Questions tagged [security]
This tag should be used for questions regarding security issues with the design or implementation of Bitcoin and related cryptocurrencies.
886
questions
0
votes
1
answer
35
views
What prevent users from cheating in an HTLC contract
I was reading about HTLC and how Charlie have to create a random number and generates its SHA256 hash that is supposed to be used by Bob in the end to finalize the payment he has received from Alice.
...
- 2,393
3
votes
1
answer
39
views
Application security of Bitcoin Core
Is there any information about how Bitcoin Core has applied secure development or application security in the past and currently? For example, the inclusion of third-party dependencies must be checked ...
0
votes
1
answer
38
views
What's the difference between the anti klepto protocol and anti exfil?
What is the difference between the anti-klepto protocol (also here) and Anti-Exfil? Is it the same thing just with different names or are there differences? It seems they are both addressing the nonce ...
- 10.5k
5
votes
2
answers
795
views
How does bitcoin prevent DDoS amplification via the `addr` p2p message type?
If I am not mistaken the mainline bitcoind will accept unsolicited addr messages, and upon receiving this message - the struct is deserialized, and then verify each address from the unsolicited ...
- 323
0
votes
2
answers
42
views
can MITM read my metamask seed phrase when I click "Reveal Secret Recovery Phrase" in the wallet? [closed]
I worry someone is leaching my WiFi and potentially trying to do a MITM attack. If I click "Reveal Secret Recovery Phrase" in my metamask wallet extension, will they be able to read it via ...
- 3
1
vote
1
answer
66
views
The true reason bitcoin needs merkle proof for SPV wallet?
I know exactly what merkle tree is, and I know it is used to verify a transaction is in a block with just a hundred of bytes flowing through my network cable (btw do I really lack that megabytes ...
- 151
1
vote
1
answer
34
views
Is there any privacy issue in doing this hard-to-summarize thing with Bitcoin Core?
I have a "hot" wallet.dat with no password, with a small amount of satoshis.
Recently, I transferred them all over to my Bisq wallet temporarily to make trades. So the hot wallet.dat has 0 ...
- 13
0
votes
1
answer
59
views
Shasum output of signature keys not matching
My shasum output does not match ANY keys listed on https://github.com/bitcoin/bitcoin/blob/master/contrib/builder-keys/keys.txt ?
shasum -a 256 bitcoin-22.0-osx-signed.dmg
...
- 11
1
vote
1
answer
78
views
Why is the Generator Point G for secp256k1 curve typically indicated in (y,-x) quadrant?
Generator Point G for the secp256k1 curve is typically indicated below where the curve intersects the y-axis. At x=0, y=sqrt(7) and -sqrt(7), which are both small numbers less than 3, but G is an ...
- 33
1
vote
1
answer
62
views
Which offers more privacy, coinjoin-whirlpool or non-KYC online exchanges?
After buying crypto with fiat on a KYC exchange, instead of just moving the crypto to a wallet, I understand that I should get more anonymity from tracking by putting the coin through coinjoin or ...
1
vote
1
answer
83
views
Is it feasible to calculate EC private key k from public key K for very low values of k?
If an EC private key k is very small, say "1", is it feasible to calculate the private key k from its public key K, since there would only be one step back to generator point G and therefore ...
- 33
6
votes
2
answers
650
views
How much entropy is lost alphabetising your mnemonics?
Yes I know this is a horrible idea and not BIP39 compliant, but please help satisfy my curiosity with this "thought experiment" and applied maths exercise.
Two questions, one for 12 words, ...
- 405
-2
votes
1
answer
39
views
Hello, I'm not new to crypto, but I am quite new to Mining, can someone give me some tips on the best BTC miner as of today?
I am quite afraid of all the things I read on the internet, in seems that there are quite a bit of scams going on and the whole space, specifically crypto mining is quite uncertain.
Anyway, I was ...
2
votes
1
answer
54
views
Can hot wallets be secure?
Hot wallets are generally considered the least secure because their online nature creates an opportunity for hackers to crack them. but is there a way to cryptographically secure the seed generation ...
- 23
2
votes
1
answer
44
views
Is it safer to send bitcoin to multiple addresses when moving to another wallet?
If I decide to move all of my bitcoins from one wallet to another, are there any theoretical benefits to generate multiple addresses in a new wallet and split the bitcoins between them?
It will still ...
- 23
0
votes
0
answers
67
views
Research article about impact of BGP hijacking on bitcoin p2p network
Based on this answer from 2014, bitcoin nodes are vulnerable to BGP hijacking. There was an incident today in which twitter prefix was hijacked and details are shared in 2 blog posts:
https://isc.sans....
- 128
1
vote
1
answer
64
views
Is bitcoin core secure?
Amir Taaki says Bitcoin Core is not secure because of undefined behaviour in this video https://youtu.be/EPpDpULPhHc after 30:00
Is this true and how can we fix this? What are the risks of using ...
- 11
1
vote
1
answer
210
views
Bitcoin private key, key range calculation?
I saw a Bitcoin puzzle on https://privatekeys.pw, on which there are different private key spaces with addresses and then you need to somehow find out the right private key?
Is there a way to ...
- 27
0
votes
0
answers
47
views
How secure are the decentralized nodes?
I colloquially understand the inherent security provided by the decentralized distribution of the nodes that host the bitcoin network. However, is the distribution of the devices which run the nodes ...
- 145
0
votes
1
answer
114
views
Bitcoin.org gpg keys expired?
I was trying to add the keys to a keyring to verify the bitcoin core download, but it looks like the gpg keys are all expired.
- 1
0
votes
1
answer
57
views
Exploit vulnerable projects using RBF policy
If a project is vulnerable to some type of RBF policies, how could an attacker exploit this project?
user103136
1
vote
1
answer
118
views
What is a security model, security assumption, and security guarantee?
I often hear bitcoiners talk about
security models
security assumptions
security guarantees
but I can't find definitions of these terms.
What do these terms mean and how do they relate to each other?...
- 330
0
votes
1
answer
32
views
Is it possible to realize MitM attack between bitcoin full node and listener of this node?
I have the appication listening bitcoin full node and receiving tx messages. Is it possible to change TxOut value by man in the middle, so I don't detect this changes?
Node I connect is public node, ...
0
votes
1
answer
41
views
Methods to find BTC addresses collisions with less complexity approaches/attemps
I have one question. I'm trying to lower complexity when breaking private keys for BTC.
If we have that an address is a hash160 from priv key, then we can assume that we have 2^96 per each address.
If ...
- 101
1
vote
1
answer
70
views
How does PoW ensure that all the transactions are recorded and that all the transactions are valid?
I just started to study blockchain and bitcoin yesterday and came up with some questions.
If miners can select transactions when creating a block, how is it ensured that all the transactions over ...
- 111
1
vote
2
answers
172
views
Does a 12 word recovery phrase offer the same security as 24 words?
Watching this Q&A with andreas he states that a 12 word recovery phrase offers the same amount of security as a 24 word seed phrase as the output is 128 bits either way.
If this is the case, why ...
- 31
1
vote
1
answer
62
views
If someone cuts a standard Bitcoin private key into two (or more) equal parts, would another person be able to spend the coins after finding one part?
Someone has a standard (non-compressed) bitcoin private key (256 bits) and wishes to store it on paper. Being paranoid about someone finding the sheet of paper, he/she cuts the private key up and ...
- 152
1
vote
0
answers
61
views
How many words are enough to confirm user backed up all words for seed phrase?
If there are 12 words in the seed phrase, is confirming random 3 words enough to ensure user has backed up all words?
Or is it necessary to confirm all words and in the correct order?
If I create a ...
user103136
0
votes
1
answer
37
views
Does an actual transaction happen on the blockchain when you buy btc/usdt?
I was wondering if I buy or sell something on the exchange if coins are actually transfered somewhere of if the exchange just changes values of what belongs to me.
0
votes
1
answer
66
views
do Bitcoin full node onions also relay non-bitcoin traffic?
During the past week or so I am setting up a Bitcoin core full node on Raspberry Pi and making it as secure as possible. In the public mind, the onion sites and Darknet are associated with many things ...
- 3
0
votes
0
answers
39
views
Number of miners and security
Where would one look for thoughtful estimates of the number of miners necessary to provide a reasonable level of security, for various definitions of "reasonable"?
- 137
1
vote
1
answer
152
views
why was syscall sandboxing added in bitcoin core?
I could not understand why this pull request was merged:
https://github.com/bitcoin/bitcoin/pull/20487
According to PR:
Enable filtering of system calls using seccomp-bpf: allow only explicitly ...
user103136
1
vote
1
answer
69
views
Can a node be maliciously programmed to validate all the transactions coming from a specific entity?
In a blockchain there are miner nodes and validator nodes. The job of a validator node is to validate transactions to be included in the mempool, broadcast or propagate the transaction for the other ...
3
votes
0
answers
112
views
How much mining activity is needed for Bitcoin to remain secure?
I'm not looking for a number, but rather for a way to make an estimate taking things like market capitalization and the fact that mining uses ASICs into account. (I assume ASICs are relevant since ...
- 31
-3
votes
2
answers
679
views
How to derive the Private key when the two the nonces are k and k*2
Is the same private key using k and k*2 respectively in two different signatures vulnerable?
If yes How to calculate the key in this case
Here is an example, Both signatures are valid and the nonce of ...
0
votes
0
answers
28
views
There is a problem with file SHA256SUMS.asc [duplicate]
There is a problem with a file SHA256SUMS.asc in https://bitcoin.org/en/download
It consists a lot of strange signatures and no sha256sum strings and no signatures of Wladimir J. van der Laan’s ...
2
votes
2
answers
91
views
If you wanted to privately receive bitcoin from someone, how would you do that?
I do not like to be tracked when receiving or sending bitcoins.
How do you make a secure wallet?
If you wanted to privately get bitcoin from someone, how do you get it?
How do you get the address to ...
- 21
0
votes
0
answers
39
views
Help Unlock Bitcoin Wallet [duplicate]
I have a lot of BTC in my wallet, but a virus infected my old computer. I remember the login, but there is no password and mail (((Is it possible to do something ???
- 1
0
votes
0
answers
28
views
Is this a good recommendation as secure way to generate paper wallet via iOS app for non-technical user?
I have suggested to a non-technical friend to use this as a way to generate a paper wallet using an iphone. I'm trying to see if there are any pitfalls. I have used the air-gapped PC method for myself ...
0
votes
1
answer
62
views
Reusing same address potential security vunerability?
I was watching Andreas Antonopoulos talk about security on youtube. I heard him say something about using the same public address multiple times could increase risk of your private key being cracked ...
- 181
0
votes
1
answer
45
views
What is to prevent someone from giving an old school DDOS attack?
So I'm not talking about on-chain dos attack via means of penny flooding and whatnot. But what happens if the actual nodes are taken offline by an old school distributed denial of service attack via a ...
0
votes
2
answers
43
views
How many characters of an address do I actually need to verify?
Let's assume I want to verify the receive address on the phone. The recipient confirms the first M and last N characters of the address. How big is the computational effort for an attacker to create a ...
- 3
1
vote
1
answer
98
views
bitcoincore with linux (tgz) or arm linux
I am running a node on a raspberry pi 4 model B 8gb with linux as os, should I update bitcoincore with linux (tgz) or arm linux.
- 13
0
votes
1
answer
66
views
Why does the locking script for MultSig contain PubKeys instead of PubKeyHash?
I am reading "Mastering Bitcoin" by Andreas Antonopoulos. In the transactions section, the locking script for normal account(single address) is
OP_DUP OP_HASH160 <Cafe Public Key Hash> ...
- 195
0
votes
1
answer
76
views
Why is signature S value is unnecessarily high not safe?
I get frequent warning when sending RawTX to PushTX message
(Non-canonical signature: S value is unnecessarily high)
Why is signature S with a large value dangerous (that is, when the first HEX ...
0
votes
1
answer
66
views
How can I contact Bitcoin.org
I need to contact with some support from "bitcoin.org". Ive tried to found some email adress or contact with them with their web, but its simply impossible. Somebody know how can i contact ...
- 1
0
votes
1
answer
52
views
Best security practices accessing/trading crypto on computer/mobile
I’ve read online with regards to crypto that, as hardware wallet users, we should treat all devices, computer, mobile phone, software, exchanges/wallets, etc. as compromised. That being said, I have ...
0
votes
1
answer
46
views
What’s the safest long-term hardware wallet solution?
Looking for safest hardware wallet solution, for long time storage. Thanks!
- 111
1
vote
4
answers
104
views
If the nodes are what keep Bitcoin decentralized, what if some big internet company spun up 60%+ majority nodes?
If the nodes are what keep Bitcoin decentralized, what if some big internet company spun up 60%+ majority nodes?
What’s stopping them from manipulating the blockchain to change transactions?
- 181
9
votes
4
answers
6k
views
How can Bitcoin.org be hacked?
Suddenly:
The Bitcoin Foundation is giving back to the community!
We want to support our users who have helped us along the years.
Send Bitcoin to this address, and we will send double the amount in ...
- 107