Will old Electrum versions work after taproot ?

[adaseb]

I am using a very very old versions of Electrum. On my cold storage I am running Electrum 2.x and my watching online Electrum is 3.0.x. They still work. Rather not go thru the hassle of having to upgrade to a newer Electrum because then I need to upgrade the dependanices and those I also need to verify to make sure they are not tampered with so I rather just leave everything as is. I'm old school.

However wondering if Taproot will be backwards compatible and will I be able to perform any transactions. All my cold storage is on wallet addresses starting with "1" and none are Segwit or Pay-by-script (start with "3"). I rarely do any transactions so this is why I keep this set up.

[1714945668]

1714945668

[ranochigo]

Taproot is implemented with a soft fork. Legacy and normal Segwit is still supported.

There's quite a few security risks with Electrum 3.X and I really can't recommend anyone to be keep using it. Though it is a watch-only wallet, I still consider it more secure to be using one that is newer. Are you still able to connect to any server with 3.0.X?

[pooya87]

The only reason why you are sometimes forced to upgrade is because of Electrum itself not the soft forks that bitcoin has such as SegWit or Taproot. For example one reason to upgrade to versions above 3.3.3 was to prevent a vulnerability in Electrum letting the node you connected to to send you any arbitrary message, HTML formatted. Or upgrading to anything above 3.3.0 because of the bug in Network class.

You can see all the changes here. As you can see apart from the additional features there has been lots of bug fixes and improvements.

[Charles-Tim]

Backward compatibility should not be what to worry about as taproot is just like segwit soft fork, as wallets that supported legacy before they begin to support segwit, this does not result to disuse of legacy addresses. Also because of taproot soft fork, if wallets started to support taproot, it will not make the wallet not backward compatible, you will still be able to make transactions with your legacy addresses. But, it is better to make use of new version of a software or app, because the old versions can be vulnerable by attackers. Also, though you do not make frequent transactions, but making use of segwit still comes with low transaction fee in a way 42% to about 52% fee can be reduced depending on your transaction input and output if compared with legacy. At least, upgrade to the latest version will not do you anything than good and better experience while using the wallet, then why no go for it.

[Lucius]

There's quite a few security risks with Electrum 3.X and I really can't recommend anyone to be keep using it. Though it is a watch-only wallet, I still consider it more secure to be using one that is newer. Are you still able to connect to any server with 3.0.X?

If it's just a watch-only wallet I don't see why an outdated version would be less secure than the latest, if we know that such crypto wallet does not contain private keys? Is there anything that could affect broadcasting transactions from a cold wallet in terms of security?

[ranochigo]

If it's just a watch-only wallet I don't see why an outdated version would be less secure than the latest, if we know that such crypto wallet does not contain private keys? Is there anything that could affect broadcasting transactions from a cold wallet in terms of security?

No. If you concern is only about broadcasting transaction, that is why the airgap exists. Your private key doesn't touch the online computer.

The most prominent one is the HTML phishing which poses a security risk at the very least. Versions in the earlier 3.X are intentionally DOSed to try to prevent them from connecting to any servers.

For the JSON RPC attack, I'm guessing if it doesn't have any authentication, then someone can use CORS to call your RPC and get your xpubs as well. Even if there isn't any attacks that are of concern right now, there are outdated modules within Electrum which could allow for exploits as well. Nonetheless, the potential headaches from anything happening with your Electrum or your computer really makes updating a no brainer. There is a plethora of ways to compromise someone's security, directly getting the private key is just one of them.

[dkbit98]

I am using a very very old versions of Electrum. On my cold storage I am running Electrum 2.x and my watching online Electrum is 3.0.x. They still work. Rather not go thru the hassle of having to upgrade to a newer Electrum because then I need to upgrade the dependanices and those I also need to verify to make sure they are not tampered with so I rather just leave everything as is. I'm old school.

I don't understand why would you still use old Electrum that is proven to have some security flaws, it's like continuing to use old Commodore64 and Windows XP and claiming it's safe and good because you are ''old school''.
Updating Electrum literally takes few minutes with all downloading, verification and installation.

[HCP]

Rather not go thru the hassle of having to upgrade to a newer Electrum because then I need to upgrade the dependanices and those I also need to verify to make sure they are not tampered with so I rather just leave everything as is. I'm old school.

Would it not be possible to just use the AppImage's? These already include the appropriate dependancies etc... so, then you would just need to verify the AppImage itself, which is a relatively simple task given that they are digitally signed like the other installers/binaries.

[ABCbits]

TLDR, yes. Taproot is soft fork where only require majority of miner and some full node to upgrade their full node software.

Rather not go thru the hassle of having to upgrade to a newer Electrum because then I need to upgrade the dependanices and those I also need to verify to make sure they are not tampered with so I rather just leave everything as is. I'm old school.

Would it not be possible to just use the AppImage's? These already include the appropriate dependancies etc... so, then you would just need to verify the AppImage itself, which is a relatively simple task given that they are digitally signed like the other installers/binaries.

If the OS is too old, even AppImage might not work. See Qt_5_PRIVATE_API not defined in libQt5Gui.so.5 with 4.1.2-x86_64.AppImage to refresh your memory.

P.S. i mention this because Electrun 3.0.X between November 1st, 2017 and Feb 3, 2018.

[DireWolfM14]

I am using a very very old versions of Electrum. On my cold storage I am running Electrum 2.x and my watching online Electrum is 3.0.x. They still work. Rather not go thru the hassle of having to upgrade to a newer Electrum because then I need to upgrade the dependanices and those I also need to verify to make sure they are not tampered with so I rather just leave everything as is. I'm old school.

However wondering if Taproot will be backwards compatible and will I be able to perform any transactions. All my cold storage is on wallet addresses starting with "1" and none are Segwit or Pay-by-script (start with "3"). I rarely do any transactions so this is why I keep this set up.

As others have already said, taproot isn't going to be an issue for you.  

However, running obsolete software on an outdated system might become an issue.  There are only five dependencies needed to install Electrum, and you can get away with three if you only want to run it from the source code.  They've all been tested to function with the OS, but I suppose there's no way to ensure there's nothing malicious in the code without auditing it.  Even validating the packages authenticity doesn't doesn't guarantee that it hasn't been compromised by a malicious developer.  I get it, there's no such thing as being too paranoid, until you are.  

Here's the list of dependencies needed from Electrum's downloads page:

Code:

python3-pyqt5
libsecp256k1-0
python3-cryptography
python3-setuptools
python3-pip

I understand why you're reluctant to update your system, and since you don't make a lot of transactions you'll likely find yourself in this situation again and again.  It might be better for you to use a hardware wallet, which effectively gives you the security you're looking for.

[Charles-Tim]

I understand why you're reluctant to update your system, and since you don't make a lot of transactions you'll likely find yourself in this situation again and again.  It might be better for you to use a hardware wallet, which effectively gives you the security you're looking for.

The main advantage of hardware wallet over electrum cold wallet is that hardware wallet support multiple currencies, if someone has a device he can use as an electrum cold wallet, and if the person only want to hold/use bitcoin, I do not see the point of getting a hardware wallet when the electrum cold wallet can do the same while the private key was also generated offline and remain offline and not connected to the online or to the watch-only wallet. What we can tell adaseb is that updating the wallet is safe, but updating it safely, following security and safety precautions.

[adaseb]

I do maybe 2 or 3 transactions a year. If I did transactions weekly then I would upgrade to either a hardware wallet or newer Electrum. However for someone as paranoid as me. Getting a hardware wallet just adds another layer of security flaws. Such as what if device is tampered, what if your home address is leaked, what if there is some vulnerability thats discovered one day.

To upgrade Electrum you need to make sure the online wallet is genuine, then offline wallet, then most likely I need to upgrade Ubuntu because version 16 might not support the newer dependencies, then I need to download the dependencies and verify each dependency make sure its not altered. Alot of work.

These old versions still work. All I do is keep restarting Electrum until I connect to a phishing node to get the up to date transactions. Then I make an unsigned transaction on the online computer, move it to offline by taking a photo with a digital camera from the year 1995. Put that SD card into the offline computer, load electrum, make sure the destination address, source address, timelock block number, are all correct, then sign the transaction. Then... take a photo of signed transaction with iPhone, and then before I broadcast it, I decode it, make sure the addresses are correct, if they are correct, I broadcast it. I can't broadcast it with electrum because it gives the phishing message. I also know of the RPC attack however, I don't leave electrum running in the background.

Thank you all that replied, gave you all merits for your help.

[NotATether]

Rather not go thru the hassle of having to upgrade to a newer Electrum because then I need to upgrade the dependanices and those I also need to verify to make sure they are not tampered with so I rather just leave everything as is. I'm old school.

Would it not be possible to just use the AppImage's? These already include the appropriate dependancies etc... so, then you would just need to verify the AppImage itself, which is a relatively simple task given that they are digitally signed like the other installers/binaries.

That will only work if OP is using an operating system with libraries more recent than the ones the AppImage was compiled against.