Explain wallets to me

[Drizzle]

I'm new to bitcoins and I have an online wallet at blockchain.info, but I want to understand wallets in general. How do I manage an offline wallet? I've read some terms like paper wallet, brain wallet, what are they?

Concrete question: suppose I create a wallet that's kept on my disk, how does money flow into it and out of it? Do I need to be online for that to happen, does the wallet file change as money goes in and out, or is that all kept virtually in the blockchain? If the latter, how do I find out how many bitcoins I have in the wallet?

[naphto]

You can go to https://www.bitaddress.org/ and create a wallet. You just need to write down the secrete key, and give the public one to receive your btc.
You can print it on the website.

[WishIStartedSooner]

I'm new to bitcoins and I have an online wallet at blockchain.info, but I want to understand wallets in general. How do I manage an offline wallet? I've read some terms like paper wallet, brain wallet, what are they?

Concrete question: suppose I create a wallet that's kept on my disk, how does money flow into it and out of it? Do I need to be online for that to happen, does the wallet file change as money goes in and out, or is that all kept virtually in the blockchain? If the latter, how do I find out how many bitcoins I have in the wallet?

Question 1) To manage an offline wallet, you create it with your internet turned off (preferably using a linux live-cd) and then print it or write down the private key and address (information which references a spot on the blockchain or ledger that everybody keeps which is where your bitcoin is actually stored). To generate one go to www.bitaddress.org, then drop offline (maybe unplug ethernet), and generate your information, print it, or write it down, then turn off your computer before going back online. This is best done from a linux live cd like ubuntu.

Once you send money out of your offline wallet it becomes compromised and is no longer an offline wallet. Also, if you load your private into a wallet managing app (like the bitcoin client, or blockchain.info) make sure you backup the wallet.dat, or send all of your bitcoin to a new wallet in one transaction. This is because of a quirk of the bitcoin clients called "change." Also, do not do this with Litecoin yet.

question 2) paper wallet is just a private key written down on a piece of paper. brainwallet is where you come up with a secure password that you can remember, and use an algorithm (bitaddress.org, again) to link it mathematically to one specific key. That way, all you need is the address to put money in it, then you can have money stored in your brain, only accessible if you provide the info.

question 3) it doesnt. its stored as information written on a ledger, kept by thousands of people, and verified cryptographically by miners. The wallet app is just a means of accessing and changing the blockchain.

therefore question 4) Yes, you do need to be online to send a transaction. Unless you have a spare old computer and set up a program called "armory" your offline wallet will be compromised when you go to send money out of it. You do not need to be online to generate a private key to a spot on the blockchain, and send money to it, however-- hence the concept of offline wallets. Yes, the wallet.dat file changes. I don't think you have to keep the changes though, just a backup. Not sure about that last sentence though, so I update it everytime just to be safe.

Question 6) already answered

Question 7) Use a blockexplorer. Blockexplorer.com comes to mind, but there are others i think. Once you send money out of a wallet blockexplorer might get messed up because of change.

Hope this has been helpful.

[JigoStardroll]

ur coins is in ur wallet :=)

[norick]

This wallet will make your life easier:

http://electrum.org/

It is lightweight application and you do not have to download whole block chain. Also, instead of doing regular backups, you need only to remember (and write down to several places) your seed phrase (10 dictionary words). And you don't need to worry about any webserver being hacked.

[Peter Lambert]

Wallets can be a bit hard to understand at first, but once you understand how they work all your questions will be answered. This also comes with an understanding of how bitcoin works.

What is a wallet? A wallet is merely a list of addresses and the private keys that go with them. The bitcoins do not actually go in the wallet, they go in the addresses. To send money from one address to another, you sign such a message with the private key from your wallet. The way cryptography works, you can sign a message only if you have the private key, but anybody can check using the corresponding public key that it was signed correctly. (This is why bitcoins are more secure than a credit card: to buy something with a credit card you have to give information that the receiver can reuse and charge your card elsewhere; but with bitcoins you are only giving the public address and signature, since they do not have the private key they cannot spend your bitcoins.)

To make an analogy, imagine the bitcoin network is made up of a bunch of mailboxes, each with an address. There is a finite number of coins which are all in these boxes. You can use your wallet (like a keychain) to open some of the boxes and move the coins to a different address. If you look at the client and it gives you a balance for your wallet, it is simply adding up all the coins currently in boxes which you have the keys for. Making an offline wallet is like taking those keys and hiding them somewhere. Even though you are not around, people can still drop coins into your boxes, they just can't be spent again until you bring back your keys.

[cp1]

The wallet contains the addresses (public) that you use to receive bitcoins and the keys (private) that you use to send bitcoins.  You don't need to have your computer on to receive them to the addresses in your wallet, but you do need it on to send them.  It's because the bitcoins that are "received" are really just a message broadcast to the network that your address has X amount of bitcoins in them.  To send them you need to broadcast to the network that you're sending them and authorize it with your private key.

[Drizzle]

Thanks a lot for all the replies. I think I understand things a little better now.

[jsmarclook]

Also, remember to backup your wallet.dat. This is your private key to your wallet. Without that, you won't be able to send transaction.

[WilderedB]

Thank you all for answering this guy's questions but I'm still a little confused.

So if I ever SEND any coins, ie use them as a currency as intended, then my 'wallet' and thus my keys, become 'compromised'?

That doesn't sound good at all?

I really love the concept of bitcoin but the security thing seems a headache or confusing. Is this some kind of bug or problem that we'll ever solve or is it always the case that the coins are 'secure' but we, the users, have no real security and our coins are easy to steal?

I work as a sales copywriter and when I get time I'm going to write a sales pitch for bitcoins - but I really need to understand it inside out first, and this security thing is a killer. I can't sell what I don't understand.

I get the idea, the concept, of an offline wallet for savings and a daily wallet for small transactions. But how can you do that, if by definition you need to top up that smaller wallet and/or address or whatever, and instantly that compromises the safety of the larger wallet?

The very fact you've used your private key to send money to the small wallet means that private key is no longer safe?

Well what's the point of it all then?

How are we supposed to use a system which isn't safe?

Either this is utterly ridiculous or I'm missing the point somewhere, so could someone explain what I'm missing please?


Thanks


Alan

[mikep2012]

This wallet will make your life easier:

http://electrum.org/

It is lightweight application and you do not have to download whole block chain. Also, instead of doing regular backups, you need only to remember (and write down to several places) your seed phrase (10 dictionary words). And you don't need to worry about any webserver being hacked.

ill second that - you can also make and use a portable version of electrum, only around 30mb.

[decentral]

The very fact you've used your private key to send money to the small wallet means that private key is no longer safe?

This is the part that I don't really understand yet either

[Blazr]

When you use/store a private key on a PC that is infected with spyware, then your key can become compromised, in the same way that your credit card number can be compromised if you were to use it on the same PC. If the PC is 100% clean with no malware on it then of course the private key's would be safe, but there's no way of ensuring that, so us paranoid Bitcoin users like to use paper wallets etc to remove this risk completely.

[WishIStartedSooner]

The very fact you've used your private key to send money to the small wallet means that private key is no longer safe?

This is the part that I don't really understand yet either

Well no... it doesn't necessarily mean that. Like the one poster said, its as safe as putting your credit card info through the internet tubes. But if that gets intercepted you have recourse.

If you're confident that you don't have any malware, either because you use linux, or because you're a total geek, or if you're not buying too awfully damn much bitcoin then you're PROBABLY ok just using a regular old bitcoin wallet client from bitcoin.org.

But when you're holding enough to effect your life, you'll probably wanna take more paranoid precautions like the ones described, at least until this is mass-friendly.

[WilderedB]

OK, I think, thanks.

How's it going to get more mass-friendly when it's like this now though?

I had 2 'wallets' the full-size one and the Multibit thing. The full-size version took forever to finally catch up with the chain thing, then today when I opened it gave some error message and started again from the beginning. That's totally unacceptable, so I've uninstalled that version.

3 questions regarding the 'Multibit' version

1.  I can encrypt the main .exe using AxCrypt, so it cannot be run without a password. Does that help in the slightest, or not?

2. Regarding the private key/s, how does one actually use them? I tried exporting from Multibit, the resulting file seems to be a registry entry. I presume it isn't one - but what is it, exactly?

To use such a key (keys?) do you have to place that file in the folder Multibit is installed in? There doesn't seem to be any keys in the folder at present, so where exactly is the "key hole", so's to speak, for these keys?

Hang on... I can "import" keys? OK, so it's a ".key" file. But there are NO .key files in the folder at present, so what keys is/are it using NOW then?

3. How do you know which keys go with which address? I can't even see what keys it's using, so how do I know if it's the right key, or even which key?



I'm 46, been messing around with computers since I was 22, yet for some reason I'm having a really hard time understanding this system. My actual job is helping people understand technical systems and selling them on the benefits, yet here I am feeling clueless. As soon as I think I understand something it seems that's wrong, or even dangerous.

It's just paralyzing.

[WilderedB]

Above someone says to backup 'wallet.dat'

Well where the heck is THAT?


 

[syebotext]

I had an offline wallet but I was tired of it taking up 10GB on my C drive so I uninstalled it. however there are some others that don't hog so much hard drive space and I will try one of those soon instead.

[Peter Lambert]

Thank you all for answering this guy's questions but I'm still a little confused.

So if I ever SEND any coins, ie use them as a currency as intended, then my 'wallet' and thus my keys, become 'compromised'?

That doesn't sound good at all?

You just have to understand cryptography to understand why that is not the case, and sending bitcoins does not compromise your bitcoins. See my post above, but I will try to explain it again:

The wallet contains two things, an address (a public key) and a private key. When people send you bitcoins, they send them to the public address. When you want to send bitcoins, you do not give anybody your private key, you use they key to sign a message saying X bitcoins are moving from this address to another address. Again, you do not give out your private key, only the public key. Nobody can sign the message unless they have the private key, but anybody can check that the message was signed correctly and that you control the key for that address.

Maybe reading more about cryptography, like starting here http://en.wikipedia.org/wiki/Public_key_cryptography might help.

[Peter Lambert]

The very fact you've used your private key to send money to the small wallet means that private key is no longer safe?

This is the part that I don't really understand yet either

Well no... it doesn't necessarily mean that. Like the one poster said, its as safe as putting your credit card info through the internet tubes. But if that gets intercepted you have recourse.

If you're confident that you don't have any malware, either because you use linux, or because you're a total geek, or if you're not buying too awfully damn much bitcoin then you're PROBABLY ok just using a regular old bitcoin wallet client from bitcoin.org.

But when you're holding enough to effect your life, you'll probably wanna take more paranoid precautions like the ones described, at least until this is mass-friendly.

No, bitcoin is much safer than sending credit card information. If somebody intercepts your credit card information then they can go use your credit card information anywhere they want. If somebody intercepts your bitcoins transaction message, they can do nothing because it does not include the private key, just a message signed by the private key. They could not generate any other spends because they do not have the key.

[WilderedB]

OK, I get the bit about signing with your private key, how that's the thing that confirms sending the money and such.

I'm still somewhat confused over the actual file/format of the thing.

It seems the 'key' is just a number. I get the idea it's a number from a website that makes such numbers for you, bitaddress.org.


Yet with Multibit it's a "XX.key" file. This is awkward because how do I turn a number into a .key file in order to use it with that software? There's nowhere in the software I can just type in a number, so if I DO have the number written down somewhere, what use is it?


That software only seems to be able to import or export .key files, so:

If I export I have a .key file, but I don't have a number.

If I have a number (bitaddress.org) I don't have a .key file

And it seems there's something else, called a .dat file? Is that only for the 'thick' client, because I see no sign of such a thing with Multibit?


I hope my confusion is clear!



Alan