15

How do Electrum and Multibit compare for being safe and secure. Both are open source. Are there any advantages, security wise, to use one or the other?

I'm new to bitcoin and the only reason for considering these thin clients is to not having to maintain a 5gb database file.

Improve this question
1
  • You can use Electrum Personal Server to have better security.
    – Janus Troelsen
    Oct 23, 2018 at 9:40

2 Answers 2

Reset to default
11

Currently, Electrum is more secure than MultiBit as the MultiBit wallets are not encrypted. The next version of MultiBit, version 0.5.9, supports encrypted wallets. (Disclaimer: I am the lead MultiBit dev)

Security in Bitcoin is related to many things. Here are some of them:

1) Is the code open source and do the developers have a track record ? Both Electrum and MultiBit are open source so you can inspect the code. They have both been developed by pretty much the same people for over a year now.

2) Can you verify that the download you get is the correct one ? The attack vector here is that an attacker substitutes a trojan instead of the real installer. The MultiBit installers are all downloaded from a dedicated server via HTTPS and are signed with my PGP key. You can verify this after you download the installer (but before you run it). As long as my private key is not compromised this means only I could have signed it.

I am not exactly sure what Electrum does about signing its builds but I know Thomas (the lead Electrum dev) is very conscious of this area/ attack vector.

3) Are there any servers that can steal your bitcoin ? MultiBit uses the regular Bitcoin network and they don't have your private keys. Electrum uses (many) of its own custom servers but again these do not have access to your private keys.

4) Both clients are theorectically open to an attack if their network connection is owned and the attacker can feed them completely false information.

5) Both clients (well every client in fact) would be vulnerable to keyloggers capturing passwords which (in combination with the encrypted wallet in MultiBit's case) would give an attacker access to your private keys.

tl;dr At the moment Electrum is more secure. When MultiBit supports encrypted wallets they will be comparable. Good security practices on your machine are also important to keep your bitcoin safe.

Improve this answer
4
  • Thank you for the info. As for the database part, is there any disadvantage to running one of these thin clients, security or otherwise?
    – cookyjar
    Apr 13, 2013 at 7:20
  • Because you don't have the complete blockchain you cannot check the transactions so thoroughly. For instance in MultiBit you typically have 4 bitcoind connections and can check that the same transaction has been sent to you by all four. The blocks you can check various things but you are trusting the bitcoind that sent it to you to a certain extent.
    – jim618
    Apr 13, 2013 at 10:35
  • Some tasks are more difficult (in MultiBit) because you don't have the blockchain - for instance importing an arbitrary private key. It is better now with bloom filters speeding things up. Electrum's servers have the whole blockchain so can serve you this data directly.
    – jim618
    Apr 13, 2013 at 10:37
  • How's the comparison in 2014. Care to update? Thx!
    – Gaia
    Mar 13, 2014 at 20:45
1

The only extra danger from using such a client is that by asking the same server about the state of a list of addresses the server can tell that they all belong to the same person.

In that way in reduced privacy to some degree.

Improve this answer
1
  • 2
    Not strictly true, a thin client may be tricked into accepting an old state of the ledger as the current state.
    – cdecker
    May 29, 2013 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.