Hot answers tagged

18

You should learn more about the way the git scm system works. First, it is distributed so that everyone has a complete copy of the entire codebase; second, every commit is checksummed, so that if github wanted to (or was forced to) underhandedly change code, it would be detected by everyone.


8

It's just not a plausible threat model. First, all changes are publicly audited by hundreds of people. Second, releases are signed by the developers. Third, it wouldn't even do any real damage. Bitcoin once had an overflow bug that did about as much damage as any intentional defect possibly could. The network easily recovered as people identified the bug, ...


8

One way to look at security is to identify the risks. For a bitcoin client there are at least : 1. Theft of private keys Mitigation: 1.1 Keys should be encrypted. 1.2 Keys should not available to servers. 1.3 Key generation should be done securely. 2. Loss of private keys 2.1 You should be able to backup your wallet or private keys. 3. Client ...


7

Print out your private keys to a Paper Wallet and print the keys on Archival Quality Paper. Those should last until the year 2211. They are however un-encrypted so you should store them in a bank safety-deposit-box or somewhere just as safe.


7

I'll answer about "the Stratum model" - it has the potential to be very secure, for any practical purpose. Consider these facts: Both the client and server implementations will be open source. The vision is to have multiple independent servers, run by various entities (including large, "semi trusted" entities such as major exchanges and pools). The server ...


5

If you follow the advice on this question, you can download the client and verify it's been signed by Jeff Garzik, free from any possible tampering by middle men. Future client versions are planned to be distributed via other, more p2p-friendly means (the name of the distribution project has slipped my mind right now)


5

We don't have federated servers right now but we do utilize open source, publicly accessible libbitcoin nodes which both Airbitz and 3rd parties host. This is a fully compatible replacement to bitcoind nodes but provides much faster blockchain queries, similar to Electrum servers. If you'd like to run one, we'll include it in the list of servers that our ...


5

It depends on what you're actually asking. Bitcoin doesn't exist within the normal model of BFT consensus so in one sense the answer is mu. Under conventional assumptions Bitcoin will converge on a stable history if honest participants have a majority hashpower. But the arguments given as to why you could expect this hashpower majority assumption to hold ...


4

Is this considered safe enough? Nothing is "safe enough" if we do not know the cost. OK, if you have $100k in bitcoins the 12-words phrase is safe enough. If the 12-words phrase is the seed to the "Method of destroying the Universe" I would recommend to add at least 11 bits of entropy and use 13 words.


4

Your wallet file contains the keys needed to sign transactions that transfer Bitcoins from your accounts. The system doesn't care who accesses what, it just cares that transactions are signed with the appropriate keys. Back up your wallet file so you don't lose the keys you need to spend your Bitcoins. But remember, if someone gets their hands on any ...


4

There are several ways to store cryptocurrencies, so let's break them down by use-case and safety-level. Exchanges There are, broadly speaking, two types of exchanges. Centralized exchanges, such as Bitfinex, Bittrex, Kucoin, etc., and decentralized exchanges such as Etherdelta and Switcheo. Trading on a centralized exchange requires you to deposit ...


4

Safety: Any transaction deemed final by one properly-operating node will eventually be deemed final by every properly-operating node. No two transactions ever deemed final by two properly-operating nodes will ever conflict. Liveness: So long as there is always at least one transaction suitable for inclusion that has not been deemed final by any properly-...


3

Nothing. It is mostly only useful for checking data integrity, not detecting malicious modification (unless you know someone trustworthy that signed the hash). SSL has the same problems though, because public keys can be altered too of course. There are multiple solutions to this problem, although none is perfect. Trusting some central authority to decide ...


3

You'd better ask it on the Apple SE, since apparently Bitcoin is not the core of this question, i.e. this could have happened with any software requiring Java. That said, you could simply chose not to use Multibit: switch to another client, be it a desktop client or an online wallet.


3

You probably should ask this question on other Stack Exchanges, like Super User, as the question is not specific to Bitcoins really. Safest place to store your wallet key would be in your memory, if you are a type that can recall a long string of digits many years later. You could try using some mnemonic tricks, like encoding the numbers in a poem with ...


3

See https://bitcoil.co.il/Doublespend.pdf. What matters is the number of blocks, not time elapsed or average time for this many blocks. Also, the idea of "wait for 6 confirmations or 1 hour" in Bitcoin is a myth. If 1 hour passes with 3 confirmations you're less secure than if 30 minutes passed with 3 confirmations, because the attacker would have had more ...


3

It seems to be a good approach. The fundamental is keep a little bit "hot" to high liquidity and keep the rest into USB stickers + papers and if possible keep it safe in a vault or bank. Also, keep the anonymity and security of who has the access to the Bitcoins. Remember: Bitcoin is real money, and if you are working with a lot of money, it can be dangerous,...


2

my personal choice to have a secure online bitcoin wallet is : having a very secure dedicated server ( gentoo hardened, grsecurity kernel . . . ) having my wallet on a ssh account ( with a very secure password, lowercase, uppercase and numbers in the password ) on that secure dedicated server having backups of my wallet on other dedicated servers using ssh ...


2

I used this tutorial to backup my Bitcoins for long-term storage. The basic steps are as follows: Create a Linux LiveCD Put a TrueCrypt installer on a USB key (or embed it in the above installation) Boot the live CD and install TrueCrypt Create two TrueCrypt volumes, one 4 GB with an easy password, another smaller one with a unique ultra-long password Mount ...


2

This question in Skeptics SE asks "Will the Sun's magnetic activity disrupt electronics on Earth?" As I understand it, the disruption has a limited geographical area of effect, and protection for a device can be achieved by simply disconnecting the power and network cables to disconnect it from long-distance grids (which amplify the effect). I'm sure ...


2

If the blockchain shows the money was in your account, then they have fulfilled their requirements. At that point, any transfer of money OUT of your account needs to be signed by your private key. This signed transaction is what is in the blockchain. The most likely situation is that the application you used to generate the key generated a weak key. If, for ...


2

XPUB refers to an extended public key, and because it is only a public key, you have not compromised your private keys. Thus it is safe to continue using, yes. You have, on the other hand, compromised your privacy, as with that xpub Trezor support can derive all your addresses and know they are all yours. But it's likely they just want to look to see if you ...


2

Frankly, I don't think your definitions are useful. But by your definitions, PoS makes a network permissioned by definition. In a proof-of-stake network, you can only participate in the validation of transactions if you possess the token, which you can only get from someone else who has the token and chooses to give it you. By your definitions, that makes ...


1

For the vast majority of possible 12-word combinations, the corresponding wallets were empty and never generated. The total number of the combinations is pretty huge so trying to brute-force them will not work out. In fact, words are just another (mnemonic) way to encode the entropy contained in the private key.


1

If for cash means you want paper then it is possible only theoretically - you sell it in the same way as cucumbers or gas to the people that want to buy it. You just need to find them and it will be hard because if you don't want to do it online means you are afraid of something: fake banknotes, money laundering, etc.


1

In short: 12-word seed has enough entropy to be safe against brute force attack. First of all not all 132 bits are random. Seed uses some kind of control sum. Lets talk about 128 bits of entropy. Lets imaging the following attack: We will take one billion (10^9) of the most powerful mining hardware in 2017 (13 TH/s each). We will make a 1000 years brute ...


1

128 bits is generally considered more than enough -- 132 bits is certainly sufficient.


1

In my opinion trusting a third party with your Bitcoin savings is kind of against the grain of Bitcoin. It makes perfect sense to keep day to day amounts on hot wallets either on your phone or online by using services such as Coinbase, Blockchain.info, Circle and their likes. These companies offer various cold storage options (e.g. coinbase vault) and there ...


1

Yes. On their sales listing they note specifically that they have passed FCC and CE approval, and their products bear the markings for this accordingly.


1

This is the official guide to building Bitcoin on Linux: https://github.com/bitcoin/bitcoin/blob/master/doc/build-unix.md


Only top voted, non community-wiki answers of a minimum length are eligible