But unfortunately you did.
Simple copy/pasting from the internet without linking to a source is plagiarism.

You could have easily quoted it, attached the source in a foot note, or simply promoted it using your own words. That is not an excuse to copy/paste from websites.

Well, the problem with PBKDF2 is that it can be implemented with a small circuit.
This means it can be bruteforced at a fast rate using an ASCI (or even a GPU).

However, given that the keysize is way too big to even bruteforce a small portion of available keys, there are no practical security implications whatsoever.
If the number used to create the mnemonic is random (and not generated by a shitty/faulty PRNG) there is no negative effect from the key derivation function.




This is completely quoted out of context.

BIP39 has nothing to do with a brain wallet. Maxwell was referring to the use of a password to additionally protect the seed.
If the original mnemonic code is known, it basically just is 'guessing' the correct password (which basically means that this layer of security is similar to a brain wallet).
If an attacker has the mnemonic code, he can simply bruteforce the passwords very efficiently (because of PBKDF2).

He was explicitly talking about the deniability in this context.



Practically, BIP39 is secure. It all depends on the RNG used.
If your seed is generated randomly (which then is being encoded into the mnemonic), you are fine.

Further, the 'plausible deniability' is not as strong as people think it is.


You can safely use BIP39 for cold storage, or you simply create a wallet using core (completely air-gapped of course), generate a few 100s or 1000s of addresses and use them to receive funds.

There are multiple approaches for cold storage.

That's nonsense.




This won't fix the issue and does not justify and trust in your wallet.

You could simply remove the backdoor before giving out the source code. And who knows whether the app on the playstore really is this exact version you are providing for 'auditing'.


You either have to open source the wallet or expect that noone will use. People are not dumb.
There are a lot good (open-source) wallets available. There is literally not a single reason to trust a new closed-source wallet announced by a new account.

So.. you got banned, register a new account and the first thing you do is to offer a service on this forum. That's crystal clear ban evading.

I am inattentive.

I don't know what i'd be doing without LoyceV. Probably walking around and talking garbage 

Both of them look perfectly fine. Which 'issue' do you see in those transactions ?

1st transaction: 1 P2PKH input -> 1 P2SH / P2WSH output
2nd transaction: 1 P2PKH input -> 1 P2SH output (can't be said whether nested segwit or multisig yet)

This is not related to the issue of the OP.

Besides that, you can't 'disable' change addresses. That's how bitcoin works. You use one (or multiple) UTXO(s) and create one (or multiple) UTXO(s).
OP has send the whole UTXO 'to someone else', therefore it is a 1 input 1 output transaction.


OP, both of the transactions were received successfully.
Which tumbler did you use? And where did your second transaction go to? A private person or some business / website ?

I have removed my negative rating and left a neutral one instead.

@zackie
Did you use the same password for multiple sites ? If so, the chances are high that other accounts of you are compromised as well.
If i were you, i'd check them and maybe change all passwords.

No, it creates a new session id for each browser/device.

Simply pulling the session id from the DB would be a small security flaw.

Invalidating all session IDs when logging out has its advantages. Imagine you logged into your account in a public place, left the place but forgot to log out.
Instead of waiting for the session to invalidate (i.e. keep me logged in for X minutes), you can simply login from another device (e.g. your mobile) and logout.




Brave is based on chromium, yes.
Almost all browser are based on chromium now. Basically it is firefox vs chrome/chromium now.

Most probably this is malware, yes.
It is already a scam and deserves a flag. But i'd still like to check the files myself to investigate HTTP requests etc.. We might find the website / C&C server of him too.

The bitbucket link seems to be down. That is the reason i asked whether someone still has access to the file.

So why are you still trying to abuse the system together with quickscammer if you admit that it doesn't change the facts ?




I wouldn't call that - what you have - 'reputation'.




Woa.. is this a threat ?
Since i have to live in fear now, you did clear damage to my mental health.. You broke an implied agreement to not damage each other.. Can i start a flag against you now?

My guess would be 13135  

That's what my magic cat told me when i asked her.

Are those internal sites only?
Or accessed via the internet? I could not understand such a situation.

Is there no IT administration or similar ? I can't imagine they approve that.

TLS certificates are for free. There is not a single reason to not use them, especially when handling sensitive information.

Link to source code ?

 

Well.. maybe he excluded you from his trust list because you are not trustworthy at all ?
Supporting falsely created flags, opposing valid and necessary flags (e.g. against quickscammer), trolling , illogical statements to protect scammer and fraudster, etc..

IMO there are tons of reasons to distrust you. In fact, you are trying to abuse the trust system to your favor.


You received the most fitting neutral trust rating i have ever seen:

Vermutlich mit einer session (cookie) die unbegrenzt gültig ist. 

OP, wenn du Zugriff auf dein Mailkonto hast, dann ist das kein Problem.
Einfach PW vergessen anklicken und auf die Mail warten.

Sich von einer anderen IP einzuloggen ist auch kein Problem.. Du wirst ja nicht gezwungen dich ständig nur von einem Ort aus einzuloggen 
Außerdem bekommen die meisten eh immer eine dynamische IP zugeordnet die nur einige Tage gültig ist. Danach gibts wieder ne neue IP.
Zudem sitzen viele auch hinter einem NAT, da die IPv4 Adressen knapp werden. Das heißt mitunter sind tausende von Accounts unter der selben IP Adresse (aus Sicht des Forums) eingeloggt.

Yes.

When pressing the logout button, the server invalidates all active sessions for this user.
Invalidating sessions basically means all session id's are removed from the database. Therefore upon visiting (or reloading) the site, no active session is found and you have to login again. Doesn't matter from which browser you are trying / from which browser you have logged out.

Does anyone have the original (apparently malicious) file ?

AV engines often create wrong positives.

I'd like to check the files myself if there is no proof yet, that they are indeed malicious. 

Is this an assumption or is there any source on this ?

The reason i am asking is because this would imply that a vulnerability would exist which allows to gain knowledge regarding the pin / seed.

I doubt that this is possible even with professional equipment (at least it shouldn't, otherwise the nano s is vulnerable and shouldn't be used IMO).
I can't really imagine which equipment could be used for that. Simply unsoldering it and trying to access the data can be done by anyone and shouldn't allow to access sensitive data.

If you transmit sensitive information via the internet, you already have to trust the other party.

Encryption does not protect you from the other party, you are basically encrypting for them to decrypt since you share the same key.

Encryption is necessary because everyone in between (every router, server, basically anyone who wants to listen to that) can read and modify the information.
You are protecting your data from a 3rd party, not from the server you are communicating with.

I would suggest LoyceV, if he is up for that.
He also logged into my throwaway account and confirmed the PM's.

If you don't trust him or he doesn't want to do that, anyone from DT1 should be fine.
Just make sure to change your password before handing it out, and afterwards again