Questions tagged [security]

This tag should be used for questions regarding security issues with the design or implementation of Bitcoin and related cryptocurrencies.

Filter by
Sorted by
Tagged with
15
votes
2answers
10k views

Are the Thin clients Electrum and Multibit safe and secure?

How do Electrum and Multibit compare for being safe and secure. Both are open source. Are there any advantages, security wise, to use one or the other? I'm new to bitcoin and the only reason for ...
9
votes
1answer
757 views

Does the BerkeleyDB-based wallet.dat implementation leak private key data?

I read this little nugget on the bitcoin client bug tracker: the bdb binary log files can also contain sensitive data such as private keys Is that true? Does this mean that even with an encrypted ...
8
votes
1answer
1k views

What is BlitCoin?

I saw BlitCoin mentioned on this forum thread, but didn't understand what it was. Can someone explain what does it do?
8
votes
2answers
2k views

What is the story behind the “Linode problem”?

What is the story behind the "Linode problem"? How did the service become compromised and what has exactly happened because of it?
7
votes
1answer
1k views

What are the security considerations for hosting *your own* Electrum server?

Lets say I wanted to use an electrum client but I'm so paranoid and also can't or won't read and understand python code so that I only trust my own server. What security considerations should I have ...
7
votes
2answers
695 views

Can the blockchain be outpaced by a chain of low-difficulty blocks?

Let's say someone creates a blockchain fork starting from the genesis block, when the difficulty was absurdly low compared to today; then he starts mining new blocks from there up to the current block ...
6
votes
1answer
1k views

How secure are the DNS servers for Bitcoin?

With the version 0.6, Bitcoin introduced the DNS servers that populate the initial peers for new clients. How secure are those servers in terms of being immune to takedown attacks, or injection of ...
6
votes
2answers
331 views

Is there any software available for testing of Bitcoin security?

I'm currently in the process of working on my thesis about Bitcoin security and I'm wondering if there's any software available for testing of Bitcoin security? For example, are there any programs ...
4
votes
3answers
148 views

How can I safely store and trade Bitcoin and other crypto currencies?

How can I safely store Bitcoin? Exchanges require me to deposit to trade, is this safe? If I can't trust exchanges, what is the best way to safely store my cryptocurrency and transact it?
4
votes
2answers
1k views

How to tell who mined a bitcoin?

If the Bitcoin algorithm was broken and someone started spitting out blocks one after the other through their otherworldly space computer, could it be detected that the same miner was busting all the ...
3
votes
2answers
296 views

To what extent does asymmetric cryptography secure bitcoin transactions?

Is there a specific attack or bug which asymmetric cryptography prevents during bitcoin transactions?
2
votes
2answers
2k views

How does the Bitcoin Standard Client wallet encryption work?

I encrypted my wallet using Bitcoin QT, then closed the application. When I restarted Bitcoin QT, it did not ask for the passphrase. But I could still access the wallet. How is it possible to access ...
2
votes
1answer
804 views

What are the most notable cases of coins or wallet thefts?

What are the most notable cases of coins or wallets being stolen from Bitcoin users or services? When did they occur, how many coins were stolen and has any of the thieves been identified?
1
vote
1answer
726 views

How does the transaction signature prevent transaction duplication?

Let's say that Alice sends 1 BTC to Bob. We have then a signature of (Alice sends 1 BTC to Bob) with Alice private key. What prevents Bob from duplicating this exact same transaction and sending it to ...
4
votes
4answers
311 views

How can one gauge the reliability, customer service, and transparency of bitcoin exchanges?

There are several exchanges for Bitcoin with a few highly respected ones like Mt.Gox, Bitstamp, bter, bit-e etc. I understand the reason why they require verification of users by supplying their bank ...
1
vote
4answers
517 views

Is there any blockchains that has implemented a 2fa type of security measure?

Currently someone can steal your btc private key and send all your funds away. But has there been a 2fa built into a blockchain that prevents something like this? Say if you wanted to send something ...
1
vote
1answer
277 views

A theoretical low cost attack scenario in PoW currencies

The scenario was designed by user:croraf and me in discussing a question of mine yesterday. To make it more clear, I want to present it here again in a stricter design. To do it in a clear way, first ...
1
vote
1answer
666 views

Can a Finney Attack make SatoshiDice betting profitable? [duplicate]

Can a Finney Attack make SatoshiDice betting profitable? If you perform a Finney Attack whenever your bet fails (by replacing it with a transaction to yourself), then would it make betting profitable, ...
0
votes
1answer
210 views

Someone is using a bitcoin account to blackmail me [closed]

Someone using a bitcoin account is trying to blackmail me. The account number is 1Mtsd3wXgkJnApaNpqaSSWLC6gCLBBxuaGG. I still have the email they sent me. I can also provide that email if needed, or I ...
0
votes
1answer
83 views

What's the impact of net-splits on block generation… over a long period of time?

Part 1 For this question, assume the overall hashrate of the environment is constant. If 25% of the network hashpower were to be isolated (Australia had no Internet for example), what is the effect ...
24
votes
3answers
5k views

Can one safely buy vanity addresses from a third party without risking one's coins from being stolen?

One can easily generate vanity addresses for Bitcoin, but they can take quite awhile to generate. Outsourcing that process to someone with a strong mining rig is an option, but then one runs into the ...
26
votes
1answer
16k views

How secure is blockchain.info?

How secure is using a wallet on blockchain.info? How do you evaluate the different sites that provide wallets?
16
votes
5answers
2k views

Is Bitcoin future-proof?

As I understand things, the security and integrity of Bitcoin rely on the assumption that its hashing is "hard" in some sense. However, in the past, processing power has increased exponentially. ...
10
votes
6answers
365 views

What would a new exchange need to be better than the rest?

If a new crypto v crypto exchange were to be built and launched. What would tempt you to use it rather than what you currently use? Or what improvements would you like to see from the way things work ...
20
votes
1answer
771 views

Gaming the “off-by-one” bug (difficulty re-target based on 2015 instead of 2016 block time span)?

In this forum post from Gavin Andresen he writes: Second: I've written 'discourage blocks' infrastructure: https://github.com/gavinandresen/bitcoin-git/tree/discourageblocks (code reviews ...
17
votes
1answer
2k views

Was a timejacking attack ever performed?

The timejacking attack appears to be a pretty straightforward attack to pull off successfully. I was wondering, whether it was ever performed and documented somewhere, or was it just theoretically ...
16
votes
1answer
3k views

Should an end-user download the whole blockchain? Or is a “lightweight” client sufficient?

The average user normally doesn’t want to host a 3+GB file on his machine and wait for hours for it to download. What are the security risks of running a lightweight client? And how does this affect ...
15
votes
1answer
2k views

What is the “zeitgeist attack”? Does it affect all blockchain technologies?

What exactly is this attack? It would be nice to have a good explanation of how it works and which chains can be effected by this. Does it apply to the bitcoin main chain, or only the newer and ...
15
votes
2answers
6k views

How does the Bitcoin client encrypt the wallet.dat file?

What is the algorithm used for encrypting the wallet.dat file?
12
votes
2answers
2k views

Colluding miners attack: Is the Bitcoin protocol compromised?

A very interesting academic paper has been recently published by two researches from the Cornell University (abstract, full PDF): Abstract The Bitcoin cryptocurrency records its transactions ...
12
votes
1answer
296 views

Schnorr's batch validation

In the recent BIP about Schnorr's standardization, Pieter Wuille presents an algorithm for batch validation. In my understanding the most heavy operation is the multiplication by a scalar: to make ...
7
votes
1answer
477 views

How should centralized wallets handle user accounts?

I tried to generalize this question from one I asked on the BitcoinJ development list. I'm working on a project that requires a centralized wallet. From what I gather, these types of services ...
7
votes
3answers
2k views

Is it safe to run bitcoind on another server

I'm making first, rough concepts of some ideas for bitcoin-enabled services I have in mind. One thing that I wonder is, is there a best-practise approach on running bitcoind on another server that ...
14
votes
2answers
1k views

Does any pool accept higher-fee transactions of a double spend, instead of the earlier one?

Some pools use a modified bitcoind that uses different rules for choosing the transactions to include in a block. Are there any pools that knowing one transaction to be included in a block would ...
12
votes
2answers
2k views

Who mined the infamous block 364422?

Block 364422 contains a transaction that takes a long time to verify. This transaction design demonstrates a way a denial of service attack could be executed. This prompted Gavin Andresen to propose ...
10
votes
6answers
681 views

Can a mobile be protected against the “Linode problem”?

The "Linode problem" I'm referring to is where an external trusted party has administrative control over your device. Mobile phones are essentially managed devices. They can be fully controlled by ...
8
votes
2answers
22k views

Creating a fake transaction

AttackerAlice has a BTC Wallet with 0 BTC. AccompliceBob has a BTC Wallet. Is it possible to transfer 100 BTC from AttackerAlice to AccompliceBob? Suppose a BadMiner accepted this as a valid ...
6
votes
1answer
2k views

How exactly is my account/wallet at ripple.com secure?

Ok, I have my wallet name, passphrase and secret account key issued by 'the network'. Now say that ripple.com is under DDOS attack or, for whatever reason closes for a month or even becomes ...
5
votes
2answers
602 views

How to perform a double spend attack in websites that accept transactions with 0 confirmations?

To perform a Finney attack or a 51% attack I need to have lots of computational power, but in this case (a website that accepts transactions with 0 confirmations) it seems to me that I only need to ...
4
votes
2answers
643 views

How many consumer computers would it take to launch a 51% attack [closed]

What is the hash rate of a standard laptop using the default client and what is it for the whole of Bitcoin? I am interested in this, because I want to understand what it would take to get to 51% of ...
3
votes
1answer
2k views

I don't understand the “51% attack” problem. Why does a mining pool have power with a 51% share?

What gives a mining pool power to maliciously dominate the system if they're mining over the majority of the coins? Profits are disseminated to miners individually. I really don't understand how this ...
2
votes
3answers
507 views

Can an exchange work which does not have control of the private keys?

It seems like there is really no great way to exchange USD for BTC. Having to trust an exchange with your private keys is undesirable. I'm wondering if there is a way to utilize the convenience of ...
1
vote
1answer
356 views

How is 6 LTC blocks “more secure” than 6 BTC blocks?

This video claims that Litecoin is more secure than Bitcoin. If the only differentiator between LTC and BTC is SCrypt, then I don't see how a merkle chain of 6 blocks would be more secure than the ...
1
vote
2answers
1k views

How to run a bitcoind on a hosting securely?

I'm developing a web site which should receive bitcoins and display the amount of received coins. As this is my first bitcoin experience I would like to know if the following scheme is secure enough: ...
14
votes
2answers
7k views

What is a block withholding attack?

How can a block withholding attack be performed, what would be its purpose and who is it a danger to? Edit: when I posted this I was thinking about withholding a block you mined in a pool. But ...
11
votes
2answers
2k views

DDoS on big mining pools: a quick way to 51%?

Slush's Pool, the second biggest mining pool around, is currently down, allegedly due to a DDoS attack: News 16.04.2013 Pool is under DDoS attack. I'm working on recovering the service back to ...
11
votes
1answer
4k views

Why is JSON-RPC over SSL “strongly discouraged”?

The Wiki contains a page that simply states: JSON-RPC over SSL is strongly discouraged Why? I found a method for enabling JSON_RPC over SSL here. The post mentions nothing about JSON-RPC over SSL ...
8
votes
3answers
48k views

Is it safe to store all my coins on Coinbase?

Is it safe to store my coins (BTC & ETH) on the Coinbase platform or is it safer to download a wallet to keep them in?
8
votes
2answers
535 views

Can nLockTime TX be used to flood Mempools?

What would happen, if I would create a large number of large transactions with a very high nLockTime? Would something stop me from filling not only the miners', but also regular nodes' mempools? ...
7
votes
3answers
2k views

Who controls Solidcoin's special millionaire accounts?

Solidcoin takes the following approach to preventing the 51% attack: As with existing cryptocurrencies, SolidCoin 2.0 stores transactions in a "block chain" which is essentially what it sounds like....