|
dkbit98
Legendary
Offline
Activity: 2324
Merit: 7382
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 19, 2020, 01:03:28 PM |
|
Update again... Electrum developers are very active this month and we have four updates in December with potential to see them more. I can't remember when something like this happening before, but it is good they are working and fixing the bugs. I would wait some time before updating to latest version.
|
|
|
|
pooya87
Legendary
Offline
Activity: 3542
Merit: 10777
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 20, 2020, 04:43:42 AM |
|
Update again... Electrum developers are very active this month and we have four updates in December with potential to see them more. I can't remember when something like this happening before, but it is good they are working and fixing the bugs. I would wait some time before updating to latest version.
They have always been very active, you can check the github repository's pulse every month or the commit history to see all that activity. It's just that they are releasing more versions this month because of the bugs that appear to be affecting Lightning Network usage and have to be fixed.
|
|
|
|
NotATether
Legendary
Offline
Activity: 1694
Merit: 7160
In memory of o_e_l_e_o
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 31, 2020, 12:20:01 AM |
|
I usually verify Electrum checksums before using a new version, but today when I intended to update to 4.0.9, I noticed that all of the downloads on electrum.org have signatures that look like this: https://download.electrum.org/4.0.9/Electrum-4.0.9.tar.gz.asc-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEZpTY3nvo7lYxvtlQK9WCS3+UcOYFAl/c/ekACgkQK9WCS3+U cOYUfQ/6AyZb7yHqVGQxyaKoxYdiGZuWUu9S2Hb3/TU1wb7MOsJenpYeI+3wTZDf 8EhiqsU/l6dMR16vLoQ9ZwJqYkkzQsTxr4qLwFz7uR3zmDu+d0FyVu7ZPD/ppXNl YFZAxcM+BkwIkF3lMlYqffSggqReRtZ1QmS3Ae4dbm12O6FXuTDD2YDjLAjLCw9w iXC3S/1/IeDBOsrw1gp4YHaRyzMWqDddrgS/vQtS21oJYKkcwZKIzI5uI7tu2ccE iBwsULaoKkpbZODKiUcJAmWBsv3lcxSdEVT1QxWlmbprGaMOo/NDtDk3lcrED2LA AnchmQQ+3381d5x7v7Az24+dk1Xyw7C2mgokkp6FE25tTRSHXmylWlcp1tVVQ/xB Q+NGJ5au+50kqCuu8mq6I6yY01qpKQiM7IE4cHrFAAkckdd2RfVgR4Awvzvjs82D MXUvMB0GVnzzZ9/MJDeO09kNKLLV1t0tb+ZeNUD8N6gWc7d4qHFsJwXfjixg2WwT /r1hNpzEGmwtYlqCTGwTq1fdxlgtskzSI9Rshj8flRTJumnqMz+GzO5CrFBwNcGu IFPeZ19/pfVx0+lJw7SdNTC4kWex1JtnRFB8fChzn+aXgrjXqH4qMPyedBAEhnsZ FYkdJcguk310dJniuoq+aVBCSMG9c0Tz5zpTMK/fkAE8L3tW6vs= =1K4Z -----END PGP SIGNATURE----- This is a valid signature from ThomasV, but where is the checksum data? Usually it's at the beginning of the signature in the message data. How am I supposed to verify that the Electrum download isn't compromised without a checksum?
|
|
|
|
pooya87
Legendary
Offline
Activity: 3542
Merit: 10777
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 31, 2020, 04:29:44 AM |
|
I usually verify Electrum checksums before using a new version,
I don't remember Electrum ever releasing checksum of their releases and the reason has always been to prevent people from relying on checksum for authenticity checks. The signature verification does a much better job compared to checksum already.
|
|
|
|
NotATether
Legendary
Offline
Activity: 1694
Merit: 7160
In memory of o_e_l_e_o
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 31, 2020, 08:45:37 AM |
|
I usually verify Electrum checksums before using a new version,
I don't remember Electrum ever releasing checksum of their releases and the reason has always been to prevent people from relying on checksum for authenticity checks. The signature verification does a much better job compared to checksum already. The problem now is how am I supposed to use this to verify this particular download, since merely any signed PGP message by ThomasV with nothing else in it doesn't guarantee the authenticity of what I just downloaded.
|
|
|
|
Husna QA
Legendary
Offline
Activity: 2366
Merit: 2958
Exchange 250+ Coins With 0% Fees
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 31, 2020, 09:31:35 AM Last edit: May 18, 2023, 06:35:05 AM by Husna QA |
|
The problem now is how am I supposed to use this to verify this particular download, since merely any signed PGP message by ThomasV with nothing else in it doesn't guarantee the authenticity of what I just downloaded.
If the file you download matches the Electrum developer's original signature, it will display "Good signature". However, if the Electrum file and Signature do not match, it will say "no signed data". ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.ibb.co%2Fn3CypRx%2F55982628.png&t=665&c=tXgXGiQFC3TRHQ) ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.ibb.co%2F6v39dMg%2F55982628.png&t=665&c=IZx5LE9eOp070Q) See also the Electrum developer statement about checksums: A checksum on the website does add any security. If the website is compromised, so is the checksum. In contrast, a signature cannot be forged.
|
| | TheChange | | | | |
░░░░░░░░░░██▄ ▄▄▄▄▄▄▄▄▄▄▄███▄ ▀▀▀▀▀▀▀▀▀▀▀███▀ ░░░░░░░░░░██▀ ░░░▄▄ ▄██▀ ███████████████ ▀██▄ ░░░▀▀ | | | | +250 COINS | | ..Crypto Exchange.. | │ | ▄▄▄▄ ▄▄▄███▀▀███▄▄▄ ▄█████▀▀░▄▄▄▄░▀▀█████▄ ██▀░▄▄▄████████▄▄▄░▀██ ██░████████████████░██ ██░████████████████░██ ██░▀██████████████▀░██ ██░▀████████████▀░██ ▀██░▀██████████▀░██▀ ▀██▄░▀██████▀░▄██▀ ▀██▄▄░▀▀░▄▄██▀ ▀▀██▄▄██▀▀ ▀▀▀▀ | | | │ | |
|
|
|
NotATether
Legendary
Offline
Activity: 1694
Merit: 7160
In memory of o_e_l_e_o
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
December 31, 2020, 10:45:53 AM Last edit: December 31, 2020, 11:42:47 AM by NotATether |
|
~snip
I seem to have gone blank for a second, thinking that only text could be signed with GPG and that for arbitrary bytes you could only encrypt it. So all this time the signatures were being made using GPG's --sign command with the contents of the Electrum binary? Can this signature be decrypted to output the original file? Something like what I saw over here? gpg --sign gpg.docx gpg --output gpg.docx --decrypt gpg.docx.gpg Edit: one more thing, does this verification process depend on the binary being present on disk? If not then what's stopping a bad actor from supplying a bad binary but with the PGP signature for the good binary?
|
|
|
|
pooya87
Legendary
Offline
Activity: 3542
Merit: 10777
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 01, 2021, 05:10:06 AM |
|
I seem to have gone blank for a second, thinking that only text could be signed with GPG and that for arbitrary bytes you could only encrypt it. So all this time the signatures were being made using GPG's --sign command with the contents of the Electrum binary?
You can encrypt or sign any arbitrary bytes, the source of those bytes doesn't matter. It can be a text (string) or it could be a small file or a gigantic one line a Linux iso file. In this case the binary file is read as a stream of bytes then passed to the signing algorithm which will then produce a signature.
|
|
|
|
clip123
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 193
Merit: 10
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 02, 2021, 11:59:41 PM |
|
Hi, when creating new wallet under Choose Seed type
Default option is Segwit but text suggests to pick Legacy.
Which one to pick? and any complications with picking one over the other?
|
|
|
|
NotATether
Legendary
Offline
Activity: 1694
Merit: 7160
In memory of o_e_l_e_o
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 03, 2021, 12:28:37 AM |
|
Hi, when creating new wallet under Choose Seed type
Default option is Segwit but text suggests to pick Legacy.
Which one to pick? and any complications with picking one over the other?
You should always pick Segwit unless you have to receive bitcoins from somebody whose using an exchange that does not support sending to Segwit addresses. Sewgit addresses are the newer address type which have lower transaction fees and by using them, you help push their adoption more.
|
|
|
|
clip123
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 193
Merit: 10
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 03, 2021, 02:03:59 AM |
|
Hi, when creating new wallet under Choose Seed type
Default option is Segwit but text suggests to pick Legacy.
Which one to pick? and any complications with picking one over the other?
You should always pick Segwit unless you have to receive bitcoins from somebody whose using an exchange that does not support sending to Segwit addresses. Sewgit addresses are the newer address type which have lower transaction fees and by using them, you help push their adoption more. Thank you will do
|
|
|
|
pooya87
Legendary
Offline
Activity: 3542
Merit: 10777
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 03, 2021, 04:20:32 AM |
|
~ unless you have to receive bitcoins from somebody whose using an exchange that does not support sending to Segwit addresses.~
Keep in mind that if any service exists that doesn't support SegWit transactions it means that the said service has not updated their infrastructure for 3.5 years and it is wise not to use such incompetent services because they definitely haven't updated a lot of other things including their security.
|
|
|
|
acroman08
Legendary
Offline
Activity: 2422
Merit: 1103
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 03, 2021, 02:12:33 PM |
|
just a question regarding updating electrum and I'm still not entirely familiar with electrum. do I have to uninstall my electrum every time there is an update or there a way to update it without deleting electrum from my computer? I tried updating it using the link provided inside the wallet but while updating an error occurred and told me to either abort, retry or ignore. after clicking abort my electrum won't open so I decided to just uninstall it then installing the latest version. again, is there a better way of updating electrum other than uninstalling and stalling it again? TIA!
|
|
|
|
Rath_
aka BitCryptex
Legendary
Offline
Activity: 1876
Merit: 3132
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 03, 2021, 02:24:14 PM |
|
do I have to uninstall my electrum every time there is an update or there a way to update it without deleting electrum from my computer? I tried updating it using the link provided inside the wallet but while updating an error occurred and told me to either abort, retry or ignore. after clicking abort my electrum won't open so I decided to just uninstall it then installing the latest version.
No, you don't have to uninstall it. Did you make sure to close the Electrum before proceeding with the update? You won't be able to update it if it is running in the background.
|
|
|
|
bL4nkcode
Copper Member
Legendary
Offline
Activity: 2142
Merit: 1305
Limited in number. Limitless in potential.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 03, 2021, 02:30:05 PM |
|
just a question regarding updating electrum and I'm still not entirely familiar with electrum. do I have to uninstall my electrum every time there is an update or there a way to update it without deleting electrum from my computer? I tried updating it using the link provided inside the wallet but while updating an error occurred and told me to either abort, retry or ignore. after clicking abort my electrum won't open so I decided to just uninstall it then installing the latest version. again, is there a better way of updating electrum other than uninstalling and stalling it again? TIA!
I experienced what you did before I forgot what version it is but the error is normal imo. What you can do is uninstall and install it again like what you did. But the recommended thing to do is have at least a backup of your wallets inside the wallet folder of electrum or your recovery seed before uninstalling electrum since the entire electrum folder will be removed in the process. Also, verify the electrum software before installing it like what others repeatedly suggests.
|
|
|
|
Rath_
aka BitCryptex
Legendary
Offline
Activity: 1876
Merit: 3132
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 03, 2021, 02:38:14 PM |
|
[...] at least a backup of your wallets inside the wallet folder of electrum or your recovery seed before uninstalling electrum since the entire electrum folder will be removed in the process
The data directory ("%APPDATA%\Electrum") is left intact when Electrum is being uninstalled. It never hurts to have an extra backup, though.
|
|
|
|
bL4nkcode
Copper Member
Legendary
Offline
Activity: 2142
Merit: 1305
Limited in number. Limitless in potential.
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 03, 2021, 02:45:46 PM |
|
[...] at least a backup of your wallets inside the wallet folder of electrum or your recovery seed before uninstalling electrum since the entire electrum folder will be removed in the process
The data directory ("%APPDATA%\Electrum") is left intact when Electrum is being uninstalled. It never hurts to have an extra backup, though. Oh, good thing if it's the case, I usually do it for extra extra backup just in case though.
|
|
|
|
acroman08
Legendary
Offline
Activity: 2422
Merit: 1103
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 03, 2021, 03:46:39 PM |
|
No, you don't have to uninstall it. Did you make sure to close the Electrum before proceeding with the update? You won't be able to update it if it is running in the background.
thanks for answering. I see I did leave my electrum running while updating. this info helps a lot. I experienced what you did before I forgot what version it is but the error is normal imo.
What you can do is uninstall and install it again like what you did. But the recommended thing to do is have at least a backup of your wallets inside the wallet folder of electrum or your recovery seed before uninstalling electrum since the entire electrum folder will be removed in the process. Also, verify the electrum software before installing it like what others repeatedly suggests.
I did some necessary precaution(but not what you mentioned) to make it is safe before uninstalling and installing electrum. thanks for telling me.
|
|
|
|
clip123
Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 193
Merit: 10
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
January 03, 2021, 09:03:19 PM |
|
just a question regarding updating electrum and I'm still not entirely familiar with electrum. do I have to uninstall my electrum every time there is an update or there a way to update it without deleting electrum from my computer? I tried updating it using the link provided inside the wallet but while updating an error occurred and told me to either abort, retry or ignore. after clicking abort my electrum won't open so I decided to just uninstall it then installing the latest version. again, is there a better way of updating electrum other than uninstalling and stalling it again? TIA!
I would not recommend updating from the app itself as there was a malware version pushed (it is noted on electrum.org as well). Always download from electrum then verify signature and then update it from verified version. Warning: Electrum versions older than 3.3.4 are susceptible to phishing. Do not download Electrum from another source than electrum.org, and learn to verify GPG signatures.
Edit: Please make sure to Always backup wallet/keys.
|
|
|
|
|