[ANN] bitaddress.org Safe JavaScript Bitcoin address/private key

[Financisto]

How would I modify this script for another coin? e.g. CatCoin, EarthCoin etc..

People did that already, see http://www.liteaddress.org

Most altcoin supported at the moment is http://www.brainwallet.org

[canton]

would you add wallet creation using coin

Lucky you! You can already do this.

1) click on "Wallet Details"

2) flip your coin(s) and record the results as 0's and 1's in the "Enter Private Key" field

3) click "View Details" and agree to have your 0101010... "key" used as a SHA256 hash.

[pointbiz]

v2.8.0
https://www.bitaddress.org/bitaddress.org-v2.8.0-SHA1-87dcf19f02ee9fb9dd3a8c787bcf52eef944aa82.html
 - more entropy from browser fingerprinting for PRNG seed
 - user can add entropy through URL hash tag
 - seed mouse movement as 16-bit number
 - whole seed pool initially filled by window.crypto.getRandomValues
 - added textbox as an alternative input source for entropy
 - address will not generate without a minimum amount of human added entropy
   from mouse or keyboard
 - discard mouse movements less than 40ms apart
 - visualize points of entropy collection from the mouse

[phelix]

v2.8.0
https://www.bitaddress.org/bitaddress.org-v2.8.0-SHA1-87dcf19f02ee9fb9dd3a8c787bcf52eef944aa82.html
 - more entropy from browser fingerprinting for PRNG seed
 - user can add entropy through URL hash tag
 - seed mouse movement as 16-bit number
 - whole seed pool initially filled by window.crypto.getRandomValues
 - added textbox as an alternative input source for entropy
 - address will not generate without a minimum amount of human added entropy
   from mouse or keyboard
 - discard mouse movements less than 40ms apart
 - visualize points of entropy collection from the mouse

cool

[pointbiz]

v2.8.1
https://www.bitaddress.org/bitaddress.org-v2.8.1-SHA1-a6e63f2712851710255a27fa0f22ef7833c2cd07.html
 - Czech translation
 - remove firstbits link
 - fix mouse movement visualization for Firefox and IE

[bitpop]

Any plans to fix the ssl chain to remove ssl warnings?

[pointbiz]

Any plans to fix the ssl chain to remove ssl warnings?

Sorry. Fixed.

[bitpop]

Any plans to fix the ssl chain to remove ssl warnings?

Sorry. Fixed.

Sweet, won't scare the mugus any more

[fluffypony]

Heya - how hard would it be to add BIP-38 for brainwallet addresses? You already have an implementation for paper wallet addresses, but adding it to brainwallets would dramatically increase security on them (imho).

[bitpop]

Heya - how hard would it be to add BIP-38 for brainwallet addresses? You already have an implementation for paper wallet addresses, but adding it to brainwallets would dramatically increase security on them (imho).

I dont think that's possible as there's nothing to encrypt.

[fluffypony]

Heya - how hard would it be to add BIP-38 for brainwallet addresses? You already have an implementation for paper wallet addresses, but adding it to brainwallets would dramatically increase security on them (imho).

I dont think that's possible as there's nothing to encrypt.

Huh? As far as I understand it, BIP-38 encrypts the private key? So confused right now, lol.

[Newar]

Heya - how hard would it be to add BIP-38 for brainwallet addresses? You already have an implementation for paper wallet addresses, but adding it to brainwallets would dramatically increase security on them (imho).

I dont think that's possible as there's nothing to encrypt.

Huh? As far as I understand it, BIP-38 encrypts the private key? So confused right now, lol.

He means that with a brain wallet the private key is not saved/stored or printed anywhere. How do you encrypt something that is not there?

[bitpop]

Yes in brain wallet your password is the private key essentially. Nothing to store.

In bip38 you must store an encrypted private key.

[moni3z]

https://www.ssllabs.com/ssltest/analyze.html?d=bitaddress.org
Should probably fix this. Also, wouldn't it be safer to write a browser addon where the entire java client side script lived?

[pointbiz]

https://www.ssllabs.com/ssltest/analyze.html?d=bitaddress.org
Should probably fix this. Also, wouldn't it be safer to write a browser addon where the entire java client side script lived?

A browser addon could be a good approach. How do you propose updates and checksums are handled? Who signs the plugin?

[moni3z]

https://www.ssllabs.com/ssltest/analyze.html?d=bitaddress.org
Should probably fix this. Also, wouldn't it be safer to write a browser addon where the entire java client side script lived?

A browser addon could be a good approach. How do you propose updates and checksums are handled? Who signs the plugin?

Crypto.cat does it https://crypto.cat/  after they gave up on server provided client side due to audit failures and packaged it all in an extension.
Firefox could sign your .xpi file using xpisign.py (with a certificate from a trusted issuer, such as whatever cert you have for your site) and Mozilla will check the update for malicious code and then distro the update. Chrome same thing can sign using your site's cert and openssl except Chrome autoupdates for extensions are shady. IE I have no idea, Safari no idea. Just Cinfu VM is kind of risky for trusting to generate keys, this way with an addon server doesn't matter.  

[pointbiz]

https://www.ssllabs.com/ssltest/analyze.html?d=bitaddress.org
Should probably fix this. Also, wouldn't it be safer to write a browser addon where the entire java client side script lived?

I read that matasano article a long time ago but from what I remember it mostly does not apply to bitaddress because no external Javascript is loaded on the page. Javascript is Turing complete and bitaddress uses the same two validation techniques as all other open source software. Detached sig and checksums.

[RGBKey]

Just wanted to drop in to say thanks, I've used your site many times and I have 8 paper wallets printed from your site that I laminated and put in my room. Love it!

[minimalB]

Using tablet... i am unable to enter any characters into textbox. Keyboard does not appear on the screen no matter what i do.

If i use some other input form on some other webpage... keyboard appears normally.

Bug?

[bitcoindaddy]

v2.8.0
https://www.bitaddress.org/bitaddress.org-v2.8.0-SHA1-87dcf19f02ee9fb9dd3a8c787bcf52eef944aa82.html
 - more entropy from browser fingerprinting for PRNG seed
 - user can add entropy through URL hash tag
 - seed mouse movement as 16-bit number
 - whole seed pool initially filled by window.crypto.getRandomValues
 - added textbox as an alternative input source for entropy
 - address will not generate without a minimum amount of human added entropy
   from mouse or keyboard
 - discard mouse movements less than 40ms apart
 - visualize points of entropy collection from the mouse

Is the increased (mouse) entropy used on all the tabs (like the paper wallet) or just on the first tab?