13

AFAIK, the generation of the address pairs occurs on your computer but the concept still makes me nervous as it's occurring in the browser and I have to trust the owner of the site, I think.

9

You don't entirely have to trust the owner of the site. The site is client side Javascript based, which means you can probably save a copy of the code, then review it, and run it offline.

If you continue to use the website though, you're trusting the owner of the site to:

  1. Not change the code in any way that compromises the security of the private key
  2. Maintain adequate security so that no hacker can change the code in any way that compromises the security of the private key
  • most of us, incl me, don't code so we depend on others. as a matter of policy i don't trust the site owner. – user1719 Aug 13 '12 at 3:35
  • 2
    I agree that asking people to review the code is about as useful as asking people to read all the T&C's on the websites they sign up to, and the EULA's on their software. If you can't read code though you're going to have to trust someone somewhere, such as the coders of the Bitcoin client. – Highly Irregular Aug 13 '12 at 3:40
  • 3
    (I read something recently that estimated we'd spend 32 days per year reading T&C's/EULA's if we read them all) – Highly Irregular Aug 13 '12 at 3:41
  • 4
    The html is also checked into Github. github.com/pointbiz/bitaddress.org – Stephen Gornick Aug 13 '12 at 7:20
  • unfortunately, the essence of Bitcoin is that you shouldn't have to trust the site owner. it seems pretty legit since no one has ever reported a theft from one his addresses. but b/c it's done in the browser, can a third party get a hold of the private key you generate? – user1719 Aug 14 '12 at 2:18
0

Unless you read and verify all the site's code (big task and impossible to verify for certain anyway, may be errors in your verification) OR provide your own private keys, there's no way to know the site isn't simply providing private keys from a pool (or mathematical subset) known to the site owner (or whoever may have hacked the site's code). THAT is the major risk. Client-side/server-side makes little difference. I'd even go so far as to say that whole concept (client-side) is false reassurance. The question still comes down to, do you trust the code you are running to provide genuinely random private keys. There's the whole rub.

-2

A site generating your PRIVATE key for you and matching bitcoin addresses? A disaster waiting to happen. There is almost no way to be sure the information is not stored and then, in a few years, used for withdrawal (theft).

Using the code offline is a better idea, but DO check the code first.

Just my 2 Satoshis...

  • 3
    There is a way to make sure the information isn't stored - which is to do all the processing client-side. The bitaddress generator does do the processing client side, but I'm not convinced 1) that there's enough entropy or 2) there's not a side-channel attack. – Nick ODell Mar 10 '13 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.