That's enough for everyone to see that you are talking about something, which you have no knowledge of at all.

You don't understand how one should develop a concept for automatic withdrawals.
You don't understand that security plays a huge role, regardless of whether private keys are stored on the server or not.
You don't understand that one can steal funds of a badly constructed web server which handles user funds even without any private key.
You don't understand that your 'approach' (if you really want to call it approach) is just inefficient and retarded.


So, stop talking about HD wallets. That was NEVER the topic in this thread.
I know that you unfortunately can't understand this.. But in this case, just start getting some basic knowledge first before trying to help people (which results in delusional bad posts with zero quality / relevance).

Simple answer, no.



That's not possible.

A hardware wallet consists of more than just a flash memory chip.




No, also you need some kind of verification which happens outside of your computer you are using to transact (preferably only on the hardware wallet itself).




They are not. Hardware wallets have secure elements embedded which keep the secret information secure and do the signing operations.
Like your credit card. It doesn't only consist of some plastic with a small flash memory.




Because it is not possible.
We have seen people who think it is possible, which simply just copied their wallet file onto the usb. But those people don't have a clue at all.




I guess you are talking about hardware wallets now (not usb sticks) ?

IF some attacker is able to flash the firmware of a hardware wallet without erasing its secret information (seed), yes.. definitely possible.
But you can't simply flash the firmware to get your own version on it without erasing all relevant data. If you would be able to do so, that would be quite a severe vulnerability (which already existed in ledgers hardware wallets, but got fixed).

If you are not able to flash the firmware, you have to somehow get the secret information out of the device with the official firmware installed.
And this is not possible, given that there are no vulnerabilities (which could always exist; especially side-channel attacks etc.. ).

You are just delusional.

Even with a HD wallet, you HAVE TO GENERATE multiple private keys (1 per address).

You obviously don't understand anything at all.. You DO NOT sign transactions with your SEED.. for gods sake.. better stop posting for a few years and learn all the basic stuff you don't know yet..






OP HAS TO generate multiple private keys.
A HD wallet just says HOW TO create them.. But you still need 1 per address.. Is that really that hard to understand ?!

The point is.. he wants to keep them SECURE.. not HOW he creates them.. 


You have been helpful ? 
Name me a few web service which handle user funds where you 'helped' a newbie to set it up.. 

I'd love to start some penetration testing against those platforms.. probably wouldn't take more than a few hours to find severe vulnerabilities.. And you are the one to blame.





I have never encountered such a large amount of nonsense in 1 person. You are a shame.

You can NOT SIGN transactions with your master private key.
You can derive your private keys from it, but you still need to use them to sign transactions..

So.. what do you do ? Create the private key, sign a transaction and delete it.. to 'not having to keep it'.. because of 'security' ?

Please stop being so delusional. Thats horrific. You don't have any clue on how to create a concept for an online service.
You probably can't even protect your own coins properly.



There is literally just 1 post from you which contains the truth:

This shows 1) how dumb you are and that you even know it and 2) that you are eager for merit.
That's not a good combination 

Mind telling us which cloud storage you have used ?
And did you encrypt your file which contained the seed ? Or did you store it in plain text ?

What VPN server did you use ? Did you only use the VPN to connect from your university network to your homenetwork ?
Or did you route the traffic from your home network trough a VPN server ?

---

The certificate usually is just for the client (you) to ensure you are communicating with the correct server.

The authentication is based on WPA2-Enterprise / PEAP / MSCHAPv2 ?
If so, the certificate is just to make sure your credentials are passed to the correct RADIUS server.

If you didn't import the certificate and connect to the wrong wifi, your credentials can be read by the malicious person operating the access point.


But you should always be able to connect without the certificate (even if it is not recommended security-wise).

IF the transaction is confirmed (which it obviously is)
AND you hold the private key associated with the public key / address -> you DID receive your transaction.

In this case, you are just not seeing it inside of your wallet, which can be because of multiple reasons.

Your level of information in this thread is very low. Did you read the sticky [READ BEFORE POSTING]-thread ?

At least answer achow101's question:


'I didn't receive them ... what's going on' is literally no information at all. We can't help you without knowing what software you are using, etc..

Why are you so keen on getting those merits ?
It's not like its hard to get them... at least not if you know what you are talking about and are not a complete retard 




You really seem to lack the ability to read properly.
Like i said:

Also.. side chains counts towards on-chain scaling now? 




These 'meaningless' things were just me correcting all of your mistakes you have done.
Someone has to correct the nonsense misinformation you are spreading. You are harming this community.

I don't know whether it is because you simply can not read, or because you just don't want to read.. Maybe it is even because you don't understand what you are reading..
But what you are posting is wrong in 80% of the cases.


So, come on, whine more about me getting merit while you desperately need them so much.
I won't argue with you. There is no reason to argue with people who do not understand what is being written / asked in most of these threads.

But if i see more misinformation from you being spread, i definitely will correct it. Not to teach you, but to keep the information in relevant threads here correct.

Where did OP say that ?

Maybe learn to read properly ? ..




OP never mentioned anything about 'keeping track of private keys', but on how to store them securely.
Also.. how do you come to the conclusion that OP does not know what a HD wallet is  He never mentioned anything which could lead to that conclusion.

Even with a HD wallet, you have to handle all private keys.

Good (and big) online services do not use a wallet software like electrum etc. to handle their keys. They build their own software (which obviously have to handle private keys..).




Irrelevant information ?
Sure, if you want to build an exchange or any other online service which handles funds of user, knowledge about hot-/cold- wallets is useless..

You didn't help at all. All you did was saying 'yo op, use HD wallet, it is best'.

It is a shame that you even dare to comment in this thread without having knowledge regarding the important parts of safely constructing a concept for OP needs..




You still don't understand what OP really wanted to know..




HD wallets are not the solution. That's not what he asked. He does know how HD wallet works (see his last post).. thats completely not he topic here..

Using a HD wallet won't secure automatic withdrawals and won't protect against attacks, does it ?

So, instead of posting nonsense, please educate yourself before trying to 'help' other people.

---

Not necessarily.

You don't need the private keys stored on the server, you just need a route between your web server and a server which does handle the payouts.

A concept without storing any private keys on the web server would be, that you have a 'withdrawal-server' which has the private keys and queries your web server to get a current list of 'next withtdrawals'.
This is the server which creates the transactions / broadcasts them.

Or - similarly - the webserver creates unsigned transactions with the public keys and sends them to the 'withdrawal-server', which then signs and broadcasts them.


All of these possibilities include that there is a way for an attack to theoretically get transactions injected into the flow. So none of these is completely sure.
But this would be a concept to avoid private keys stored on the server and therefore against them being stolen.

Wasn't it (in previous firmware versions) that you could either access your nano s via 3rd party wallets with browser support on OR native ledger application (back then chrome addons) without browser support ?

Or did this only apply to ETH? I don't remember properly 




Which advice? Bringing everything up-to-date ? Or removing all applications and reinstalling them ?

I can't imagine the latter one would fix that issue 
But outdated software could definitely be the reason, unfortunately it seems that OP doesn't want (?) to tell us his software-/firmware versions
At least he didn't answer to whether his nano s / electrum is up-to-date.

Ye, i always have my encrypted paper wallet with me and my laptop with a fresh linux iso on my usb.
That's so handy.

Who needs a small device with a weight less than 100g, which secures your coins and can be always accessed everywhere without putting your BTC at risk, if he can just carry around a laptop + linux iso + paper wallet to access his BTC.  

You might decide that it is unnecessary for YOU. But calling hardware wallets a 'dumb concept' is simply retarded.


Name one way to securely carry BTCs with you together with the ability to spend them everywhere without much hassle..




IOs free of bloatware ?  

Ok, apple fanboy. Is this a fact because steve jobs appeard in your dreams and spoke to you ?
Or how do you come to that delusional conclusion ?


And sure, IOs does not have any vulnerabilities.
If the code is closed source, noone knows how to exploit them, correct ?  

Security by obscurity has always been a good idea..  




Must feel very good to pay 800$ for a mobile which has a worse (closed source) OS and much inferior hardware than a 400$ android device.

I guess you like bitten apples.

No.

Ledger live is NOT infected with malware. Not a single update is infected with malware.

There is a simple malware spreading which replaces the original ledger live with a malicious software  which looks like ledger live asking for the seed.

These are 2 completely different things.


The same can happen for each application. Bitcoin core, electrum, microsoft word, your browser, etc...


The fact that they chose to do THAT, shows that they are very desperate.. They could have done way more with access to the victims computer (who knows what they are actually doing).
But just replacing ledger live is a really bad attempt to make money.

If they are not as stupid as i think they are, they also compromise your whole system, and not just replace ledger live.




Nevermind, i think they removed this option which is automatically enabled now (not sure about that).

Did you check that everything is up-to-date ?

Which 'electronic' signature schemes are you exactly talking about ?
I hope you are not talking about RSA..




Like you wrote... in libaries.

Some random developer wrote a buggy libary which allowed room for exploitation.. So.. how is this related to ECDSA / bitcoin at all ?




And the government controls all of our brains with the help of chemtrails!


Please.. for the sake of satoshi.. stop posting so much retarded misinformation. That hurts reading.

Because you might still want to access your coins and move them around / use them instead of hoarding them for 10 years ?!
Maybe because you want to take BTC with your for a bigger purchase without risking losing them all ?

Who cares about 60$, if all of your coins are secured for that money?!


This 'malware' is the dumbest form of a malware.
I mean.. i could also create a malware which says:

"Your paper wallet has been updated, please enter your private key, or directly send your coins to 12ScammerAddress to not lose them".

It is the same as with the current malware.
HW seeds and paper wallet private keys do not belong on the computer. And people who don't know this, didn't use their brain at all when setting up their wallet.




Ios > android is bullshit.
Android a big chunk of malware.. is bullshit.

It is your personal opinion, and thats fine. But it is wrong.


You are saying that an closed source operating system whose 'encryption' and screen lock can be circumvented by federal agencies and apple itself is better than an open source mobile OS based on linux with proper screen lock and proper encryption ?
WTF, dude. Less smoking, more thinking.

I mean.. i don't care what your personal opinion is.. but stop spreading misinformation.

 

You mean onchain 'scaling' like btrash ?  






No.. honestly.. on-chain scaling is good (except for just doubling the block size, thats absurd), but not enough.
There is no good (non-btrash-propaganda-) argument against off-chain scaling.. But a lot against on-chain scaling..

Or - even more easy - download the appimage.

He still might be missing some dependencies which would result in errors.
Using the appimage would probably be the best way since it comes with all needed dependencies and is easier to use for people who are not that familiar with linux:

No.

OP is right, you are wrong.

Bitcoin is following a UTXO model, where ethereum has an account model.
This definitely makes a difference.

OP never said that HD wallets do not exist, he said that it works differently when comparing ethereum to bitcoin, which is correct.




Hot- / cold wallets is an irrelevant topic when hosting an online service which handles user funds?  

The 'main problem' is the mapping from addresses to user ??  


I really don't get what you are trying to say.

If you believe the correct handling of the funds (hot-/cold wallet) is irrelevant, you obviously don't have a clue at all.
And if you additionally think that the mapping is a problem, you absolutely don't know what you are talking about. That is probably the easiest task of creating such a service..


Also, there is no reason to have a 'single master key' to spend funds from.
That's not even possible. You need 1 private for each address. The private keys can be derived using the same seed, but thats not the topic here at all (and won't allow you to spend funds from one 'master key')..

So.. instead of posting bullshit without having any clue, what about you browse through the forum for a few month first (to learn all the stuff you obviously don't know yet) before trying to 'help' someone ?




Do you even know how a HD wallet works ?
Not like HD wallets would generate private keys or something silly like that...

Please stop creating post which contain anything 'technical' regarding bitcoin. You are just embarrassing yourself.

They do work.

You did download the .tar.gz from electrum.org, right ? You did not just try the commands in your command line without having the file in your current directory ?

Also, "They don't work" is pretty little information, don't you think ?
Linux gives you an output explaining why the command didn't work...



The easiest would probably be, if you simply download and use the app image:



But make sure to verify the signature before executing / using it.



If you want to have it installed, and not just as an executable containing all dependencies, do as ETFBitcoin said and download the .tar.gz and run

But again, make sure to verify the signature before installing!



What version of python3 are you using ? To find out, run this:

 

Having a backup does not prevent unauthorized access at all.

This is a tip to increase the safety of your funds, not the security.


A 'real pro tip' to prevent unauthorized access would be to decrease the attack surface (e.g. offlline wallet -> not accessible through internet).
You would 'just' have to secure it from offline access then.

---

That's definitely a good way of storing your coins securely.

But not everyone wants to travel with a second laptop, just to be able to spend some BTC.

A hardware wallet is - by far - not unnecessary.
It is a way to store your coins secure (not as secure as an air-gapped cold storage) while still having the convenience and portability of a mobile wallet.

Bitcoin Forum > Bitcoin > Bitcoin Technical Support

Please explain how this is a technical question regarding bitcoin.
Hint: It's not.

Please move it into the correct sub (Bottom left: move topic). Choose an appropriate sub (Alternative Cryptocurrencies -> ... ).

Missing udev permissions would result in a different error ('no permission' or something similar).

Also, i believe the error OP is facing only occurs under windows (please correct me if i'm wrong).


@OP:
'Browser support' is disabled on your nano s, right ?
Becaues it has to, in order to work with electrum.

You can disable it by opening the BTC app on your nano s, then open the settings and check that browser support is disabled.

It might be also worth to note that phishing can not only happen through fake sites.

If a website (e.g. an exchange) is vulnerable to XSRF (Cross-Site request forgery), one might be able to access / change your login credentials or do anything else in your name.

For example:
Lets look at the exchange: www.exchange.com
This (theoretical) exchange is vulnerable to XSRF and handles most actions with GET-Requests.

If you are logged in into www.exchange.com, i can send you a link in this format (given that that's how the webserver / PHP script works):
www.exchange.com/settings.php?newpassword=MySecretNewPassword

This will change your password to MySecretNewPassword, and the attacker can instantly log in (given that no 2FA etc. is activated).


This is a simple (and easily recognizable) example. But URLs can be quite long where it is not that easy to see anymore.
Furthermore an attacker might be able to encode the parameter, depending on the implementation of the webserver. So instead of ?newpassword=MySecretNewPassword, you would see some random-looking long string of characters.

Just checking the domain name and the TLD is not enough here.