0

Hacking Question: First of all i am totally noob. I dont know much about bitcoins. I have an ecommerce website. I want to accept bitcoin payments for my products. I dont want to use 3rd party api's. I am hiring a developer to run bitcoin core on my server for my website to accept and process bitcoin payments.

  • Is it safe to use a freelance developer?

  • He'll have access to private keys?

  • Will he be able to hack it?

  • Is there a way to make my bitcoins safe from hacking in which insider job is involved?

Please kindly give me a serious, detailed and non technical answer

Improve this question
5
  • 1
    There are ways around it, but in general, yes he will have access to your private keys. You probably want to generate an HD wallet yourself and only give the XPUB key to the freelance developer. That way you keep control over the private keys. He should be able to help you set that up.
    – Jannes
    Mar 9, 2016 at 13:55
  • Please don't use words such as "Important" in the title. Everybody thinks their own questions are important, and it just takes up space.
    – Nate Eldredge
    Mar 9, 2016 at 15:00
  • 1
    @Jannes Not if he uses private key sharing and shares part of the key with you (cf. multisig).
    – Geremia
    Jun 9, 2016 at 23:08
  • @Geremia that doesn't make sense, the freelancer can't do anything with part of the private key, so might as well give him nothing at all then. Re-reading this question now, I think watch-only addresses should do the job, but to avoid address-reuse he would have to generate a lot of them in advance. Therefore the HD XPUB key might be better.
    – Jannes
    Jun 10, 2016 at 10:10
  • Read this before you proceed any further: Running A Full Node bitcoin.org/en/full-node#what-is-a-full-node
    – Aurigae
    Jul 9, 2016 at 20:36

1 Answer 1

Reset to default
1

If you want to accept and hold bitcoins it is trivial to generate a large number of addresses offline and feed the public addresses (not the private keys) to the web developer. He would not have any access to the funds. Also as suggested in the comments you could use an HD wallet and provide the XPUB key to the developer. This would allow him to generate only the addresses that you have private keys for.

For example the electrum wallet is an HD wallet that would provide the required capabilities.

Improve this answer