Questions tagged [security]

This tag should be used for questions regarding security issues with the design or implementation of Bitcoin and related cryptocurrencies.

Filter by
Sorted by
Tagged with
19
votes
6answers
7k views

51% attack - apparently very easy? refering to CZ's “rollback btc chain” - How to make sure such corruptible scenario can never happen so easily?

I was shocked to see binance CZ comment to literally "roll back" the bitcoin chain by just "calling" in some favors from "friendly" Asian miners . This ONE person could effectively do it??? I mean ...
0
votes
1answer
41 views

Possibility of a DDoS attack

Theoretically. This is not a mechanism of any kind of attack, but It's about the "lost" coins. May be. It is just for an educational experiment. What if someone has the ability to send transactions ...
0
votes
0answers
17 views

I received altcoins without an address in my microwallet, how is this possible?

I have only 4 addresses in my real wallet and in my microwallet account. So how is it possible that I receive cryptocurrencies of POT, BCH, etc. without having a wallet address?
2
votes
3answers
496 views

What can you do with the private key?

I am trying to understand all security regarding blockchain and bitcoins. Let's say you have a bitcoin wallet which is secured, only you know the private key. This bitcoin address was created on one ...
32
votes
2answers
13k views

What is a Finney attack?

What is a Finney attack? Extra points for explaining its purpose, the prerequisites for it to be possible, how the attack can be performed and the origin of the name "Finney attack".
-3
votes
0answers
50 views

Can we divide Bitcoin attackers into “adaptive” and “non-adaptive”? [closed]

For the first time I faced the terms "adaptive" and "non-adaptive" corruption in an article related to the vulnerabilities of the blockchain. Then I found the same term in this Ethereum github page (...
0
votes
0answers
14 views

What is the best crypto wallet with token swap built-in to it and without limits on the amount of funds? [closed]

I have a question about the wallets out there in the market. Which of the existing wallets is the best wallet in terms of security, no limits on amounts of funds, back up, restoring mechanisms ... ? ...
0
votes
2answers
27 views

How do I find out where a bitcoin address is from?

I am not looking necessarily a name but more like is it an offline, coinbase, blockchain.com, etc... I had $80 sent from my account yesterday and it says it went to ...
2
votes
1answer
32 views

Does assumevalid lower the security of Bitcoin?

Bitcoin's assumption was to download the blocks and verify it in order to prevent getting fooled. But by default, the assumevalid option is enabled in the software, which, as I understand it, makes ...
2
votes
1answer
34 views

Is this a collision attack or a 2nd-preimage attack?

This question revolves around Bitcoin Optech newsletter #51 (1) and an email thread from the bitcoin-dev mailing list (2). I asked the same question in a reply-email of the newsletter and the response ...
1
vote
2answers
46 views

Is it possible to separate blockchain and wallet functions?

I'm looking for a way to use bitcoin-core in monero-way (It uses separate blockchain daemon and wallet daemon). I'd like to run bitcoin-qt interface on my laptop and connect to external node with ...
10
votes
2answers
2k views

Long term BTC investing

my question is, what is the safest way of buying and holding bitcoin for the long term? And I mean 10-20 years, either a lump sum or through dollar cost averaging, is a paper wallet the answer? Or ...
5
votes
2answers
553 views

Capturing IP address of transactions submitted to Bitcoin

Dan Kaminsky has pointed out that it would be possible to build a service that tries to infer the source IP address of each Bitcoin transaction. His idea, which he calls Blitcoin, works by ...
3
votes
2answers
145 views

Is possible to destroy the Bitcoin for just $500K? (51% attack)

Everytime I read about the 51% attack the answer was something like: is really expensive to get 51% of power on BTC and nobody will invest so much so to destroy the bitcoin. But I found this site ...
3
votes
1answer
42 views

How many nodes is too many?

Has anyone done the math on this? For example, if we had 10’s of millions of nodes all connecting to 8 peers would there be some latency issues in propagating blocks across the network in the 10 ...
1
vote
1answer
235 views

What bad things could happens if Bitcoind RPC is public?

It is always suggested to enforce authentication on Bitcoind RPC. However, in case the RPC authentication get compromised (or if it is public), what kind of bad things could happens? First I could ...
14
votes
2answers
3k views

How do you derive the private key from two signatures that share the same k value?

I wrote my own ECDSA signature algorithm just for the purpose of creating unit tests. With it I created two signatures which went into transaction 56ec7ca7df..., sending from 1GXFXm3es.... These ...
10
votes
1answer
2k views

Bitcoin automatically diverted to bech32 address

I sent bitcoin to an address starting 3Cn using Electrum but the blockchain viewers seem to show that it has gone to an address beginning bc1 as shown in the link below. Transaction Viewer How can ...
0
votes
3answers
60 views

Bitcoin scam artist

A guy I have been talking to says he is having trouble accessing his account and asked me to make a wallet in blockchain and then wants my login, password, and wallet id so he can use it in another ...
35
votes
3answers
8k views

What are checkpoints?

I often read that checkpoints protect the network from a 51% attack because an attacker cannot reverse transactions made before the last checkpoint. How exactly does this checkpoint mechanism work? ...
0
votes
1answer
5k views

What happens to Bitcoin wallet / Bitcoins if PC is stolen

I am a beginner and just starting to explore the possibilities of Bitcoins. So I would be very grateful if somebody could help me with this question. Is there a risk that my Bitcoins are lost if the ...
2
votes
1answer
71 views

How much of the Bitcoin Source code is untouchable? [CVE-2018–17144]

My understanding is that CVE-2018–17144 (inflation bug introduced in 0.15) was partially a result of how convoluted the original code is. Regardless of the specific CVE-2018–17144 example, are there ...
12
votes
1answer
289 views

Schnorr's batch validation

In the recent BIP about Schnorr's standardization, Pieter Wuille presents an algorithm for batch validation. In my understanding the most heavy operation is the multiplication by a scalar: to make ...
0
votes
2answers
135 views

LND Security best practices? Disaster recovery?

Can anyone share a knowledge how to _ secure LND node _ backup node with all Channels I think only a seed will not be sufficient. What is your plan B in case of disaster? How to do an Emergency ...
2
votes
1answer
126 views

Lightning network hub security?

Reading the whitepaper, I came across a point: nodes wishing to act as effective intermediaries, 'hubs' or not, need high availability and need to operate autonomously. This means they must have ...
4
votes
1answer
569 views

Lightning network and lightweight clients

How will the lightning network handle lightweight clients? Do I understand it correctly that opening a payment channel require writing on the blockchain to protect against double-spend? The integrity ...
3
votes
1answer
67 views

Does LN require an on-chain “emergency lane” to mitigate systemic risks?

According to LN social slides, a fee market (in other word: "congested mempool", to my understanding) is good. But, there's systemic risks around penalty mechanism, so some sort of on-chain scaling (...
11
votes
1answer
4k views

Why is JSON-RPC over SSL “strongly discouraged”?

The Wiki contains a page that simply states: JSON-RPC over SSL is strongly discouraged Why? I found a method for enabling JSON_RPC over SSL here. The post mentions nothing about JSON-RPC over SSL ...
1
vote
2answers
120 views

Does my Electrum wallet become less secure if I keep generating seeds until I see one I like the look of?

Let's say I want to create a new electrum seed... I didn't like the initial seed words, since I want to remember them and these didn't look too appealing. Looking "too random" for my taste. When I ...
0
votes
1answer
2k views

Private key to mnemonic words, is it safe?

Is it safe to do the following? Suppose I do not want the HD wallet, but I do want the convenience of using mnemonic words to remember the private key. I know I can convert the private key's hex ...
-1
votes
1answer
43 views

How Spectre tolerates spam transactions?

Spectre is a DAG based (directed acyclic graph) distributed ledger (a structure as an alternative to blockchain based distributed ledger). Is there any mechanism in Spectre to prevent sending spam ...
1
vote
2answers
104 views

What’s the purpose of checking for input overflow?

Everyone knows this famous fix for block 74638 which still exists in other files. But there’s something I can’t understand, why check for inputs overflow since it’s not possible to have enough utxo ...
3
votes
4answers
347 views

Store Bitcoins offline

I have some bitcoins and ether at Blockchain.info and I am really scared of losing them. How do I best secure them? Right now I have a paper with the code to restore my wallet, but my coins are still ...
0
votes
1answer
84 views

Does a HD Wallet log my IP when i do a transaction?

Companies like BitPay and Electrum, can log my IP when I make a transaction, right? If so, should I use a Web Wallet (plus VPN) for transactions?
1
vote
2answers
58 views

Why was noise XK fundamental pattern chosen in the transport layer (BOLT 08) of the lightning network

I am currently reviewing the transport layer of the Lightning network protocol. It builds on top of the noise protocol framework handshake patterns. What I don't get: Why was the fundamental pattern ...
1
vote
0answers
11 views

Does Bitcoin security rely on the assumption of nearly continuous transactions? [duplicate]

So for an attacker not to overcome good nodes, I believe we rely on the fact that blocks are always being produced, making the attacker essentially outpaced. But in the extreme and ridiculously ...
3
votes
2answers
1k views

Make remote RPC connection to bitcoind server secure

I set up a bitcoind server on an Ubuntu server and I can remotely execute commands on the server. I am doing this with Java/RPC. To execute a command I need to provide a username and password. But I ...
0
votes
1answer
38 views

Automatically close the bitcoin-qt when enable SSL for RPC

I Just try to enable SSL for bitcoin-qt RPC call. I follow the SSL on RPC link to archive my target. But I am getting the following error and close the bitcoin-qt automatically. I am using the ...
0
votes
1answer
29 views

How does the Blockchain detect a cheater, who manipulates the blockchain?

Let's assume we have 100 blocks. One miner x has the intention to manipulate block 90. So he has to recalculate the hash for block 90. Following he also has to recalculate the hashes for block 91-100. ...
2
votes
1answer
43 views

Malicious full nodes causing denial of service attacks

To control >51% of the mining power in bitcoin is impractical due to the immense investment that will be required. Also, The Bitcoin Core client has DoS protection against malicious nodes forwarding a ...
0
votes
1answer
254 views

Are DAG-based crypto currencies as secure as proof-of-work based blockchains?

A key feature of blockchain based cryptocurrencies is that they provide inherently secure systems that don't rely on third parties. The newer DAG-based cryptos like Byteball are being touted as ...
0
votes
0answers
26 views

secure Multi-Party Computation (sMPC) in Enigma?

In Enigma whitepaper (>> Link to the Enigma paper <<), in section 5.1 "Overview of secure multi-party computation", page 4, explains how to divide a secret s into multiple shares, using ...
0
votes
1answer
181 views

Hello, someone is using an bitcoin account to blackmail me [closed]

Someone using a bitcoin account is trying to blackmail me. The account number is 1Mtsd3wXgkJnApaNpqaSSWLC6gCLBBxuaGG. I still have the email they sent me. I can also provide that email if needed, or I ...
0
votes
1answer
67 views

Private key generation doubt

I read that the private key pk has to be any number between 1 and n, where n is almost 10^77. Since pk' s function is practically to be used as a scalar for multiplying the generator point G, why does ...
0
votes
1answer
34 views

Are transactions with the same ScriptSig a security problem?

For instance while looking at the transaction stack of my address, tracing it to exchanges I use, I came across this: https://www.blockchain.com/btc/tx/...
2
votes
1answer
388 views

Are lightweight LN wallets vulnerable to transaction withholding?

As far as I know, LN requires the user to watch the blockchain in order to perform penalty in time. However, running full node is probably a heavy burden to some users, especially to mobile phones. I ...
8
votes
2answers
22k views

Creating a fake transaction

AttackerAlice has a BTC Wallet with 0 BTC. AccompliceBob has a BTC Wallet. Is it possible to transfer 100 BTC from AttackerAlice to AccompliceBob? Suppose a BadMiner accepted this as a valid ...
0
votes
1answer
22 views

Security of ChaChaPoly (IETF rfc7539) in the noise protocol framework of the Lightning Network

According to this paper ChaChaPoly is secure against chosen known plaintext attacks. I wonder however if that security assumption is weakened by a lot since messages sent on the transport layer of the ...
2
votes
1answer
164 views

Byzantine Fault Tolerance Threshold of Bitcoin: 1/2 or 1/3? (Edited)

According to this answer: https://bitcoin.stackexchange.com/a/58908/41513 a Byzantine Fault Tolerant (BFT) consensus threshold is 1/3. On the other hand, there is a common belief that Bitcoin network ...
5
votes
1answer
118 views

Why is the length of the transport messages on the lightning network encrypted?

From BOLT 08 we can see that every message is sent in the following way: 2 byte: length 16 byte: MAC [length] byte: Encrypted message 16 byte: MAC In reality these messages will be send over TCP/...