Don't forget electrum 4.

You'll have to clone the github repo and build it yourself, but it does include a lightning wallet

If you read my previous answer, this should make things clear for you...

If you used a weak password to encrypt your private key, and there is any chance whatsoever this key encrypted with the weak password ever touched an online machine, you're basically best off creating a brand new paper wallet using a strong password to bip38 encrypt your key, decrypt your "old" private key, import it in electrum, fund your "new" paper wallet (emptying out the old one, mark it "compromised").

IF you are 100% sure your key encrypted with a weak password never ever touched an online machine and no copies were ever shown to anybody but yourself, you could potentially use the offline version of whatever tool you used to bip38 encrypt your private key to decrypt it, then re-encrypt the same key using a strong password. After double-checking the decrypted versions of both encrypted keys match, you should probably burn the old paper wallet (with the weak password). Only do this after verifying tough!

I'll try to give a basic example that should make things clear for you

you use any tool to create "MySuperSecretPrivateKey", the public key hash of "MySuperSecretPrivateKey" is "1MyFirstAddress".

Anybody who gets their hands on "MySuperSecretPrivateKey" can spend any unspent outputs funding "1MyFirstAddress". Luckily, you bip38 encrypted "MySuperSecretPrivateKey" into "MyEncryptedSuperSecretPrivateKey" so now, people need your password to decrypt "MyEncryptedSuperSecretPrivateKey" before they can rob you.

To  bad you chose a weak password ("YourBirthDate").

You realise this, so you decrypt "MyEncryptedSuperSecretPrivateKey" using password "YourBirthDate", the output is "MySuperSecretPrivateKey".
You Re-encrypt "MySuperSecretPrivateKey" with a strong password ("AllRandomLetters"), the output is "MyStrongEncryptedSuperSecretPrivateKey"

HOWEVER....
decrypt("MyEncryptedSuperSecretPrivateKey", "YourBirthDate") = "MySuperSecretPrivateKey"
decrypt("MyStrongEncryptedSuperSecretPrivateKey", "AllRandomLetters") = "MySuperSecretPrivateKey"

Sooooo... IF ANYBODY, and i mean ANYBODY had POTENTIAL access to "MyEncryptedSuperSecretPrivateKey" at any point in time, he/she can easily brute-force "MyEncryptedSuperSecretPrivateKey" and find  "MySuperSecretPrivateKey", it doesn't matter the slightest bit that you re-encrypted  "MySuperSecretPrivateKey" with a strong password.

97 - mocacinno

thanks 

25 - mocacinno

Thanks

This might seem like an obsession, but in reality, it could very well matter. For example, i've seen low end VPS providers offering LXC containers with a quota of 10 Gb or less. If you think you'll be able to run a pruned node with 50 Mb of diskspace (or 550 Mb for that matter), such a cheap, low end box will suffice. However, if you take into account all data, log, binary and 500 extra Mb for the blocks, a 10 Gb SSD quota will be cutting it very close.

You're right tough: if the op is going to make thousands of requests per hour, he should just buy a 500 Gb disk and run his own node (i would advice him to run a non-pruned full node), and he'll be much better of than if he's using a (free or paying) api.

So, in conclusion, i agree with the general conclusion of your post, i only had some side remarks that migh (or might not) be relevant (depending on the usecase)

The bare minimum is prune=550 (IIRC), keeping little over 550 Mb block data.
Next to this, there are other datafiles, config files, log files and binaries,... So a pruned node will still need a lot more than 50 Mb (even the minimum size on disk of the blocks of a pruned node alone are > 50 Mb)

And, as a sidenote, a pruned node will still need to download, parse and verify every single block... So pruning will only save diskspace, not initial sync time or system load. And if, for some reason, a rescan is required, the pruned node owner needs to repeat the complete initial phase of downloading, parsing and verifying every single block.

That being said: you are correct that a pruned node will benefit people with a bottleneck regarding their diskpace (like people using VPS's)

[BUMP] => will be removed the next time i bump this thread in > 24 hours

Ah, so you only have one machine... In that case, the setup you describe would probably be "safer" than a "normal" desktop wallet, but defenatly not as safe as a proper airgapped setup (or a hardware wallet, or a properly generated paper wallet)... a VM with an encrypted disk and no network devices, nor using a shared clipboard might actually be a reasonably safe setup (albeit, you'll need a procedure to transfer signed/unsigned transaction back and forth with the use of a virual usb or something). I'm also thinking about applying patches to such a vm, since it's still located on an online pc, I'd still regulary apply patches, which would be a pain for a vm that doesn't have network interfaces...

An option if you have one machine would be to  boot tails and use it offline for your wallet with the private keys, then reboot to your "normal" online OS to create the watch-only wallet. This way you'd have a proper airgapped setup with only 1 machine (so you don't have to "sacrifice" a device for holding your airgapped wallet)

You're describing an air-gapped setup, considered to be (one of) the most secure method(s) of creating a wallet.

As long as your private keys never touch an online machine, and you've created these keys in a secure way, you're setup perfectly.

By the way: if your machine holding your private keys never ever touches the internet (remove network drivers, or even network hardware), a firewall isn't needed, nor can keyloggers harm you (unless you're talking about those hardware keyloggers that are actually connected to your keyboard, but at this point a hacker should have had physical access to your cold wallet hardware)

On average, there's ~10 minutes between blocks. If this average time between blocks is < 10 minutes, at the next difficulty retarget, the diff will increase so the time between 2 blocks is once again ~10 minutes (or vice versa).

Do note the word "AVERAGE"...
It's perfectly possible to see a time of 20 or 30 minutes between 2 blocks... As long as the average time is 10 minutes for the current retarget period, everything will stay the same.

By the way, i notice you're new here...
Some tips:
* don't post several replies after eachother. If you want to reply to several people, do so in one post.
* the emoticon of rolling eyes is considered impolite. I use it (for example) when a scammer is using the same old excuses for his scam technique (i roll my eyes at them)

19 - mocacinno

Thanks, these raffles always brighten my days

I've given freewallet the benefit of the doubt for quite a long time... I mean, from an outsider point of view, it did look like most cases eventually got resolved (rather later than sooner).
This being said, i never actually took the time to dig in the terms and conditions untill i've read Harlot's quotes. The combinations of these absurd KYC procedures (which freewallet aparently doesn't want to discuss), the completely random KYC-locks (for which the complete trigger mechanism is "secret"), the inability to resove issues in a timely basis (months rather than days), and the fact that (indeed) most of the victims will never complain on a big medium (like bitcointalk) made me rethink my stance.

Flag supported, these guys really, really, really need to clean up their act. This is not OK...
I'm defenately willing to withdraw my flag support IF they get their act right... The KYC-procedure should be passable by any person that did not kidnap, murder, steal or hack their way into the BTC they hold, and it should be passable in a matter of hours. Requesting absurd information, costly information, taking days to respond will no longer be acceptable.

Well, if you have 50 webservers, i'd probably use them to do what they were supposed to do: web hosting...
Really.

If you run miners on these servers, you'll take a big performance hit, and the server's primary function will be downgraded.

One of the only profitable, stable, cpu-minable coins is monero. Sure, you can mine some new, unknown coin and hope it's exchange rate will skyrocket, but that's basically a form of betting. Now, if you want to look at monero, i'd suggest looking here: https://monerobenchmarks.info/

The highest performant CPU seems to be the AMD EPYC 7742, hashing @ 44000 H/s while drawing 225 Watt.
This means, if you had a server farm of 50 servers with such cpu's, you'd hash a 2200000 H/s, making about 0.013 BTC/day (~$120)

The retail price of 50 of such processors is $375.000, not counting all other hardware you'd need (just the processors), you would burn 8,5 Mwh, and you'd make $3600/month, but from these $3600 you'd need to pay off your hardware cost and electricity cost, and you should realise that when hashing at these speeds, the system will be rendered useless for anything else. $3600 sounds like a lot, but it's the best case scenario and you'll defenatly won't be able to break even... I mean, you'd need close to a million dollars in hardware and burn 8,5 MegaWatt a month...

Odds are you don't have EPYC 7742 processors, so your hashrate will be a lot lower, and your power consumption might be higher...

Bottom line: not worth it... If you have a server meanth for web hosting, use it for web hosting... Accept a couple more clients and accept crypto as a payment sollution... Makes a lot more than overheating those precious machines by trying to mine.

Your webserver for mining? Doesn't sound like a good idear...
So, let me guess, you're on a shared host, and you'd like a php script to mine for you? In this case, you should realise that your host will most probably ban you in a heartbeat. I know a lot of shared hosters are overselling resources, and they monitor the load very closely. If they detect a php script to mine crypto, they'll kick you off their server in mere seconds, and potentially sew you for damages.

Next to this, even if you mine a cpu minable coin (like monero), with a php script on a shared hosting environment, you'll make pennies a year... Not worth the risk, defenately not worth the effort.

If it's your own, dedicated, bare-metal, host (so not a VPS), you might try to cpu-mine monero using a compiled minerd binary (not a php script), eventough it's defenately not profitable... You'll never earn enough to pay back the server and datacenter costs.

But, if you insist, a quick google query turned up this 2013 github project https://github.com/codler/Bitcoin-phpMiner . If you decide to run it now, i'll pretty much guarantee you won't even make a single satoshi, no matter how hard you try.

Any statistics to backup this quote?
I have no idear which percentage of the tx are for illegal purposes, but i've been part of the community for ~6 years, and my gut feeling tells me it's the other way around (>95% legit, <5% illegal). But, like your post, i don't have actual statics to back up my claim (just my gut feeling).

The problem here is that the mainstream media only reports on the bad aspects of crypto. They don't care if newegg adopts bitcoin, or if bitgild sells a ton of gold, or if binance exchanges millions from KYC'ed people, if bob pays alice for some artwork, if UNICEF receives tons on crypto donations,... . But if a ransomware asks for $30.000 in btc to unlock a company's server, they jump in and make it look like crypto currencies are only used for illegal purposes.
Mainstream media thrives on negative reports, especially if it marginalizes a small group of people. It's beneficial for them, they can scare people about a technology they do not use, it makes their readers feel good about themselves and scared about crypto, and it makes them buy newspaper subscriptions.

So, if you've only read mainstream media, i'm pretty sure you'll end up with the belief most of cryptospace is filled with illegal things,... But it isn't. These are real people, and just like in "normal" society, most of them are good folks, but a small percentage is bad. It doesn't matter of these bad players use crypto or fiat to conduct bad transactions tough...

As for the fact you reported a scam ring: the only thing i can say is "kudos". It doesn't matter if somebody is stealing fiat, crypto or physical items,... Thiefs and scammers should be stopped and reported, and i sincerely hope they'll catch these guys.

Well, ethically it would be rather simple: find out if you stumbled upon this wallet by sheer "accident" or because of a flaw somewhere in the RNG. A flaw would be for more likely than a complete random "accident".

If a flaw was found, you'd probably have to move those funds to a wallet generated by an unflawed RNG, and try to find out the actual owner to return his funds... If it was a freak accident, you'd have to delete the wallet and never look back.

Offcourse, that's the correct ethical part. Many people have financial problems, lost their jobs due to corona, have mortgage payments, are unsure what the future will bring for their children... Personally, i think i'd do the right thing, but i'd rather not be tempted with enough money to pay off my mortgage, stop working, make sure my daughter nor her (potential, future) children will ever have to worry about money ever again... In reality, i have no idear if i'd be able to take the high road, eventough i sincerely hope i would... I'm pretty sure that if i stumbled upon a wallet that was actively used, i'd be able to do the right thing, but in this case it's a dormant one, which makes it harder.

The total block weight is limited... Basically, this means that in a block there's only place for 1 Mb of transactions, but witness data of segwit transactions doesn't count for this 1 Mb limit (it has a higher limit).
This means that if the mempool contains 50 Mb of unconfirmed transactions, they won't fit into one block... Because the miner can add the fees of the sum of the transactions he puts into a block to the coinbase reward, it makes sense he picks the transactions with the highest fee (in sat/vbyte) to fill the block he's trying to solve. It also means that all other transactions won't be put into the block he's trying to solve, so they'll stay unconfirmed if he actually solves said block. Everybody getting payed in BTC wants their transaction to end up in a block (get confirmed), so they outbid other people that already have unconfirmed transactions in the mempool.

This boils down to a fee that changes depending on how much unconfirmed transactions are waiting, and which fee is payed by these unconfirmed transactions. If you want your transaction to have a high chance of getting into the next couple of blocks, you have to make sure you have a fee (in sat/vbyte) that makes your unconfirmed transaction be in the top 1Mb of the mempool (excluding the witness data).

An other thing to keep in mind is that the fee isn't fixed to the dollar (or euro, or whatever fiat money you're using), nor is it fixed for one transaction.. You pay a fee in sat/vbyte. Usually, the more inputs are used for your transaction, and the more outputs are created, the bigger your transaction is, so the more fee you'll have to pay. Bigger does not mean higher value... If you use 4 unspent outputs with a value of 0.00001 BTC as input and create 3 new unspent outputs of 0.00001 BTC, you'll usually end up with a bigger transaction than if you use 1 unspent output with a value of 100 BTC as input creating 1 new unspent output of 99,9999 BTC as output (eventough the second transaction transmits a much higher value).

To be honest, i always connect to my servers via a ssh terminal, and use x-forewarding to run graphical tools. So i know very little about the default desktop shipping with ubuntu. Even if i have to open an application on my private laptop (freebsd), i usually open a terminal window to run a binary. It might seem scary to use a terminal, but once you're used to it, you probably won't ever use those gui menu's or icons again...

That being said, this should be the sollution to your problem:
https://www.addictivetips.com/ubuntu-linux-tips/install-electrum-on-linux/
source: https://www.addictivetips.com/ubuntu-linux-tips/install-electrum-on-linux/

It's far more complex than sha256(seed phrase). As a matter of fact, i'll just point you to ledger's documentation, they did a good job at trying to explain what's happening in relatively simple terms (i couldn't do a better job in explaining).

Here's an interesting read for you, that should explain your question:
https://ledger.readthedocs.io/en/latest/background/master_seed.html
https://ledger.readthedocs.io/en/latest/background/hd_keys.html

And if you're ready to start playing: https://iancoleman.io/bip39/ (open source, so you can actually download the sourcecode and read what's happening)

I know it's a (very) little bit offtopic, but still a valid question for freewallet:
Apparently, you force people to get notarized translations for their documents if they're not in English... I recon more people are living in non-english speaking countries than the other way around, so i guess most of the people that get ambushed by your hidden KYC procedure end up having to pay for notarized transations?

https://www.universal-translation-services.com/what-is-a-notarized-translation/

-bank card statement => my bank card statement is at least 3 pages long... 3*20 + 20 = $80

-excerpt from a household register => no idear what this is, no idear where i would get one... Apart from this, at least 1 page... 1*20+20 = $40

-tax bill or tax return => 10 pages in my country... 10*20+20 = $220

-utility bill payment receipt (water/gas/internet/phone and so on). .. At least 4 pages in my country... 4*20+20 = $100

Minimal notarised translation cost => $440

What if the amount of their funds you locked up is smaller than the cost of these translations? You just keep everything? I've got a good idear, stipulate that the notary public has to be a famous person that has appeared in at least 2 dozen films with a rotten tomato score of 8 (or higher), that way you get to keep everything all the time...

What if the documents are in a spouse's name? For example, our phonebill is in my wife's name, but you require documents to be in my name... Do I really need to cancell my phone contract and open a new one in my name before you'll unlock my funds?

By the way, i'm not active on any social media, so i guess i would be screwed anyway if i ever decided to use your service, right?

I agree with everybody else in this topic: if you're going to force people to do this completely over the top KYC procedure, you should do so BEFORE activating their account and allowing them to fund their wallet... I'm curious if you'd gain 1 single customer if the cost of opening a freewallet account was $440 in notarised translations and a complete and utter surrender of every piece of private information you own