What are the risks of using Strongcoin.com as an online wallet?

Question

Strongcoin claims it is "The Safest way to store your Bitcoins. The only Bitcoin e-wallet service that's not vulnerable to security breaches. Your Bitcoin keys are encrypted in the browser."

As I understand it, with their system your private keys are essentially encrypted by your browser before they are sent to the website. They also appear to have a method of creating an encrypted paper copy of your wallet so you can restore your wallet if the website disappears.

Even so, it seems you're still potentially vulnerable if you access your wallet from an infected computer (i.e. through keystroke loggers and more advanced logging techniques).

What other risks are there in using such a service?

Note: I have not used Strongcoin, and have no affiliation with them in any way.

Answer 1

I am the operator of My Wallet which is a similar javascript based wallet service. I will try and keep this answer as impartial as possible.

The Website Owner is Malicious

The website operator is free to change the javascript code at any time so if they are so inclined can change the code to uploaded your unencrypted keys or intercept your password. If you do not trust the site owner it is therefore not recommended you use such a service.

The website database is leaked

Assuming the site has been programmed correctly in the event of a database leak only your encrypted keys will be leaked. The attacker maybe able to brute force your password if it is not secure enough, but as long as users are made aware of the leak they will have enough time to move their coins to new addresses.

The website server is compromised

In the event of a full server breach the attacker may be able to alter the javascript code or website code to send him an unencrypted copy of the keys next time you login. This type of attack is generally less common than database leaks and to have any significant effect would need to go unnoticed by the site operator.

You forget your password

As your password is never sent to the server the site owner cannot offer a password recovery procedure. In the event of a lost password your key(s) will be unusable. Paper wallet backups can help with this.

Key logger or virus

If you have a key logger or virus on your computer it is possible to that it could intercept your password which the attacker can then use to login to your wallet and spend your coins. Traditional desktop wallets are also vulnerable to this. My Wallet is less vulnerable to this as the site supports yubikey two factor authentication.

One final note: Using My Wallet you can add your Bitcoin address only without the associated private key. If you then keep a paper wallet backup of your private key even in the event your account is compromised there is nothing to steal.

Answer 2

I'm the owner of StrongCoin.

Ben has detailed just about every possible risk with StrongCoin. You can read about how we handle server security in our FAQ.

It's not in my interests to defraud my customers, I'm pretty easy to trace and I don't fancy having angry users knocking on my door

So with Bitcoin like cash there are risks with storage, I lost a wallet.dat which spurred me to build StrongCoin.

StrongCoin is a convenient way to store and spend Bitcoins. I recommend you hold your spending Bitcoins in StrongCoin and use an offline mechanism for your savings or high value holdings.

Answer 3

I agree with the answers of both Ian and Ben. Let me point out that I like the StrongCoin service. As former CEO of Hushmail, I would like to add some relevant information because Hushmail is like an encrypted wallet for email and we faced a similar set of issues.

The other risks that need to be addressed with services such as StrongCoin are:

1. Spoofed applet - The browser-based java applet that is served to you should be published as source code so that users may compile it themselves and/or seek review from cryptography peer-review groups, as Hushmail did. You should also have the ability to store locally a version of the trusted applet for your own use. This is important if you still want to use the service after StrongCoin receives a court order to serve compromised applets to certain persons suspected of 'something'.

2. Weak password - Since the private keys are stored on StrongCoin servers encrypted and protected with a passphrase, you would be subject to brute force attacks from anyone that gained access to the server data so a strong password is essential.

3. Keyboard sniffers and cameras - You are only as secure as your physical surroundings so be aware of keyboard loggers (hardware and software) and cameras that may have been inconspicuously placed above your computer work station to capture your passphrase.

4. Legal and physical jurisdiction - The StrongCoin servers are subject to court orders of the jurisdiction in which they they are located. If StrongCoin is legally domiciled in a different jurisdiction than the physical servers, then that country's courts could also have jurisdiction. Both jurisdictions should be examined for their privacy and data protection statutes.

Also see:

(a) http://www.hushmail.com/about/technology/security/

(b) http://www.schneier.com/essay-191.html

Answer 4

In addition to the points made in the other answers on this page, the key derivation function used by StrongCoin to derive an AES encryption key from the user's password (which is then used to encrypt the user's private wallet key) is very weak.

This page on StrongCoin's blog explains how users' private wallet keys, which are encrypted by StrongCoin's client-side javascript, can be decrypted using openssl, by way of the following command:

openssl enc -d -aes-256-cbc -in key.txt -a -k password

This openssl command is notorious for using a very weak key derivation function - i.e. just one round of MD5 hashing, as explained in this post on security.stackexchange.com in 2013. To quote from the accepted answer:

This is quite weak! Anybody who knows how to write code on a PC can try to crack such a scheme and will be able to "try" several dozens of millions of potential passwords per second (hundreds of millions will be achievable with a GPU). If you use openssl enc, make sure your password has very high entropy! (i.e. higher than usually recommended; aim for 80 bits, at least). Or, preferably, don't use it at all; instead, go for something more robust (GnuPG, when doing symmetric encryption for a password, uses a stronger KDF with many iterations of the underlying hash function).