Security issues with the design or implementation of Bitcoin and related crypto-currencies.
1
vote
2answers
26 views
Integrity of ensuring the correct recipient of a BTC public address?
If a hacker gains access to a website and proceeds to vandalize the website, including changing the public-key of a BTC wallet, this would direct all payments to the hacker. Is this a security risk ...
3
votes
1answer
108 views
Is it a 51% attack or a >50% attack?
Is it 51% attack or 50.0000...1% attack ?
Seems like a stupid question, but bitcoin is getting to a point where 1% is a lot of hashing power...
My understanding is >50% due to the nature of the ...
1
vote
1answer
48 views
Compromised Bitcoin clients?
Are there any known cases of compromised Bitcoin clients (whether proprietary or free)?
I don’t mean separate malware that attacks installed clients, but malware that is included in the client ...
1
vote
0answers
52 views
How do I use multisig transactions? [duplicate]
I want to create an joint "address", made of 3 individual ordinary addresses, such that any combination of 2 addresses can move the bitcoins stored at the joint address.
What is the way to do this ...
1
vote
2answers
115 views
How to run a bitcoind on a hosting securely?
I'm developing a web site which should receive bitcoins and display the amount of received coins. As this is my first bitcoin experience I would like to know if the following scheme is secure enough:
...
1
vote
1answer
113 views
What are the pros and cons of different methods for transferring Bitcoins between different wallet services?
I am interested in transferring Bitcoins between several different wallets: my Mt.Gox account, my Bitcoin client wallet, and my Blockchain wallet. I am aware of two primary ways to transfer funds ...
-1
votes
3answers
69 views
Why can't just any hash be used for a block? [duplicate]
disclaimer: I'm completely new at this, basic computer skills limited to GUI point-&-click
I took a look at how difficulty was explained, that it is "increased" by requiring the SHA-256 ...
1
vote
1answer
33 views
Is there any way to tell if there is a miner (in a pool) on the network, from a network perspective?
I'm thinking traffic analysis, packet inspection, IP.
How would that be differenciable from other traffic patterns?
How active do admins look for such patterns?(I'm thinking more P2P stuff)
5
votes
1answer
111 views
What precautions should be taken to protect a Ripple wallet?
What if a Ripple wallet gets hacked?
What are the suggested precautions for the average user?
4
votes
1answer
244 views
DDoS on big mining pools: a quick way to 51%?
Slush's Pool, the second biggest mining pool around, is currently down, allegedly due to a DDoS attack:
News
16.04.2013
Pool is under DDoS attack. I'm working on recovering the service back to ...
2
votes
1answer
154 views
How exactly is my account/wallet at ripple.com secure?
Ok, I have my wallet name, passphrase and secret account key issued by 'the network'.
Now say that ripple.com is under DDOS attack or, for whatever reason closes for a month or even becomes ...
2
votes
1answer
41 views
How should webapps handle addresses/wallets?
There is a ton of bitcoin information, but it's hard to find up to date best practices for making webapps. I am very comfortable making secure webapps, and I'd like to start some bitcoin related ...
-2
votes
2answers
203 views
What prevents a user from finding all bitcoins and claim them? [duplicate]
I am new to the bitcoin world and I'm fascinated by its principles. I have found a great description of how the mining works in this answer. Now, I see that a great deal of it is based on network-self ...
-2
votes
2answers
90 views
Catching thieves: Network Jury? Account blacklist? Additional TX script commands? [closed]
When someone steals 25,000 BTC from a single user, everyone on the network can just watch the coins move around the public ledger, but no one can do anything about it.
Can't we do something about it? ...
4
votes
1answer
286 views
Are the Thin clients Electrum and Multibit safe and secure?
How do Electrum and Multibit compare for being safe and secure. Both are open source. Are there any advantages, security wise, to use one or the other?
I'm new to bitcoin and the only reason for ...
2
votes
1answer
65 views
Is there any risk associated with using the same passphrase on two different wallets both hosted on blockchain.info?
Does blockchain.info use any salt with the passphrase?
I.e., is there any risk associated with using the same passphrase on two different wallets both hosted on blockchain.info?
edit: of course ...
1
vote
1answer
87 views
Is Google Authenticator really useful on blockchain.info?
blockchain.info hosts encrypted wallets, and all decryption is done locally, so having a Google Authenticator bound to a wallet only prevents an attacker from downloading that encrypted wallet.
Now, ...
1
vote
1answer
56 views
Can the Bitcoin client be used without any incoming ports being opened?
I am running bitcoind on the latest Ubuntu 12.10 Quantal Quetzel on amazon's EC2 network.
The security group I have attached to the box only allows port 22 so I can login via ssh.
How is bitcoind ...
1
vote
1answer
83 views
Bitcoin HEISTS: Has USD, EUR, etc ever been stolen from an exchange?
Many bitcoin exchanges allow users to store two balances: one in bitcoin and one in a fiat currency like USD. This is convenient because it allows one to trade in and out of the bitcoin market ...
8
votes
2answers
319 views
Can the BitCoin network be used for cracking?
I'm assuming that the BitCoin economy is rapidly building a computing cluster capable of unprecedented amount of hash searching.
Would it be possible for an attacker to leverage this to crack other ...
1
vote
1answer
81 views
Feasibility of a “High horsepower” attack (based on difficulty -4x adjustments)
This is really Part 3 of this earlier question.
Given that the QT client is hard coded to never adjust difficulty more (or less than) a factor of 4...
What realistic scenario would cause the ...
2
votes
2answers
159 views
Can someone with an unlimited amount of money compromize the network?
I was reading this interesting discussion in the comments section on ZH where this guy was talking about how a single entity (think corrupt government and banksters) can throw money and processing ...
1
vote
4answers
392 views
Would bitcoin be destroyed if a wealthy organization obtained a CPU majority for a sustained period?
Inspired by this question ("Could bitcoin be destroyed by an entity cornering the market?") and the top comment on this answer to this question ("How much would it cost to execute a 51% attack?").
...
1
vote
1answer
77 views
Would bitcoin be compromised if the officially distributed executable was?
From the official Bitcoin FAQ:
Could miners collude to give themselves money or to fundamentally change the nature of Bitcoin?
... Bitcoin is a distributed network, so any changes implemented ...
1
vote
1answer
68 views
Is there a risk of double-spending when making a face-to-face transaction?
When exchanging funds or services face-to-face, is there a risk of a double-spending attack? If there is, how could it be technically done?
7
votes
3answers
239 views
Scenario: disaster splits the Internet into dozens unconnected fragments
Major US cities restore connectivity locally for a couple of days, but the internet islands are separated (or have very poor interconnectivity). Two days later, connectivity is restored resulting in, ...
7
votes
2answers
238 views
Are there alternatives for proof of work?
Bitcoin uses proof of work to secure the network, Ripple uses a global consensus system and PPCoin uses proof of stake.
Are there any known alternatives to the above methods?
2
votes
2answers
124 views
Possible to create a double spend attack by replacing a Tx in the merkle tree?
This question on crypto.SE describes how preimage attacks are avoided in the Bitcoin network.
For a second preimage attack:
hash(x) = hash(y) implies hash(hash(x)) = hash(hash(y))
So it ...
7
votes
2answers
426 views
How safe is a brain wallet?
Brain wallets can be created with a (minimum 15 character) pass phrase at https://www.bitaddress.org
There are no warnings given on the site about the safety of this. How secure are brain wallets?
A ...
-2
votes
2answers
181 views
What improvements could a next-generation cryptocurrency implement?
What would next generation cryptocurrency would look like? What are the major weaknesses that you think we could solve? How do you envision it could be implemented technically? For example:
How ...
3
votes
0answers
51 views
Can the Bitcoin protocol be configured to *never* rollback after a certain block? [duplicate]
Is it possible to hard code a block and its block hash into the client so that the block chain will never diverge from the main chain past that block?
My thought is that this will improve confidence ...
3
votes
2answers
108 views
I want my site to accept bitcoins (and automaticly reward users with it) but do not want to deal with security issues
is there a SaaS which could handle all the hassle for me?
0
votes
1answer
240 views
What files do I need for backing up my wallet? [duplicate]
Is %APPDATA%\Roaming\Bitcoin\wallet.dat the only file I need to backup my wallet?
I've heard about backing up every ~50-100 transactions is this correct? I thought that with the wallet.dat file, I ...
1
vote
1answer
134 views
Security of Bitcoind
Due to recent reports of theft activities by hackers, is cyber security is an on-going concern for Bitcoin and are active measures being taken to improve security?
2
votes
1answer
616 views
What has a lower long term cost per hash: LTC, BTC or other alt coin?
I'm trying to understand the cost per hash operation with Litecoin vs Bitcoin over time. The theory is that the network that has the best prospects for long-term security (via hashing) will set a ...
4
votes
1answer
280 views
What are the security considerations for hosting *your own* Electrum server?
Lets say I wanted to use an electrum client but I'm so paranoid and also can't or won't read and understand python code so that I only trust my own server.
What security considerations should I have ...
2
votes
1answer
84 views
Where can I look to see a revealed public key?
I've read that pub keys aren't exposed until they're spent from. Can someone show me an example of a transaction prior to the pub key being exposed and then after? Where do i look?
3
votes
1answer
265 views
Use Stolen Private Key?
If only my private key were stolen, could it be used?
Without knowledge of the corresponding public key or address, can one spend BTC with only the private key?
I know you can derive the public key ...
3
votes
2answers
81 views
Risk of a certain machines being compromized
Is it possible for a sinister entity to peek into the p2p network of bitcoin and manipulate it in such a way so as to compromise a certain transaction?
3
votes
1answer
128 views
Is JavaScript wallet generator available at bitaddress.org relatively secure?
I wonder if it's safe to use JavaScript generator available at bitaddress.org.
Even if I'll generate it offline, how can I know if the algorithm is not using any pre-computed / pre-planned way of ...
3
votes
2answers
61 views
What alternatives are there to hardcoding checkpoints into the Bitcoin client?
Checkpoints seem like a crucial part of the security & validation apparatus in BitCoin. Is there a written policy in place, among the developers defining the maximum interval between checkpoints?
...
3
votes
1answer
84 views
What is the easiest way to “listen” to the network?
If I want to automatically check up on payments and ensure they are not double spends and check the confirmation count, what is the easiest way to do so?
1
vote
2answers
106 views
Is the scripting system an incalculable security risk?
Why does Bitcoin have a complicated scripting system?
https://en.bitcoin.it/wiki/Script
https://github.com/bitcoin/bitcoin/blob/master/src/script.cpp
I guess because it makes fancy contracts ...
5
votes
2answers
163 views
How does Ripple solve the sock-puppet problem during consensus?
I'm under the impression that Ripple uses a consensus based system in order to determine which of two payments is the authoritative one, with the other getting rejected due to a lack of proponents. ...
1
vote
2answers
325 views
What are the advantages and disadvantages of 24/7 Bitcoin trading?
What are the advantages and disadvantages of 24/7 Bitcoin trading over traditional stock market which operates only 6 - 8 hours a day and 5 days a week? Any threats?
3
votes
2answers
216 views
Is it safe to run bitcoind on another server
I'm making first, rough concepts of some ideas for bitcoin-enabled services I have in mind.
One thing that I wonder is, is there a best-practise approach on running bitcoind on another server that ...
7
votes
1answer
265 views
How does the Electrum wallet encryption work?
Nube bitcoin question... I created an electrum wallet, and can find it under appdata on my windows machine. When creating it I set up a pass phrase and password. I sent a small transaction into one ...
5
votes
1answer
104 views
Signing Bitcoin transactions
There is a part of the Bitcoin protocol that I don't quite understand.
When you make a transaction, and spend the output of a previous transaction for say 1 BTC, you provide a signature using the ...
5
votes
2answers
153 views
How would Bitcoin usage be affected within a country that severed its Internet connection?
Clearly this system depends upon data exchange. What happens if national authorities in one or more countries decide there exists a "national emergency", "requiring" the shutdown of the internet in ...
3
votes
4answers
202 views
Securing bitcoin addresses in database
I'm working on a service which will require me to store bitcoin payout addresses in my database. This means that a potential attack to my service would be to gain access to the database and replace ...
