Pages:
Author

Topic: Coming Soon! impossible to steal wallets - page 2. (Read 6546 times)

hero member
Activity: 686
Merit: 564
October 27, 2011, 06:26:30 PM
#54
I already have such a utility on my linux box, and I use if regularly:

  shred -u ~/.bitcoin/wallet.dat

Nobody's stealing that fucker!
There was actually someone on here that claimed to have recovered a wallet he accidentally deleted using shred - it's not guaranteed to actually protect you.
legendary
Activity: 1512
Merit: 1049
Death to enemies!
October 27, 2011, 06:01:32 PM
#53
As far as keepeing wallet.dat on TrueCrypt encrypted volumes goes, it helps only against thug who might steal your computer. For Bitcoin to operate you need wallet.dat to be acessible, so the truecrypt volume must be mounted. And when mounted, truecrypt volume is acessible to any software, including malware. Even more, malware can capture your truecrypt password and steal the truecrypt container to be mounted later.

And no source available = security trough obscurity = no real security at all. Don't waste your time, there are enough false security software out there, such as Kaspersky, Norton and NOD32, better learn more about real life security.
hero member
Activity: 616
Merit: 500
Firstbits.com/1fg4i :)
October 27, 2011, 02:06:02 PM
#52
If it is not open source - forget it.... just don't spend your time on it you will not get a dime out of it...


people that make anti-viruses or firewalls do not make them open source as that would defeat the point. With the source, people would work out ways around it.

It wont be open source, if you dont trust it, dont install it. Dont install anything ever again, why have you got an OS installed if its not open source?? have you installed anything in the past year that isnt open source?? i wouldnt trust it then if i were you.

...


I'm already suspicious of programs that make absurd claims about protecting my whatever, it's even worse when it's a paid closed source system from a random individual. I haven't installed, much less trusted, anything like that, your thing won't be the first.
vip
Activity: 1386
Merit: 1140
The Casascius 1oz 10BTC Silver Round (w/ Gold B)
October 27, 2011, 01:07:02 PM
#51
My Bitcoins are already protected against theft and I don't have to trust a 3rd party for their security.

I've created about 100 Bitcoin addresses off-line. I've divided my Bitcoins into manageable denominations and distributed the Bitcoins to those off-line addresses.

The private keys have been GPG encrypted and encoded to QRCodes. Those QRCodes have been printed to paper and distributed to several locations online and in the real world.

As I need to spend Bitcoin, I only need to import an address at a time until I have my needed funds. The rest remain off-line - safe.

It was a very tedious and scary process, but I did a lot of testing to ensure my procedure. I would not wish this on any n00b. Any solution to protect someone's Bitcoins needs to be a self reliant process, with redundant outputs, and no requirement for 3rd party trust. I am confident that some developer will soon make this process an easy, "click here" solution for the average user to benefit from.

That has already happened.  Go to www.bitaddress.org, save his single .htm file, put a copy on an offline machine that's connected to nothing but a printer, and voila, you have a secure paper wallet factory complete with QR codes.
hero member
Activity: 527
Merit: 500
October 27, 2011, 12:26:51 PM
#50
The only really secure way to use a wallet is to use some trusted computing platform, like a smartcard. This could be done when bitcoin supports this new transaction type which requires two or more signatures. One of the required keys could be stored on the trusted platform (and NEVER LEAVE IT) and add the additional signature to the transaction. Correct destination address and amount of coins must be verified and confirmed on the trusted platform (like with this smart cards who have a display and buttons). The finished transaction is transfered back to the computer and then send to the network.

THIS is secure. Anything else is just making it more anoying to malware to steal the wallet.

lol @ protecting the wallet with truecrypt. Of course it's a good idea to encrypt your wallet, especially when putting it on some external storage, but it won't help against the most likely attack scenario, and that's a trojan on the computer.
hero member
Activity: 938
Merit: 1002
October 27, 2011, 12:24:34 PM
#49
people that make anti-viruses or firewalls do not make them open source as that would defeat the point. With the source, people would work out ways around it.

Well, it's hardly a measure for anti-viruses. And firewalls? What part of them are obscure?

It wont be open source, if you dont trust it, dont install it. Dont install anything ever again, why have you got an OS installed if its not open source?? have you installed anything in the past year that isnt open source?? i wouldnt trust it then if i were you.

If I run something that isn't open source, I run it as a user with few privileges. I do the same with software that isn't popular, even if it is open source, so being oss is not an automatic protection.

Have you put funds on mtgox or tradehill recently? how can you trust it without full password access to their servers and bank accounts?

You can't trust them fully, can you... You'd also need the source code for their brains. That's a whole different mechanism.

I bet 99% of you didnt check the source code for the bitcoin software anyway, let alone check the signature. I could easily post source code to a trojan and remove all the trojan bits, and no one would notice for some time.

That's not the point at all. Obviously enough people check Bitcoin sources and all commits are distinctly visible. You can't sneak in malicious code easily. If you are talking about compromised servers or MITM, that's also a different issue altogether.

I know people will still use it. Probally be a bit wary of it at first, but once it gains enough reputation more people will trust and use it.

That's true. But without knowing the internals, we have to assume that it "could be" security by obscurity, so the system could be depending on reverse engineering skills of some people. After reading how you missed the point with firewalls, etc., I'd certainly worry about that.
hero member
Activity: 812
Merit: 1001
-
October 27, 2011, 12:24:32 PM
#48
Coming Soon! impossible to steal wallets

Is this based on some kind of unknown to masses magic or is it because once the coins are stolen they cannot be stolen again (not from the same person anyway)?

sr. member
Activity: 448
Merit: 251
Bitcoin
October 27, 2011, 12:17:22 PM
#47
I put all my bitcoin information in plain text on my microsoft front page websites,  no one bothers to view source Smiley

sr. member
Activity: 252
Merit: 250
October 27, 2011, 12:16:53 PM
#46
Everything can be stolen. EVERYTHING. You can make it harder, but not impossible. Keyloggers (hardware or software), code injection, cold boot attacks, and so on, will beat any encryption.

Here, get this tool: http://www.mcgrewsecurity.com/tools/msramdmp/ and have fun recovering your encrypted wallet private keys from memory.
donator
Activity: 1218
Merit: 1079
Gerald Davis
October 27, 2011, 12:00:49 PM
#45
My best bet? Truecrypt it onto a USB stick and stick the USB stick into a safe. Done.

Unless your computer is infected w/ a trojan.  When you insert the USB and unlock the truecrypt partion it has access to wallet.dat and your passphrase.

As indicated upthread securing "frozen" bitcoins is trivially easy.  No need even for truecrypt just print out the private keys or print out QR codes and put them in a safe.

Securing online, transaction ready wallet is more difficult.  Truecrypt doesn't add anything beyond an encrypted wallet.dat.
legendary
Activity: 1428
Merit: 1001
Okey Dokey Lokey
October 27, 2011, 11:47:53 AM
#44
If the computer is compromised, the malware can do anything, and this means anything! If it is specifically targeting one software (your Bitcoin "protection"), it will circumvent it and it's done!

Backing up file to network? Sounds bad idea. Even if the wallet is encrypted, the encryption keys should remain known only to owner of wallet.dat So the keys should be backed up by owner, prefereably on removalbe medium. So why not back up the whole wallet.dat on encrypted flash drive instead, and keep your system always clean and secure? With secure system the wallet can be in plaintext.

Keys should only be held in Cold Storage or Mental Memory,Almost Anything else will eventually be compromised.

Personally, i've never seen malware Find a TrueCrypt volume, But a Remote attacker would sure as hell know what to look for.
Want an IMPOSSIBLE to steal wallet? Stick it on a fucking CD, And stick the CD in a safe, Then mail the safe to a bank, then have the bank lockup, and go 100fathoms below into the ocean.
But that wont even work. Nothing is impossible to steal.

My best bet? Truecrypt it onto a USB stick and stick the USB stick into a safe. Done.
donator
Activity: 1218
Merit: 1079
Gerald Davis
October 27, 2011, 11:45:16 AM
#43
There is a way to make bitcoins safe,   we offer the cold storage option that the bitcoins are sent to a computer physically turned off...   but it's a manual process and we had to spend considerable funds securing a deposit box in the bank to store the USB keys,  rent an office with a security system just for the cold storage system,  get new servers only to be used for the backup process...

It's possible, just such a hassle...

Good points.  Paper wallet works equally well also.  Keeping "frozen" bitcoins (or deposit only accounts) secure is relatively easy.  Keeping funds ready to outgoing transactions secure is more complex.

Still anyone claiming something is "impossible to steal" knows nothing of security.  Hell the authors of AES or SHA don't even make claims like "impossible to crack" they use more realistic terms like "no know cryptographic flaws", "no pre-image vulnerabilities beyond 40 rounds".
legendary
Activity: 1428
Merit: 1001
Okey Dokey Lokey
October 27, 2011, 11:44:04 AM
#42
Okay i read, the first 5posts, Then Laughed too hard to keep reading.

"My software will make it impossible for the wallet to be accessed by anything other than the real bitcoin software."

Okay, So that means that if i try to right click on wallet.dat my comp should BSoD? Right?
LOL

Come the fuck on, Nobody listen to this drabble, Just toss your wallet into a TrueCrypt Partition and Voila, No matter how compromised your computers is(please challenge me on this lol), Whatevers in that TrueCrypt folder isnt going Anywhere.

I would love to see a virus/Remote user (or literally BADASS hacker) try to get inside a remote truecrypt volume.

The fucking FBI takes One Month to open a 6letter truecrypt drive(if you dont use the Noob encryptions), And thats when the comp is At Their Place, and they can do ANYTHING to it.
This is just so fucking funny.


"My software will make it impossible for the wallet to be accessed by anything other than the real bitcoin software."
That is impossible. lollololololololllllll.
legendary
Activity: 1512
Merit: 1049
Death to enemies!
October 27, 2011, 11:32:54 AM
#41
If the computer is compromised, the malware can do anything, and this means anything! If it is specifically targeting one software (your Bitcoin "protection"), it will circumvent it and it's done!

Backing up file to network? Sounds bad idea. Even if the wallet is encrypted, the encryption keys should remain known only to owner of wallet.dat So the keys should be backed up by owner, prefereably on removalbe medium. So why not back up the whole wallet.dat on encrypted flash drive instead, and keep your system always clean and secure? With secure system the wallet can be in plaintext.
sr. member
Activity: 448
Merit: 251
Bitcoin
October 27, 2011, 11:29:27 AM
#40
There is a way to make bitcoins safe,   we offer the cold storage option that the bitcoins are sent to a computer physically turned off...   but it's a manual process and we had to spend considerable funds securing a deposit box in the bank to store the USB keys,  rent an office with a security system just for the cold storage system,  get new servers only to be used for the backup process...

It's possible, just such a hassle...



donator
Activity: 1218
Merit: 1079
Gerald Davis
October 27, 2011, 11:25:21 AM
#39


True in most cases, however for things like a TPM a process doesn't have access to data stored inside the TPM unless it has also compromised the operating system.  I was just pointing out a second attack vector, even IF you could assure the private keys remain private a wallet could be compromised by transfering the value using the client.

a compromise of the OS, would'nt do anything. the TPM only does signing, it contains a private key, that the OS does not have access to.

True I spoke somewhat unclearly.   TPM doesn't have enough memory to store bitcoin wallet.  It also doesn't support the hahsing algorithms used by Bitcoin.  so TPM could only be used to hold the decryption key for a Bitcoin wallet.  A TPM aware OS will support a feature called protected memory.  TPM can indicate to the OS to dedicate some memory as protected memory and indicate which processes are allowed to access it.  This would allow a key in TPM to be given to a wallet running in protected memory to decrypt wallet, perform transactions, and then clear the protected memory.

If everything works correctly the key can only be accessed by the valid wallet application.  If the OS is compromised though it may not properly protect this "protected memory" allowing a trojan or other app.

The larger point is that even if the private key can be guaranteed to NEVER be lost/stolen/copied one still needs to protect the actual wallet applications otherwise malicious software could simply use the wallet to transfer funds out.
legendary
Activity: 1050
Merit: 1000
You are WRONG!
October 27, 2011, 11:00:13 AM
#38


True in most cases, however for things like a TPM a process doesn't have access to data stored inside the TPM unless it has also compromised the operating system.  I was just pointing out a second attack vector, even IF you could assure the private keys remain private a wallet could be compromised by transfering the value using the client.

a compromise of the OS, would'nt do anything. the TPM only does signing, it contains a private key, that the OS does not have access to.
donator
Activity: 1218
Merit: 1079
Gerald Davis
October 27, 2011, 10:50:31 AM
#37
That way if a Trojan were running on the system it could not copy or read the file. At least it would make it more difficult for the Trojan as it would have to circumvent or shut down the protecting process first, or it would have to directly read out of the memory.

Problem is, the trojan probably already elevated privileges to install itself. If it's got that permission on the system, it would be able to do anything else (like disable the "dont touch my wallet.dat" file protection process.

True in most cases, however for things like a TPM a process doesn't have access to data stored inside the TPM unless it has also compromised the operating system.  I was just pointing out a second attack vector, even IF you could assure the private keys remain private a wallet could be compromised by transfering the value using the client.

A truly secure wallet would:
a) be deterministic to avoid the need for backups and protect against loss.
b) prevent access to private keys by any process.
c) required 2nd factor authentication.
legendary
Activity: 1050
Merit: 1000
You are WRONG!
October 27, 2011, 10:45:51 AM
#36
when you release it, i will hack it in 10 seconds, or at least proof that there are a flaw in your system.

wanna a bet? 100btc, 1000btc?

Ill take it!
1000 BTC it takes you more than 10 second to hack or disprove my unhackable arhm.. I dont know, obfuscated file extension enhanced password protected zip file method. Ready when you are, Ill publish and you have 10 seconds. Deal?
typo! minutes?
hero member
Activity: 518
Merit: 500
October 27, 2011, 10:39:07 AM
#35
when you release it, i will hack it in 10 seconds, or at least proof that there are a flaw in your system.

wanna a bet? 100btc, 1000btc?

Ill take it!
1000 BTC it takes you more than 10 second to hack or disprove my unhackable arhm.. I dont know, obfuscated file extension enhanced password protected zip file method. Ready when you are, Ill publish and you have 10 seconds. Deal?
Pages:
Jump to: