No, I'm talking about the case if it goes right into dispute. Since LocalBitcoins doesn't have access to the banking system, verifying the authenticity of the receipt is a problem because they cannot tell who is telling the truth and who isn't. While the honest person wins most of the time, the whole process is annoying and takes too much time.

Great point. I quite like the looks of ColdCard as well though they were actually affected by a vulnerability within the secure element (which isn't that big of a concern for me, doubt anyone would take it for an 200k sidechannel attack).

I'll probably purchase a ColdCard soon and post a review on it once I've had sometime to inspect and use it. The price tag for Ledger with the shipping actually makes it more expensive than a ColdCard, I'll probably get a Ledger if I find any on sale on the forum in the future, just as a collection.

Thanks all for the response!

There are definitely better methods but it's one of the long standing OTC exchanges.

I think they've pivoted their strategy. There are scammers from time to time who would send you fake receipts that are photoshopped and the trades are often disputed. I don't think it's that much of an issue if you are able to validate the identity of the user you're trading with. Most of the time, it just takes some time for the dispute to be resolved but it's usually fair.

Bet it's not as sophisticated as this: https://bitcointalk.org/index.php?topic=2607077.msg26530966#msg26530966!

It has been happening for longer than you think.

I've seen plenty of fake devices being tossed around in Amazon, they aren't as stringent about counterfeits as you think and plenty makes it through the sieves. But, it isn't that risky as long as you heed the advice here[1] and do a complete reset beforehand to ensure that you're generating new seeds (people were scammed similar to this before).

[1] https://support.ledger.com/hc/en-us/articles/360002481534-Check-if-device-is-genuine

Shouldn't be the case, you're specifying pip3 as the package installer.

I think this is an obvious question but, are you in the correct directory? Is the requirements.txt inside your directory?

Correct. It stores your private key and keeps any malware from accessing it and stealing your coins but it can't function by itself alone.
As in, the software is used only to spent the Bitcoins. You don't have to connect the Ledger to your computer all the time. The software has to be used to script and push the transactions into your Ledger. IIRC, there are certain mobile apps with Ledger integration as well.

The hardware wallet merely helps you to generate addresses and sign the transactions. You will still have to connect it to a computer and for the computer to script a transaction for your hardware wallet to sign. Without the use of any software, you can't possibly be able to craft a transaction and send it to your Ledger to sign.

The integration is beneficial as most user wants some form of control over what they can do with their transactions instead of just being limited to a single wallet.

You'd want to explore this[1]. It's not a huge issue as long as its only one word. You should run it on an offline computer as far and possible and assume the seed to be compromised once you've found the correct word and transfer the funds into a newly resetted Ledger wallet, with the seed correctly written down of course.


[1] https://github.com/gurnec/btcrecover Oof I linked the wrong one. See below.

But you'll still receive and relay tx messages from other peers that you're connecting to. If not the wallet can't function as it can't see unconfirmed TXes. Hmm I might be missing something here.

Report to mods. Giving him a red tag doesn't really do anything and is not what the trust system is supposed to be used for.

Does copyright laws apply in this case? Electrum is opensourced with the license allowing the use of the source code. I doubt it would actually be considered as a copyright infringement in this case.

Actually this presents a pretty big issue; users can't possibly verify the hashes of APK (Downloaded from GPlay) and it doesn't make sense for most to sideload Electrum either. Guess this is a pretty good point to dissuade people from using a mobile wallet as their primary wallet.

Lot #2: 0.007BTC

I get what both of you mean. But I think having an extra node (though not accepting incoming connections) still does bring a marginal benefit to both the user themselves and the network in general, though I can't really estimate the effectiveness of these against sybil attacks specifically. Though it is certainly, much much more beneficial to have one that accepts incoming connection.

Btw, isn't the TX relay mentioned by @pooya87 only applicable for blocksonly mode? Or has it changed, I'm still using 0.19.

Um Coinbase is nearly always down during the period where Bitcoin rises, which is quite annoying to say the least.

If you're putting your coins in the exchange, then you'll have to hope that the exchange doesn't experience any downtime during the most crucial period. Or, you can be like me and keep my funds offsite and use whichever exchange that doesn't go down .

I'm currently using a Raspberry Pi as my primary cold storage, airgapped with Electrum. Don't get me wrong, it's a $35 set up and it provides reasonable safeguards against non-physical attacks (and I don't hold lots of Bitcoins).

I'm considering to get a ColdCard as well, it looks great and I liked the simplicity of the design. However, given the hefty price tag and the functions, I'm not sure if I want to splurge that much money for something that I don't exactly need right now. I can't exactly find recent reviews within the forum on MK3 as well. Would like to gather some inputs from the community between CC Mk3 and Ledger.


Ps. I know that any hardware wallet would be more secure than an air gapped RPI so please don't spam the thread up with that.

The 24 words seed is used to generate the private key. The private key still exists and it is the reason why you can send the Bitcoins from the address you own. The private key comes with a public key and the private key is used to prove that you're able to spend the funds that's associated with the public key/public key hash.

With most wallets, you don't have to be concerned about private keys. It would suffice to just keep the phrases given to you safe.

Time to re-introduce the newbie jail? IMO though it had it's numerous downsides, it was the one effective strategy to keep spam congregated in one section instead of distributing it across the forum and making it hard to catch. Wasn't there a bot which automatically nukes accounts which exhibits a certain behavior? I vaguely remember an account that was created specifically for that purpose.

Take your Bitcoins out of Coinbase. Coinbase has been consistently unreliable in terms of their uptime and I'm not sure if you'd want to keep the coins in an unreliable service. Try exploring desktop wallets (Electrum, Bitcoin Core) and hardware wallets if you've large sums of Bitcoin. I know many would argue about 2FA on Coinbase but I don't think 2FA actually adds that much security when you're talking about malware attacks.

No... The point here is about arbitrage bots which specifically requires the funds to be transferred within the exchanges to take advantage of the differences in prices between exchanges. Leaving it on an exchange isn't safe and I don't think it's the best choice.