Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

This tag should be used for questions regarding security issues with the design or implementation of Bitcoin and related cryptocurrencies.

9
votes
1answer
1k views

Does the main Bitcoin client blacklist addresses?

Does the main Bitcoin client blacklist any addresses that send too many erroneous messages? If so, how can one whitelist a particular address? I am developing an app that will be communicating with ...
9
votes
1answer
733 views

Does the BerkeleyDB-based wallet.dat implementation leak private key data?

I read this little nugget on the bitcoin client bug tracker: the bdb binary log files can also contain sensitive data such as private keys Is that true? Does this mean that even with an encrypted ...
5
votes
2answers
592 views

How to perform a double spend attack in websites that accept transactions with 0 confirmations?

To perform a Finney attack or a 51% attack I need to have lots of computational power, but in this case (a website that accepts transactions with 0 confirmations) it seems to me that I only need to ...
43
votes
4answers
15k views

Why was the target block time chosen to be 10 minutes?

According to the wiki, 10 minutes was chosen as a 'tradeoff'. Why ten minutes specifically? It is a tradeoff chosen by Satoshi between propagation time of new blocks in large networks and the ...
7
votes
4answers
233 views

Do no-fee transaction represent a greater risk if the product is delivered instantly?

Let's say I want to accept payments instantly on a site for digital downloads. So I publish an address and wait for the unconfirmed transaction, I see the transaction and release the digital download....
34
votes
3answers
7k views

What are checkpoints?

I often read that checkpoints protect the network from a 51% attack because an attacker cannot reverse transactions made before the last checkpoint. How exactly does this checkpoint mechanism work? ...
15
votes
2answers
6k views

How does the Bitcoin client encrypt the wallet.dat file?

What is the algorithm used for encrypting the wallet.dat file?
12
votes
4answers
827 views

What software and skills do I need?

Never having owned bitcoins I don't know how bitcoin wallets work and I'm wondering: if I buy bitcoins, what will I need to know about the software involved, and where should I keep my bitcoin wallet? ...
7
votes
3answers
2k views

Who controls Solidcoin's special millionaire accounts?

Solidcoin takes the following approach to preventing the 51% attack: As with existing cryptocurrencies, SolidCoin 2.0 stores transactions in a "block chain" which is essentially what it sounds like....
20
votes
1answer
765 views

Gaming the “off-by-one” bug (difficulty re-target based on 2015 instead of 2016 block time span)?

In this forum post from Gavin Andresen he writes: Second: I've written 'discourage blocks' infrastructure: https://github.com/gavinandresen/bitcoin-git/tree/discourageblocks (code reviews ...
12
votes
3answers
2k views

Can someone with 51% computing power earn more than he deserves?

See also What can an attacker with 51% of hash power do? This may have been discussed elsewhere, but I'm not sure what the answer is - if someone owns 51% of the hash power, can't he just ignore the ...
3
votes
2answers
136 views

Is the tenebrix client safe?

I'm fairly proficient in C++ and wondered if the tenebrix client was safe to use? Also if I wanted to review the code myself, are there any warning signs I should look for without studying the code ...
13
votes
6answers
7k views

How can I stop websites running an integrated Bitcoin miner without disabling javascript altogether?

"Bitcoin Plus" is one example of a javascript bitcoin mining client that can CPU mine bitcoins through a browser when viewing a website. Here is a screenshot from 4bitcoins dot com which automatically ...
9
votes
1answer
380 views

How can I best implement Bitcoin in my business?

Is there any good tutorial, discussion or implementation of bitcoind for business? What's the best Bitcoin.conf? How to expose the Bitcoind API to the internet? How to guarantee confidentiality, ...
8
votes
2answers
239 views

Trojan Clients?

The Bitcoin client is downloaded from a non-HTTPS server, so you cannot verify that it is legit, and the installer exe is not digitally signed. How often does that result in a Trojan client, and why ...
12
votes
2answers
298 views

Can I force my wallet to only have news keys, post-encryption?

Now that v0.4 of the bitcoin client has encryption I've gone ahead and encrypted the keys in my wallet. But I had previously made backups of my (unencrypted) wallet and those keys are the same keys ...
6
votes
3answers
251 views

Are there any attacks with a plurality of computing power?

There has been some discussion about possible attacks if one has the majority (over 50%) of the computing power of the bitcoin network. What happens if an attacker (or coordinated group of attackers) ...
1
vote
1answer
744 views

Fraud Detection & Prevention

What are controls that are in place to detect and/or prevent fraud within the bitcoin system? Are there any know exploits, or potential threats to the system?
11
votes
3answers
667 views

What can be done to mitigate the risk of a Finney-attack?

Related Question: Would a reduced block generation time make the Finney attack more difficult? I understand that the Finney-attack is the main reason why accepting a zero-confirmation transaction ...
108
votes
5answers
18k views

Why is 6 the number of confirms that is considered secure?

Why is 6 is the number of confirmations that is considered secure? I haven't found any mathematical explanation or otherwise that explains why it is 6 and not 5 or 7. Is there a historical reason for ...
9
votes
4answers
309 views

String-along, is this possible and is it an attack?

I haven't seen this discussed before, if it has been please provide a link. If I find a block while mining but then discover that another miner broadcast a block mere moments ago, I could begin ...
26
votes
5answers
2k views

How much would it cost to execute a 51% attack?

I know that it's commonly said that they're not really in the realm of possibility right now, but how much would it really cost to execute a 51% attack on the network? And are there any organizations ...
7
votes
1answer
466 views

How should centralized wallets handle user accounts?

I tried to generalize this question from one I asked on the BitcoinJ development list. I'm working on a project that requires a centralized wallet. From what I gather, these types of services ...
21
votes
2answers
5k views

Could the EC2 infrastructure be used to efficiently launch a 51% attack?

This excellent answer from Serith states that one would need 31150 ATI 5870 graphics cards to launch a 51% attack. Amazon EC2 offers computers for rent for 2.10$ per hour. These instances have 2 x ...
20
votes
4answers
3k views

Can a 51% attack be detected and dealt with?

If someone got 51% hash power and started rewriting the blockchain from scratch (building a longer chain with a completely different history), could this be detected? Could "the honest users" revert ...
4
votes
2answers
639 views

How many consumer computers would it take to launch a 51% attack [closed]

What is the hash rate of a standard laptop using the default client and what is it for the whole of Bitcoin? I am interested in this, because I want to understand what it would take to get to 51% of ...
15
votes
1answer
2k views

What is the “zeitgeist attack”? Does it affect all blockchain technologies?

What exactly is this attack? It would be nice to have a good explanation of how it works and which chains can be effected by this. Does it apply to the bitcoin main chain, or only the newer and ...
16
votes
5answers
2k views

What can xxxCoin do to stop the impending 51% attack?

Within the coming weeks both Namecoin and SolidCoin have been threatened with the same attack. What can be done by the users, pool operators and developers of these forks to either; A. Minimise ...
9
votes
2answers
1k views

Why did BitcoinEXpress plan a 51% attack on Namecoin?

I don't understand this post. What is "ArtForz modified exploit"? What does "Gavin's patch will not work for the exchanges" mean? Any more important details I'm missing?
19
votes
2answers
3k views

How does a client decide which is the longest block chain if there is a fork?

Is it only the block height or is it the effort that went into the forks? In other words: does this decision account for different difficulties?
52
votes
4answers
29k views

What keeps the average block time at 10 minutes?

I've been told "the network" sets the difficulty level such that there will be one new block mined every ten minutes. I imagine the rich would instead prefer to keep difficulty as high as possible to ...
5
votes
2answers
400 views

What incentive is there for a miner to not include a bad transaction?

'A' has got 1BTC legitimately. He sends out a transaction to transfer that one bitcoin to 'B' with a 1BTC transaction fee added on. (i.e. a bad request.) 'C' is a miner who cares nothing for ...
9
votes
2answers
444 views

What prevents bitcoin from breaking down in case of a “transaction attack”

Let's say that I want to kill Bitcoin by means of a transaction attack. What in the bitcoin system prevents the following approach: I buy a limited number of bitcoin in the market. Using a small ...
8
votes
1answer
1k views

What is BlitCoin?

I saw BlitCoin mentioned on this forum thread, but didn't understand what it was. Can someone explain what does it do?
36
votes
5answers
6k views

What is a deterministic wallet?

It sounds as if it's a process that enables a wallet to be rebuilt from a passphrase, or from several fragments scattered about. Could someone provide a detailed technical explanation?
130
votes
8answers
47k views

What can an attacker with 51% of hash power do?

Suppose organization X has 51% of the hash power for a period of 1 week. In this week, what exactly can and can't X do?
6
votes
1answer
353 views

What is meant by “releasing code tells the hackers what to attack”?

I came across this statement from a SolidCoin developer: Can anyone explain this statement? [06:48] gavinandresen: I came here to ask RealSolid to be responsible and report problems or ...
28
votes
7answers
3k views

How can one download the bitcoin client securely?

What is the correct procedure to download the official bitcoin client, and validate it was signed by the developers, and not infected with any malware by a man in the middle?
12
votes
1answer
271 views

What security features are built in to the standard Bitcoin software?

I have read much of the Bitcoin algorithm and its encryption basis, however little has been said of the software's inherent security. What solutions are already built in to the software, and what is ...
25
votes
8answers
3k views

How can a single person operation keep a collection of online wallets secure?

While this question is similar to others about securing wallets, I think it merits a question of it's own. One thing that has dissuaded me in the past from running an online wallet service of some ...
13
votes
2answers
345 views

What are the minimum security expectations of an online wallet service?

If you wanted to assess the security of an online wallet service such as a bitcoin bank or ewallet, what would expect to see addressed? Obviously SSL connections, but what about authentication, ...
19
votes
1answer
2k views

What protection does Bitcoin have against Denial of Service (DoS) attacks?

What protection does Bitcoin have against DoS attacks? Could you bring down a node by flooding it with data? What happens if someone starts flooding the network with legitimate, yet nonsense, ...
21
votes
4answers
1k views

Are there any fundamental security vulnerabilities in Bitcoin?

Although Bitcoin does its best to prevent double-spending, could it still happen in practice? Is it just very unlikely that fraud could happen, or is there a mathematical proof that it could never ...
9
votes
2answers
236 views

Do any of the Bitcoin exchanges implement trading curbs?

After the big hack of Mt Gox we all became aware that there is nothing in place to prevent "flash crashes." Most stock, FOREX and other exchanges have features like trading curbs or other market ...
55
votes
4answers
7k views

Have any cryptography experts vetted the bitcoin source code?

Theoretically, bitcoin's open source nature makes it more resistant to bugs and exploits. However, due to the specialized nature of the code, even many programmers don't fully understand the ...
50
votes
9answers
5k views

What methods could a government use to shutdown Bitcoin?

Let's say that a government decided to shut down the Bitcoin network. What options would they have to achieve this? Would they need to convince other governments? All governments? Let's set as a ...
6
votes
2answers
258 views

Is the authentication system of the Bitcoin <-> SMS service PHONECO.IN adequate?

@osmosis made me aware of PHONECO.IN, which makes it possible to send Bitcoins via SMS. My question is whether their authentication system is adequate. From their website: PhoneCo.in is designed to ...
20
votes
6answers
2k views

How can I send Bitcoins via SMS?

I am considering working on giving Africans access to trade using Bitcoins. In many ways, parts of Africa is more developed when it comes to mobile payments than the west. The success of M-PESA ...
37
votes
5answers
2k views

How do I accept bitcoin payments at a real world store?

From what I understand, there are some requirements for using bitcoins at a physical store: Both the store owner and the client must have Internet access The client must have a cellphone or a laptop ...
32
votes
1answer
51k views

How can I restore my wallet?

I just purchased a new laptop and I want to decommission my old one. I have a back-up of my wallet.dat file copied to my new PC. What do I need to do to restore it to my Bitcoin (Windows) client? ...