Security issues with the design or implementation of Bitcoin and related crypto-currencies.

learn more… | top users | synonyms

1
vote
2answers
48 views

How does Ripple ensure that transactions take place

I am struggling with some concepts in the Ripple system. As I understand it: After an American user goes to a gateway and loads $ into the Ripple system that he wants to send to Cambodia, the ...
1
vote
1answer
36 views

Encrypting Bitcoin private keys instead of printing out paper

I follow the procedure of making a cold storage wallet: downloaded copy of bitaddress.org using an off-line computer booted with Ubuntu from CD. Instead of printing out the private keys and ...
2
votes
1answer
57 views

Technical analysis of Blockchain.info security breach

I the news I read this: The firm was forced to make a security disclosure on its blog and on Reddit, admitting that a development error had led to a problem with the generation of private ...
0
votes
1answer
22 views

Funds and Wallets

If I load bitcoins to my wallet and the funds are there, and I go back to load more Bitcoins with a new address for my wallet are the funds from my first wallet going to merge with the newly added ...
0
votes
1answer
41 views

Lower confirmation time schemes: any requirement between confirmation time and the probability to find a block during that confirmation time?

Bitcoin, the first blockchain-based cryptocurrency, set a 10 minute confirmation interval time; LiteCoin set a 2 minute confirmation interval time; DogeCoin set it at 1 minute; QuarkCoin set it at 30 ...
1
vote
0answers
27 views

Which exchanges support U2F authentication?

I got myself a nice security key (Yubico Fido) today, which utilises the U2F protocol. But to my surprise not a single Bitcoin exchange seems to support this yet, only Google itself. So which ...
1
vote
3answers
100 views

ECDSA x,y coordinate validity verification doesn't seem to work

The ECDSA algorithm, secp256k1 for Bitcoin allegedly uses the equation y ^ 2 = x ^ 3 + 7 mod P to determine the validity of an alleged point upon the elliptical curve. Utilizing ...
6
votes
1answer
194 views

Is there a fallback plan if bitcoin's underlying cryptography is cracked?

Lets say someone started making real viable quantum computers that were affordable enough that large companies could buy one. And lets say a quantum algorithm was devised to crack the private keys of ...
1
vote
2answers
85 views

Why don't any of the SHA-256 vulnerabilities matter for mining?

Wikipedia lists several vulnerabilities in SHA-256. Presumably, none of them can be used to mine faster, or it would be done already. Why don't these vulnerabilities lead to a problem for mining?
2
votes
1answer
46 views

Can side chains or “pegged” chains negatively affect the security of Bitcoin?

Regarding the concept of side chains or "pegged" chains which has been discussed since as early as 2011 and explored in this white paper, how can these negatively affect the security of Bitcoin? ...
3
votes
1answer
67 views

How to generate a public key from a private key using Elliptic Curve Digital Signature Algorithm

I'm trying to understand the graphical basis that underlies the discreet logarithmic Elliptic Curve Digital Signature Algorithm (ECDSA) introduced in Chapter 4 of "Mastering Bitcoin" by Andreas ...
1
vote
2answers
88 views

How does a Trezor passphrase prevent restoration of a wallet if an attacker knows the seed?

Trezor User Manual says if you forget the passphrase there will be no way to recover your bitcoins. Not even the Recovery seed. How is it that you (or an attacker who knows the seed) can't just ...
2
votes
2answers
111 views

Can a Trezor seed be used in any other HD wallet?

Trezor FAQ says If you do not use a passphrase, your recovery seed is all that is needed to access your bitcoins. If you do not use a passphrase, can the Trezor seed be used to recreate a ...
3
votes
2answers
116 views

What is it about a Trezor that means it can't be infected by malware?

The Trezor testimonials include that TREZOR ... cannot be infected by malware What is it about a Trezor that means it cannot be infected?
0
votes
3answers
112 views

How can an online wallet be more secure than paper wallets or cold storages?

Recently, after I was reading that some bitcoin early adopter lost 750 BTC due to theft from his macbook, I was looking for the most secure storage solution for my coins. I already know about paper ...
0
votes
1answer
34 views

How can address' hash160 be used to determine information for malicious purposes? (Ie reusing of the same address)

I've been playing around with Richard Kiss's Pycoin app which is clarifying how P2PK works. I see that the hash160 of the value: (0x04) (x-coordinate) (y-coordinate) (for an uncompressed Testnet ...
0
votes
2answers
47 views

Hash property resistance

I'm experimenting with some self study cryptography and I was curious about the two following scenarios (simple answers and/or in relation to bitcoin) If SHA256 was found to lack pre-image ...
1
vote
2answers
79 views

Can you encrypt not just the private key, but also the public keys (ie bitcoin addresses) in an Armory wallet?

I would imagine that the paranoid darknety bitcoin user has an interest in keeping not only their private keys safe (so nobody can steal their bitcoins), but also has an interest in keeping their ...
1
vote
2answers
41 views

Theoretical security of mining bitcoins

Is it possible to change rules of mining bitcoin division? rewrite P2P bitcoin client (or write maleware) which will be pretending that fake bitcoin client is legal, original client distribute ...
0
votes
1answer
26 views

How do I reset my TFA token in Coinbase?

I would like to move my Coinbase Two-factor authentication token from one device to another. I cannot find a location on their website to disable TFA once it has been set up, or to move the token to ...
2
votes
1answer
40 views

How secure is calling bitcoind JSON-RPC from same computer?

I am wondering if calling JSON-RPC from the computer it is running on is secure. I read How secure is calling bitcoind JSON-RPC? and understand why it is insecure to do so from a different computer. ...
1
vote
0answers
83 views

Standardize wallet format [closed]

What's the status of wallet format standardization? Is there any proposal or work-in-progress around? If not, how come nobody urges to define standard wallet formats yet? This is especially needed ...
3
votes
1answer
148 views

New to Bitcoin - tips on securing my server

I regard myself as being a competent programmer and have good general IT knowledge; however I know very little about BTC. I just want to make sure that my setup is "generally secure" and that I'm ...
2
votes
1answer
77 views

How to securly move bitcoins from a wallet.dat file to a paper wallet? [duplicate]

I have an old wallet.dat file with a few Bitcoins. It is stored in an isolated computer that is not connected to the internet. I would like to get rid of the wallet.dat file, and move all the ...
1
vote
0answers
44 views

How do mnemonics encrypt wallet data and what prevents hacking of the algorithm?

How do mnemonics encrypt wallet data and what prevents hacking of the algorithm? For example Blockchain seems to encrypt all data using a mnemonic yet doesn't hold customer data server side. What ...
1
vote
1answer
97 views

How does CryptoNote prevent a 51% attack and double-spending?

How does CryptoNote prevent a 51% attack and double-spending? I’m interested to know what is the mechanism that protects CryptoNote coins from 51% and double-spending attacks.
0
votes
0answers
22 views

Ensure Wallet consistency

I have recently migrated machine. I used the Apple Migration Wizard and when it was finished my new machine's copy of Multibit appears to have my BTC within it. My next task is to wipe the old ...
2
votes
1answer
77 views

What is Mt. Gox's YubiKeys' “configuration protection access code”?

Does anyone know if Mt. Gox, now that they're bankrupt, has released their YubiKey's "configuration protection access code" (cf. this)? If so, we could reprogram the free YubiKeys they sent us and use ...
3
votes
1answer
74 views

What are some of the pitfalls of a 100% proof of stake currency (pos) like NXT?

Bitcoin has the vulnerability of a 51% attack for a proof of work currency, but what pitfalls does a 100% proof of stake (pos) currency have like NXTcoin?
2
votes
1answer
92 views

Bitcoin security, what is wrong with my thinking? [duplicate]

Lets assume I keep generating random public keys with their matching private keys and never use them. Severals years later I am checking for positive match against the blockchain for all my generated ...
6
votes
2answers
150 views

Does GHashIO already have above 51% hashrate?

Right before writing this question I noticed the GHashIO showing 32% hashrate distribution using the following link. Unknown has 26%. And the IP address of the most blocks reported from unknown is: ...
5
votes
4answers
2k views

Supermajority to prevent 51% attack?

I would think that amending the bitcoin protocol to require a supermajority, say 60% or 75%, to verify proof of work help reduce the risk of a 51% attack. If this is so, what are the major obstacles ...
1
vote
1answer
131 views

How is Coinbase any different than Mt Gox?

Apparently Coinbase handles the private keys for your wallet which allows them to easily handle buying and selling. As Coinbase is a hosted wallet, we do not provide users with their private ...
1
vote
1answer
103 views

How likely are key pair collision attacks? [duplicate]

Is it possible to be profitable by developing a collision application that continually and automatically generate a key pair, check for the existence of the public address in the block chain, and then ...
0
votes
0answers
39 views

Can't get armory to work

When I try running armory, it seems to download the block change and actually gets to 0 blocks, but then all of the sudden, armory disappears. Anyone know why this is happening? In the log file, I ...
2
votes
1answer
43 views

How are mutated transactions prevented from getting relayed?

Quoth Bitcoin release-notes-0.9.0.md: This release contains a few fixes for transaction ID (TXID) malleability issues: -nospendzeroconfchange command-line option, to avoid spending ...
5
votes
2answers
143 views

BItcoin value vs. Supercomputing

What protects the stability of bitcoin's value if supercomputers or some other technological breakthrough allows them to be mined at rates we have not anticipated?
4
votes
1answer
181 views

Is a full blockchain fork possible?

Let's say someone creates a blockchain fork starting from the genesis block, when the difficulty was absurdly low compared to today; then he starts mining new blocks from there up to the current block ...
2
votes
1answer
50 views

Can I detect a 51% attack as a developer

I am a developer building an application that accepts payments in cryptocurrencies. Is it possible, in the occurence of a 51% attack, to build a script that detect this, so we can suspend withdrawals ...
1
vote
2answers
263 views

Is the denumerability of private keys a threat?

Since the set of all private keys is denumerable, it is at least possible to create a searcheable record of all keypairs. Which, when finished, is a killer for the whole idea. Am I right or do I miss ...
3
votes
1answer
117 views

Detecting stolen bitcoins?

Is it possible to detect stolen bitcoins? With so many coins being stolen these days, for the more "ethically conscious" bitcoin users, is it somehow possible to check if the coins (you're about to ...
0
votes
0answers
61 views

Multisig transactions vs secret sharing

Some background here, I am implementing a wallet that enhances security by using smart cards. The card stores a pin protected key but unfortunately cannot do ECDSA signing. There is also a server ...
0
votes
1answer
53 views

Can a double spend attack be obfuscated by mimicking the transactions seen before the fork?

An attacker controls the majority of the hashing power and wants to double spend without arousing suspicion. If they mirror the public chain's activity while generating the private fork and the fork ...
9
votes
1answer
129 views

Heartbleed bug and Altcoins

Bitcoin recently released V 0.9.1 patching vulnerabilities from the Heartbleed bug, however I have not seen anything from any alt coin. What are the possible security risks associated with using these ...
9
votes
5answers
302 views

What would a new exchange need to be better than the rest?

If a new crypto v crypto exchange were to be built and launched. What would tempt you to use it rather than what you currently use? Or what improvements would you like to see from the way things work ...
2
votes
2answers
249 views

I think my bitcoin wallet was hacked. What to do?

I opened bitcoin-qt after not mining for a couple months and found that I suddenly have no more bitcoins! And I see that there were 2 transactions that I did not authorize sending my coins to other ...
0
votes
1answer
68 views

What are the methods for getting an old, used windows P.C. ready for secure Bitcoin usage? [closed]

Let's say I am about to set my Grandmother up with a wallet. I have no idea what she has on her computer. There could be a host of malware, keyloggers etc. Let's also say that a complete wipe and ...
0
votes
3answers
100 views

Does Bitcoin's SHA256 proof make a 51% attack more likely?

Ethereum's description says that Bitcoin's mining algorithm requires only a simple SHA256 computation, which caused the creation of specialised ASICs, which centralizes mining in the hands of a few ...
0
votes
3answers
258 views

TorBrowser + HTTPSEverywhere Blockchain.info wallet safe?

I seem to find conflicting information regarding the possibility of a TOR exit node stealing my data even while using HTTPS. How possible/likely is this? Let's assume user implements strong security ...
1
vote
1answer
203 views

Who can see my IP address while using Electrum

Who exactly is my IP exposed to when sending transactions in Electrum. I'm assuming the server operators can see it every time I connect (to query the servers about my balances). When I make a ...