Security issues with the design or implementation of Bitcoin and related crypto-currencies.

learn more… | top users | synonyms

1
vote
1answer
50 views

Does the private key have special mathematical properties?

[I read that there are private keys with lengths other than 256 bit. I only talk about 256 bit private keys here. Are other lengths even common and supported by popular wallets like Electrum?] Let's ...
0
votes
1answer
40 views

Double Spend Attack

What's to prevent someone from sending bitcoins back to themselves using the same transaction id before any confirmations? So if I go into a deli and pay with Bitcoin and send those bitcoins back to ...
-1
votes
0answers
28 views

Has there been an investigation into “proof of skill”

There are basically two kinds of proofs used to secure blockchains of various currencies: Proof of Work: Proof that a simple but expensive computation has been done. As long as at least 51% of ...
1
vote
2answers
64 views

can man in the middle change transaction before its broadcast?

i'm very new to bitcoins (started learning it today). i hope i get the question right: i understand when a transaction is created, using my private key i sign the transaction, but i also provide the ...
-1
votes
1answer
46 views

How many confirmations do bitcoin escrow websites wait on average?

To me it seems very dangerous not to wait for 6 confirmations when running an escrow. The scenario I'm thinking of: a miner deposits a large sum of bitcoins the escrow waits for one or two ...
0
votes
0answers
29 views

Trezor Custom Mnemonic

How do I go about using words I pick in a trezor seed? I only want words that I select and in an order I select. I'm not worried about this being a less secure way to generate a seed. I will be doing ...
0
votes
1answer
71 views

Bitcoin adresses seem not to be collision resistant. Please tell me I am wrong [duplicate]

I am trying to understand Bitcoin addresses, but it does not seem to be easy at all. As far as I know, a Transaction uses one or more addresses as input and one or more addresses as output. Is this ...
1
vote
2answers
48 views

Bitcoin adress security questions

I am trying to understand Bitcoin addresses, but it does not seem to be easy at all. As far as I know, a transaction uses one or more addresses as input and one or more addresses as output. Is this ...
5
votes
2answers
82 views

Capturing IP address of transactions submitted to Bitcoin

Dan Kaminsky has pointed out that it would be possible to build a service that tries to infer the source IP address of each Bitcoin transaction. His idea, which he calls Blitcoin, works by ...
1
vote
1answer
40 views

Displaying the bitcoin wallet on the internet

I was wondering, is it a security risk if you display your bitcoin wallet on the internet? Let's say my bitcoin address is 123abc. This is linked to my wallet which stores several bitcoins. It is ...
3
votes
2answers
218 views

Can a clever hacker still steal everyone's money from the blockchain.info wallet?

Blockchain.info claims: We cannot (and don't want to): View your balance View your address book Make transactions on your behalf Confiscate your wallet Lock you into our service. ...
10
votes
2answers
1k views

Who mined the infamous block 364422?

Block 364422 contains a transaction that takes a long time to verify. This transaction design demonstrates a way a denial of service attack could be executed. This prompted Gavin Andresen to propose ...
4
votes
5answers
505 views

How one checks which customer made a payment

One question I'm not able to properly answer when asked is How exactly the blockchain can verify the identity of the user without a centralized trusted party such as VeriSign? I know this is ...
2
votes
2answers
40 views

Is there any wallet that allows safely storing private keys in an offline computer?

I have a computer that is 100% disconnected from the internet. I'd like to: Generate my own private keys by dice rolls; Import them on the offline computer wallet; Send coins to their addresses; ...
2
votes
2answers
65 views

Should you be able to insure Bitcoin the way banks insure bank accounts?

If insurance for Bitcoin were available for Bitcoin losses what kind of losses would the insurance cover?
1
vote
1answer
73 views

Can we make Sybil attacks virtually impossible?

I suspect that we CAN make them virtually impossible, but that we have not yet done so. We operate on the assumption that computing a private key from the public key is virtually impossible. We also ...
0
votes
0answers
64 views

Are blockchain reputation networks viable?

There has been much interest lately in how the blockchain could be used as the underpinnings of reputation network. For example, ...
1
vote
1answer
415 views

Is it safe to authorize Coinbase to withdraw cash directly from my bank account? [closed]

I wanted to buy Bitcoin in order to give some people tips on Zapchain. Zapchain has an arrangement with with Coinbase. If you buy at least $100 worth of Bitcoin, from the link via Zapchain, then ...
3
votes
2answers
63 views

Is it computationally feasible to find two transaction IDs with the same first 20 bytes?

Transaction hashes uses sha256, so they are 32 bytes long. If I have to store a very large database of transaction hashes, only for the purpose of checking existence later on, is it really necessary ...
2
votes
2answers
91 views

Can google steal my Bitcoins if I store the private key in Google Keep note

A while ago I put all my addresses with private keys (although they did not have that much money in them) onto a google keep note. I put it on a password protected notepad on my phone now, but could ...
2
votes
4answers
189 views

Why are brain wallets not secure? People keep saying it, but explain to me why?

Everyone keeps saying brain wallets are insecure. Can someone explain to me WHY? What if I had a brain wallet that is 200 characters long which is the concatenation of all of my family members names ...
3
votes
1answer
42 views

Why is a chain code needed for entropy in HD wallets?

In the documents and articles I have read, it is stated that the "chain code" in HD wallets exists to provide entropy to the derivation of child public/private keys. If I understand the process ...
2
votes
3answers
153 views

Could someone solve for your private keys by sending many transactions to the same address?

I've read that it's never safe to use the same bitcoin address more than once because there is a small chance that someone could solve for your private keys (though I don't have a solid-enough ...
0
votes
0answers
11 views

I have FTP and console access, can I start mining? [duplicate]

Greetings and thank you for this I_love_satori_ forum. I have full access to 3 websites (FTP and console). I love BTC. I want to earn BTC. I know how to spend BTC; a pizza purchased with BTC taste ...
5
votes
1answer
361 views

Why can't bitcoin miners modify transaction outputs?

I am learning the Bitcoin protocol by reading the bitcoin developer reference documentation. As far as I know, a raw transaction consists of: Version (which is always 1) Inputs. Each input ...
3
votes
1answer
59 views

What's the maximum possible utxo growth rate now? Can that be turned into an attack?

Now bitcoin unspent transaction output growth rate (not total size) can be, 260k utxo/day (3×60×60×24). With 8MB blocks, that's 2.8 million. Single 1 bitcoin output can be split into 1000 x 1 mBTC ...
3
votes
2answers
62 views

Can contracts programmed in bitcoins be used to scam merchants?

I've been learning a lot about bitcoin over the past couple of weeks because I have some interesting ideas for websites and I would like to accept bitcoin as payment. One of my concerns centers ...
3
votes
1answer
175 views

How to secure my Electrum wallet?

What I did is put a password on word document and put the seed words in there and then put the file in google drive. I can't think of any way I can lose it. I can't think of anyone stealing the money ...
4
votes
1answer
67 views

Would it be wise and extra secure to use non-ascii characters in a brain wallet?

What are some pitfalls if you use non-standard ascii characters in your brainwallet? Say if you were to use asian language characters? Or even extended ascii characters ...
2
votes
1answer
70 views

getnewaddress (RPC) on encrypted bitcoin wallet without wallet password?

Say for example an encrypted wallet has 5000 addresses already pre-generated in the keypool. Can getnewaddress be called via RPC command without knowing the actual wallet password? I envisage a ...
1
vote
1answer
63 views

BIP 38 Implementions for Altcoins?

Trying to identify implementations for creating BIP 38 encrypted private keys for alternative coins to spark collaborative open source discussions to standardize BIP 38 to support altcoins. Please ...
2
votes
2answers
131 views

How do on-line wallet or bitcoin exchanges usually secure their private keys?

I suppose they're kept encrypted as not to do so would be the equivalent as saving plaintext passwords. I heard most of them keep a percentage of the funds in cold storage, but then isn't it ...
7
votes
2answers
117 views

How can importprivkey compromise wallet security when importing a publicly known private key?

A question was asked on reddit over here which I gave a reply: https://www.reddit.com/r/Bitcoin/comments/3khrvm/how_do_i_use_private_keys_to_receive_bitcoin/ However, luke-jr replies with: Don't ...
4
votes
3answers
333 views

I just lost 1.36275883 ($313), and I don't know how it happened or how to prevent it again

I just opened my multi bit wallet, and the 1.36275883 that was in there is now gone. It loaded a brand new wallet, so I don't even have my old wallet with the old transactions or password. I know ...
1
vote
1answer
175 views

Creating a Bitcoin online wallet service

My question is this: Lets say I wanted to create a bitcoin site, where users register and can deposit bitcoins into their account. should i use my MPK to generate infinite addresses, so after a user ...
7
votes
1answer
384 views

Why is JSON-RPC over SSL “strongly discouraged”?

The Wiki contains a page that simply states: JSON-RPC over SSL is strongly discouraged Why? I found a method for enabling JSON_RPC over SSL here. The post mentions nothing about JSON-RPC over ...
0
votes
1answer
186 views

What happens to Bitcoin wallet / Bitcoins if PC is stolen

I am a beginner and just starting to explore the possibilities of Bitcoins. So I would be very grateful if somebody could help me with this question. Is there a risk that my Bitcoins are lost if the ...
1
vote
0answers
9 views

Mining incentive and bitcoin limit [duplicate]

As I understand it mining provides the security for the blockchain in that it makes it hard to forge a transaction. The incentive for finding eligible hashes is a reward in the form of Bitcoin. As ...
1
vote
0answers
24 views

Is Bitcoin vulnerable to a Birthday Attack against Private Keys? [duplicate]

This is a definition of the Birthday Attack. Someone claims Bitcoin is vulnerable to such an attack in the bitcoin IRC chat. Are they correct?
0
votes
1answer
55 views

Faking transaction? [duplicate]

I have a question here. Lets says we have Nick, who has maybe 1 BTC on his account and Bob who has 0 BTC on his account. Can Nick transfer 10 BTC to Bob's account? I assume no. But what if he creates ...
2
votes
1answer
167 views

The shortest ECDSA signature

I want to create ECDSA signature {r,s} where r is very low (for example 1) and can be encoded in DER-format in one byte. How to calculate k value? Seems to me that it does not depend of anything. ...
2
votes
1answer
67 views

Duplicate r value for an address: only an issue for a multi-input Tx?

I've modified the r-scan Python code to look beyond the 50 Txs the Blockchain.info API usually returns. My modifications take all the r values for my address and look for duplicates, but a commented ...
5
votes
1answer
106 views

What is the “1 RETURN” bug?

From Nathaniel Popper's “Digital Gold : Bitcoin and the Inside Story of the Misfits and Millionaires Trying to Reinvent Money", this heavily edited (by me, for clarity) excerpt: “In late July ...
2
votes
1answer
90 views

What is the waste ratio of the overall network?

The answer to the question "Why do I have to wait 10 minutes before I can spend money I received?" in the FAQ of Bitcoin contains the sentence "For example, if it takes miners 1 minute on ...
2
votes
2answers
531 views

What security threats does blockchain technology solve or present?

I am interested in security, identity and authenticity in electronic networks. What sort of security concerns could blockchain technology help with and what sort does it pose? Are there entry and ...
-3
votes
1answer
66 views

In India how does one accept or give Bitcoin? Do we also get a physical coin for a Bitcoin? [closed]

I heard about Bitcoin and its endless possibilities to use Bitcoin irrespective of a particular geographic location. But my doubt is How does one accept and give a Bitcoin, Does it have its own market ...
1
vote
1answer
60 views

Reuse of addresses by a service (“get new address” returning *funded* addresses)

Recently, a marketplace was said to have been reusing deposit addresses, such that clicking the "get new address" button would immediately give the user a different address, however, the "new address" ...
1
vote
1answer
46 views

Do any router custom firmwares enable Bitcoin for anonymous usage?

I want to find Wifi firmware where I can sell my internet service with anyone who needs to use it... ideally paying in an Altcoin or Bitcoin. Are there any router modifications that support a wallet ...
4
votes
2answers
208 views

How can services that use the bitcoin blockchain help secure it?

There are many projects being worked on that involve using the bitcoin blockchain for its public verifiability and immutability. A few examples would be Counterparty, Medici, Factom, etc. But each use ...
0
votes
2answers
75 views

Is an unencrypted wallet secure if bitcoind is not accepting RPC calls?

I'm interested in setting up a P2Pool node (which requires running bitcoind) to run a little mining pool for myself. Before you ask, nope I'm not even trying to break even, I know I'll lose money on ...