The hash of a file never changes (even if you rename the file). Jpeg degradation refers to compression related degradation. That is, if you edit a jpeg file (like change white balance) it will do recompression that will degrade the quality. jpegs as a file doesn't degrade even a million years from now  It's a digital image (made of 1s and 0s) it's not a print |
|
|
|
By the way, since nxt is brain wallet, one password scheme could be that hash of any file that the user chooses can be his secret phrase. This could mean any photo from personal photo gallery could be a "secret phrase"
Even more than one file could be a "secret phrase". Something like Hash (Hash (file1) + hash (file2) + .... )
Not sure if it's a good idea, but this is possible due to brain wallet,
The real plus to this is that if there is malware on user computer, the malware wouldn't be able to guess what file is the secret phrase. Plus, keylogger will not able to steal the secret either. |
|
|
|
|
By the way, since nxt is brain wallet, one password scheme could be that hash of any file that the user chooses can be his secret phrase. This could mean any photo from personal photo gallery could be a "secret phrase"
Even more than one file could be a "secret phrase". Something like Hash (Hash (file1) + hash (file2) + .... )
Not sure if it's a good idea, but this is possible due to brain wallet,
|
|
|
|
Can you save it as encrypted? The user picks a password (his choice, could be weak, doesn't matter)?
Yes (wouldn't save it any other way). So the client creates 12 words secret phrase. Then it it asks the user to retype it (same everything as it's right now) Then it also saves the 12 word secret phase in an encrypted file, so that the user doesn't have to retype that long secret phrase again. He has to only type a smaller password that was used for local encryption. I think this will work fine. I will also add that next time the user opens the client, don't ask for encryption password or secret phase. Just open the account. The encryption password would only be needed for outgoing transaction (or forging) anyway, so there is no need to require the user to type it everytime. Password is also needed for decrypting encrypted messages. How do you think that should be handled? Need password in memory to decrypt them. (I can do that now if users checks box to remember password during session at login). Yes, good point. I guess that means requiring the encryption password each time the client is opened (but not the longer 12 word pass phrase). |
|
|
|
Can you save it as encrypted? The user picks a password (his choice, could be weak, doesn't matter)?
Yes (wouldn't save it any other way). So the client creates 12 words secret phrase. Then it it asks the user to retype it (same everything as it's right now) Then it also saves the 12 word secret phase in an encrypted file, so that the user doesn't have to retype that long secret phrase again. He has to only type a smaller password that was used for local encryption. I think this will work fine. I will also add that next time the user opens the client, don't ask for encryption password or secret phase. Just open the account. The encryption password would only be needed for outgoing transaction (or forging) anyway, so there is no need to require the user to type it everytime. |
|
|
|
Can you save it as encrypted? The user picks a password (his choice, could be weak, doesn't matter)?
Yes (wouldn't save it any other way). So the client creates 12 words secret phrase. Then it it asks the user to retype it (same everything as it's right now) Then it also saves the 12 word secret phase in an encrypted file, so that the user doesn't have to retype that long secret phrase again. He has to only type a smaller password that was used for local encryption. I think this will work fine. |
|
|
|
Let's use only this link: http://nxtra.org/nxt-wallet/ in our forums OP and on our sites, like wiki, nxtcrypto, mynxt or any local lites
Who agrees?
I agree. Lets promote this as default link on every major nxt site. This thread. http://www.nxtcrypto.org/ (can you get QBT to make that as default site to download?) |
|
|
|
How safe is indexedDb/WebSQ ? Can malicious websites sites access it?
No, only the domain that created it. Can you save it as encrypted? The user picks a password (his choice, could be weak, doesn't matter)? |
|
|
|
Calling everyone who criticise Nxt a troll is not a good idea, I think.
Solarion raised a valid (and recurring point) here, as well as BrianNowhere did. Yes, the way how he communicates is not nice, but I can understand this, as he lost his money. (even if it was his fault) If we want Average Joe to use Nxt (no, not the Joe from bitcointalk, but the Joe from Facebook), we need to make it foolproof. This takes some time, but instead of arguing, the developers should keep improving the clients to make it more user friendly as they are doing it ny by releasing new versions again and again.
That is a valid point, but this is a decentralised community, someone must take command to do something? Why don't you write OP and tell him to rephrase the OP? I am 100% sure he will do this, as he has done many times before on request NRS is NXT So it's understandable why it's the main link everywhere. Clients are just GUI interfaces that interact with NRS server. NRS server comes with default "client" that user can use at 27.0.0.1:7875 .. If it didn't include that default client, no one would be confused. |
|
|
|
Calling everyone who criticise Nxt a troll is not a good idea, I think.
Solarion raised a valid (and recurring point) here, as well as BrianNowhere did. Yes, the way how he communicates is not nice, but I can understand this, as he lost his money. (even if it was his fault) If we want Average Joe to use Nxt (no, not the Joe from bitcointalk, but the Joe from Facebook), we need to make it foolproof. This takes some time, but instead of arguing, the developers should keep improving the clients to make it more user friendly as they are doing it ny by releasing new versions again and again.
I sent Jean Luk PM almost two weeks to make it a priority to replace the client. If nothing else, just remove the client from the server software, as was the original plan. No one would then be mistakenly confusing NRS server with clients. |
|
|
|
My 40,000 NXT bounty still hold. (When wallet.dat is integrated in official client AND is the default option )
There is wallet.dat with offspring. The built-in client (which as has been said many times was supposed to be temp) can't have wallet.dat as it runs from a browser with restricted access to hardrive. I will be providing : - Open source browser extensions that will be able to read and write a wallet.dat. - Windows, mac and linux standalone apps that will be able to read and write a wallet.dat. Now for a browser only, the best that can be done is to save the wallet in the localStorage or indexedDb/WebSQL. Is that a good option? The user should be forced to backup the wallet on creation. Don't include wallet.dat with browser version. It's more dangerous than forcing user to save the password. The user will clear his cache and lose his account, then come back here telling us why nxt sucks. If someone wants wallet.dat, they should download the desktop version. That's why I said the user should be FORCED to back it up. How safe is indexedDb/WebSQ ? Can malicious websites sites access it? |
|
|
|
My 40,000 NXT bounty still hold. (When wallet.dat is integrated in official client AND is the default option )
There is wallet.dat with offspring. The built-in client (which as has been said many times was supposed to be temp) can't have wallet.dat as it runs from a browser with restricted access to hardrive. I will be providing : - Open source browser extensions that will be able to read and write a wallet.dat. - Windows, mac and linux standalone apps that will be able to read and write a wallet.dat. Now for a browser only, the best that can be done is to save the wallet in the localStorage or indexedDb/WebSQL. Is that a good option? The user should be forced to backup the wallet on creation. Don't include wallet.dat with browser version. It's more dangerous than forcing user to save the password. The user will clear his cache and lose his account, then come back here telling us why nxt sucks. If someone wants wallet.dat, they should download the desktop version. |
|
|
|
My 40,000 NXT bounty still hold. (When wallet.dat is integrated in official client AND is the default option )
There is wallet.dat with offspring. The built-in client (which as has been said many times was supposed to be temp) can't have wallet.dat as it runs from a browser with restricted access to hardrive. |
|
|
|
You mean someone that wants to donate to the millionares that created this thing can't be bothered to enter an account #?!? Color me skeptical. Do we even know who owns that non account?
everyone owns that account, you know how to enter it yourself  If you send NXT there, than the first person to detect that, will send the NXT to his own account. In your case the NXT went to this account: http://87.230.14.1/nxt/nxt.cgi?action=3000&acc=15403621473314136443Maybe he runs a program that checks the "easy" account numbers for incoming transfers. I think this is so really stupid argument. If I want to donate it, I would rather donate it to someone I know, rather to random hacker running a bot by sending them to "null" account. I doubt anyone sending nxt to "null" account are donating it. They are all new users making the same mistake. There is no point in arguing it's not a problem. Brain Wallet by itself is a for very advanced users who understand entropy. It should be make much harder for users to just enter any random (or nothing) as pass phrase |
|
|
|
Thanks. If you think I'm the lowest common denominator intellectually, then well, I hope you're financially diversified.
Haha, good post It is true that we need to make a failsafe client for really computer-retarded persons. But a client like Offspring is close to that. Can't make much wrong with it! New users are going to go to http://www.nxtcrypto.org/ and download the default NRS server -- Most won't even know "Offspring" exists. The build-in client (that was supposed to be temporary) that comes with NRS server needs to be replaced. This will solve most password related user errors. Totally agree. When introducing friends or fellow pokerplayers to NXT I always send them to nxtclient.org and stell them to now install the main client, because it is too much hassle to set it up. But I am sure we will figure out a solution to that soon. I guess nxtcrypto.org should redirect users to nxtclient.org from the download link. NRS is the "server". Something like the main backbone. The clients interact with it. Anyone can write any type of client (like Offspring with wallet.dat as option) that interacts with NRS server. NRS comes with it's own (very basic) client javascript client, but it was always intended to be temporary. Who manages the site? Might be a good idea to change that, until the new UI comes out. I think it's QBT who runs that site. |
|
|
|
Thanks. If you think I'm the lowest common denominator intellectually, then well, I hope you're financially diversified.
Haha, good post It is true that we need to make a failsafe client for really computer-retarded persons. But a client like Offspring is close to that. Can't make much wrong with it! New users are going to go to http://www.nxtcrypto.org/ and download the default NRS server -- Most won't even know "Offspring" exists. The build-in client (that was supposed to be temporary) that comes with NRS server needs to be replaced. This will solve most password related user errors. Totally agree. When introducing friends or fellow pokerplayers to NXT I always send them to nxtclient.org and stell them to now install the main client, because it is too much hassle to set it up. But I am sure we will figure out a solution to that soon. I guess nxtcrypto.org should redirect users to nxtclient.org from the download link. NRS is the "server". Something like the main backbone. The clients interact with it. Anyone can write any type of client (like Offspring with wallet.dat as option) that interacts with NRS server. NRS comes with it's own (very basic) javascript client, but it was always intended to be temporary. |
|
|
|
Thanks. If you think I'm the lowest common denominator intellectually, then well, I hope you're financially diversified.
Haha, good post It is true that we need to make a failsafe client for really computer-retarded persons. But a client like Offspring is close to that. Can't make much wrong with it! New users are going to go to http://www.nxtcrypto.org/ and download the default NRS server -- Most won't even know "Offspring" exists. The build-in client (that was supposed to be temporary) that comes with NRS server needs to be replaced. This will solve most password related user errors. |
|
|
|
I don't care if next succeeds. I was merely anxious to try it out. I've been disappointed with the product from the start.
Your criticism has been noted and hopefully in another month we won't see the same kind of problem appear again (flame wars don't improve software - that takes work which is going on as we are posting). In another month there'll be 5 more legitimate competitors. Come back when they are out and working and lets see how many bugs and problems they have and where they are on coinmarket. Until them, yawn |
|
|
|
|
Show Posts
