[ANN] bitaddress.org Safe JavaScript Bitcoin address/private key

[adaseb]

If I were to SIGN and VERIFY a private key offline in Bitcoin-qt would it be adequate enough that I would be able to access the funds?

Yes.

So which method of creating the private key is safer? Using Bitaddress or just using the one that get created in Bitcoin Core 0.1.3?

[dooglus]

it's possible that only 1 in a million addresses generated by a tool will have problems

Dooglus, I went back several pages looking for any post where you linked to a bug, but couldn't find it.
Could you post the link again?

The link is in the post you quoted. It's the blue bit.

[Dabs]

If I were to SIGN and VERIFY a private key offline in Bitcoin-qt would it be adequate enough that I would be able to access the funds?

Yes.

So which method of creating the private key is safer? Using Bitaddress or just using the one that get created in Bitcoin Core 0.1.3?

Both are safe if both are offline, or a computer never connected to the internet. The risk is the private key gets stolen. If you can prevent or mitigate that risk, then that private key remains safe.

If you use bitaddress, then you will have to import the private key into your wallet. If you use bitcoin core, then you simply have to keep a backup of the wallet file.

[adaseb]

If I were to SIGN and VERIFY a private key offline in Bitcoin-qt would it be adequate enough that I would be able to access the funds?

Yes.

So which method of creating the private key is safer? Using Bitaddress or just using the one that get created in Bitcoin Core 0.1.3?

Both are safe if both are offline, or a computer never connected to the internet. The risk is the private key gets stolen. If you can prevent or mitigate that risk, then that private key remains safe.

If you use bitaddress, then you will have to import the private key into your wallet. If you use bitcoin core, then you simply have to keep a backup of the wallet file.

I was simply going to swish (don't remember the term) with Blockchain when I decide to spend it in the future. They only require the private key correct?

[Dabs]

I was simply going to swish (don't remember the term) with Blockchain when I decide to spend it in the future. They only require the private key correct?

I believe the term is sweep.

I've never used the online Blockchain.info wallet so I'm not sure, but I think that is correct: they only require the private key. Mt. Gox had a sweep function too, and many other wallets, like the Android bitcoin wallet and Electrum.

Depending on the amount you saved in cold storage, I would consider which wallet to use. In my case, I've stuck with Bitcoin Core since I started, so that's what I'm comfortable with using, despite the large amount of space needed if not using pruned mode.

I might consider using a brand new wallet with Core (the new ones are HD) and sweep all my funds to addresses there, and then prune that or something. Maybe.

[adaseb]

I was simply going to swish (don't remember the term) with Blockchain when I decide to spend it in the future. They only require the private key correct?

I believe the term is sweep.

I've never used the online Blockchain.info wallet so I'm not sure, but I think that is correct: they only require the private key. Mt. Gox had a sweep function too, and many other wallets, like the Android bitcoin wallet and Electrum.

Depending on the amount you saved in cold storage, I would consider which wallet to use. In my case, I've stuck with Bitcoin Core since I started, so that's what I'm comfortable with using, despite the large amount of space needed if not using pruned mode.

I might consider using a brand new wallet with Core (the new ones are HD) and sweep all my funds to addresses there, and then prune that or something. Maybe.

I looked up what HD wallet meant and since I am using this address once for long term cold storage I don't really need HD, correct?

Since I will send an entire input, and later on when I withdraw I will withdraw everything in one output without leaving any change.

[Dabs]

I looked up what HD wallet meant and since I am using this address once for long term cold storage I don't really need HD, correct?

Since I will send an entire input, and later on when I withdraw I will withdraw everything in one output without leaving any change.

Yes, you don't need HD. I used to be against the idea since it is deterministic; but it is convenient. If there is any change at all, find out the change address and its private key. Or intentionally send the leftovers to another address you have already created, or send it back to the same address (not recommended, but lots of people do that.)

[adaseb]

If I want to make more than one private key with Bitaddress, do I need to reload the page each time and keep moving the mouse to generate the randomness or is doing it once enough for multiple private keys?

If I use one of these private keys, can some "hacker" generate any other of my private keys since he can reverse engineer the randomness?

[pointbiz]

If I want to make more than one private key with Bitaddress, do I need to reload the page each time and keep moving the mouse to generate the randomness or is doing it once enough for multiple private keys?

If I use one of these private keys, can some "hacker" generate any other of my private keys since he can reverse engineer the randomness?

You don't have to reload the page. No, a hacker cannot correlate the keys from one session as they are all random and not deterministic.

[adaseb]

If I want to make more than one private key with Bitaddress, do I need to reload the page each time and keep moving the mouse to generate the randomness or is doing it once enough for multiple private keys?

If I use one of these private keys, can some "hacker" generate any other of my private keys since he can reverse engineer the randomness?

You don't have to reload the page. No, a hacker cannot correlate the keys from one session as they are all random and not deterministic.

Ok sounds good. Thanks so much

[adaseb]

Got another quick question, trying to test the PGP and SHA256 of the files.

Here is what I did following the first post in this thread with the updated signatures.

wget https://www.bitaddress.org/pointbiz_bitaddress.org.asc
gpg --import pointbiz_bitaddress.org.asc
wget https://www.bitaddress.org/bitaddress.org-v3.2.2-SHA256-f4d047c264a2b71946de319482a9365e56d8d7289dd85a352da3b1448b7647df.html
sha256sum bitaddress.org-v3.2.2-SHA256-f4d047c264a2b71946de319482a9365e56d8d7289dd85a352da3b1448b7647df.html
wget -qO- https://www.bitaddress.org/bitaddress.org-v3.2.2-SHA256-f4d047c264a2b71946de319482a9365e56d8d7289dd85a352da3b1448b7647df.html.sig | gpg -d

IN the end I get a WARNING however

Detached signature.
Please enter name of data file: bitaddress.org-v3.2.2-SHA256-f4d047c264a2b71946de319482a9365e56d8d7289dd85a352da3b1448b7647df.html
gpg: Signature made Sun 21 Aug 2016 05:56:51 PM MDT using RSA key ID 63974F5A
gpg: Good signature from "pointbiz <pointbiz@bitaddress.org>"
gpg:                 aka "ninja <ninja@bitaddress.org>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 527B 5C82 B1F6 B2DB 72A0  ECBF 8749 7B91 6397 4F5A

[Dabs]

I think you have to add his PGP key to your keyring, or you have to sign his key first.

[pointbiz]

Got another quick question, trying to test the PGP and SHA256 of the files.

Here is what I did following the first post in this thread with the updated signatures.

wget https://www.bitaddress.org/pointbiz_bitaddress.org.asc
gpg --import pointbiz_bitaddress.org.asc
wget https://www.bitaddress.org/bitaddress.org-v3.2.2-SHA256-f4d047c264a2b71946de319482a9365e56d8d7289dd85a352da3b1448b7647df.html
sha256sum bitaddress.org-v3.2.2-SHA256-f4d047c264a2b71946de319482a9365e56d8d7289dd85a352da3b1448b7647df.html
wget -qO- https://www.bitaddress.org/bitaddress.org-v3.2.2-SHA256-f4d047c264a2b71946de319482a9365e56d8d7289dd85a352da3b1448b7647df.html.sig | gpg -d

IN the end I get a WARNING however

Detached signature.
Please enter name of data file: bitaddress.org-v3.2.2-SHA256-f4d047c264a2b71946de319482a9365e56d8d7289dd85a352da3b1448b7647df.html
gpg: Signature made Sun 21 Aug 2016 05:56:51 PM MDT using RSA key ID 63974F5A
gpg: Good signature from "pointbiz <pointbiz@bitaddress.org>"
gpg:                 aka "ninja <ninja@bitaddress.org>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 527B 5C82 B1F6 B2DB 72A0  ECBF 8749 7B91 6397 4F5A

In the original post I put my key fingerprint
527B 5C82 B1F6 B2DB 72A0 ECBF 8749 7B91 6397 4F5A

There is an issue on github where I also list the fingerprint and on bitaddress.org

If one of the 3 doesn't match then something has happened.

[pointbiz]

I think you have to add his PGP key to your keyring, or you have to sign his key first.

Yeah he has to sign my key or Web of Trust

[shorena]

I think you have to add his PGP key to your keyring, or you have to sign his key first.

Yeah he has to sign my key or Web of Trust

No they dont have to and they should not as they are unable to actually verify your identity[1]. The important part is that signature is valid, which it is:
"gpg: Good signature from "pointbiz <pointbiz@bitaddress.org>""

Whether or not the key should be trusted has nothing to do with the verification of the code, its about verification of the key used to sign. If you just not want to see the message, sign the key locally with --lsign-key.


[1] I guess it depends how you use the WoT here.

[pointbiz]

v3.2.3
https://www.bitaddress.org/bitaddress.org-v3.2.3-SHA256-c9a0bb3ed50aa75a5ae9c606d81e3fd41a4ff686ad38ad5379e2402f481e79a4.html
 - wallet details: show error when checksum validation fails
 - wallet details: show error when private key outside of curve range

[minimalB]

Thanks for checksum validation fix!

[pointbiz]

v3.3.0
https://www.bitaddress.org/bitaddress.org-v3.3.0-SHA256-dec17c07685e1870960903d8f58090475b25af946fe95a734f88408cef4aa194.html
 - remove support for IE8
 - small translations updates for hu and pt-br

[dooglus]

IN the end I get a WARNING however

It's saying the signature is good for the key:

Good signature from "pointbiz <pointbiz@bitaddress.org>"

but that it has no way of checking that the key you used is the correct one.

Anyone can make a key for pointbiz@bitaddress.org. You need to check that you have the right one. If you do, everything is fine, and you can ignore the warning.

[silversurfer1958]

at https://bitaddress.org The url is :-

https://www.bitaddress.org/bitaddress.org-v3.3.0-SHA256-dec17c07685e1870960903d8f58090475b25af946fe95a734f88408cef4aa194.html

I'd expect the Sha256 Hash of the downloaded file to be dec17c07685e1870960903d8f58090475b25af946fe95a734f88408cef4aa194

However, after downloading the file and checking it with a Sha256 CRC it gives a Sha256 Hash of

739DDD62F01F06DDA02E7E69AEA9AF7526AB2349F02372619B92C5A952E02E6B

Where did I make a mistake.