0

I am a newbie in the crypto markets, but as a software engineer, it seems to me that a huge security vulnerability could be choosing a wrong wallet.

If you are using a hot wallet, and can't see the app code, doesn't that mean it is theoretically possible for the devs to steal your crypto, even if you can see your private key?

Shouldn't everyone be using exclusively open-sourced wallets for this reason?

3

Can you really trust a non-open-source desktop wallet?

No

Shouldn't everyone be using exclusively open-sourced wallets for this reason?

Yes, everyone should use open source wallets. And still use small amounts in hot wallets or wallets that are relatively new and experimenting with new features.

More details: What stops a wallet from stealing bitcoins?

2
  • Thank you for the response. Now, since Electrum is bitcoin-only, are there any good open-sourced wallets that can hold multiple currencies? – NobodySomewhere Dec 23 '20 at 22:50
  • 3
    Sorry not the best person to answer this question. Also it is offtopic here. For bitcoin wallets refer to bitcoinwallet.guide – Prayank Dec 23 '20 at 23:14
1

Can you really trust a non-open-source desktop wallet?

Yes! Iff they hired top security experts and regularly undergo audits.

The only reason some people don't is the existence security-by-obscurity : Certain services only rely on the fact that the source code is not published for security. For as long as this is not the only protector, there is no reason not to trust! Using non-deterministically compiled binaries of open-source software is unsafe anyway.

For me, well-reviewed code is more important than open-source-ness. Not everyone, not even most of somethings' users, audit the source code! Open-source does not protect programmers from ignorance and making silly security mistakes.

So personally, open-sourceness only depends on their business model, which is not linked to their security guarantees anyway!

If you are using a hot wallet, and can't see the app code, doesn't that mean it is theoretically possible for the devs to steal your crypto, even if you can see your private key?

It is possible for devs to steal your money even if they use open-source! See event-stream

The problem is not being unable to see the code, it's about VERIFYING ALL of the code. If paid audits are taking place, I would trust them more than as if I saw their code!

Shouldn't everyone be using exclusively open-sourced wallets for this reason?

No. It's generally better to use stuff whose code you can see ... so if you're the developer of a closed source software, I don't see a reason not to ... given that the most recent audit was actually recent.


The reason open-source is considered superior is because being able to access the code makes people feel safer, even if they never will.

6
  • Based on what you said, it would seem as it is more a matter of opinion than of a real security difference? Wouldn't you say that any application that is not open source has more chance of being intentionally malicious? – NobodySomewhere Dec 24 '20 at 18:34
  • @NobodySomewhere It's easier to be malicious if your software is closed-source, but it's equally possible to be malicious in open source and closed source. Open-source tend to be safer in practice since it allows 3rd party audits and it's a signal that the developers pay attention to being transparent. I'm just saying that closed-source software, especially if it's well-funded and has trustworthy developers, is not inferior in terms of security. – MCCCS Dec 24 '20 at 18:49
  • Sorry I think you are plain wrong, it's not equally possible to be malicious in open source as it is in closed source, it is much more easy to be malicious in closed source software. Also, by saying open-source is safer in practice, you are contradicting yourself. I'm a software engineer so I know what I'm talking about. My question is more about how easy is it for developers to run away with someone else's crypto if they wanted to; are there any safety mechanisms engineered to blockchain that can protect the user in such cases? – NobodySomewhere Dec 24 '20 at 20:24
  • 1
    Unfortunately anything in the computer memory can be read. So there is no way we can guarantee security. The closest I can think of is nLockTime which prevents coins from being moved until a certain time, but after that time, they can still be stolen. – MCCCS Dec 24 '20 at 20:36
  • 1
    Hardware wallets also exist and they might be safer than computers. Computers are unsafe environments. A compromised desktop software can't harm a hardware wallet if the user cautiously reads the hardware wallet's screen. – MCCCS Dec 24 '20 at 20:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.