Bitcoin Forum
December 04, 2016, 04:31:28 PM *
News: To be able to use the next phase of the beta forum software, please ensure that your email address is correct/functional.
 
   Home   Help Search Donate Login Register  
Pages: « 1 ... 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 [183] 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 »
  Print  
Author Topic: Armory - Discussion Thread  (Read 481709 times)
jl2012
Legendary
*
Offline Offline

Activity: 1484


View Profile
May 05, 2014, 02:31:23 PM
 #3641

Regarding the virus, how would one double check that I was not victim to this attack.  **nervous**

Generate the new addresses on your cold system first, and then verify that the addresses you generate on the hot watch-only system match the addresses in the cold system.

If a computer is infected, it is completely hopeless

Let say you generated an address with the cold system, which is "1User". You send a withdrawal request to the exchange, asking them to send bitcoin to 1User. A sophisticated malware could secretly replace the address with "1Hacker" before sending the request the exchange.

Extremely valid point.

Some users on Reddit have actually been having this problem caused by extensions on google chrome. Though it could be any sort of malware, google chrome extensions just seem to be the thing lately.

Always a good idea to send a small test transaction out of an exchange before sending the whole amount.
I should be able to avoid that by noticing that I'm signing the txn to 1User on the offline rig.

No, it's not about signing, it's about sending a payment request

Donation address: 1CiZPrEJdN4FJcqdLdgVLzT8tgCXxT5ion
PGP: D3CC 1772 8600 5BB8 FF67 3294 C524 2A1A B393 6517
Bitcoin Wizards Wiki: https://8333.info/
1480869088
Hero Member
*
Offline Offline

Posts: 1480869088

View Profile Personal Message (Offline)

Ignore
1480869088
Reply with quote  #2

1480869088
Report to moderator
1480869088
Hero Member
*
Offline Offline

Posts: 1480869088

View Profile Personal Message (Offline)

Ignore
1480869088
Reply with quote  #2

1480869088
Report to moderator
1480869088
Hero Member
*
Offline Offline

Posts: 1480869088

View Profile Personal Message (Offline)

Ignore
1480869088
Reply with quote  #2

1480869088
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1480869088
Hero Member
*
Offline Offline

Posts: 1480869088

View Profile Personal Message (Offline)

Ignore
1480869088
Reply with quote  #2

1480869088
Report to moderator
1480869088
Hero Member
*
Offline Offline

Posts: 1480869088

View Profile Personal Message (Offline)

Ignore
1480869088
Reply with quote  #2

1480869088
Report to moderator
1480869088
Hero Member
*
Offline Offline

Posts: 1480869088

View Profile Personal Message (Offline)

Ignore
1480869088
Reply with quote  #2

1480869088
Report to moderator
jl2012
Legendary
*
Offline Offline

Activity: 1484


View Profile
May 05, 2014, 02:34:57 PM
 #3642

One day we will be able to lock an exchange to a public key and they can make addresses guaranteed for us

I like that idea very much.

Could that be done without forcing the masses to learn PGP?

EDIT: or at least exchanges could make it an option for those who do wish to use PGP.

Actually no pgp, just a public seed

Theoretically a malware could replace your public seed with the hacker's. The only bullet-proof way is to register an account with an offline pgp key (or with a bitcoin key), and sign any payment requests with the key.

Donation address: 1CiZPrEJdN4FJcqdLdgVLzT8tgCXxT5ion
PGP: D3CC 1772 8600 5BB8 FF67 3294 C524 2A1A B393 6517
Bitcoin Wizards Wiki: https://8333.info/
etotheipi
Legendary
*
Offline Offline

Activity: 1428


Core Armory Developer


View Profile WWW
May 05, 2014, 05:02:59 PM
 #3643

Actually no pgp, just a public seed

Theoretically a malware could replace your public seed with the hacker's. The only bullet-proof way is to register an account with an offline pgp key (or with a bitcoin key), and sign any payment requests with the key.

Sorry guys, I've been out of town at the MIT Bitcoin Expo this past weekend and haven't even been looking at this thread.

I just want to mention that the "real" solution here is something I've talked about for a while, but no one else in the community seems to be taking it seriously, even though it's perfectly compatible with BIP 32.  You provide your BIP32 branch root public key (but not chaincode!), perhaps putting it on your business card.  So your business card contains the public key portion of M/i/j, then when you compute address M/i/j/k for someone to pay you, you do all the hashing and crypto, and save off the multiplier just before it is applied to M/i/j.  You send the recipient the receiving address and the multiplier.  They can apply the multiplier to the public key on your business card and see that it matches the address given, proving that it's actually part of your wallet.  Note that this is perfectly private because the chaincode is not the same as the multiplier, and cannot be computed from the multiplier.  It simply allows you to optionally prove that an address is related to your root public key without leaking any privacy or security information.

Stealth addresses are based on this idea, but don't require any interaction.  It lets the sender generate the multiplier for you using ECDH, and then encoding the DH information in an OP_RETURN output.  However, it comes at the expense of extra data in the blockchain, and the receiver must scan every transaction in the blockchain with expensive crypto ops to find transactions to his wallet.  This doesn't work with lite wallets, and the stealth address discussion has gone through many ideas of outsourcing that computation/search to trusted nodes with enough computing power.

Instead, using this rootkey+multiplier trick, you still have to provide a payment address to the sender, but they can prove to themselves that the address is yours as long as they have verified your root public key at any point in time.  This doesn't require any extra computation or embedded blockchain data like stealth addresses do.  It is a solid compromise between where we are and what stealth addresses attempt to accomplish.  

When I talked about "...and a whole lot more" in my foreshadowing of what the new wallet format will do, that is one of those things we will be supporting.  It would allow you to save BIP32 root public key information for various contacts in the wallet, and provide a new (optional) address encoding that proves your addresses are related.    In all cases, we are requiring the sender to verify the receiver's address under the assumption that maybe the receiver's own WO wallet has an error or is compromised.  

Until then, the best thing you can do is exchange watching-only wallets with parties you interact with frequently, and make sure that any payment addresses they send you appear in the WO wallet you have for them.  Armory already gives you a way to watch multiple wallets and mark who they belong to.  Out-of-band verification of payment addresses (such as phone call) would be recommended for exceptionally large transactions.



P.S. - This proposal does not have a compact extension into P2SH multisig, but it is still possible.  Your company would actually have, say, 5 public keys associated with the company address (because the company uses a 3-of-5).  The sender would receive 5 multipliers, apply the multipliers to verify each one, and then sort the resulting public keys and create the P2SH-multisig themselves.   There's no loss of privacy there, just a lot more data needing to be moved between parties to do the verification.

P.P.S - You would most likely include a much shorter hash on your business card, and then supply the root key(s), multiplier(s) and payment address all at once.  They would hash the root key(s) to make sure it matches your business card, then follow the process above.




Founder and CEO of Armory Technologies, Inc.
Armory Bitcoin Wallet: Bringing cold storage to the average user!
Only use Armory software signed by the Armory Offline Signing Key (0x98832223)

Please donate to the Armory project by clicking here!    (or donate directly via 1QBDLYTDFHHZAABYSKGKPWKLSXZWCCJQBX -- yes, it's a real address!)
justusranvier
Legendary
*
Offline Offline

Activity: 1400



View Profile WWW
May 05, 2014, 05:16:24 PM
 #3644

Until then, the best thing you can do is exchange watching-only wallets with parties you interact with frequently, and make sure that any payment addresses they send you appear in the WO wallet you have for them.  Armory already gives you a way to watch multiple wallets and mark who they belong to.  Out-of-band verification of payment addresses (such as phone call) would be recommended for exceptionally large transactions.
This is something Bitcoin companies should have been doing for years.

How many exchange balance thefts would have been avoided if exchanges let users upload a WO wallet and only processed withdrawals to addresses in it?
plethora
Member
**
Offline Offline

Activity: 83



View Profile
May 05, 2014, 06:56:22 PM
 #3645

Caution: When copying and pasting the command line arguments from Troubleshooting Bitcoin Armory into your shortcut to launch Armory, the quotes are not actual characters recognized by Windows resulting in the path not being respected.
Quote
To move BOTH Bitcoin Core AND Armory home dir:

            Complete both steps above but instead, modify Armory Shortcut by adding: --satoshi-datadir=“F:\Bitcoin\new\home\dir” --datadir=“F:\Armory\new\home\dir”
Notice the “ and ” instead of ".
Roy Badami
Hero Member
*****
Offline Offline

Activity: 562


View Profile
May 06, 2014, 10:37:59 PM
 #3646

I have a feature request, that's kind of a thought-in-progress...

The other day I fired up Armory on my laptop while I was at work because I needed to transfer a small quantity of coins from my online Armory wallet to my Bitcoin Core wallet.  (I normally use Bitcoin Core for day to day purchases, but by balance was a little low.)  But I was conscious that anyone who happened to walk past and see my screen (and knew what they were looking at) would also know exactly how much I had in cold storage.

I'm not sure what UI change I'm really asking for here - maybe a preference that hides balances when the client is launched (and allows an individual wallet balance to still be viewed by means of a UI action)?

It's true that my bank's Internet banking has the same problem - launching it would reveal the balance of my current account (checking account), credit card account, and savings account.   The difference, of course, is that I can make payments from the first two just by typing my debit or credit card number into a merchant's web site, so the privacy issue never arises in normal use...

Thoughts, anyone?



CircusPeanut
Full Member
***
Offline Offline

Activity: 123

Core Armory Developer


View Profile WWW
May 06, 2014, 10:42:23 PM
 #3647

I have a feature request, that's kind of a thought-in-progress...
...

I'm not sure what UI change I'm really asking for here - maybe a preference that hides balances when the client is launched (and allows an individual wallet balance to still be viewed by means of a UI action)?
...
Thoughts, anyone?

You could drag the right edge of the Armory window to the left until the balance column is obscured.
Roy Badami
Hero Member
*****
Offline Offline

Activity: 562


View Profile
May 06, 2014, 10:53:27 PM
 #3648

I have a feature request, that's kind of a thought-in-progress...
...

I'm not sure what UI change I'm really asking for here - maybe a preference that hides balances when the client is launched (and allows an individual wallet balance to still be viewed by means of a UI action)?
...
Thoughts, anyone?

You could drag the right edge of the Armory window to the left until the balance column is obscured.

Ah, so the long delay before Armory displays the balances is actually a feature, to give me time to do this....   That works Smiley

EDIT: Actually, that doesn't help if I actually do want to check the balance of the wallet I'm paying with - without revealing the balance of any other wallet(s)
CircusPeanut
Full Member
***
Offline Offline

Activity: 123

Core Armory Developer


View Profile WWW
May 06, 2014, 11:12:56 PM
 #3649

Ah, so the long delay before Armory displays the balances is actually a feature, to give me time to do this....   That works Smiley

There actually is a reason for the delay. Armory only shows balances after it has synced with the top block. Seeing that balance tells the user that it is now available for creating transactions. Armory really cannot allow users to create transactions unless it is fully synced. Not everything in Armory is as efficient as possible, but some things necessarily take time.

EDIT: Actually, that doesn't help if I actually do want to check the balance of the wallet I'm paying with - without revealing the balance of any other wallet(s)

So you would want to hide the balances per wallet. I think that's a great idea. Perhaps we can hide the balance of specified wallets and only show it in hover text.
Roy Badami
Hero Member
*****
Offline Offline

Activity: 562


View Profile
May 06, 2014, 11:30:51 PM
 #3650

So you would want to hide the balances per wallet. I think that's a great idea. Perhaps we can hide the balance of specified wallets and only show it in hover text.

Yes, I think so - although then I don't know what you would do with the totals.  As I said, it's still a bit of a thought-in-progress.

roy
kittucrypt
Full Member
***
Offline Offline

Activity: 236

Ok Check!


View Profile
May 07, 2014, 02:32:19 PM
 #3651

Is it possible to export a private key out of Armory, such that it can be used to sign transactions on some other platform or with outside code/script?

goatpig
Moderator
Legendary
*
Offline Offline

Activity: 1316

Armory Developer


View Profile
May 07, 2014, 08:00:50 PM
 #3652

So you would want to hide the balances per wallet. I think that's a great idea. Perhaps we can hide the balance of specified wallets and only show it in hover text.

Yes, I think so - although then I don't know what you would do with the totals.  As I said, it's still a bit of a thought-in-progress.

roy

For now you could flag other loaded wallets as not yours then choose to only display the ones you marked as owned. Not very convenient but can get things done while we implement something better

Is it possible to export a private key out of Armory, such that it can be used to sign transactions on some other platform or with outside code/script?

Start Armory in Expert mode, go to your wallet's properties window, choose 'Backup This Wallet' from the right panel options then pick the 'Export Key List' option.

btcarmory.com
K1773R
Legendary
*
Offline Offline

Activity: 1526


/dev/null


View Profile
May 09, 2014, 02:06:12 PM
 #3653

@etotheipi / dev-team

In the wallet properties view, there is a button named "Remove Imported Address".
It wants me to select which address to remove, tough im unsure which i imported.
As the wallet is deterministic, its possible to find out which addresses are imported. Is there a way to display said addresses?

[GPG Public Key]  [Devcoin Builds]  [BBQCoin Builds]  [Multichain Blockexplorer]  [Multichain Blockexplorer - PoS Coins]  [Ufasoft Miner Linux Builds]
BTC/DVC/TRC/FRC: 1K1773RbXRZVRQSSXe9N6N2MUFERvrdu6y ANC/XPM AK1773RTmRKtvbKBCrUu95UQg5iegrqyeA NMC: NK1773Rzv8b4ugmCgX789PbjewA9fL9Dy1 LTC: LKi773RBuPepQH8E6Zb1ponoCvgbU7hHmd EMC: EK1773RxUes1HX1YAGMZ1xVYBBRUCqfDoF BQC: bK1773R1APJz4yTgRkmdKQhjhiMyQpJgfN
bitpop
Legendary
*
Offline Offline

Activity: 1918


https://keybase.io/bitpop


View Profile WWW
May 09, 2014, 02:11:51 PM
 #3654

@etotheipi / dev-team

In the wallet properties view, there is a button named "Remove Imported Address".
It wants me to select which address to remove, tough im unsure which i imported.
As the wallet is deterministic, its possible to find out which addresses are imported. Is there a way to display said addresses?

I don't know if you tried but it will fail if the address wasn't really imported

Also they're clearly labeled http://i.imgur.com/E2sMkoP.jpg

Reputation  |  PGP  |  DigitalOcean  |  OpenVPN 2GB Free  |  TorGuard  |  Ethereum Classic
Bitcoin: 3DSh6AnmvBpDJFUz2mnLirMLmTMcFs9nDm
Bitmessage: BM-2cXN9j8NFT2n1FxDVQ6HQq4D4MZuuaBFyb
K1773R
Legendary
*
Offline Offline

Activity: 1526


/dev/null


View Profile
May 09, 2014, 02:17:20 PM
 #3655

@etotheipi / dev-team

In the wallet properties view, there is a button named "Remove Imported Address".
It wants me to select which address to remove, tough im unsure which i imported.
As the wallet is deterministic, its possible to find out which addresses are imported. Is there a way to display said addresses?

I don't know if you tried but it will fail if the address wasn't really imported

Seems the wallet i was checking had no imported keys.
Another one has. Seems the feature i asked for already exists.

In the Wallet Properties, the first cell (#) will show Imported instead of the N'th seeded address

[GPG Public Key]  [Devcoin Builds]  [BBQCoin Builds]  [Multichain Blockexplorer]  [Multichain Blockexplorer - PoS Coins]  [Ufasoft Miner Linux Builds]
BTC/DVC/TRC/FRC: 1K1773RbXRZVRQSSXe9N6N2MUFERvrdu6y ANC/XPM AK1773RTmRKtvbKBCrUu95UQg5iegrqyeA NMC: NK1773Rzv8b4ugmCgX789PbjewA9fL9Dy1 LTC: LKi773RBuPepQH8E6Zb1ponoCvgbU7hHmd EMC: EK1773RxUes1HX1YAGMZ1xVYBBRUCqfDoF BQC: bK1773R1APJz4yTgRkmdKQhjhiMyQpJgfN
bitpop
Legendary
*
Offline Offline

Activity: 1918


https://keybase.io/bitpop


View Profile WWW
May 09, 2014, 02:18:00 PM
 #3656

@etotheipi / dev-team

In the wallet properties view, there is a button named "Remove Imported Address".
It wants me to select which address to remove, tough im unsure which i imported.
As the wallet is deterministic, its possible to find out which addresses are imported. Is there a way to display said addresses?

I don't know if you tried but it will fail if the address wasn't really imported

Seems the wallet i was checking had no imported keys.
Another one has. Seems the feature i asked for already exists.

In the Wallet Properties, the first cell (#) will show Imported instead of the N'th seeded address

Yup just tested it http://i.imgur.com/E2sMkoP.jpg

Reputation  |  PGP  |  DigitalOcean  |  OpenVPN 2GB Free  |  TorGuard  |  Ethereum Classic
Bitcoin: 3DSh6AnmvBpDJFUz2mnLirMLmTMcFs9nDm
Bitmessage: BM-2cXN9j8NFT2n1FxDVQ6HQq4D4MZuuaBFyb
etotheipi
Legendary
*
Offline Offline

Activity: 1428


Core Armory Developer


View Profile WWW
May 10, 2014, 04:45:27 PM
 #3657



Simulfunding Now Implemented!

Updated the top post in the multisig thread:  we have been able to remove most of the limitations of the lockboxes, and now even have a clunky-but-usable simulfunding interface:

https://bitcointalk.org/index.php?topic=559776.0

The whole multisig section of the "devel" branch is extremely usable right now.  It now does P2SH for everything by default (but you can optionally use bare multisig), it handles signature merging, and now allows for multi-party simultaneous funding of lockboxes (and should be easy to expand for general-purpose, manual CoinJoin).

If you are already familiar with things like buyer-seller escrow, I'm hoping that the simulfunding stuff will be somewhat straighforward (despite there being lots of steps and moving things around) -- it's a complex process, but I think I've made it about as easy as possible for a totally decentralized app.  Besides cleaning up a bunch of things, I will work on documenting how to use the interface, and the things that can be done with it.

I think I will merge all the steps/options into a single "dashboard" which sorts everything by "organizer" and "participants".  It will show something like:

  • Create Lockbox:
    • Organizer: Collect Keys
    • Participants:  Provide Pub Key
  • Deposit (regular):  Send Funds
  • Deposit (simulfund):
    • Organizer:  Merge Notes
    • Participants:  Create Promissory Note
    • Participants: Review and Sign
  • Spend:   
    • Organizer: Create Proposed Spend
    • Participants: Review and Sign

    (Not sure what's up with the table formatting, but you should get the idea...)

Founder and CEO of Armory Technologies, Inc.
Armory Bitcoin Wallet: Bringing cold storage to the average user!
Only use Armory software signed by the Armory Offline Signing Key (0x98832223)

Please donate to the Armory project by clicking here!    (or donate directly via 1QBDLYTDFHHZAABYSKGKPWKLSXZWCCJQBX -- yes, it's a real address!)
po0kie
Newbie
*
Offline Offline

Activity: 23


View Profile
May 12, 2014, 11:24:21 AM
 #3658

Hi there!

After making some test with 100.000 addresses in Wallet, we have a problem signing the Tx's on offline server.
It takes several minutes to sign, I tried some tweaks on unlock method (just taking the addrObj which I need, and not all of the 100.000 addresses to unlock)
But later on self.wallet.signTxDistProposal(txdp) it stucks.

Before stuggling into modifying more code, wanted to ask if someone of armory see some
fast way to sign a TX in a hugh big wallet?

Best regards!
etotheipi
Legendary
*
Offline Offline

Activity: 1428


Core Armory Developer


View Profile WWW
May 12, 2014, 03:22:33 PM
 #3659

Hi there!

After making some test with 100.000 addresses in Wallet, we have a problem signing the Tx's on offline server.
It takes several minutes to sign, I tried some tweaks on unlock method (just taking the addrObj which I need, and not all of the 100.000 addresses to unlock)
But later on self.wallet.signTxDistProposal(txdp) it stucks.

Before stuggling into modifying more code, wanted to ask if someone of armory see some
fast way to sign a TX in a hugh big wallet?

Best regards!

I'm fairly certain that this can be done without unlocking the entire wallet (which checks the validity of each key).  In fact, I was pretty sure we had done this already, but perhaps not.  Or maybe it wasn't sent to armoryd (isn't that what you're using?)

The problem might be that the wallet relocks itself after 10 sec and you are not getting to the signing before then.  So you have re-unlock it by the time you get to the signing procedure (and make sure you only unlock the specific keys you need, again.

Founder and CEO of Armory Technologies, Inc.
Armory Bitcoin Wallet: Bringing cold storage to the average user!
Only use Armory software signed by the Armory Offline Signing Key (0x98832223)

Please donate to the Armory project by clicking here!    (or donate directly via 1QBDLYTDFHHZAABYSKGKPWKLSXZWCCJQBX -- yes, it's a real address!)
po0kie
Newbie
*
Offline Offline

Activity: 23


View Profile
May 12, 2014, 03:25:34 PM
 #3660

Yes -> armoryd

what do you mean with re-unlock it?
just setting: self.wallet.isLocked = False ?
Pages: « 1 ... 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 [183] 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 »
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!