|
They use bitcoinj, it could be changed since they sold it, but I bet they have a way of knowing which transactions would be processed and if they have passed the secret to the public, so no one can use the old secrets and just change the time. I also think that if you are not using the correct time in a transaction full nodes and miners will reject it from the network.
So you would have to target just their bitcoinj instance which if they are smart is only connected to a full node they have control of.
|
|
|
|
So the question is: 1. Easy, light and working ios wallet, but maybe a bit risky? 2. Not too easy wallet with holding the keys, which you should not lose? 3. Or just make 2 registration ways. "Easy-to-use" mode and "Paranoid" mode?
Don't say easy or not easy to use, because it is your job as a designer or developer to make it easy and it can be easy. There are other wallets that take on the same technique and do it quite easily. https://www.bitgo.com/ |
|
|
|
|
Is that password for your wallet? Because you have use wallet unlock before using signrawtransaction.
|
|
|
|
|
The scriptPubKey is the public key of address, you can use validateaddress to get it.
|
|
|
|
Do you mean the one that user can "get back" will be stored on our server also? Or how can they "get back from our site"?
I believe your model involves fruitwallet moving user bitcoins out to addresses that only fruitwallet controls. Gweedo is suggesting you to use 2 of 3 multisig, so fruitwallet have NO control over users' bitcoins. I think "get back" means you provide a page (preferably an offline tool), so users can easily send those bitcoins off to another address. Get the bitcoins back incase I lose my phone or something like that which would have one of the multi-sig public keys on it yep, thanks! got it. It might need some time to develop, if there are quite a big percent of people who wouldn't use us without this feature, BUT will use us with this feature, then we will implement that  This isn't a feature, it is safe guard against you or hack against you. This should be mantory of all wallets. |
|
|
|
Do 2 of 3 you guys have one. Make user write one down and keep one in local storage if they lost their phone they can use your site to get them back.
Do you mean the one that user can "get back" will be stored on our server also? Or how can they "get back from our site"? Nothing will be stored on your server but your private key. So lets walk thru this together. User Alice loss her phone, she wrote down the private key for her back up public key which is used to create the multi-sig address but only requires you to use 2 of those keys. Alice goes to your site and says she lost her phone she A) can make a new account and send the bitcoins their or B) wants to send them to another address she has. Your site should sign either one of those transactions. One she gets that signed hex, she can either sign it on your site WITH Javascript so you don't have her public key and that is easy for the user or Alice being an advance user takes that hex and goes to another wallet to sign it and broadcast it. Then she has her bitcoins and not at once did you have a control over them. |
|
|
|
Multi-sig is very easy and not difficult to the end user, that is why there should be no answer but to include it. I also don't think you know much about bitcoin from a technical point either from what you are saying.
Agree. But what will happen if user loses his phone or it got stolen? Do 2 of 3 you guys have one. Make user write one down and keep one in local storage if they lost their phone they can use your site to get them back. |
|
|
|
I know there is a bitcoin conference taking place in NY in the coming week. I plan to attend and was wondering if anyone else around would like to catch up too.
Moderators: Not sure if the thread is under correct category. If it isn't, please move.
Cheers!
Moving it to meetups for you. I'll be attending. I'm actually one of the speakers. What are you speaking on? If anyone is going to the NY conference you have to all say hi to http://www.mediabistro.com/insidebitcoins/new-york/speakers.asp#bojansimic because this man started the https://bitcoinsecurityproject.org/ which I have contruibed to and believe is important part of bitcoin is security. I am still deciding if I should go, I feel like I have to play the 2cool4skool card. Nothing is catching my eyes on the speaker stuff same old same old. Takes a lot to get me out the basement. |
|
|
|
Insecure to the user from us stealing their money? If yes, then it is done. We will not implement any difficult to the end user features, at least for now. Lets keep it simple. There are a lot of wallets that are secure but absolutely unusable  What you say means, that we have to store key in storage, we have to think what to do if user switches to other browser, moves file in the storage, or clears the cache or reset the device or just lose the phone? If user loses the phone, then what? "sorry we don't have your keys, your BTC stuck in the chain". That is the task to my CTO actually, but that sounds not too reliable comparing to what we have now. Overall. Just imagine fruitwallet it is like cash in you pocket, a bit risky to keep but convenient. But don't worry, we will not steal anything and our servers are secured Multi-sig is very easy and not difficult to the end user, that is why there should be no answer but to include it. I also don't think you know much about bitcoin from a technical point either from what you are saying. |
|
|
|
You should use multi-sig addresses to make it secure. Or make it so the wallet is encrypt and only using javascript to decrypt it and storing the private keys in local storage. This is way too risky even if you aren't looking to scam but if you get hacked or your hosting takes your Bitcoins then all the users loose their funds. You should research it there are better ways than shared hosting.
We are addicted to security, it is our main priority. The approach we use now is totally secure. I even gave you my credentials, that means i'm confident about security. We don't use shared hosting. Have you tried the app by the way? If you have access to my coins you don't have proper security and have not researched the best way to do this. Please don't look at coinbase as a model for this. This is a very much a flaw, and way better ways to handle this. Look at wallet services that use multi-sig and using javascript to decrypt and encrypt wallets so you can't have access to the private keys. Learn to use those models. If you continue to use this model I will continue to call you a scam and warn people to not use this. Do you know any user friendly way to store keys on iphone taking in account that no ios apps can't be downloaded? Updated. That is why we sign transaction with iphone hardware. But you probably didnt tried that either. If you have my private keys then I don't care if you signed my transaction on the moon it is insecure. Yes you can use local storage a html 5 api to hold private keys. Remember html 5 is very powerful. But lets now say we don't trust the hardware, well then you can store a public key on your server, I can store a public key on my iphone I can create a transaction that I sign and you then sign, then you push to the network. This would be much more secure than a hosted shared wallet. Shared wallets are the most insecure way of handling user funds. |
|
|
|
You should use multi-sig addresses to make it secure. Or make it so the wallet is encrypt and only using javascript to decrypt it and storing the private keys in local storage. This is way too risky even if you aren't looking to scam but if you get hacked or your hosting takes your Bitcoins then all the users loose their funds. You should research it there are better ways than shared hosting.
We are addicted to security, it is our main priority. The approach we use now is totally secure. I even gave you my credentials, that means i'm confident about security. We don't use shared hosting. Have you tried the app by the way? If you have access to my coins you don't have proper security and have not researched the best way to do this. Please don't look at coinbase as a model for this. This is a very much a flaw, and way better ways to handle this. Look at wallet services that use multi-sig and using javascript to decrypt and encrypt wallets so you can't have access to the private keys. Learn to use those models. If you continue to use this model I will continue to call you a scam and warn people to not use this. |
|
|
|
Why do you store everyone's bitcoin? You should never use a shared hosting wallet for user funds. Do you have any cold storage protection?
This looks to be a scam. Probably TF coming back.
Hi gweedo. We store all coins in our wallet to make transactions easier for all the users. We will use cold storage when the amount of bitcoins will be significant. As i told. We provide service: you can easily and securely use ios for BTC usage. If you want to try hacking my fruitwallet account -> please: email: fruitwallet@gmail.compass: 12345678 If you want to try creating own - go ahead, if you want me to send you some BTC in case you afraid of using yours -> ask me to send you some. My name is Maksym Krupyshev. Why do you call me Scammer? Can you explain to everybody? P.S. I don't know what does TF means (sure i googled). English is not my first language, sorry. Thanks! You should use multi-sig addresses to make it secure. Or make it so the wallet is encrypt and only using javascript to decrypt it and storing the private keys in local storage. This is way too risky even if you aren't looking to scam but if you get hacked or your hosting takes your Bitcoins then all the users loose their funds. You should research it there are better ways than shared hosting. |
|
|
|
Let me talk to you about how you should handle funds in a very secure way. I willing to help one person do this and walk with them on the test net of how to streamline the handling of cold storage funds. This could shave a lot of trial and error off your company and keep your reputation on top.
I am building a project on Bitcoin. I would request u to check my signature link and leave your suggestion/opinion. Sounds like you are building a ponzi scheme just you are being upfront about it. I am more interested to work with people with real ideas and the drive to start something that could be a $1 million business your is just you looking to make a quick buck. So please leave this thread for serious people who are looking for serious help. |
|
|
|
|
Why do you store everyone's bitcoin? You should never use a shared hosting wallet for user funds. Do you have any cold storage protection?
This looks to be a scam. Probably TF coming back.
|
|
|
|
|
Let me talk to you about how you should handle funds in a very secure way. I willing to help one person do this and walk with them on the test net of how to streamline the handling of cold storage funds. This could shave a lot of trial and error off your company and keep your reputation on top.
|
|
|
|
Yes lets talk bitcoin is too big, but this other one I will probably contact. Sound good what about ustream.tv and stream casting a show, that would be very good for bitcoin.
I don't want to start my own podcast. I rather run a company than do radio, just my opinion. |
|
|
|
Just to tick all the boxes here, can you confirm that you have no other vested interests in TREZOR (shares in company, consultant agreements, endorsement incentives etc) that might bias your review? (Excepting of course being enthusiastic about the tech. generally.)
Just quoting this so Mike see it... Kinda fishy you got one so early on, I think the core development team should really have been the first to handle it so they can add support and confirm that is follows the BIP 32 as spec'd by them. Would have been a nice independent review as well. |
|
|
|
|
This is exactly why I would never use cloudfare, there are better ways to handle DDOSes.
|
|
|
|
|
Show Posts
