Piuk, can you comment on the Amazon S3 backup regime for deleted private keys - i.e. if I were to upload a private key and then later on delete it - are old copies of the encrypted wallet file still stored on S3 - and if so, for how long?
The last 50 backups are kept, so if you update the wallet 50 times old ones will start getting removed. However If you are deleting the key for security reasons you should assume the backup is kept for ever and instead use a new private key generated offline.
Missing "Refresh" and "Logoff" GUI buttons that were in the top right corner previously. Is it just me, or something changed in the GUI?
This should be fixed now, you may need to clear your cache.
I was just suggested to pay a 0.005 fee by the blockchain app. The app is really great however I really miss the option to enter a specific fee. The choice right now seems to be to either not pay anything or to pay what the app suggests..
For the android app? A number of people have requested this, my opinion is with the mobile app you want to send as quickly and easily as possible and so should need to alter the fee. I'm sure I can add a settings option for it but I don't want to add it to the send form.
How does Blockchain.info calculate a transaction fee? I've made a 2420-byte transaction and paid 0.0015 BTC, I thought 0.0005 is the norm for Bitcoin network (for now).
The transaction is larger than standard, it has calculated 0.0005 BTC per KB and rounded up. (see fee changes below).
I like this change - but blockchain.info assumes my email is secure. I don't think this is a great assumption.
Question: Shouldn't 2-factor authentication be sufficient here? If I have the right identifier and I pass the 2-factor check *then* you can send me the encrypted wallet?
It assumes it is at least semi secure but you of course still need the password(s) and 2FA details to actually login. 2FA should be sufficient but not everyone has it enabled, this is mandatory.
...Also given the recent scandal with Instawallet URLs being searchable via Google - can you send a one-time-alias URL rather than the real identifier?
This is possible but would take a fair bit of restructuring. Might be better to require every browser to authenticate themselves via email even if they have access to the identifier, depends how annoying it gets have to respond to all the Authorise login attempt emails.
I'm not sure this is working. On a new browser with no cookies or other local storage (Chrome in icognito mode) I enter my alias for Identifier. The page is reloaded and the ID field remains blank. Then in another tab I go to Blockchain.info/wallet and there is my identifier. So the challenge is defeated somehow.
Fix now thanks Stephen, same with the other bug regarding the corrupted transaction.
I just looked on my phone using iExplorer and didn't see anything, can anyone else (Ben) confirm or deny how this actually works?
Yes the main passwords on both mobile apps are stored plain text but sandboxed. If the phone is rooted malicious apps will able to break the sandbox and read the password.
The second password is stored in memory while the app is running but never saved locally.
Possible solutions are:
1) Never remember the password. Depending on how long the password is it would get extremely annoying having to type it in every time the app is launched.
2) Encrypt/Obfuscate the password with information stored locally. Solves the shock factor of "Ah my password is in plain text" but would be easily circumvented by anyone with technical knowhow.
3) Pin protection with server side help. A random password is generated when the app is installed the user's password is encrypted with this and uploaded to blockchain.info. The encrypted password can then be retrieved from blockchain.info by providing a pin and decrypted locally. It is a decent solution but at the moment the users password is never uploaded to blockchain in any form and this violates that rule.
Feedback appreciated.
-------
Changes- When the transaction fee policy is set to "Frugal" in account settings the base fee has been lowered to 0.0001 BTC.
- There is now the ability to block TOR exit nodes from accessing a wallet. If you are a TOR user you can of course continue to use your wallet without problem but don't enable this option.
- Double encryption now supports any custom defined number of pbkdf2 rounds. However there is no option to adjust this yet as when the rounds are increased over 1000 there is significant noticeable lag when decrypting the wallet and creating transactions, the decryption routines need to be made none blocking with a progress indicator.
