Armory - Discussion Thread - page 51.

bitpop

legendary

Activity: 2912

Merit: 1060

Quote from: TierNolan on May 03, 2014, 10:09:54 AM

Quote from: bitpop on May 03, 2014, 01:59:50 AM

This also means new best practice is sending to offline wallet using an address created on there. Previously I got an address from the watch only copy.

Interesting, to say the least.

Is that being added to the next version or already in the current version?

There's no new feature per se

TierNolan

legendary

Activity: 1232

Merit: 1094

Quote from: bitpop on May 03, 2014, 01:59:50 AM

This also means new best practice is sending to offline wallet using an address created on there. Previously I got an address from the watch only copy.

Interesting, to say the least.

Is that being added to the next version or already in the current version?

bitpop

legendary

Activity: 2912

Merit: 1060

Quote from: jl2012 on May 03, 2014, 09:38:44 AM

Quote from: bitpop on May 03, 2014, 07:12:39 AM

Quote from: flipperfish on May 03, 2014, 07:05:25 AM

Quote from: bitpop on May 03, 2014, 01:59:50 AM

This also means new best practice is sending to offline wallet using an address created on there. Previously I got an address from the watch only copy.

Can you explain this a little further? AFAIK, the addresses generated on the offline wallet and the watch only copy are the same? Wouldn't be of much use otherwise...

A virus can compromise your watch only copy to generate addresses that aren't yours. This completely bypasses all security.

You could generate it then glance at the cold storage copy to make sure it's in the list. You may have to generate extra ones to get the number of addresses the same.

Is that a malware, or a bug in Armory?

Malware, armory is solid.

jl2012

legendary

Activity: 1792

Merit: 1111

Quote from: bitpop on May 03, 2014, 07:12:39 AM

Quote from: flipperfish on May 03, 2014, 07:05:25 AM

Quote from: bitpop on May 03, 2014, 01:59:50 AM

This also means new best practice is sending to offline wallet using an address created on there. Previously I got an address from the watch only copy.

Can you explain this a little further? AFAIK, the addresses generated on the offline wallet and the watch only copy are the same? Wouldn't be of much use otherwise...

A virus can compromise your watch only copy to generate addresses that aren't yours. This completely bypasses all security.

You could generate it then glance at the cold storage copy to make sure it's in the list. You may have to generate extra ones to get the number of addresses the same.

Is that a malware, or a bug in Armory?

bitpop

legendary

Activity: 2912

Merit: 1060

Quote from: flipperfish on May 03, 2014, 07:05:25 AM

Quote from: bitpop on May 03, 2014, 01:59:50 AM

This also means new best practice is sending to offline wallet using an address created on there. Previously I got an address from the watch only copy.

Can you explain this a little further? AFAIK, the addresses generated on the offline wallet and the watch only copy are the same? Wouldn't be of much use otherwise...

A virus can compromise your watch only copy to generate addresses that aren't yours. This completely bypasses all security.

You could generate it then glance at the cold storage copy to make sure it's in the list. You may have to generate extra ones to get the number of addresses the same.

flipperfish

sr. member

Activity: 350

Merit: 251

Dolphie Selfie

Quote from: bitpop on May 03, 2014, 01:59:50 AM

This also means new best practice is sending to offline wallet using an address created on there. Previously I got an address from the watch only copy.

Can you explain this a little further? AFAIK, the addresses generated on the offline wallet and the watch only copy are the same? Wouldn't be of much use otherwise...

bitpop

legendary

Activity: 2912

Merit: 1060

Quote from: superbit on May 03, 2014, 01:21:00 AM

Quote from: goatpig on May 02, 2014, 05:17:39 PM

He has 2 of these. One that is "online", used for email signing and encryption, one marked as "offline" used for release signing. Also you could try to verify the bitcoin signature.

How would I get an "offline" key?

http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x4AB16AEA98832223

bitpop

legendary

Activity: 2912

Merit: 1060

Quote from: marcus_of_augustus on May 03, 2014, 01:17:28 AM

Quote from: bitpop on May 01, 2014, 09:11:22 PM

Basically there's an attack they can't talk about yet, just get updated. The attack makes armory generate addresses from the virus.

This also means new best practice is sending to offline wallet using an address created on there. Previously I got an address from the watch only copy.

superbit

hero member

Activity: 763

Merit: 500

Quote from: goatpig on May 02, 2014, 05:17:39 PM

He has 2 of these. One that is "online", used for email signing and encryption, one marked as "offline" used for release signing. Also you could try to verify the bitcoin signature.

How would I get an "offline" key?

marcus_of_augustus

legendary

Activity: 3920

Merit: 2349

Eadem mutata resurgo

Quote from: bitpop on May 01, 2014, 09:11:22 PM

Basically there's an attack they can't talk about yet, just get updated. The attack makes armory generate addresses from the virus.

goatpig

legendary

Activity: 3738

Merit: 1360

Armory Developer

He has 2 of these. One that is "online", used for email signing and encryption, one marked as "offline" used for release signing. Also you could try to verify the bitcoin signature.

superbit

hero member

Activity: 763

Merit: 500

Quote from: goatpig on May 02, 2014, 04:15:36 PM

Which key are you verifying against? You should have Alan's offline signing public key in your key ring before doing this.

The one hosted at MIT? I do and it is marked as trusted.

goatpig

legendary

Activity: 3738

Merit: 1360

Armory Developer

Which key are you verifying against? You should have Alan's offline signing public key in your key ring before doing this.

superbit

hero member

Activity: 763

Merit: 500

What am I doing wrong to verify the file?

It looks like the key file is right?

bitpop

legendary

Activity: 2912

Merit: 1060

Basically there's an attack they can't talk about yet, just get updated. The attack makes armory generate addresses from the virus.

RoadStress

legendary

Activity: 1904

Merit: 1007

Quote from: etotheipi on May 01, 2014, 03:17:23 PM

Quote from: RoadStress on May 01, 2014, 02:59:42 PM

Quote

It is not necessary to upgrade any offline computers just to check wallet consistency.

How do we do that from the Armory menus? Or just restart Armory?

I have upgraded to 0.91.1 and it checked for my wallet consistency when i started it. Guess i don't have to do anything else.

Notice it says not necessary

If all your hot wallets and watching-only wallets have been loaded on 0.91 or 0.91.1 before, and no notification popped up, no further action is required. I would guess that 99%+ users will pass this check without issue. And of those cases with consistency issues, the recovery tool can fix most of them.

Will post more information about this soon. Working on getting an announcement page up and distributing notifications to older versions.

Somehow I understood that an upgrade isn't necessary, but we still needed to check the wallet consistency. I got it now. Thank you.

etotheipi

legendary

Activity: 1428

Merit: 1093

Core Armory Developer

Quote from: RoadStress on May 01, 2014, 02:59:42 PM

Quote

It is not necessary to upgrade any offline computers just to check wallet consistency.

How do we do that from the Armory menus? Or just restart Armory?

I have upgraded to 0.91.1 and it checked for my wallet consistency when i started it. Guess i don't have to do anything else.

Notice it says not necessary

If all your hot wallets and watching-only wallets have been loaded on 0.91 or 0.91.1 before, and no notification popped up, no further action is required. I would guess that 99%+ users will pass this check without issue. And of those cases with consistency issues, the recovery tool can fix most of them.

Will post more information about this soon. Working on getting an announcement page up and distributing notifications to older versions.

RoadStress

legendary

Activity: 1904

Merit: 1007

Quote

It is not necessary to upgrade any offline computers just to check wallet consistency.

How do we do that from the Armory menus? Or just restart Armory?

I have upgraded to 0.91.1 and it checked for my wallet consistency when i started it. Guess i don't have to do anything else.

etotheipi

legendary

Activity: 1428

Merit: 1093

Core Armory Developer

Quote from: TierNolan on April 28, 2014, 11:52:48 AM

Quote from: etotheipi on April 28, 2014, 11:43:17 AM

This is already supported by the lockboxes! All parties in a lockbox can be offline keys, created separately and independently. Each party individually manages their own wallet holding that key, including all the regular methods we have backups... yes you can do a 2-of-4 lockbox between 4 parties, and each party can do a 3-of-5 fragmented backup of their individual wallets (which hold the key).

Cool, I need to do some forum searching.

https://bitcointalksearch.org/topic/teaser-multi-sig-lockboxes-now-with-simulfunding-559776

TierNolan

legendary

Activity: 1232

Merit: 1094

Quote from: etotheipi on April 28, 2014, 11:43:17 AM

This is already supported by the lockboxes! All parties in a lockbox can be offline keys, created separately and independently. Each party individually manages their own wallet holding that key, including all the regular methods we have backups... yes you can do a 2-of-4 lockbox between 4 parties, and each party can do a 3-of-5 fragmented backup of their individual wallets (which hold the key).

Cool, I need to do some forum searching.

Topic: Armory - Discussion Thread - page 51. (Read 521749 times)