Topic: BitcoinSpinner - page 26. (Read 55544 times)

Thanks for the feedback.
The only thing under the 'transaction history' button is a 'use at your own risk' notice. I'll test on an emulator with 320x240 resolution and see if I can make it all fit and avoid scrollbars.

To answer the one item...

BitcoinSpinner operates with only one address. All spends are from that address, with all change going back to that address. I believe this address is generated when the app runs for the first time, and stays constant from then on.

That said, you could backup the (single-address) wallet, then uninstall and reinstall the app. That should cause the app to generate a new address, and by carefully backing up the current wallet and restoring the saved one, you can swap between two or more of them as desired. Probably not exactly what you want, but in a pinch, it may be helpful.

finally, newest version runs on 2.1. Many thanks, Jan!

this is awesome.

some remarks:

• my screen is 320x240. is there anything below "transaction history" button on main screen? the button is 2/3 visible and no scrollbar appears
• on the "send bitcoins" page, there is a scrollbar (generally it's good to have one), but if you can save one pixel somewhere, it would disappear, so that might be a slight beautification for small screens
• how to get a new receiving address?

thanks again for taking the effort to "port" to android 2.1

While a QR code is a nice solution, a slightly more convenient alternative would be an NFC chip. You would only briefly have to hold the phone over the pocket where the chip is. The QR code would still work fine with older phones.

Thanks!


Something like this has come up before, and it is on my list.
I am planning to add a simple and optional PIN code that you can enable in settings.
If enabled, the user would have to enter the PIN when:
1. Sending coins
2. Disabling the PIN feature
3. Changing the PIN
4. Making a QR-code backup
5. Exporting the private key

The PIN is not meant for securing the private key stored in the app. The key is stored in app-private data on the phone, and you can only access it if you gain root access on the device. Getting root access is not trivial.

To secure the private key against root access it would have to be encrypted with a non-trivial password of significant length. This would in my mind make the app very cumbersome to use.

The PIN prevents someone from grabbing your phone and leech it of coins, which is a very useful feature.

The best solution would be to not have the private key on the phone at all. You can achieve that by having several wallet backup QR-codes printed on laminated paper. One QR-code for petty change and another for larger sums. Whenever you need access to the fat wallet you restore it from a QR-code, do your spending, and restore your slim wallet from a QR code on top. This way the fat wallet is wiped from your device.

I think the goal here is not to get 100% security, but rather stop someone who just borrows your phone for 5 minutes to steal your money, or give you more time to empty your wallet from a back-up in case you drop your phone.
[/quote]

Yes exactly that's my goal.
I had a phone stolen once with a very weak password on my password vault. I haven't seen any fallout from that and I expect that is due to the thief not being too clever.

That said, proper encryption would be great. But of course I just thought I'd go for suggesting hopefully something easy that code might already be out there for. Of course it would need a warning on it along the lines of "This isn't secure protection and is designed for people casually picking up your phone. In the case of having the phone stolen you would need a backup of the wallet file and act quickly"

Then again, if someone knows what bitcoin is... perhaps they'd be quick enough to upload the wallet file to a server somewhere anyway right? hmm...

For the moment I think I will address this by using just a little petty cash on the app and recharging it from a savings account accessed via a ssh server with:

1) Perfect Paper Passwords
or
2) Google Authenticator installed on a different phone or with backup codes printed.

In fact, being able to use either of these 2 factor auth directly on the phone would be great.

Hope this helps for anyone interested in Bitcoin phone client security.

I think the goal here is not to get 100% security, but rather stop someone who just borrows your phone for 5 minutes to steal your money, or give you more time to empty your wallet from a back-up in case you drop your phone.

Implementations like this are way to naive: someone would just dump the content to their computer and have private keys ready to go. Private key encryption is the only sure way of protecting against theft, but using passwords with enough entropy is a hassle on a mobile phone...

First of all thanks, I'll be donating.

I think possibly an essential feature might be something to stop someone picking the phone up and emptying your wallet.

If anyone would be interested in helping with that here's a code snippet for some swipe code:
https://github.com/chriscoyier/Slide-to-Unlock

Perhaps the most simple implementation might be a swipe pattern required for sending a payment and if the user forgets the pattern the password can be reset by a 30 hour time delay, hopefully giving the chance to recover coins in the event of a stolen phone.

Version 0.5.3b is available:

• Support for Android 2.1 devices. Until now only 2.2 and newer devices were supported. This has so far only been tested in a 2.1 emulator, as I don't have a 2.1 device. Molecular has agreed to do thorough testing.
• Translated to Finnish. Kudos to Tomi Blomberg.
• The 'copy to clipboard' bug has been fixed. Previously your Bitcoin address was copied to clipboard when clicking 'copy to clipboard' on pages showing private key or backup QR-codes.

Enjoy

Awesome news! I will gladly test.

Molecular. You are right on all accounts.
I have tested the latest changes against a 2.1 emulator (I don't own a 2.1 device myself) and everything seems to work. The next version should be 2.1 compatible. My hope is thay you will thoroughly test on a real device.
Cheers,
Jan

The problem will not disappear on its own... a phone doesn't just update itself and there are actually people that don't buy a new one every year or two.

There's actually a cyanogen mod for my phone now (there hasn't been last summer when I last checked) and I'm going through the excruciating hoops to get it onto my device (backup, find old version of rom manager app (since newest doesn't run on android 2.1, whatever else needs to be done). That's not for everyone and his mom as you probably know. It's also dangerous (you can brick your phone). In addition to that, the process voids the warranty of the phone.

If BitcoinSpinner can be made compatible by linking against some other android.jar then this is a little work on the devs side (1 person) and _no_ work for many users, also the ones that don't even know what version of what? android? what is that? they have on their phone. Bitcoin should be not just for us geeks, you know.

Also think of the secondary phone market (like Africa, for example) that depends on used phones and therefore lags a couple of years technology-wise. Africa is a good example because bitcoin might find fertile grounds there.

I agree, if the effort necessary is high, it might not make sense. But you make it sound like I could just "install cyanogen" and everything is fine. Android 2.3 might even have higher resource demand than my phone can actually deliver.

For all those android <2.2 users: I tried electrum4a (based on python, should also work on 1.6), which works just fine. There's no .apk yet, so you have to go through some hoops to install it, ah, but hell, you can also just wait a few years, maybe someone makes an installer and the problem goes away.

No problem. It's hardly a mission-critical bug.

Why exactly do you want it to work on the old Android version? Perhaps you could update Android instead, which may anyway be the better way to go. Which type of phone is it? Have you checked http://cyanogenmod.com/ and other Android branches for support of this particular type of phone?

Given that this problem will disappear in very few years on its own, I have some understanding for not wanting to put extra effort into it.

because I'm hoping you can make BitcoinSpinner work on android 2.1. You said in another you'd try with the next update. But I guess above bug-fixes dont count as an "update", right?

Thanks for the report. The bug has been fixed by this change: http://code.google.com/p/bitcoinspinner/source/detail?r=38
The current release procedure requires two individuals to take action. One person for signing the app and one for updating it in the Android Market. This is a safeguard for minimizing the risk of one individual injecting malicious code. Right now the signing guy is off-line during Easter, so please be patient a few more days.

Found a new bug. I'm using BS version 0.5.2b on a Droid X.

I open BS with an address already in the clipboard (call it C.)

I goto my address book and select a friend's address (we'll call it F.) The menu appears, and I choose the option to show the QR code.

The QR code appears, and I press the "copy to clipboard" button. A quick dialog message tells me the address was copied.

But then when I paste the address to a field, either within BS or in another app, address F does not appear. Address C does not appear either. Instead, my BS receiving address is what is pasted into the field.

Repeated copying attempts produce the same result, even when I place other data into the clipboard before trying to copy an address.

Thanks, the transaction completed.

Was war's denn? Ein Fehler im BitcoinSpinner?