|
Thanks for taking my feedback into consideration and especially for that github link. Some interesting stuff there.
|
|
|
|
Thanks for your suggestions.
I've found roughly ten "80" in the four strings. I then copied the following 64 characters in a hex -> base58check converter to obtain the corresponding wif private key and imported the results into a blockchain.info wallet. All the corresponding addresses are completely empty.
Could these strings be generated from a brainwallet dump or something?
Does somebody know if electrum or multibit generate hex encoded backups?
Probably the answer is just behind the corner, but I tried to find infos online without luck for a few days now!
A private key can have two addresses one for the compressed public key and one for the uncompressed public key. Compressed WIF private keys start with L or K while uncompressed ones start with 5. Easy way to get all the possible combos is to enter the private key into bitaddress.org's wallet details tab. |
|
|
|
|
I've played around with it. Some feedback:
You may want to list old receiving address in the UI somewhere. It's a bit disconcerting when you generate a new address, browse elsewhere and then go back the address is gone. If you've handed that address out to someone and later forgotten about it then it helps to see it listed in the UI so that you can say "yes that address is mine". It also helps you recognize your account if you see familiar addresses in it.
The mnemonic is too long to memorize. If you can please increase the dictionary size and make the mnemonic 12 words.
Add a logout link when using a wallet restored from mnemonic. Maybe it's there but I can't see it. Is it there?
It's multi-sig but how do we know what combination of n of m it is? There must be some way to independently verify it.
Electrum makes you type in the mnemonic before it creates the wallet. This ensures that you noted it down correctly. You should duplicate this functionality.
|
|
|
|
LOL don't worry! It's highly unlikely we will see such sophisticated malware in the wild anytime soon. You asked the question so I thought I'd show you one extreme scenario. |
|
|
|
|
Shutdown bitcoind. Backup the wallet.dat file and then delete the original. bitcoind will create a new wallet.dat file when it is run again.
|
|
|
|
btcbot,
I read about Tails... It says it uses Tor as the means for its anonymization features. What I'm wondering is if you boot into this OS and use it offline, why does it have to be Tails, can it not be any other live CD/USB Linux distribution?
It can. |
|
|
|
I have to add, since I actually worked on it yesterday, that I've been using Electrum to generate paper wallets. (It's for a project to make a Bitcoin fountain for my spouse, where I've assigned the address for weekly dividends from 2 of my AsicMiner shares. She's got a QR code with just that private address, unencrypted and will use Mycellium's cold storage fetching to take money from it on an as needed basis). For those who are not aware, Mycellium lets you repeatedly access paper wallets without having to worry about change address loss. I created an Electrum wallet, while running Tails, offline, for one paper wallet and wrote down the 12 words just in case I need to run the wallet ever again and need to sign something. The idea was to create one wallet for one private key of cold storage. From the console I typed: dumpprivkey('1blahblahblahblahblahblahblahblah') Then take that private key that is output and run: gui.show_qrcode("5blahblahblahblahblahblahblahblahblahblah") I grabbed the QR code and printed it out. Done... A magical piece of paper, still backed by Electrum, which can be turned into money, repeatedly with Mycellium, as a few dollars a week drips in.  There's an electrum plugin here that does paper wallets: https://bitcointalk.org/index.php?topic=374138.0But please note the risks of revealing a private key in a deterministic wallet: https://bitcointalk.org/index.php?topic=374138.msg4237294#msg4237294 |
|
|
|
Are you saying malware on the offline PC could cause it to change the recipient while you are signing it? Cause I don't see how any other way malware would be a prob on the offline PC here....and if so, Wouldn't that be able to be detected visually?
Malware could encrypt (with the malware author's password) and embed the offline wallet's seed within the transaction so that when you broadcast the transaction you would also be broadcasting the encrypted seed. The malware author could then read the seed from the blockchain, decrypt it and steal your bitcoins. |
|
|
|
Use an OS that predates Bitcoin. Windows XP or some old Linux distribution. Obviously install the vanilla version and don't update it.
If you use an older, unpatched OS you risk a malware infection. For example if your USB drive gets infected it is more likely to infect the older OS on your offline PC rather than if you had an up to date modern one there. There is also the question of RNGs on older Linux distros. There was that Debian openssl bug for instance. |
|
|
|
So what happens to the CEO of Flexcoin now?
Nothing? He writes a press release then goes on with his day?
I assume law enforcement will be arresting him soon and putting him on trial to answer for his actions, right?
Just like any other company on earth?
Nope. Did anything happen to the tradefortress? I don't think so. |
|
|
|
Thanks! Wow this looks pretty darn secure. Is there any way coins could be stolen if this approach was used?
Malware could get to the offline PC via the USB stick. It would have to be malware that runs when you put the USB stick into the computer i.e. malware that exploits an OS vulnerability. Otherwise you are not really running any executable files off the USB stick. All you'll be doing is opening, closing and saving text files. |
|
|
|
Hi at all.
I have one (or two) question(s):
Can in start Electrum more than once at the same time and open defferent wallets?
Yes. Use File>open or the command line: electrum -w /path/to/wallet_file Is there a plan to implement the use of multiple wallets in (one times startet) electrum (like Multibit or Armory)?
Unlikely. Electrum aims to have a minimalistic GUI. |
|
|
|
Hi ThomasV,
I am EXTREMELY puzzled.... Does this mean that the MPK is enough for the software to derive the full seed from it? This sort-of makes offline transactions useless, as the MPK goes to the onlne PC where it could be vulnerable.
I just tried again on a fresh install. Yes, just pasting the MPK into the wrong box creates a fully working wallet, as the software is able to derive the private keys from the Master Private Key.
I think the name "Master PUBLIC Key" is EXTREMELY misleading, as the word "Public" makes me think it's harmless to bring it around (i.e. to the online PC)
Did I mix things up, or is this how it's supposed to work?
You mixed things up. The master public key cannot be used to derive the private keys. You probably have the seed in hex confused with the master public key. The MPK consists of 128 hexadecimal digits while the seed is made up of 32 hex digits. |
|
|
|
The URL you've posted above is incorrect. The correct URL is given below: http://labelectrum.herokuapp.com/In your URL you've transposed the u in heroku. Are you nervous? You may want to shelve this project until you've calmed down. |
|
|
|
|
Show Posts
