[ANN] bitaddress.org Safe JavaScript Bitcoin address/private key

[dooglus]

Quick question, does anyone know if Blockchain.info store the private key from a watch only address once you use on their site to authorize a payment?  i used the private key created on Bitaddress the other day to do such a thing.

I don't know, but you should assume that they (or your own computer) store it and will one day leak it to a hacker.

To assume anything else is dangerous. You're presumably using bitaddress.org for offline storage. Once you've entered a private key online, consider it compromised, and move any remaining funds to a new address.

[dooglus]

I published a branch with bip38 encryption on the wallet details tab. It addresses the requests on this thread and the issue posted on github:

Looks good. Thanks.

I'd like to be able to 'skip entropy collection', like I added to https://clamaddress.org/ (a fork of bitaddress). I took the code for that from the bitcoinpaperwallet fork.

[pointbiz]

v3.1.0
https://www.bitaddress.org/bitaddress.org-v3.1.0-SHA256-c3d4d8da8fc6980435a520dff562b7f831b2f6037ec2d4dd6bf76c5321873303.html
 - add BIP38 encryption on Wallet Details tab.

[minimalB]

Not sure if this is a bug:

If I manually change a letter in a private key and click "View Details" (wallet details tab), I don't get any error message but text and QR codes are not displayed either.

For example:
1. generate private key like: 5KjQAHniFiy18SU7eenyJ9EPYUkjrbiBPfDqw987QjT5vehVQZV
2. paste address into "Wallet Details" tab
3. manually change something, for example
  5KjQAHniFiy18SU7eenyJ9EPYUkjrbiBPfDqw987QjT5vehVQZV
  5kjQAHniFiy18SU7eenyJ9EPYUkjrbiBPfDqw987QjT5vehVQZV
  (at the beginning uppercase is changed from "5K" to "5k")
3. click "View Details"

Nothing happens... no text, no QR code, no Error message.

Would it be possible to get "CRC Error" message or something like that?

[pointbiz]

Not sure if this is a bug:

If I manually change a letter in a private key and click "View Details" (wallet details tab), I don't get any error message but text and QR codes are not displayed either.

For example:
1. generate private key like: 5KjQAHniFiy18SU7eenyJ9EPYUkjrbiBPfDqw987QjT5vehVQZV
2. paste address into "Wallet Details" tab
3. manually change something, for example
  5KjQAHniFiy18SU7eenyJ9EPYUkjrbiBPfDqw987QjT5vehVQZV
  5kjQAHniFiy18SU7eenyJ9EPYUkjrbiBPfDqw987QjT5vehVQZV
  (at the beginning uppercase is changed from "5K" to "5k")
3. click "View Details"

Nothing happens... no text, no QR code, no Error message.

Would it be possible to get "CRC Error" message or something like that?

The error is uncaught and shows in the console:
Checksum validation failed!

Yes, I'll fix it so that the error is handled and shown to the user. No one can lose money due to that bug, so I'll fit it in with the next release.

Thanks for reporting it.

[Trolololo]

I published a branch with bip38 encryption on the wallet details tab.

Thank you very much!


Tip for you!

[pointbiz]

v3.2.0
https://www.bitaddress.org/bitaddress.org-v3.2.0-SHA256-ad4fd171c647772aa76d0ce828731b01ca586596275d43a94008766b758e8736.html
 - switch languages without full page load
 - add BIP38 encryption to Bulk Wallet
 - use compressed addresses on Single/Paper/Bulk Wallet
 - add compressed address option on Brain Wallet

[Trader Steve]

I'm trying to understand the use case/purpose for having the compressed address. Can anyone enlighten?

[minimalB]

The error is uncaught and shows in the console:
Checksum validation failed!

Yes, I'll fix it so that the error is handled and shown to the user. No one can lose money due to that bug, so I'll fit it in with the next release.

Thanks for reporting it.

v3.2.0 still shows "uncaught exception: Checksum validation failed!" in console.

[pointbiz]

The error is uncaught and shows in the console:
Checksum validation failed!

Yes, I'll fix it so that the error is handled and shown to the user. No one can lose money due to that bug, so I'll fit it in with the next release.

Thanks for reporting it.

v3.2.0 still shows "uncaught exception: Checksum validation failed!" in console.

Sorry, still on my TODO.

[pointbiz]

I'm trying to understand the use case/purpose for having the compressed address. Can anyone enlighten?

Compressed public keys are 66 hex characters. Uncompressed are 130 hex characters. Using compressed keys saves space in the block chain because the transaction size is smaller and potentially would reduce the transaction fee which is calculated by transaction size in the reference bitcoin implementation.

There is no downside.

[Trader Steve]

I'm trying to understand the use case/purpose for having the compressed address. Can anyone enlighten?

Compressed public keys are 66 hex characters. Uncompressed are 130 hex characters. Using compressed keys saves space in the block chain because the transaction size is smaller and potentially would reduce the transaction fee which is calculated by transaction size in the reference bitcoin implementation.

There is no downside.

Thank you!

[minimalB]

@pointbiz:
I find labeling in v3.2.0 a little bit confusing:

In "Single wallet" tab, string "Bitcoin Address" represents compressed address.
In "Wallet Details" tab, string "Bitcoin Address" represents normal uncompressed address.
The same is true for private keys...

Also - if usage of compressed keys is preferred, it would make sense (at least to me) that compressed bitcoin address would be the first choice (on the left side) in "Wallet Details" tab.

Just my 0.00000002

[pointbiz]

@pointbiz:
I find labeling in v3.2.0 a little bit confusing:

In "Single wallet" tab, string "Bitcoin Address" represents compressed address.
In "Wallet Details" tab, string "Bitcoin Address" represents normal uncompressed address.
The same is true for private keys...

Also - if usage of compressed keys is preferred, it would make sense (at least to me) that compressed bitcoin address would be the first choice (on the left side) in "Wallet Details" tab.

Just my 0.00000002

Yes, I see what you are saying. I want to make wallet details less confusing. And de-emphasize the uncompressed info.

[BitCharlie]

Why are someone is going to encrypt the paper wallet?
I think the bigger risk is not that the wallet get stolen instead of forget the passphrase. Or I don´t unterstand the idea behind it?

[dooglus]

Why are someone is going to encrypt the paper wallet?
I think the bigger risk is not that the wallet get stolen instead of forget the passphrase. Or I don´t unterstand the idea behind it?

When securing your coins you have two conflicting issues to address:

1) you want to be able to access the coins at some point in the future
2) you don't want anyone else to be able to access the coins without your permission

If you don't encrypt your paper wallet then you are making (1) more likely, but (2) less likely. If anyone finds your printed paper wallet they can immediately just take your coins.

So you encrypt it. It's relatively hard to crack the password on paper wallets, but there's a risk that you will forget the password yourself. So (1) is less likely, but (2) is more likely.

It's a trade off. Encrypt if you like. Or don't.

[dooglus]

@pointbiz:
I find labeling in v3.2.0 a little bit confusing:

In "Single wallet" tab, string "Bitcoin Address" represents compressed address.
In "Wallet Details" tab, string "Bitcoin Address" represents normal uncompressed address.
The same is true for private keys...

Also - if usage of compressed keys is preferred, it would make sense (at least to me) that compressed bitcoin address would be the first choice (on the left side) in "Wallet Details" tab.

Just my 0.00000002

Yes, I see what you are saying. I want to make wallet details less confusing. And de-emphasize the uncompressed info.

Also in v3.2.0 I found another confusing inconsistency:

If I use the 'paper wallet' or 'bulk wallet' tabs to encrypt a private key, I get a "6Pn" (compressed) or "6Pf" (not compressed) encrypted private key, whereas if I use the 'wallet details' tab to encrypt the same private key, I get a "6PY" (compressed) or "6PR" (not compressed) encrypted private key.

The little research I did tells me that 6Pn and 6Pf represent "Encryption when EC multiply mode is used" whereas 6PY and 6PR represent "Encryption when EC multiply flag is not used".

Why is "multiply mode" used in 2 of the 3 tabs offering encryption but not in the 3rd? Is that deliberate? Is there a good reason for it? Is using "multiply mode" any more or less secure than not using it?

[BitCharlie]

Why are someone is going to encrypt the paper wallet?
I think the bigger risk is not that the wallet get stolen instead of forget the passphrase. Or I don´t unterstand the idea behind it?

When securing your coins you have two conflicting issues to address:

1) you want to be able to access the coins at some point in the future
2) you don't want anyone else to be able to access the coins without your permission

If you don't encrypt your paper wallet then you are making (1) more likely, but (2) less likely. If anyone finds your printed paper wallet they can immediately just take your coins.

So you encrypt it. It's relatively hard to crack the password on paper wallets, but there's a risk that you will forget the password yourself. So (1) is less likely, but (2) is more likely.

It's a trade off. Encrypt if you like. Or don't.

Thank you very much for your explanation.
I personally think the higher risk is to forget in a couple of years the passphrase - all BTC are useless, that will be one of the hardest pain, especially if it >10k/btc

[BitCharlie]

I currently setup my paper wallets and want to use split wallets.

Is there a way to proof the Shares and check if the right private key works or not
without run it live with BTC?

The find the private key I can only use bitaddress.org or is there also other ways
in case the service is offline in a couple of years?

I just don´t want to lose my money

Thank you.

[BitCharlie]

One more question:

What is the best wallet to pay from a paper wallet? iOS or Mac