Blockchain.info and other products make you read dire (but vague) warnings that "you must be an expert" before you can import private keys. What's that all about?
-
To venture a guess: To prevent complaints from unhappy users after realizing that handling cryptographic secrets has its pitfalls? Bitcoin private keys have the additional complication that there are at least two formats (the mini key option). I guess it might be a support nightmare to advertise this functionality---after all, doesn't the site seem the first suspect when you cannot redeem your incomplete, compromised, or fake private key?– user6049Dec 12, 2013 at 19:18
Add a comment
|
2 Answers
Importing a private key can lead to non-intuitive behaviour, and that can be exploited by an attacker.
Imagine I'm evil. I give you a paper wallet with 1 mBTC on it. You're happy and import it. I keep the private key and wait. Depending on the client/user, maybe someday you'll put some real money on there as change/received funds. Then I can swipe them right off from you. If you don't bother moving the original money off the key, I can also steal that back.
If not, then at the very least I can trick you next time into thinking you were paid by sending funds to that address. Then I can steal them right back.
Importing also tends to break backups, especially deterministic key schemes. Armory gives you one line of text for all your keys, and then 1 line per imported key. Every time you import, you'll need to redo all your backups.
Because most users don't understand these implications, wallets tend to discourage importing, and instead offer sweeping (moving the funds to an address that was generated by the wallet itself). Supports 90% of the use cases with none of the issues.
-
3In other words, you should only import private keys that are only known to yourself.– uminatsuMar 12, 2014 at 21:38
-
6If that's the reason for the warning, the warnings should be re-written to specifically say that any coins in the wallet are still accessible to anyone who has the private key. It's confusing that many sources say "users should never import private keys", but then don't say why and leave users wondering how they're correctly supposed to spend coins from their own private paper wallets.– orrdJun 25, 2017 at 4:14
because exposing your private keys on your computer will expose them to all the viruses and keyloggers on your computer that non-experts tend to have.
thats one reason
