einkäufe, Kreditkarten Daten, etc... bereits preisgaben. Bei der physischen Adresse sieht es natürlich noch etwas anders aus.. aber verglichen mit den anderen Daten welche offensichtlich leicht zugänglich ist, ist das wohl kaum mehr so ausschlaggebend. Schöner Hype um den Leak.. aber insbesondere die Leute, die eh schon alles von sich preisgeben, regen sich darüber auf.. Welch Ironie. |
|
|
|
But you actually can. Hardware wallets don't require typing them (IIRC)
Trezor (don't know which models exactly) require to type in the mnemonic code into your PC to actually restore it on your hardware device. However, the words get shuffled, which makes it not trivial to gain access to the correct mnemonic code ( 24! = 6.2 * 1023) possibilities. and if you are using electrum, you could just type the first letter of the word and click the right word on the suggested word list. If an attacker had some spyware on you, he'd only have the initial letter of each word, and getting the right seed from that is a close to imposible task.
If you type the first letter, there are only a few possibilities left. So it mathematically should be quite easy to recover the correct mnemonic code with only ~4-10 possible words per position. And further, if your computer is compromised, you should also assume that the attacker sees everything you do. This includes mouse movement. |
|
|
|
Funktioniert nicht. Also kann es bis zu 2 Wochen dauern ? Klingt so als könnte ich nichts machen als Warten . Richtig ?
Nein, das hat garnichts damit zu tun. Deine Transaktion hat das RBF (Replace-By-Fee) Flag gesetzt. Das heißt du kannst die Transaktion durch eine neue mit einer höheren Gebühr ersetzen. Nur lässt Ledger Live das nicht zu (Weil Ledger Live allgemein kaum Funktionalität bietet). Wenn du, wie ich oben beschrieben habe, Electrum zusammen mit deinem Ledger verwendest, dann kannst du die Gebühr problemlos erhöhen. |
|
|
|
Dummer Fehler.
Keineswegs. Im schlimmsten Fall dauert es einfach 2 Wochen. Verlieren kannst du deine BTC so nicht. Anleitung raussuchen bzw. Zusammenschreiben  Oh mein Gott. Das klingt kompliziert . UFF Naja.. die "Anleitung" besteht im Normalfall aus 2-3 Schritten (und damit aus vlt. 10 Klicks insgesamt). Aber in Ledger Live ist es, soweit ich weiß, nicht möglich die Gebühr im Nachhinein zu erhöhen. Falls du das vor hast, müsstest du Electrum verwenden und dort angeben ein Hardware Wallet verwenden zu wollen. Dort lässt es sich dann mit ein paar Klicks bewerkstelligen (Transaktionshistorie -> Rechtsklick auf Transaktion -> Gebühr erhöhen / "Bump Fee"). |
|
|
|
1. I would stay away Wasabi's mixing feature because it is ideal tool for the adversaries to taint your addresses, but sure this is my personal choice. How is your conclusion to "stay away from coinjoin" ? The authors don't even consider the case where coinjoin is used. Simply because their methods wouldn't work. It only allows to know that the coins come from a coinjoin. And if there is 1 transaction in-between, you already can't be sure anymore whether they belong to the same entity. From the paper: This assumes that the user is versed in privacy and does not for example reuse addresses. It also assumes the use of techniques such as CoinJoin to prevent addresses from being connected. These techniques add additional overhead and are too advanced for the average Bitcoin user so they received little to no traction
and The counter-example to this would be the CoinJoin (9) principle. This effectively allows multiple disparate entities to include their unspent outputs into a common transaction. But it also requires a party to act as a synchronizer between all other parties. This creates a high level of complexity which leads us to believe that such principles are rarely used.
I don't see why one would discourage from using coinjoin based on this. |
|
|
|
Was kann ich tun . Wird so eine Transaktion überhaupt mal Bestätigt oder gelöscht und geht die dann zurück ?
Solange sie nicht bestätigt ist, sind deine BTC auch nicht "weg". Du siehst sie nur nicht in deine Wallet, weil sie "ausgehend" sind. In der Regel werden solche Transaktionen bestätigt. Wenn aber viel los ist im Mempool, dann kann es auch sein, dass sie gedroppt wird. Dann kannst du eine neue TX versenden. Da du RBF aktiviert hast (erlaubt es die Transaktion zu ersetzten), dann kannst du die Gebühr jetzt immer noch "erhöhen". Um dir konkret zu beschreiben wie du vorzugehen hast, müssten wir jedoch wissen was für ein Wallet du verwendest. |
|
|
|
wieso hat das broadcasten jetzt bei dir funktioniert und bei mir nicht  Das kann ich dir ohne konkretere Informationen leider auch nicht sagen  Habe sie aber auch direkt über meinen Node gebroadcasted und nicht über blockchair. Was kam da denn für ein Fehler? |
|
|
|
I wouldn't ever generate a paper wallet using a browser-based software and/or javascript. Just run any reputable wallet (e.g. electrum) completely offline and write down the mnemonic code + address and private key (if necessary). But, what if you use a VPN and TOR? Would a user still face the same kinds of risks addressed above (and elsewhere)?
I have two hardware wallets, but am curious if a VPN and TOR would make paper wallets reasonably safe...
Neither a VPN nor Tor would help you in any way. You would still face all the risks mentioned, yes. |
|
|
|
du meinst dann in der konsole diesen befehl eingeben: getrawtransaction [die besagte tx] ? Genau. In deinem Fall also: getrawtransaction 8416c93454d22c913af5571745b99607a667f224a4e09a2b51c3ce3024ab0a39
Das liefert dir einen langen Textstring zurück. Den dann einfach online posten. |
|
|
|
Yes, they do. The first transaction consumes 1 UTXO (from 15EC9F1PtcaJYAZhCRNqfMmB4qoFC4oCQ7). The second transaction consumes 26 UTXO (and all from the same address: 15EC9F1PtcaJYAZhCRNqfMmB4qoFC4oCQ7). So.. yes.. they come from the same wallet. Well, given that you didn't export your private key and imported it into a different wallet. But for your purpose, this effectively would also mean "from the same wallet". |
|
|
|
|
Show Posts
