Bitcoin Forum
December 05, 2016, 08:48:55 PM *
News: Latest stable version of Bitcoin Core: 0.13.1  [Torrent].
 
   Home   Help Search Donate Login Register  
Pages: « 1 [2]  All
  Print  
Author Topic: Automatic Encrrytion and Password Protection of wallet.dat File?  (Read 7204 times)
slush
Legendary
*
Offline Offline

Activity: 1358



View Profile WWW
November 21, 2010, 02:49:59 PM
 #21

Probably, yes, I don't understand you. Can you tell me more?

You use a password + salt and hash them for creating new password?
How did you manage to enter a password without access to any hash functions? Or you remember the hashes?

The few most important hashes I already remember. I also have my website with simple hash calculator in javascript and virtual keyboard.

Quote
I prefer to simply do not use a passwords. Smiley

Of course, I absolutely agree. But do you prefer to use *nothing* than passwords? It is the main concern I'm speaking again and again here. I'm ABSULUTELY agree with you that passwords are not good enough and I use PAM and private/public keys everywhere it is possible. But I will use password rather than leaving my money in plaintext. Agree?

Quote
I am wait for your answer and we compare our methods.

I didn't say it is not possible or that YOU cannot do that. I see that on bitcoin forum are 90% people geeks and 10% libertarians (which are not both geeks and libertarian). So you probably know how to do memory overflow. But I'm telling you there are tens of thousands of sysadmins which does not know how to do memory overflow but know how to do copy&paste. Again, passwords are better than nothing.

Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1480970935
Hero Member
*
Offline Offline

Posts: 1480970935

View Profile Personal Message (Offline)

Ignore
1480970935
Reply with quote  #2

1480970935
Report to moderator
caveden
Legendary
*
Offline Offline

Activity: 1106



View Profile
November 21, 2010, 03:04:46 PM
 #22

I didn't read the whole topic but I agree that built-in password encryption of the wallet.dat would be a good thing.
The current client is really a "geek thing". It won't go mainstream like that.

18rZYyWcafwD86xvLrfuxWG5xEMMWUtVkL
nightrow
Newbie
*
Offline Offline

Activity: 15


View Profile
November 21, 2010, 03:41:59 PM
 #23

I can only agree on that.
Actually, wallet.dat is like a vault with the door open big.

Anyone that gain a physical access on your computer, or can execute something on it could theorically transfert all you wallet away.

We need some sorts of securisation.

You could suggest for example that when generating the private key, the last X digits are show to the user to store somewhere else, and are not stored in wallet.dat.
This way, you need both the password AND the wallet.dat to do anything.
Password is stored nowhere on computeur, and is just used to complete private key when signing payments.

bitcoin randomizer : http://fxnet.co.cc/?ref=148 turn 1BTC into many BTC
Want to give me some bitcoin ? 1JrbxRMVhdFUHkoSGk7RRvjYS5FfJMUUj9
bitcoinex
Sr. Member
****
Offline Offline

Activity: 350


probiwon.com


View Profile WWW
November 21, 2010, 04:04:56 PM
 #24

Probably, yes, I don't understand you. Can you tell me more?

You use a password + salt and hash them for creating new password?
How did you manage to enter a password without access to any hash functions? Or you remember the hashes?

The few most important hashes I already remember. I also have my website with simple hash calculator in javascript and virtual keyboard.

Yeah! Well we found a breach in your security strategy

Actually, you either have to remember passwords-hashes (but you can not remember a lot of hashes), or hash them on computer under your control (then you can just write down your password on this computer without any hashing), or give your password to someone else's computer to get the hash what you need (totally insecure method).

Like I said, you can simply encrypt the home dir with the same result.

Quote
Quote
I prefer to simply do not use a passwords. Smiley

Of course, I absolutely agree. But do you prefer to use *nothing* than passwords?

Don't juggle! I suggest using one password instead of several useless annoing passwords.

Quote
It is the main concern I'm speaking again and again here. I'm ABSULUTELY agree with you that passwords are not good enough and I use PAM and private/public keys everywhere it is possible. But I will use password rather than leaving my money in plaintext. Agree?

Quote
I am wait for your answer and we compare our methods.

I didn't say it is not possible or that YOU cannot do that. I see that on bitcoin forum are 90% people geeks and 10% libertarians (which are not both geeks and libertarian). So you probably know how to do memory overflow. But I'm telling you there are tens of thousands of sysadmins which does not know how to do memory overflow but know how to do copy&paste. Again, passwords are better than nothing.

My opinion: 5% geeks, 5% libertarians and 90% SEO-moneymakers-HYIP-investors-etc. Smiley

First two are able to use cryptography and such stuff. Second I'm not interested, but for them nothing is to cost  to encrypt sections of their home dir for secure their private data

New bitcoin lottery: probiwon.com
- Может, ты ещё и в Невидимую Руку Рынка веруешь? - Зачем же веровать в то, что можно наблюдать непосредственно?
bitcoinex
Sr. Member
****
Offline Offline

Activity: 350


probiwon.com


View Profile WWW
November 21, 2010, 04:06:56 PM
 #25

I can only agree on that.
Actually, wallet.dat is like a vault with the door open big.

The same is true for any personal data, not only for bitcoin wallet.

New bitcoin lottery: probiwon.com
- Может, ты ещё и в Невидимую Руку Рынка веруешь? - Зачем же веровать в то, что можно наблюдать непосредственно?
grondilu
Legendary
*
Offline Offline

Activity: 1134


View Profile
November 22, 2010, 07:24:58 AM
 #26

You are responsible of the security of your data.  So there is no "best practice".

Poor argument. Not all people can be an experts in safety. Why not to help people with transparent encryption of wallet.dat? It should improve security a lot.

Sure you can do that.  But in a separate project.  The whole point of bitcoin is not to depend on someone else trust for security.  Therefore, I don't care if some people are unable or unwilling to be responsible for the security of their data.  Those people could just as well use only mybitcoin.com.

If you want you can create a software that will wrap the headless bitcoin client and add a nice security layer around it.  But there is no reason to put any of it inside the bitcoin client itself.

fergalish
Sr. Member
****
Offline Offline

Activity: 440


View Profile
November 23, 2010, 11:06:09 AM
 #27

All that said:  As my personal bitcoin wallet gets more valuable, I get more nervous.  I would like to be able to export some of the value in my wallet onto a USB thumb drive and then put that thumb drive in my safe deposit box (along with a backup, gpg-encrypted copy that I'd keep in the fire safe in my basement).

So this is easy, right?  Quit bitcoin, rename wallet.dat to wallet.dat.orig.  Start bitcoin again, it will create a new wallet.dat with a new address.  Write it down, quit bitcoin.  Rename the new wallet.dat to wallet.dat.safe.  Rename wallet.dat.orig back to wallet.dat, start bitcoin, send most of your BTCs to the new address you just wrote down.  Voilà.  Start up again with wallet.dat.new and watch your savings roll in.  It's much easier if you do it on two separate computers of course.  Encrypt & backup wallet.dat.safe and tell no-one about it.  You could even print out a uuencoded version of the encrypted file and store it on your bookshelf.  Me, I'd be mostly nervous about storing in some communal wallet.dat (as I understand mybitcoin does, am I correct?).  It'll be fine until the day comes that BTC1 = US$lots, be that either through dollar hyperinflation, BTC market growth or both.  Imagine how upset you'd be if some employee of your backup service transacts everybody's btc to themself?

Really, though, bitcoin should allow for multiple wallet.dats and importing & exporting them (as someone already said).
stakhanov
Full Member
***
Offline Offline

Activity: 175


View Profile
February 24, 2011, 07:08:42 AM
 #28

I see analogy with safety belts in car (=passwords in software).

I worry that the correct analogy is:

Typing a password every time you use your bitcoin wallet is like putting padding your car's steering wheel instead of wearing a seatbelt.  It might make you feel safer, but it is a false sense of security.

Good security is hard.  If you're not computer savvy, then you've probably already got spyware and trojans on your system, and running bitcoin on a system infested with spyware and trojans is a bad idea.  Period.

[...]

Another analogy:  I keep most of my money in the bank; I don't have piles of cash or gold in my house.  I will do the same for my bitcoins, keeping only enough in my online, connected, possible-to-hack wallet to use day-to-day.


I like your analogies. But to build up on them, don't you have a lock on your home door? Even if you don't keep all of your money at home, you may still want to keep the small amount you have inside it somewhat secure. Granted, it's not "true" security (but nothing is, your online bank can also be compromised), but if a simple password encrypted wallet prevents stealing the wallet when the bitcoin application isn't started, why not include it? It would at least prevent most script kiddies to attempt simple scams.
Timo Y
Legendary
*
Offline Offline

Activity: 938


bitcoin - the aerogel of money


View Profile
February 24, 2011, 10:06:03 AM
 #29

It would be nice to have a "bitbox".

A smartphone-sized piece of hardware used exclusively for Bitcoin. It would have an aggressive firewall that allows no communication except for the Bitcoin protocol and perhaps a simple way to receive Bitcoin addresses from the web/ bluetooth/camera.  Automatic wallet encryption would mean that you have to enter a password before each transaction, but that's no more incovenient than using a credit card.  Perhaps it could include a fingerprint reader?

The bitbox would be a way to make strong security accessible to the non-geek user. 

Web wallet providers are not a satisfactory alternative IMO.  Except for small amounts of BTC.

They are not banks and they carry all sorts of risks of their own.

GPG ID: FA868D77   bitcoin-otc:forever-d
bitcoinex
Sr. Member
****
Offline Offline

Activity: 350


probiwon.com


View Profile WWW
February 26, 2011, 11:54:49 AM
 #30

It would be nice to have a "bitbox".

A smartphone-sized piece of hardware used exclusively for Bitcoin. It would have an aggressive firewall that allows no communication except for the Bitcoin protocol and perhaps a simple way to receive Bitcoin addresses from the web/ bluetooth/camera.  Automatic wallet encryption would mean that you have to enter a password before each transaction, but that's no more incovenient than using a credit card.  Perhaps it could include a fingerprint reader?

The bitbox would be a way to make strong security accessible to the non-geek user. 

Web wallet providers are not a satisfactory alternative IMO.  Except for small amounts of BTC.

They are not banks and they carry all sorts of risks of their own.

Bluetooth wireless 'smartcard' device which can ECDSA cryptography. On PIC controller with LCD screen and 2 buttons.

It can receive request (bills) for payents by bluetooth, display payie selfname and "To: payee address", amount and wait for pushing 'Pay' or 'Cancel'.

New bitcoin lottery: probiwon.com
- Может, ты ещё и в Невидимую Руку Рынка веруешь? - Зачем же веровать в то, что можно наблюдать непосредственно?
Pages: « 1 [2]  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!