One suggestion is to introduce a thread in the technical and wallet section for Bitcoin. There are actual wallet users there who are good with coding (I'm not one of them) who, if interested could try out your code. How many programmers do you have?
Sorry, what? We are currently two developers following build instructions found on wallet projects. We are both Android Bitcoin Wallet developers, so we certainly are more up to this task than the average user who wants to compile the wallet for himself but we do not code much. Just the website.
So I saw this post and clicked on it.
Hmm, can't build bitpay wallet, can't build copay cant find bitcoin.com
As a NOOB I built copay took about an hour.
We disclosed our findings in great detail, including the date we did our investigation. If back when you did it or now, things are different, that might explain it and we might give it another shot.
That repository has its last code update in June, while the wallet on Google Play's last update was in October. This repository was not linked from Google play or their website. Why should I assume it's relevant?
<RANT>
While we have a commitment with Mycelium, we also have a private life and while we do work for the company, we do not call the shots. Also Mycelium still owes me money since June and Rassah?? Do you live under a rock? He's not with Mycelium since years and said so in various occasions.
I can only say that so far I have only used the Electrum Android version and that I have no objection to anything related to that wallet. I find it safe until the opposite is proven, and for bigger amounts, I will never use it anyway.
That's the problem. Those wallets have not millions of dollars under management, they have millions of users that have god knows how many dollars in their wallets. This is a huge incentive for anybody who could pull it off, to leak the private keys to then empty all wallets at once. This is also a huge incentive to provide a wallet for free that many people use and trust. To pay people to do great support and to go to conferences ...
if you use a very old version of Android that no longer supports updates/patches, any mobile wallet in such a potentially dangerous environment is just an extra risk, no matter how safe it is. It should also be highlighted that most people do not perceive the security of their smartphones as something important, as if there were no viruses/malware for Android/iOS.
Yes, this is an issue and why I use a "GoogleOne" phone, which comes with guaranteed updates for years. On the other hand, wallets can alert their users about security issues and I know Mycelium alerts users that try to run it on certain insecure versions of Android. In the end, Android is pretty secure though. More secure than your average Windows certainly.
experts recommends using a hardware wallet
Totally agree. Never put life-changing amounts in anything but a trusted hardware wallet. If you manage amounts that would change the life of many people, don't trust any single hardware wallet neither. Use multi signature with at least 3 brands of hardware wallet and pay somebody who knows how that works. Don't try that at home with that amount of money.
In any case being inherently riskier, mobile wallets should be relegated for very small, perhaps a day worth of use at most.
Thanks to the backup I trust my Android with more money than my leather wallet. Losing one is not like losing the other. For any serious money, other wallets are more suited.
I don't particularly trust anything not open source to begin with. And Android is plagued from that, just like Windows. Linux can't help when surrounded by closed software, which is how its done in Android.
To be fair, sandboxing on Android is pretty good. With your argument you could also say to not use the web cause of Java Script being insecure. Sometimes Browser makers screw up but usually it's so much more secure than to install apps on your Windows where the app can do whatever with the storage of all the other apps ...
Android is too unsecure platform to store wallet there
Yeah, I like the project with researching the security of wallets, but why are you looking specifically at Android Wallets? I mean, does the majority of users even store Bitcoins on Android..?
Android is what I know as a contributor at Mycelium and I see the issue there, with more than 20 million downloads for the wallets I investigated.
If people care, we might expand to other platforms and maybe also other apps but for now, Android is already quite a lot of apps to look after.
And since the article about the methodology of this project admits that verifiability does not really say about much, I wonder whether the team is thinking about improving the methodology by adding some other factors to consider. It could be really useful to know which wallets are more secure and which are less, but limiting the project to, basically, exit scam possibility for Android wallets seems too narrow.
If people care, we will expand. For now, there are only 3 wallets "green", so it's kind of pointless to be more strict and have them all red. My hope is that some 10 of the open source wallets fix their build setup so we can verify it and then we raise the bar. We would love to test new releases in real time and alert users if a verifiable app turned non-verifiable. We would also like to list bug bounties paid by the different projects, so security researchers get on board for the better paying ones.
Anyway, I don't know how good op's project is in terms of accuracy, but whether it is or isn't, people need to watch what kinds of crypto apps they put on their phones anyway, not just wallets. It's possible for someone to install a coin stealer onto your phone, tho I haven't heard of this being done yet...and it may be that I've just never heard of it happening, but it could have.
Android is pretty good at sandboxing apps. One app should not be able to reach into another app's sandbox unless you give it root access. Keep your Android updated and it's pretty secure. More secure than Windows for sure.
If it's bitcoin you're storing on your phone, I'd only use one of the trusted wallets like electrum or mycelium which have been around for years and haven't had security issues. None of the newer wallets offer any real advantages over those two. And I'm not even sure if there's a multi coin wallet that's been proven to be secure.
There is no such thing as proven to be secure. Any wallet provider in distress might turn evil. So you trust Mycelium? I'm compiling the release versions for that wallet. How do you know you can trust it? Maybe somebody took my family hostage. Do you believe I care more about your bitcoins than their life? Maybe somebody infected my work laptop with a malware that injects a backdoor when I compile the wallet. Those are the reasons why reproducibility matters even for closed source projects. You have to check every build. At Mycelium, if there is a backdoor in our wallet, not only must I have missed it, my whole team and interested outside security researchers must have missed it as every release is compiled and verified by other team members and the public source code is pushed before we push the apk to Google Play. All this happens behind the scenes but it matters greatly and only if the app is publicly verifiable can people hope that it's actually been verified.
I hope you plan in future to involve even PC/Linux/Mac wallets in your project!
Thanks for good work
We certainly would hope to get the funding necessary to focus on this project and expand it to cover all wallets. For now we have to see how the community receives the project.
Already good and really helpful for the new people who hasn't determined which wallet thay gonna use. You should add more wallet to review and make a filter for that list, or search bar would be help a lot if people want to check their wallet is secure or not.
Which wallets should we add? Please provide a link to Google Play if you want us to review your wallet of choice. We only looked at what we know and could easily find.
Every browser should have a search feature
Already good and really helpful for the new people who hasn't determined which wallet thay gonna use. You should add more wallet to review and make a filter for that list, or search bar would be help a lot if people want to check their wallet is secure or not.
Check out our
Methodology page.
I, as a Blockchain Wallet user, see that this worries me about the security of my assets. Blockchain Wallet Still Not Verifiable!
will it still be safe?
Didn't you give a message to Blockchain Wallet to solve this Not verifiable problem.
Blockchain Wallet has the most users and the highest rating.
I'm glad you care and I don't want to say you shouldn't but as you see you are not alone in trusting your money to a wallet that cannot be publicly scrutinized. I hope that many of the anyway open source wallets will come around and fix their setup so they can be easily audited. I bumped
this issue and maybe you want to state your concern to them there, too.
