4

Rather than having a single, fixed address, I want to generate a new address on my website every time a user request comes in.

I'm concerned about google or another web crawler indexing my website and tying my Bitcoin address to my website address.

I've thought about pregenerating the addresses, storing them in a database, and only showing one to each user. I think there's probably a better way.

I use node.js, so a solution using bitcoinjs or another node.js package would be preferable.

I would prefer to use multisignature addresses.

I would rather not depend on blockchain.info or an exchange - it introduces a single point of failure.

Improve this question
2
  • PS: Are you OK with having the private keys to the addresses stored on your website?
    – Nick ODell
    Oct 23, 2014 at 15:00
  • no. private keys bitaddress/bulkwallet) must be stored locally, the public addresses can be stored in mongodb on the server, hidden from google etc. we built a website for an old man that runs a novelty shop, he doesn't know doodly about tech so this has got to be dumbed down automated for him, yet as anon as possible.
    – ken Code
    Oct 23, 2014 at 15:13

4 Answers 4

Reset to default
1

You should try using BIP32 to generate addresses.

There's a node.js implementation here: http://cryptocoinjs.com/modules/currency/hdkey/

Improve this answer
0

One time keys are standard practice on some exchanges. E.g. when you top up the exchange wallet the receiving address is recycled after it receives one transaction. You can generate receiving addresses on the fly, there is no need to pre-generate them.

You need to put receiving addresses behind something which stops the crawler. If you only target web crawlers, putting the payment page behind HTTP POST form is enough. If you want to stop malicious visitors you need to have CAPTCHA before the visitor can get the payment address.

Also you might want to make sure that there are no log entries of QR codes and such. This is best accomplished by generating the QR code image on the client side using JavaScript. Here is an example library for it. Some popular solutions, like Google's QR code generator, have QR code content in URL, thus leaving log entries containing the address.

Improve this answer
8
  • I hate captcha's, so does everyone else, so that's out. Using an Exchange is also no longer an option. Form method=post sounds like the only option then for hiding the key? So, what library do we use then for what I am trying to accomplish..
    – ken Code
    Oct 23, 2014 at 11:50
  • bitcoinaddress.js also displays everything on the page in plain text, not good. see my question above for why etc thanx :)
    – ken Code
    Oct 23, 2014 at 12:02
  • There is no difference if you display it as plain text, QR image or voice clip with some lady reading every character. You need to give the public address out if you want to receive anything to it and thus, it really doesn't matter which method you use as all of them are equally secure.
    – Mikko Ohtamaa
    Oct 23, 2014 at 12:30
  • Here is one JavaScript based multisig wallet as open source github.com/bitpay/copay
    – Mikko Ohtamaa
    Oct 23, 2014 at 12:33
  • 2
    @kenCode: Unfortunately that is not true. Both are copyable with a simple right mouse click. Emphasizing the fact that the image is safer would be building your security on wrong principles and undermine your promise of secure service.
    – Mikko Ohtamaa
    Oct 23, 2014 at 12:41
0

Output the address with Javascript, crawlers cannot see that. e.g. document.WriteLn(addressHere); Hiding the page behind a POST will stop most crawlers but not all.

Alternatively you could do some simple obfuscation, e.g. split the address in two and ask the user to combine it, or leave off the '1'/'3' prefix and ask users to add that manually. Kinda like when people list their email address as userATdomainDOTcom.

Alternatively, you could use a payment processor that pays out in bitcoin e.g. snapcard.io

Improve this answer
0

I ended up on this page because I was looking for a solution so that my public bitcoin address would not be indexed by search engine bots.

I have found a solution to that.

The idea is to serve the bitcoin addresses via js or ajax, and disallow the access to the file to the bots by using a robots.txt rule.

You write your html (template) with placeholders for the bitcoin adress(es). And either use a plain js file holding adresses in variables or make an ajax call to get addresses (generated on the fly may be) via json, and display (via js) the adresses on the page in the browser.

But you add a Disallow rule to your robots.txt to forbid the bots to download either the js or the ajax url.

This has been tested with GoogleBot and works fine. (explicitly tested in Search Console with "Explore like Google" feature). All well-behaved bots that follow robots.txt should not be able to see the addresses and could not render the page properly.

This doesn't work for bots that don't care about robots.txt or ignore it to render the page.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.