Questions tagged [security]

Security issues with the design or implementation of Bitcoin.

Filter by
Sorted by
Tagged with
0 votes
1 answer
28 views

Hardware wallet security

With a hardware wallet, when you enter your pin and seed onto the hardware wallet software, is that data stored on their servers, and potentially accessible to hackers? I know that the private key is ...
Eoin's user avatar
  • 325
0 votes
0 answers
16 views

Is there a way to block 100s of emails monthly asking $67-120. "Transfer" fee; & is it poss.. 2collect mining frm all apps/sites prior usd w/ my email [duplicate]

Question one; I get literally hundreds of emails about I need to pull my crypto in 24 hours then they take u to the same green dominated site with kaylee in comments stating new then add up a bunch ...
Justnik001's user avatar
0 votes
0 answers
78 views

Is it safe to share half of the private key in WIF format?

Assuming I would generate my keys on https://www.bitaddress.org. Is it safe to share the following four pieces of data? One half of the private key. The public key. An SHA512 hash of the private key. ...
Ohumeronen's user avatar
0 votes
0 answers
62 views

Is it recommended not to take hardware wallets through international airport security scanners?

I suspect this won't get an answer as it is highly speculative (on the scanning technology in airports) but does anyone have any information or informed views on whether you can take hardware wallets/...
Michael Folkson's user avatar
2 votes
0 answers
60 views

Headers-first sync and malicious peers [duplicate]

Since headers-first syncing specifies that the entire header chain is downloaded from a single peer, how does the downloading node know that it is not being served a manufactured out-of-consensus ...
Brutus's user avatar
  • 21
0 votes
2 answers
304 views

Security Of Public Bitcoin Nodes / Servers

I have been wondering about the security of using public bitcoin nodes with your wallet. E.g. sparrow wallet offers three connection options (public nodes, your own bitcoin core node or a private ...
Neo's user avatar
  • 33
2 votes
2 answers
93 views

Are SPV and fraud proofs a viable option for scaling Bitcoin?

I'm aware that this might be borderline taboo to discuss because of its potential implications (uncapped block size) but, in an attempt to put aside the ego stuff from the block size wars, I'd like to ...
Marco's user avatar
  • 395
1 vote
0 answers
22 views

Can Pending HTLC's drop my balance?

I just noticed that 2 million sat's disappeared from my balance in thunderhub. No payments or transactions have been made. Can pending HTLC's effect my balance? If Not what else could drop my balance ...
Ryan's user avatar
  • 11
3 votes
1 answer
187 views

Can punched-in seed phrase on steel plate be read by airport security x-ray?

If I put a steel plate with seed phrase in bag and it goes through TSA's x-ray machines at the airport, am I at risk of them being able to read the words?
Runeaway3's user avatar
  • 329
0 votes
1 answer
86 views

What's the point of Multi Signature Addresses?

When an attacker has access to the private key of the wallet, he can dump the private keys of every address used for the multisign address(es). So, what's the point of multi sign addresses when there'...
Otijun's user avatar
  • 3
5 votes
1 answer
216 views

Why does Miniscript add an extra size check for hash preimage comparisons?

When I input the following miniscript into https://bitcoin.sipa.be/miniscript/: and(pk(claimant_pk),sha256(H)) I get the following Script: <claimant_pk> OP_CHECKSIGVERIFY OP_SIZE <20> ...
Sachin Meier's user avatar
1 vote
0 answers
84 views

Is it safe to install Bitcoin Core using a package manager?

For example, on macOS: brew install --cask bitcoin-core Or on Ubuntu: snap install bitcoin-core Etc. In particular, what attack vectors might I be exposing myself to if I choose to install Bitcoin ...
Jonathan Wheeler's user avatar
1 vote
1 answer
247 views

Should different brands of hardware wallets be used in multisig setups?

Is there genuinely a compelling reason to use different brands of hardware wallets in multisig setups? I am contemplating using a series of Coldcard hardware wallets in a multisig setup but some ...
Guru Josh's user avatar
  • 171
5 votes
1 answer
253 views

What types of transaction malleability exist and which one of them does SegWit solve?

I am little confused about what types of transaction malleability exist in bitcoin and which one of them does SegWit solve. Here Antoine Poinsot talks about txid malleability and third-party ...
dassd's user avatar
  • 1,079
4 votes
1 answer
164 views

Why is concatenating scriptPubKeys and scriptSigs unsafe?

Around the 5:00 timestamp in this talk, John Newbery states that running the concatenation of scriptPubKey and scriptSig is unsafe, since it can result in someone using a carefully crafted scriptSig ...
Cosmik Debris's user avatar
-1 votes
1 answer
63 views

Is Bitcoin a network protocol or is it just a concept of an encrypted currency?

Today in technology groups they always say that bitcoin is just a currency, a concept of electronic money. But the problem with such a statement for other people is not considering that bitcoin is a ...
user avatar
2 votes
2 answers
247 views

Can the same set of private keys be used multiple times in a multisig wallet?

Is there any limitation to how many times the same set of private keys can exist within a multisig wallet? For example, could a 3 of 4 multisig wallet be created with two of the four keys being ...
Guru Josh's user avatar
  • 171
1 vote
1 answer
94 views

Taking the existing INPUT and changing the OUTPUT to steal bitcoins. Is this a possible bitcoin theft scenario and how to prevent it?

I'm relatively new to Bitcoin and I'm wondering how Bitcoin defends against the following scenario and if it's even possible. Before I start with the scenario, just two notes: 1. There is a lot of ...
dassd's user avatar
  • 1,079
4 votes
1 answer
956 views

What does it mean that the security of Bitcoin public keys and 256-bit ECDSA is 128 bits?

I am reading the Master Bitcoin book and came across the following: From a security perspective, the amount of entropy actually used for the production of HD wallets is roughly 128 bits, which equals ...
dassd's user avatar
  • 1,079
0 votes
1 answer
206 views

Address Reuse and ECDSA Concern

I have a question about address reuse. Admittedly, I'm a little confused on the matter, so please bear with me if the framing of my question doesn't make much sense. Recently I started using Sparrow ...
anonpleb's user avatar
2 votes
3 answers
2k views

Is 24 words seed safer than 12 words in terms of bruteforcing the private key

Is a 24 words seed more secure than 12 words in terms of brute forcing the private key? From the following answer I read that a private key is always "just" 128bit even when derived from 24 ...
drivenuts's user avatar
  • 123
1 vote
0 answers
318 views

Exporting Bitcoin settings to bitcoin.conf?

How do I Export/dump the settings of bitcoin into a .conf file? I know I can review some of them via bitcoin-qt GUI. I'm not interested in the GUI settings like font, etc. I'm interested in exporting ...
JDOaktown's user avatar
  • 206
1 vote
0 answers
137 views

multisig vs singlesig

Due to the Ledger debacle I have purchased a Coldcard hardware wallet. I made this decision partly based on watching the Antonopoulos live stream last week. Until now I have backed up my bitcoin on a ...
Sam's user avatar
  • 11
10 votes
2 answers
1k views

What is the controversy with Ledger's new recovery service?

There has been a lot of controversy recently over Ledger's new recovery service which will shard your seed out to third parties for storage. What is the controversy? This question was posed by ...
Michael Folkson's user avatar
6 votes
1 answer
878 views

How could Bitcoin developers handle and resolve severe software vulnerability without drawing public attention?

I am curious about the process Bitcoin developers follow to address and resolve critical software vulnerabilities, such as bugs or flaws, that could be exploited by attackers to disrupt the network or ...
deyw's user avatar
  • 550
0 votes
0 answers
22 views

I don't understand why Wallet keys are only a little over a kilobyte when the transaction signatures are extreme in size [duplicate]

I'm asking this question related to bitcoin security. There's a general consensus that it's nearly impossible for a %51 attack on the bitcoin blockchain which isn't generally considered a risk that ...
podlook's user avatar
0 votes
2 answers
152 views

Is it safe to connect my HW wallet to a computer which is connected to the internet?

Cold wallets are those that have never been connected to the internet, and are safer than hot ones, which have been exposed to it. If I connect my HW wallet to a computer which is connected to the ...
Dan's user avatar
  • 191
3 votes
1 answer
773 views

Is there any known 80-bit collision attack?

Regarding [bitcoin-dev] Time to worry about 80-bit collision attacks or not? considering that it is from July 2016, is there any known instance of this attack in practice? Also what addresses are ...
WebOrCode's user avatar
  • 353
1 vote
1 answer
242 views

Are satoshis private keys easier to find than modern ones (given proper security in both cases)?

I read that back then, you had entropies of 128 bit instead of 256. Like 12 vs 24 word mnemonic seed phrases. Are their wallets easier to brute force than other ones?
codepleb's user avatar
  • 189
1 vote
1 answer
276 views

Was the bug bounty ever claimed for OP_CTV?

There was a large bug bounty on the implementation of OP_CTV in 2022 (according to this source it reached as much as 5.3 Bitcoin). Was it ever claimed?
Michael Folkson's user avatar
-1 votes
2 answers
95 views

Is the 'real barrier' to attack bitcoin's consensus 33.34%, rather than 51%?

Saw a random tweet thread that claimed that the "51" in "51% attack" was misinformation, and that in reality only 33.34% of hash power would be needed for a bad actor to attack the ...
Runeaway3's user avatar
  • 329
2 votes
1 answer
413 views

12 or 24 words for mnemonic?

I do not have reference, but I have heard that there is no use in using more than 12 word for mnemonic, because ECDSA secp256k1 only has 128 bit strength. Is this correct? If it is, then does ...
WebOrCode's user avatar
  • 353
0 votes
0 answers
24 views

First Question from New User to Bitcoin [duplicate]

What is Bitcoin? I received a "congratulations" message from George Green saying I have a new Bitcoin transaction and to click a link to "get it." Payout is: $29,970.07 and ...
Anonymous's user avatar
0 votes
1 answer
118 views

Does key derivation make (or help to make) Bitcoin "quantum safe"?

We have these two other questions that touch on the same subject of how safe is Bitcoin from quantum computing attacks, but I believe mine is specific enough to be a separate question: What effects ...
Pedro Martins Timóteo da Costa's user avatar
2 votes
2 answers
205 views

What are the risks of OP_VAULT?

In the past it has been argued that some covenant schemes could be risky. However AFAIK OP_VAULT is a very specific and limited construction. What are the risks associated with it, if any?
Son Kaos999's user avatar
2 votes
1 answer
194 views

Is spitting a BIP39 seed phrase in half meaningly less secure than splitting the entropy in half?

One way to create a distribution, 2-of-3 backup of your seed phrase ABC is to store the following in three separate places: AB BC CA Any two of these lists is sufficient to reconstructed the entire ...
satsflat's user avatar
1 vote
1 answer
55 views

Are bitcoins with more confirmations more valuable?

Are bitcoins with more confirmations more valuable, or does the number of confirmations not add a sort of "time value of money (TVM)"?
Geremia's user avatar
  • 4,626
1 vote
1 answer
140 views

If Multisig Xpub is compromised, but not the seeds or wallets

I have a multisig set up. My seeds and hardware wallets are secure. However, what would happen if someone got a hold of my Xpub file only? Am I correct they could view my holdings and transactions, ...
user135120's user avatar
0 votes
2 answers
258 views

Is Taproot the best address against quantum computers attack?

I'm looking for an address type for long term storage of bitcoin but I don't know what to choose. I'm not sure if Taproot is more secure than segwit. Another question I have about Taproot, is that if ...
Dodi Alf's user avatar
1 vote
1 answer
198 views

does connecting to full node via rpc over the public internet reveal your credentials?

While trying to connect to my full node, I accidentally entered my public ip address in the rpcconnect field of bitcoin.conf. Should I be worried that my password is now out there and anyone can ...
jesuis's user avatar
  • 13
1 vote
1 answer
86 views

What were any supply chain attacks against Bitcoin, if any?

Was there ever a case were Bitcoin or Bitcoin-Core itself was compromised? For example, did it ever happen that a malware hacker could insert code that compromised Bitcoin at the protocol level? For ...
Niklas Rosencrantz's user avatar
0 votes
2 answers
77 views

What is the correct way to make crypto payments except the escrow intermediate?

For small payments, bitcoin does not require any way to guarantee the exchange of coins for goods. But how do you make a big purchase (such as houses), especially when buyer and seller do not meet in ...
ivan866's user avatar
  • 103
0 votes
1 answer
86 views

Security issues and theft of money from the wallet

A transaction was sent from my node night CTransaction(hash=27aac94405, ver=2, vin.size=7, vout.size=1, nLockTime=762357) CTxIn(COutPoint(85d4e6a81c, 0), scriptSig=, nSequence=4294967294) ...
localhost01's user avatar
2 votes
2 answers
79 views

What is the difference between a push-based transaction model and a pull-based transaction model?

What is a pull-based transaction model? What is a push-based transaction model? I've heard people describe bitcoin as a push-based transaction model. I've heard people describe traditional financial ...
Michael Altfield's user avatar
0 votes
1 answer
81 views

Has money ever been stolen in bitcoin due to a design flaw in the protocol?

Is there an example of a single historical case of theft of bitcoin due to a flaw in the design of the bitcoin protocol? When googling "is bitcoin secure?" it's easy to get confused because ...
Michael Altfield's user avatar
4 votes
1 answer
156 views

What is the November 2022 bug in LND, what caused it and what would prevent a similar bug in future?

LND users are being asked as of November 2022 (as they were in October 2022) to urgently update their Lightning node software due to a bug in LND/btcd (alternative Bitcoin implementation in Go). What ...
Michael Folkson's user avatar
-1 votes
2 answers
59 views

Block Transaction if it is over a certain amount

Is there a way to block a transaction if the transaction exceeds a certain amount of BTC. I am running bitcoind.
D0n's user avatar
  • 1
0 votes
1 answer
90 views

Is it possible to sign a transaction programmatically via a connected cold storage wallet?

Lets say I want to generate my own transactions and sign them myself via my computer. Signing them in the computer would require me to input my private key, which would compromise the key. Is it ...
Trevor Wood's user avatar
0 votes
2 answers
235 views

Security of Vanity Addresses

I found a vanity address with this verified tool: https://github.com/JeanLucPons/VanitySearch And now I hold my private key, with BTC I am used to only the recovery seed and I don't know what position ...
Johnyk7's user avatar
2 votes
1 answer
246 views

What is the current status of watchtower implementations in October 2022? Are they mature, widely in use?

One way of protecting yourself against losing money as a result of bugs and crashes in your Lightning node implementation software (e.g. the recent LND bug) is to run a watchtower yourself or employ ...
Michael Folkson's user avatar

1
2 3 4 5
19