Questions tagged [security]

This tag should be used for questions regarding security issues with the design or implementation of Bitcoin and related cryptocurrencies.

Filter by
Sorted by
Tagged with
4
votes
1answer
220 views

Are there any transaction-related artifacts left in the database?

Bitcoin writes to some log files (bitcoin/*.log and bitcoin/database/log.nnnnnn ) Are these (and everything else other than wallet.dat) clear of any information that would allow a forensic ...
5
votes
1answer
209 views

Is bitcoinica.com planning to reopen after the 11th May 2012 theft?

On 11th May, 2012, 18,547 BTC were reported stolen from bitcoinica.com as stated here: https://bitcointalk.org/index.php?topic=81045.0 The bitcoinica.com website is unresponsive at the time of ...
3
votes
1answer
173 views

Is there any way to measure relative occurrences of wallet theft over time?

Soon after Bitcoins became valuable enough to be worth stealing, I started seeing news about viruses/malware that steal Bitcoin wallets. Presumably, wallet encryption has reduced the level of this, ...
2
votes
1answer
341 views

How do mining pools protect their wallets?

Since Slush took quite a hit due to the hacked Linode servers, I'm wondering how do mining pools protect their wallets from theft of file and theft of private keys in those files?
3
votes
1answer
127 views

Is an attack on a local bitcoind via an img or embedded flash viable?

In this thread on the Bitcoin forums it was suggested that a local attack on bitcoind might be possible through malformed img tags or (more likely in my opinion) through embedded flash. This also ...
4
votes
1answer
984 views

How to secure one's Bitcoin Client from packet sniffing?

Potential packet sniffing weakness has been described on the Weakness Wiki page. It states that an attacker that can see all of our internet traffic can pick up which transactions originate from our ...
5
votes
4answers
343 views

How does Alice know she is receiving the correct address?

Let's say Alice wants to send Bob some coins. Bob needs to tell Alice where to send them, so he sends his address to Alice. How does Bob send this address so that Alice knows that the address she is ...
0
votes
1answer
342 views

Bitcoin transaction anonymity [duplicate]

Possible Duplicate: How do I see the IP address of a bitcoin transaction? When making a bitcoin transaction from or into a wallet that is on my computer, can my Ip address (and thus identity) be ...
2
votes
2answers
722 views

How would one inject a blockchain fork to the Bitcoin network?

For theoretical purposes, how would one inject a blockchain fork in to the Bitcoin network? For example, lets say we have a small chain of blocks prepared in a program that is not a standard client / ...
10
votes
2answers
2k views

How secure are various models of Bitcoin clients?

As there was some disagreement on security of various models of Bitcoin clients in comments to this answer, I'd like to address the problem. How secure are various models of Bitcoin clients? Those ...
3
votes
2answers
1k views

Which bitcoin client distribution to use on a secure pen drive?

I have just purchased an Ironkey. Which version of bitcoin client can run without needing installation or download of the blockchain? One which may connect to a server to access blockchain info? So ...
11
votes
1answer
2k views

How safe is it to use a Linux live CD to access my savings wallet?

It's clearly safe to create a savings wallet offline with a live CD, as no data can be sent to an attacker even if the live CD image is compromised (which seems unlikely). However, when it comes to ...
6
votes
2answers
487 views

Two bitcoin addresses - Can you link them together?

I'm new to bitcoins and I was wondering; if I generate an address, add money to it (from MtGox for example), remove the address and use another address in the future. Would it be possible to link ...
19
votes
1answer
2k views

What protection does Bitcoin have against Denial of Service (DoS) attacks?

What protection does Bitcoin have against DoS attacks? Could you bring down a node by flooding it with data? What happens if someone starts flooding the network with legitimate, yet nonsense, ...
2
votes
1answer
278 views

Is bitcoin subjected to DOS attack? [duplicate]

Possible Duplicate: What protection does Bitcoin have against Denial of Service (DoS) attacks? Assume I am a malicious user, and my goal is to make bitcoin unusable. I can simply make millions or ...
9
votes
1answer
768 views

Does the BerkeleyDB-based wallet.dat implementation leak private key data?

I read this little nugget on the bitcoin client bug tracker: the bdb binary log files can also contain sensitive data such as private keys Is that true? Does this mean that even with an encrypted ...
12
votes
2answers
300 views

Can I force my wallet to only have news keys, post-encryption?

Now that v0.4 of the bitcoin client has encryption I've gone ahead and encrypted the keys in my wallet. But I had previously made backups of my (unencrypted) wallet and those keys are the same keys ...
7
votes
4answers
234 views

Do no-fee transaction represent a greater risk if the product is delivered instantly?

Let's say I want to accept payments instantly on a site for digital downloads. So I publish an address and wait for the unconfirmed transaction, I see the transaction and release the digital download....
3
votes
2answers
137 views

Is the tenebrix client safe?

I'm fairly proficient in C++ and wondered if the tenebrix client was safe to use? Also if I wanted to review the code myself, are there any warning signs I should look for without studying the code ...
8
votes
2answers
239 views

Trojan Clients?

The Bitcoin client is downloaded from a non-HTTPS server, so you cannot verify that it is legit, and the installer exe is not digitally signed. How often does that result in a Trojan client, and why ...
1
vote
1answer
767 views

Fraud Detection & Prevention

What are controls that are in place to detect and/or prevent fraud within the bitcoin system? Are there any know exploits, or potential threats to the system?
25
votes
8answers
3k views

How can a single person operation keep a collection of online wallets secure?

While this question is similar to others about securing wallets, I think it merits a question of it's own. One thing that has dissuaded me in the past from running an online wallet service of some ...
5
votes
2answers
403 views

What incentive is there for a miner to not include a bad transaction?

'A' has got 1BTC legitimately. He sends out a transaction to transfer that one bitcoin to 'B' with a 1BTC transaction fee added on. (i.e. a bad request.) 'C' is a miner who cares nothing for ...
9
votes
2answers
444 views

What prevents bitcoin from breaking down in case of a “transaction attack”

Let's say that I want to kill Bitcoin by means of a transaction attack. What in the bitcoin system prevents the following approach: I buy a limited number of bitcoin in the market. Using a small ...
6
votes
1answer
353 views

What is meant by “releasing code tells the hackers what to attack”?

I came across this statement from a SolidCoin developer: Can anyone explain this statement? [06:48] gavinandresen: I came here to ask RealSolid to be responsible and report problems or ...
13
votes
2answers
346 views

What are the minimum security expectations of an online wallet service?

If you wanted to assess the security of an online wallet service such as a bitcoin bank or ewallet, what would expect to see addressed? Obviously SSL connections, but what about authentication, ...
16
votes
5answers
2k views

Is Bitcoin future-proof?

As I understand things, the security and integrity of Bitcoin rely on the assumption that its hashing is "hard" in some sense. However, in the past, processing power has increased exponentially. ...
9
votes
2answers
238 views

Do any of the Bitcoin exchanges implement trading curbs?

After the big hack of Mt Gox we all became aware that there is nothing in place to prevent "flash crashes." Most stock, FOREX and other exchanges have features like trading curbs or other market ...
6
votes
2answers
259 views

Is the authentication system of the Bitcoin <-> SMS service PHONECO.IN adequate?

@osmosis made me aware of PHONECO.IN, which makes it possible to send Bitcoins via SMS. My question is whether their authentication system is adequate. From their website: PhoneCo.in is designed to ...