How can users have confidence that there are no backdoors in paper wallet generators?

Question

I'm thinking of issues like the randomization not being truly random. I appreciate that some users could examine the code themselves, but what assurances do less technically skilled users have?

Answer 1

There's really no way for a nontechnical user to know. In fact, most technical users do not have the specific technical knowledge required to evaluate cryptographic code (including the random number generator). Therefore, it comes down to a matter of trust. If the user does not directly trust the software author, they may sufficiently trust somebody else who has evaluated the technical aspects of the software.

Answer 2

This is a time when very rapidly, people like you and me (Luddites in a highly Technical, complex virtual environment) are either going to swim or ... do something else less uplifting...

Having played 3+million hands of internet poker in my career, I do however know 1 or 0 things about RNG's; trust spread over a large, human net, cast upon the backdrop of the Internet - - - Trust no one, trust nothing, kill first and kill last. It is just that kind of world in the real, it's only natural these aggressive attempts to deceive and defraud other humans pervades the virtual realm as well.

Yes, there is a well-known repository of Peer Reviewed code. It can be found at www.github.org. It's free, it's open, and it's everyone's for the pilfering, plagiarizing, pluralizing and profiteering. It's also just vastly interesting, even more incomprehensible.

The cut dry answer to your question is: One should NOT trust Paper Wallet Generator services because services like this are centralized, often closed systems that commonly operate contingent upon a for-profit business model. You have immediately given incentive to the bad actors that would hack your Bitcoin Protocol, realized in it's truest form - A Trust-less Digital Currency, store of value, and pioneer of transparency in a proprietary world.

Bitcoin's most essential virtue is precisely this notion of requiring, unlike all previous systems introduced to the human race, a purely open-source technology. Meaning even an idiot like I could tinker with the deepest layers of coding in the protocol, if I so desired, if I so deemed it pertinent to my wallets security, or to satisfy my curiosity. It is, in it's highest form, a purely P2P, distributed network of individuals, self-governing their every transaction. It is very unfortunate indeed that we continue to see the growing trend where would be cryptographers counterfeit the gift of Satoshi by relinquishing trust to centralized, closed third parties that have every mal/ability to coffer their coin.

You have no assurance other than your best knowledge. To the best of your knowledge, you would never willingly hand your money, your trust, over to a faceless, inhuman, fallible Paper Wallet Generator Service - one that is susceptible to various forms of attack from within, and without. You would much rather understand your world, your finances and your future, and place all of your trust in yourself. THAT is what bitcoin is all about.

It's a sad reality but it's an exquisite solution, so I recommend you rethink who and why you entrust your wallets security. The pinnacle of cryptography, of bitcoin, is a system that requires you to know your code. I mean honor, I mean integrity, not necessarily that of the intractable, deep math encoding the client, either. Especially prescient is that knowledge that, if you don't trust yourself with your own paper wallets randomization, you can only trust that given sufficient time, every hack will be realized. Without hands on security measures put in place by the capable individual, infinite time*computer integrity = 100% failure.