14

You actually can't update all the firmware. In particular, the portion of the firmware that implements the security logic cannot be modified, it's burned in for good. If you want to take full control over a Trezor, which would even let you load malware onto it, you can. However, the internal security logic would still wipe all the data in the unit when you ...


13

There are both security and privacy related issues that arise from address reuse. Based upon your question you are less concerned with the privacy implications and more concerned with the security implications in this question. I will discuss security first before briefly mentioning why the privacy implications are greater than the security implications. ...


13

What stops malware from being malicious? Nothing What can you do to ensure that the wallet you are using is a secure way to access your bitcoin? Use an open source bitcoin wallet, download from the original source and verify authenticity before use. If you understand code, review and build it yourself. Obviously, if a person creates a wallet to steal bitcoin ...


12

The term trustless is often misunderstood. I suspect you mean not needing to trust anyone, but if a program being open source helps for that, aren't you implicitly relying on the people who are capable of reviewing the source code to have actually done so? Isn't that also a form of trust? Of course it is. Every production system needs to trust various ...


10

The network wide Alert system is being retired. No Bitcoins are at risk and this warning may be safely ignored. Upgrade to the newest version of your wallet software to no longer see the alert. Read more here.


7

The reasons for the 3 numbers: Bitcoin uses 256-bit ECDSA signatures. These require in the order of 2128 steps to find a private key from the public key is known. This is Bitcoin's security level: we aim to always require an attacker to perform 2128 steps. If the seed has less than 128 bits of entropy, this inevitably leads to a faster algorithm, where an ...


6

I emailed them about this: As for the possibility to get the seed out of the TREZOR: Official firmware doesn't have any support for exporting the seed Official firmware is opensource at github and signed by SatoshiLabs so anybody can check that the firmware can't leak the keys. The signature is checked by the device's bootloader which can't be changed, ...


6

Yes. A paper wallet is basically nothing more than your private key on a piece of paper. For usability it is often represented as a QR code though. You can make copies of it, and store several of them in different places, or even store half of the key in one location and another half in another. Bitcoins are never in your wallet, paper or otherwise; they ...


6

The simple answer is no. A hashing algorithm is ment to be a one-way function. If it is possible to recreate the public key from the hash, this means that the hashing algorithm is broken. However there is one aspect that you might find useful. For message signatures, bitcoin uses a custom encoding (compared to the DER encoded signature found in ...


6

It is a scam. He wants to get you comfortable with a process he can exploit later by sending you larger sums and getting you to pay an accomplice most. Maybe in a week or a month he will say he wants you to help with a property transaction. In reality the money will be from a crime, maybe some older person's life savings he has tricked them out of. He will ...


5

Why address reuse is discouraged: Reduced security An unused address is protected by ECDSA AND several SHA-256 and RIPEMD-160 operations, but only ECDSA after being used because the public key must be revealed during spending. This has been shown to open up several possible attacks in the past.[1] Reduced privacy All participants who you give the address to ...


5

It would not be wise to do this. "Brainwallet" software is completely non-standardized, there's no guarantee that any two implementations handle the encoding of characters in the same way. Addition of UTF8/UTF16 these characters is also likely to be incredibly confusing, did you mean Tooxy or Тооху? Those strings look the same but one is a completely ...


5

They anticipated this type of attack and they are monitoring their JavaScript files, check this website of theirs http://blockchain-status.com/javascript_verifier Also, CloudFlare (the reverse proxy they use) can modify the Javascript on the fly (CloudFlare is at the other end of the encryption for your browser, so SSL here only secures the connection ...


5

Use a desktop or mobile wallet (Electrum or Mycelium) to spend bitcoins (be sure to write down your recovery seed and store it like a paper wallet). To receive and store them, use offline paper wallets. As soon as a paper wallet exceeds some amount (50mXBC for instance), put it in storage and start a new one. If you are spending and your online wallet runs ...


5

Wallet The wallet holds the most valuable component of the bitcoin network, your private key. When you go to Bitcoin.org, there are several choices. A HD wallet (Hierarchical Deterministic) is more future proof. Wallet Feature Caveats Example Mobile Convenience Trust? Mycelium Online Backing of co ...


5

1) If you generate your paper wallet on your computer, you have to fully trust your computer 2) If you use a website for generating your paper wallet, a) you need to trust that website (hopefully its local javascript) b) your browser and its random number generator and c) eventually your network provider(s) (depending on the transport layer security) 3) If ...


5

Addresses are textually encoded public key hashes, which means that somebody in possession of only the address cannot read the public key - but eventually the public key must be revealed in order to spend the funds which are locked by an address - so it may become a privacy concern if addresses are reused, which is discouraged anyway. With a HD wallet, we ...


5

As @Prayank mentioned before: Nothing. As Ken Thompson said: "you can't trust code that you did not totally create yourself". If you are paranoid, it's better that you use cold wallets and make them air-gap.


5

Yes, it's a scam. Don't send them anything.


4

Yes, the attack you describe is possible. But this isn't specific to blockchain.info nor to online wallets. If an attacker manages to run code on your machine, you're pwned. As long as an attacker manages to inject code which deals with the private keys in their unencrypted form, the attacker can make it send the keys back to her. One way an attacker can ...


4

The researcher Jochen Hoenicke has done some work on the Trezor. He was able to extract the private key by monitoring the power cable with an oscilloscope. Trezor has since updated the firmware to defeat the described attack.


4

No because bitcoin wallets always have access to private keys and have the ability to communicate across the Internet. With this combination of capabilities, closed source wallets could become attacked (either by an insider or an outsider) in a manner that would be unknown to the user. The biggest concern would be a key stealing/ exfiltrating module that ...


4

The most secure operating system is no operating system. As Pieter mentioned in the comments, dedicated hardware wallets prevent private keys from leaking out of the secure hardware enclave, and therefore can't be grabbed from the Internet. All operating systems are enormous, complex software systems with lots of ways to fail catastrophically. It is likely ...


4

So some background as to what happened here. I wanted to claim my bitcoin diamond air drop. I googled and this video came up first. The video played this weird music which I think was hypnotic in some way. It instructed me to paste my blockchain.info restore phrase into this website: mybcdwallet.org. I foolishly followed the instructions and did not ...


4

Exchanges typically have a split storage setup. They have a hot wallet and a cold wallet. The hot wallet holds private keys on an online server that can quickly send and receive Bitcoin for when people deposit and withdraw Bitcoin to the exchange. The hot wallet usually contains a small amount of Bitcoin, whatever the exchange operator things will be ...


4

There are several ways to store cryptocurrencies, so let's break them down by use-case and safety-level. Exchanges There are, broadly speaking, two types of exchanges. Centralized exchanges, such as Bitfinex, Bittrex, Kucoin, etc., and decentralized exchanges such as Etherdelta and Switcheo. Trading on a centralized exchange requires you to deposit ...


4

Use TAILS Linux. From the website: Tails is a live operating system that you can start on almost any computer from a USB stick or a DVD. It aims at preserving your privacy and anonymity, and helps you to: use the Internet anonymously and circumvent censorship; all connections to the Internet are forced to go through the Tor network; leave ...


4

Anyone who knows the private key will have full access and control of any coins stored at the corresponding address. When you put a password on a wallet or login account, that password is only for unlocking that instance of the wallet (it is possible to create another instance, that is not locked by your password). Once unlocked, the wallet will use the ...


4

What if a person has your private key? Then they have independent control over all the unspent Bitcoins associated with that private key. Once they have the private key there is nothing you can do to rescind their control (other than moving the Bitcoin into a new wallet before the other person does) How can that person interact with your wallet? They ...


4

who store the private key adresses of these seed phrases, The private-keys are generated from the seed-phrase by a mathematical function. There is no need to store a list of seed-phrases and corresponding private-keys. I suppose it is the wallet software provider No, you should be the only person to know or store your seed-phrase. Ideally it should not ...


Only top voted, non community-wiki answers of a minimum length are eligible