7

I am running a blog and would like to receive donations from my followers. So I thought to add a bitcoin address on my "Support me"-page!

But on bitcoin.it, it is recommended to never reuse addresses, which is supported by citing not only Privacy concerns (not my concern here) but especially for security reasons.

So:

  1. Is it safe to use (and thus reuse) the same address for all my donations?
  2. If not, what are the best practices?

3 Answers 3

4

For a blog that only receives occasional small amounts you probably shouldn't worry too much about it. However, if you plan to scale up, here are some things to consider:

One issue with using the same address for all transactions is that people can see the total amount received by that address and know how many bitcoins you have. If the total is large enough, this might make you a target for attack, especially if you publish personal information along with the bitcoin address.

Another potential issue is that people can see who else is donating to you. They only see the bitcoin addresses used, but this might be enough to draw some conclusions about who they are.

Best practice is to use new addresses for each donation. This way there is no link among the transactions except in your wallet, which is only accessible by you.

If you plan to keep bitcoins (instead of just receiving them and cashing them in), you should look into creating an offline wallet. You could generate a new address for each web page view, and then transfer funds from each of the addresses that received a donation to a different pre-computed offline wallet address.

2

But on bitcoin.it, it is recommended to never reuse addresses (not only for Privacy (not my concern here) but especially for security purposes).

It doesn't make a security difference. The two attacks mentioned (deriving k through a timing attack, and reusing k for two transactions) have very little to do with address reuse.

If you don't care that someone can link your transactions together, listing a constant donation address is fine.

-2

The main security risk is that the elliptical curve might get broken in which case reusing addresses will become unsafe. You can use armory to make new addresses every time if this is a big concern.

3
  • Does somebody know why this is downvoted? Is this accurate?
    – Murch
    Jan 15, 2016 at 15:14
  • I would love to know myself =)
    – Jimmy Song
    Jan 19, 2016 at 1:06
  • 1
    @Murch Probably because he is wrong. You can receive an infinite amount of donations to the same address and as long as you have never SPENT anything from it, you public elliptic curve key is not known to anyone but yourself, only the hash of it. A quantum computer could reverse a public key, but to our knowledge it cannot reverse a hash of one.
    – Chris_F
    Mar 12, 2021 at 7:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.