Question about private keys

[gnode]

In the bitcoin wiki about private keys (https://en.bitcoin.it/wiki/Private_key), there is the following warning,


In contrast, bitcoind provides a facility to import a private key without creating a sweep transaction. This is considered very dangerous, and not intended to be used even by power users or experts except in very specific cases. Bitcoins can be easily stolen at any time, from a wallet which has imported an untrusted or otherwise insecure private key - this can include private keys generated offline and never seen by someone else.

Why is this dangerous? Can somebody clarify? How is this different from inporting keys in a bitcoin-QT wallet?

[1713490101]

1713490101

[1713490101]

1713490101

[1713490101]

1713490101

[1713490101]

1713490101

[1713490101]

1713490101

[DannyHamilton]

Why is this dangerous? Can somebody clarify?

Whomever wrote that paragraph wasn't thinking very much about what they were saying.  It's ambiguous and confusing.

Relying on importing a private key to load funds into a wallet can be risky if the person that imports the private key isn't the person that generated it, or if the person that imports the key didn't generate it in a secure manner.  This isn't unique to boitcoind.  It's true of any wallet that allows you to directly import private keys.

How is this different from importing keys in a bitcoin-QT wallet?

It isn't.

[gnode]

In other words there is no danger associated with the importing process itself. Correct?


So as long as the private key was generated in a secure manner and it isn't something like a brain key, there is no danger of losing coins at any time?

[DannyHamilton]

In other words there is no danger associated with the importing process itself. Correct?

Correct.  The danger is in trusting a private key that is already insecure, or importing the private key into an insecure wallet.

There is also some risk with not understanding how change is handled by the wallet you are importing into, and misunderstanding the technical details of how the protocol works.  Such lack of knowledge can lead someone to make false assumptions and accidentally believe that their bitcoins are still associated with the private key when the wallet has sent them to some other private key without their knowledge.

So as long as the private key was generated in a secure manner and it isn't something like a brain key, there is no danger of losing coins at any time?

As long as the private key is not compromised and is not imported into an insecure wallet, the act of importing the private key won't cause you to lose any bitcoins.

There are some people who have misunderstood how their wallet works, and have lost bitcoins because of it.

As just one example of how this loss of bitcoins can happen, I'm aware of a user that did the following:

• Created a private key and associated bitcoin address offline (paper wallet)
• Sent a transaction with bitcoins to the offline address
• Later decided they wanted to spend some of those bitcoins
• Imported the private key into a brand new bitcoind wallet
• Created a transaction to send a very small portion of the imported bitcoins somewhere
• Deleted the brand new bitcoind wallet (since they though they could just import the private key again in the future if they wanted to)

Unfortunately, the next time they went to spend some more of the bitcoins, they discovered that all of the bitcoins were permanently lost.

If you don't understand why, then you should not be importing private keys.

If you do understand why, then you realize the importance of knowing absolutely for certain that a process works the way you think it does before you start messing around with your money.

[gnode]

In other words there is no danger associated with the importing process itself. Correct?

Correct.  The danger is in trusting a private key that is already insecure, or importing the private key into an insecure wallet.

There is also some risk with not understanding how change is handled by the wallet you are importing into, and misunderstanding the technical details of how the protocol works.  Such lack of knowledge can lead someone to make false assumptions and accidentally believe that their bitcoins are still associated with the private key when the wallet has sent them to some other private key without their knowledge.

So as long as the private key was generated in a secure manner and it isn't something like a brain key, there is no danger of losing coins at any time?

As long as the private key is not compromised and is not imported into an insecure wallet, the act of importing the private key won't cause you to lose any bitcoins.

There are some people who have misunderstood how their wallet works, and have lost bitcoins because of it.

As just one example of how this loss of bitcoins can happen, I'm aware of a user that did the following:

• Created a private key and associated bitcoin address offline (paper wallet)
• Sent a transaction with bitcoins to the offline address
• Later decided they wanted to spend some of those bitcoins
• Imported the private key into a brand new bitcoind wallet
• Created a transaction to send a very small portion of the imported bitcoins somewhere
• Deleted the brand new bitcoind wallet (since they though they could just import the private key again in the future if they wanted to)

Unfortunately, the next time they went to spend some more of the bitcoins, they discovered that all of the bitcoins were permanently lost.

If you don't understand why, then you should not be importing private keys.

If you do understand why, then you realize the importance of knowing absolutely for certain that a process works the way you think it does before you start messing around with your money.

Yes in the above example, the person didn't understand that the balance was sent to a new address (the change address) with a new private key. So if he didn't dump and save the new private key before deleting his wallet he was SOL.

[Luke-Jr]

End users should never manage ECDSA private keys. Doing so, especially importing, is likely to lead to loss of bitcoins.

[jbrnt]

End users should never manage ECDSA private keys. Doing so, especially importing, is likely to lead to loss of bitcoins.

Can you elaborate further? I am not sure what you mean by manage?

I think users should manage their own keys. Like making paper wallets or making a backup of the online wallet keys, to name a few. To use those coins on those addresses when we need to, importing them into a client is an inevitable process. Do you expect end users to use only bitcoin core and only backup by having multiple copies of wallet.dat?

[gnode]

End users should never manage ECDSA private keys. Doing so, especially importing, is likely to lead to loss of bitcoins.

See Danny Hamilton's response above, 

"As long as the private key is not compromised and is not imported into an insecure wallet, the act of importing the private key won't cause you to lose any bitcoins."

What are you talking about?

[Luke-Jr]

End users should never manage ECDSA private keys. Doing so, especially importing, is likely to lead to loss of bitcoins.

Can you elaborate further? I am not sure what you mean by manage?

I think users should manage their own keys. Like making paper wallets or making a backup of the online wallet keys, to name a few. To use those coins on those addresses when we need to, importing them into a client is an inevitable process. Do you expect end users to use only bitcoin core and only backup by having multiple copies of wallet.dat?

Yes, backups should always be of an entire wallet, not of individual keys.

End users should never manage ECDSA private keys. Doing so, especially importing, is likely to lead to loss of bitcoins.

See Danny Hamilton's response above, importing is NOT likely to lead to loss of bitcoins. What are you talking about?

No, he clearly states:

If you don't understand why, then you should not be importing private keys.

If you do understand why, then you realize the importance of knowing absolutely for certain that a process works the way you think it does before you start messing around with your money.

This is what "dangerous" means.

[gnode]

I think you are taking what Danny Hamilton said out of context.

[Luke-Jr]

I think you are taking what Danny Hamilton said out of context.

This thread started off with an improper contrast with importing to Bitcoin-Qt, which is also equally dangerous.
He is correct that importing to bitcoind is not more dangerous.
But it remains dangerous no matter what wallet you import to.

[gnode]

I think you are taking what Danny Hamilton said out of context.

This thread started off with an improper contrast with importing to Bitcoin-Qt, which is also equally dangerous.
He is correct that importing to bitcoind is not more dangerous.
But it remains dangerous no matter what wallet you import to.

What exactly is dangerous about importing a private key into a wallet?

[Muhammed Zakir]

I think you are taking what Danny Hamilton said out of context.

This thread started off with an improper contrast with importing to Bitcoin-Qt, which is also equally dangerous.
He is correct that importing to bitcoind is not more dangerous.
But it remains dangerous no matter what wallet you import to.

What exactly is dangerous about importing a private key into a wallet?

He may be pointing out the privacy problem. But.. That line should be removed or atleast make it correct. It is somewhat like spreading false news and it would be really bad as it is in BTC wiki.

  ~~MZ~~