Topic: Beginner questions on wallets (Read 956 times)

Thank you for explaining; it really helps to get a bigger world picture that I did not have yet. As for creating a wallet where the dev doesn't have access to private keys in any way, the simplest would be one of the existing forms of wallets where the user keeps their private keys on their own computer. Of course, it is very important to remind and encourage users to make backups of their keys (whether on paper, in one's memory, and so on).

A determinstic wallet may be handy for this (where one phrase/key needs to be backed up and can be used to restore ALL addresses EVER created with that wallet). Electrum does this, as does Multibit HD. Non-deterministic wallets require frequent backups and more data to be backed up. See https://en.bitcoin.it/wiki/Deterministic_wallet (or ask here for further clarification if I missed something)



This is a complete duplicate of what has already been said in this topic, just worded less clearly. Are you just posting for your signature campaign?

In truth that is precisely one of the questions that I would like the answer to myself, so far I believe that most changes have to come in the user interface area where small but significant differences in concepts exist. For example a bitcoin wallet is commonly called a 'bitcoin account' here, that shows that people believe that bitcoin services are much more related to banks than they actually are, although this might sound like a bad thing one of the ideas I was exploring is making a wallet that feels like an 'account' of sorts. Also for a little context, many latin americans are unbanked and view the idea of having an 'account' as something of moderate luxury, also advanced financial services are very scarce so even if these might seem like obvious ideas keep in mind that there is no paypal or venmo for comparison. I am from Venezuela so most of my opinions are based on what I have learned living here.

P.S. From a regulatory standpoint here in Venezuela it would be much easier if a wallet can be created in which the developer does not have access to any private keys as having them could be a legal liability (they might consider you an unregistered bank = very bad news). I will probably be posting questions about this in the future.

Hope that was helpful, will be happy to answer any other questions on Venezuelan and Latin American bitcoin perception.

If I may ask, what are the features/changes that could be made to wallet software itself with Latin America in mind, beyond localization of the software's interface itself?

Wow very good replies in very little time, thank you very much. The reason why I'm asking this is not because I'm looking for a wallet (although that wouldn't be a bad outcome), I use bitgo for my 'hot' wallet and keep the rest of my coins in a trezor wallet, the reason is that I am a latin american entrepeneur and would like to see more bitcoin products (such as wallets) being made specifically with Latin America in mind, so I thought I might learn the important conceptual aspects of bitcoin storage, not to a point that I could program or anything but rather that I understand what is going on behind a front end so that if I work with a team of programmers something solid can be done. I did not know that this forum was such a great resource, thank you again for your help, I will continue posting questions on this topic and hopefully one day I'll be answering some too.

vitta

EDIT:  It looks like hexafraction types faster than I do.  I'll go ahead and post my response anyhow since I took so much time to write it, but if you've already read hexafraction's response then there isn't much need to read mine as well.


Blockchain.info does store your private keys, but they store them in an encrypted format. When you access your wallet, you supply the decryption password to the wallet software (or if you are using a mobile wallet, then the password might be stored in the software no your phone).  The wallet software running in your browser (or on your phone) then requests the encrypted keys from the blockchain.info servers.  The keys are decrypted in the local software and used for creating transactions.


Since the private keys are all encrypted with your password in your browser (or on your phone) before they are stored on blockchain.info's servers, anyone (employee or hacker) would have to crack your password before they could access your bitcoins. This is why it is very important to choose a strong password if you are going to use a hybrid web wallet like blockchain.info.

Note, that if the blockchain.info service (or some hacker) can trick you into running software that provides them with your password, then they can retrieve your encrypted private keys from the blockchain.info servers, decrypt them with the password you've provided, and steal your bitcoins.


A "full node" is software that doesn't trust any of the data that it receives from any peers at all.  It connects to peers on the network and starts with the genesis block hard coded into the software. Then validates EVERY transaction and EVERY block that it receives from peers.  Since every transaction requires valid inputs from the outputs of a previous transaction all the way back to the block rewards, the full node must download and process the entire blockchain.

There are a few different types of "lightweight" wallets.  The two main ones are client/server and SPV.

In a client/server wallet, the client software that you run stores your private keys and builds transactions, but it trusts a server that supplies it with information about what transaction outputs are available to it.  The server would be a full node that communicates with other peer full nodes on the bitcoin network to keep up to date with all the transactions and blocks.  A single full node server could then support many connected clients.

In a SPV wallet, the software connects to full node peers and looks at recent blocks.  The SPV wallet assumes that if a transaction is deep enough in the blockchain, and that multiple full node peers are all stating the same thing about the transaction, then it is accurate enough to be trusted.  As such, the SPV wallet trusts the peers that it is connected to to provide accurate information about the current blocks.


As long as the software is open source and well reviewed, you shouldn't need to just trust the developer.  If you have the ability, you can review the code yourself and make sure that the software doesn't do anything malicious.  If you trust someone that can review the code for you, then you can ask them to do so, or you can trust that someone in the community would point any issues in the code.

Blockchain.info DOES keep your keys, but encrypted so that they cannot access them. Whenever you log into the wallet, your browser downloads the encrypted keys, decrypts them locally, and uses them to sign transactions and the like. While this is good in theory in practice there have been multiple flaws such as RNG issues and so on. Most services will actually keep private keys around. It's advised to only keep as much as needed in those services and use a non-online wallet.


Not necessarily. You are correct that a 'heavy' wallet typically downloads the blockchain and validates it locally. However, 'light' wallets are of a few types. There is something called an SPV wallet, which is not dependent on a server run by the dev, since it can connect directly to Bitcoin nodes and request only certain information (block headers and those blocks that it would care about). There is a [/i]slight[/i] diminuition of security compared to a heavy wallet, but only under certain circumstances, and in a limited nature (IIRC an attacker can keep you from seeing transactions that would concern you, but they have no way to get your keys or steal your BTC). Additionally, there are true light wallets such as Electrum. They depend on a server (that has a full blockchain copy) to communicate to the Bitcoin network. However, due to the open-source nature of both the client and server software, there are plenty of servers available so no single point of failure exists.

Indeed they are. Thank you for asking!

Hi, I have some questions about bitcoin wallets and how they function. I'm not a developer but I would still like a somewhat technical response so as to better understand what it is that wallet services are actually doing. Sorry if this is not the place to post this stuff please direct me to the right place if it isn't here. As for the questions: Where are private keys stored in services like blockchain.info? Since they say that they do not keep them, how secure is this really, for example if we compare it to a service like bitgo o copay? Another question I have is related to 'lightweight' wallet clients vs 'heavy' ones, does this mean that the user simply downloads a software plus the blockchain (full node) and then does not depend on the developer in order to use his wallet, whilst a 'light' client means that the user is dependant on communications with the wallet provider since they are the ones ultimately running the node and thus can actually perform the transaction?

I hope these questions are sensible, thank you for your help.