0

Is there any validation service that tests/validates/vets wallet implementations?

I use bitcoin-qt on the desktop and I'm not worried about that wallet, I assume it's been well vetted, but if I were to get a wallet for my (Android) phone, is there a way I can be assured the implementation is correct, secure, and not malevolent?

Added elaboration: It seems feasible for a trusted 3rd party to be in the business of validating wallet implementations. Wallet implementers would submit their implementation to the service, the service would run the wallet through a test suite, examine the code, etc. and if the implementation passed the service would publish a hash of the wallet. When you get a copy of the wallet implementation you could check its hash and against the published hash so you'd know it hasn't been tampered with.

Likewise an online wallet service (Mt. Gox) could submit its implementation for 3rd party validation to increase its trust factor.

| improve this question | |
1

It is pretty much impossible to verify 100% if an implementation is correct.

See for example https://backdoorhiding.appspot.com/ or "The Underhanded C Contest" at http://underhanded.xcott.com/ - in both of these, people compete to write code that looks secure, but isn't.

Similarly, there are theories that the NSA has put back doors in various random number generators, even open-source ones. It is, however, very difficult to test this theory.

| improve this answer | |
  • Thanks. I understand the difficulty with 100% verification, but it seems an expert group's best effort at verification would be worth something. A combination of code (source code, byte code, and/or machine code) analysis, plus an execution test suite, would go a long way towards fighting mischief. – obelia Feb 18 '14 at 20:59
  • Third party audits cost a lot of money, especially if done right. I am sure that, if you wanted to pay, bitcoind would LOVE an audit. – AMADANON Inc. Feb 18 '14 at 21:43
1

Short answer: no. Imagine this scenario: a developer writes a closed-source Android wallet that becomes extremely popular. At some point the combined worth of the user wallets is $100M. The developer could have purposely left an open vulnerability, and claimed that a hacker exploited it. There would be no way to know if he was telling the truth.

Rule of thumb: keep the bulk of your BTC in cold storage. Online wallets should be treated like the wallet in your pocket. How much cash are you comfortable carrying around, knowing that you could lose your wallet and it's gone? That's how much you should have in an online wallet.

| improve this answer | |
  • Thanks. I don't use online wallets, like to keep things local. I elaborated on my original question. – obelia Feb 18 '14 at 18:41
  • I think, in this case, "online" means "on a computer with an internet connection", not "a website". – AMADANON Inc. Feb 18 '14 at 20:21
  • Yes, that's what I meant by online. Presumably your phone is online most of the time, and as such it's vulnerable to a wide array of exploits. – Diego Basch Feb 18 '14 at 21:15
  • obelia: google "air gap" for a great way to keep your bitcoin safer. It is a hassle though. – AMADANON Inc. Feb 18 '14 at 21:41
  • @AMADANONInc. re: air gap - I wonder if there's an easy to do that, like keep wallet.dat on a flash drive and only plug it in to transact. – obelia Feb 18 '14 at 21:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.