Topic: BitcoinSpinner - page 19. (Read 55489 times)

BitcoinSpinner v0.8.0b is out. You can download/upgrade it from the Google Android market (god know why, but they call it Google Play these days), or fetch it directly from the project site. The differences may seem subtle, but it is backed by 1 1/2 months of hard full time work where most of the time has been spent on the backend system.
User visible changes:
 - Even faster: The next generation BCCAPI is simpler, has fewer lines og code, requires fewer server roundtrips during startup, while being as secure as before.
 - In addition to displaying "coins on the way to you" on the main screen it also displays how many coins you are currently sending.
 - Transaction history color coded to make it easier to distinguish receives and sends
 - Transaction history now displays the address you received coins from instead of displaying which address you received the coins with.
 - Better error messages when trying to spend your last coins while you cannot afford the miner fee.

BitcoinSpinner is now backed by another version of the BCCAPI, which makes it much easier to manage multiple redundant servers as they no longer need to share anything but the block chain.  I will maintain backwards compatibility with version 0.7.3b for about a month, leaving people time to upgrade, whereafter I'll scrap the old server. This allows me to manage multiple redundant copies of the new backend, which has been requested by several.
 
Enjoy

Isn't the key encrypted with the pin when stored on non-volatile mem?

I know Jan said it's trivial to brute-force that, but still, it'll add some time, right?

The only other attack I can think of against BitcoinSpinner is extracting your backup wallet which is the same as getting your private key, which is probably more a problem of your phone or OS more than the software itself, (or if some malware gets root on your android phone, because of some stupid game you installed that wasn't in the google play store, that you picked up from some random web site = this is now user error.)

Is there a server outage or problem about now?
I made a transaction at 5:11 Pacific time (for 0.40950000) and an hour later it's still unconfirmed.
The transaction doesn't show up in block explorer.
The app seems to think it's talking to the server just fine and I'm not having any network trouble.

The wallet address is: 152U2YVT27mWTbnDT5XnWxeGSjmr2Dk9e5

I am currently in negotiations with a company in the Bitcoin world around this. I am sorry, but I cannot say more right now.

Wow, solomining, I wish I was around back in those days.
Nice PIN workaround  
Keeping BitcoinSpinner simple and secure is on the top of my list.

uhm ok, jan. I can see why you would use bitcoinspinner as savings wallet. I don't. I have 4 levels of wallets:

• brainwallet for long-term savings
• satoshi client for mid-term stuff and to retain glorious early mining history (I actually mined a block solo)
• electrum for shopping or whatever, everyday use
• bitcoinspinner for on-the-go action

I'll load up bitcoinspinner with what I suspect I could need before getting back home. As you saw personally in London when you looked at my phone this can be quite a lot, though

I want to retract my suggestion of "alternating pins", because I have found a nice workaround:

• enter first half of PIN
• turn 180 degrees
• enter second half of PIN

thanks for your consideration, though.

keep it simple ;>

I have restarted the phone, however problem persists, did a screenshot. After I reinstalled bitcoinspinner and restored the backup, the button worked until the moment i activated hardware keyboard. Since that it doesn't work anymore again. I'm using sony xperia mini pro with qwerty hardware keyboard.

I have two different QR-code backups for BitcoinSpinner, each is for a different wallet (savings/spending wallet)
Whenever I am running low on coins on my spending wallet I do this (at home):
1) restore the backup of my savings wallet by scanning a QR-code
2) send some coins to my spending wallet (I have the address in my address book)
3) restore the backup of my spending wallet

Whenever you restore a wallet the previous wallet is wiped from the device. This way no one can get to my savings wallet unless they do a firehose attack in my home.

The way to create two QR-code backups:
1) Install BitcoinSpinner
2) Make QR-code backup
3) uninstall BitcoinSpinner
4) Install BitcoinSpinner (new random address generated in each install)
5) Make QR-code backup

Now you can switch back and forth by just scanning a QR-code.  

Good to hear that your bitcoins survived a mainboard replacement. I haven't heard about the Send button being permanently disabled before. Try and restart BitcoinSpinner (it is not enough to exit the application). You can stop apps somewhere in system settings, or alternatively restart the phone. Let me know whether that helps.

If you have access to the mainboard and the right skills/equipment I am pretty sure that you can get to the keys. However, encrypting the keys with the 6 digit PIN doesn't really help, as brute forcing it is trivial. Having the user enter a very long passphrase on a phone is not feasible (you need about 128 bits of entropy), and people are notoriously bad at choosing "safe" passwords.
If you use BitcoinSpinner to store more coins than you are comfortable loosing from a physical attack I suggest that you have two different backup QR-codes. Switching between them is as easy as scanning a QR-code. Once you scan a different backup the old keys are overwritten.
This is what I do myself, and it works really well.

I don't understand what you mean with 2 qr-code backups?

Hmm.. I am not sure I like it. If some guy can observe you enter one PIN he can also observe you enter two. Also, I'll have to remember two PINs, and get frustrated whenever I enter the wrong one, which will happen 50% of the time as I cannot possibly remember which one I use last time. In the end my head will explode.
In the end I think it is much better to have two QR-code backups. The one with the large amount is only loaded briefly to recharge the other.

I recently had an idea:

how about having 2 pins which have to be entered alternatingly.

That way, if some dude sees you enter pin and takes your phone it wont help him because next time he'll need the other one and you have enough time to move the coins.

Hello,

my phone came from warranty repair with replaced mainboard (= completely wiped), I upgraded it to android 4, reinstalled bitcoinspinner and restored it from backup. Now all looks fine, only the "Send Bitcoins" stays always disabled, no matter what amount I put in.

Version 0.7.3b
System version: 4.0.4

And I have a question: Seems like the old mainboard was not dead completely, perhaps only battery management circuits failed. If I connected the phone to a PC, it did detect it. In this situation, would someone examining the board be able to extract the private key? If yes, it would be worthwhile to add passphrase encryption to bitcoinspinner.

h jan,

thank you for your effort.

what will happend if the server is not reachable ?
will the bitcoin spinner app has also a malfunction ?
can i have access to my bitcoin wallet and bitcoins ?

what is happend in this case ?

regards
pazor