Topic: GreenAddress: open source multisig wallet service - page 9. (Read 28195 times)

Thanks for working on this. I look forward to testing it.

I am using an LG Motion 4G (MS770), running Android 4.0.4 (Ice Cream Sandwich).

mmortal03 thank you for the feedback

We have fixed some of the issues you mentioned and will release them soon in the next version on github.
Others have not been fixed yet and we'll look into them next.

Can you clarify what version of Android and mobile model you have please?

Thanks!

Some feedback on the Android app:

1.) First of all, I found the app to be very slow! It stays frozen at "Logged in!" screen forever. Sometimes it will freeze at 100% when using the encrypted mnemonic and password.

2.) In my opinion, having the default login requiring the user to type in the full mnemonic is beyond tedious. Using, say, a quick login pin along with the required two-factor authentication should be the default, not simply an option. I know you guys are going for a secure wallet, but *ever* expecting a user to type in a 24 word mnemonic as the default case, especially when hitting back by accident requires typing it all in yet again, is just overkill. Copying and pasting the unencrypted mnemonic isn't safe, but having to type in such a long mnemonic conditions users into choosing such "bad" usage cases.

3.) After I created the quick login pin in settings, I hit back twice, and the app crashed. It would then crash at every loading, so I had to uninstall and re-install, and type the mnemonic in all over again. I tested doing this yet again, and it caused the same result, so this IS a reproducible bug.

4.) Having the user find out that to verify their mnemonic backup requires them to have written down their "unencrypted" mnemonic, when they weren't told this, thinking that writing down the encrypted one would be enough, is bad usability design.  

5.) You can't copy the generated mnemonic to the clipboard so as to paste it elsewhere for backup purposes, therefore you have to write it all down by hand (or, usability wise, *type* it in if you have a laptop handy, because you'll ultimately want to message it back to yourself paste it in to log in with, lolol (see number 2 above)).

The inability to copy it to the clipboard may be by design, but at least allow copying the *encrypted* mnemonic to the clipboard (and even, say, e-mailing it out, a la Mycelium's backup feature)! Go ahead and warn users of any safety concerns of this, of course. Mycelium actually has the best usability design in this area as far as I'm concerned.

And, yes, one could use the QR code option to copy the mnemonic to a second device, but just as having a laptop handy to type it in in advance of needing to copy and paste it through some messaging service back to the phone, this also requires having a second device handy, which makes things even more tedious. It'd be better to be able to go through the initialization process efficiently all on the single device, without having a pen and paper, a second phone, or a laptop next to you. If avoiding self-referential device security concerns is the issue behind why this might be by design, then tell the user that they really should have one of those three secondary items on hand at initialization -- though, the copy-paste urge still remains if the mnemonic is the default.

6.) Speaking of copy/paste usability, GreenAddress doesn't allow you to paste codes into the various numeric input boxes within the app (and though this might be by design, not all such cases are needed, for instance, with Google Authenticator codes not being pasteable, which is silly).

7.) When setting up GA, the displaying of the QR code for the seed seems utterly pointless, as anyone is going to actually want the very camera of the phone being set up to see it, not another device! Some sort of camera recursivity simply defies the laws of physics, people!

8.) By the way, GA seemed utterly broken in my case. I would copy the seed, paste it into a GA instance. This apparently didn't result in functioning code generation, as none of my resulting authenticator codes that I then typed back into GreenAddress worked. Trying to type in the GA codes, btw, with the slowness of the app's numeric keyboard causing multiple numbers to not be inputted, then finally register at once, taking so much time such that the code had expired on me, was extremely irritating. Then, once I would get it typed in correctly, it'd STILL tell me it was invalid!

Posted a tutorial video on YouTube on how to install the GreenAddress wallet as a Chrome app from GitHub.

https://www.youtube.com/watch?v=zF3Xar5hJ_0

Installing from GitHub as per the video is useful for the following purposes:

• Avoiding the google login on the google chrome store
• Make sure you are running the open souce version
  
• Avoid autoupdates
• Play with the source code

re: YubiKey NEO

By open api i meant something we can freely integrate in our open source products.
Also, I wonder if we need to have any agreement with YubiKey before we integrate or not. I'll find out and keep you posted!

I'm very glad you like what we've done so far and that you like our plans for new features.

Feel free to spread the word/love

Glad to hear it, this was the only major concern I had. 


I really should have made it clear what I was looking for, instead of suggesting some sort of solution first. I was mostly talking about a simple recovery mechanism for a lost 2fa that didn't involve email or one's phone. You're already considering a paper-based 2fa, which sounds like an even better way to address this, so that's great!


I'm not sure what an "open" API is (please excuse my ignorance), but they do publish their API online. One method they support is OATH-HOTP based (very similar to Google Authenticator, except instead of the time they use a counter which is incremented after each new code). The only reason I thought of them is because I use them with LastPass (on my desktop). I was thinking they could be both a desktop and a mobile solution, but I don't really know anything about their mobile integration (it's NFC based).


I should have realized that, thanks for correcting me. Adding such an option would only lead to a false sense of security, please pretend I had never mentioned it in the first place. 

For what it's worth, I've been really impressed with your overall approach. I really hope GreenAddress gets the attention it deserves!

I don't think it should be optional, I agree that it can be safer it GA codes can't be reused not even within the window so we'll definitely make this change.


In a few words, do you want multiple GA? I don't think it makes sense to create them without asking you to confirm them. Too risky.
Or is this one GA plus some one time code to recover 2fa?

Just so that you know, we are also working on a paper 2fa, which shall contain a number of columns and rows and each with a number and a random series of these gets requested as 2fa.


Yubikey neo seems reasonable, I don' t have experiences with them but we'd have to check if they have some open API we can use and which apps to support unless it should be used with android only.

In terms of 2fa for login i would say that an option could be added for it although once they have the mnemonic the attacker can derive almost all addresess and find out information anyway.

To work around this hw wallets are best. We already support one and plan to support all major manufacturers.

Hi tryexcept, I have a couple of suggestions re 2fa I'm hoping you can consider.

The one thing that's keeping Google Authenticator a bit unsafe is that the same code can be reused (if it's within the same 30s window). This is something that could be abused by malware, and one of per-tx-2fa's biggest draws for me is safety from malware. I'm wondering if an option could be added to prevent the reuse of GA codes? I understand that some users would prefer not to have a once-per-30s rate limit, hence making it optional might be better than forcing it on everyone (although for myself the rate limit wouldn't bother me).

Second, how about an OTP option for 2fa? For example, I enable OTP as a 2fa method, and then ask GreenAddress to generate two or three OTPs which I store on Post-Its. I enable Google Authenticator, but I don't enable any of the other 2fa options because I consider them less secure. Now I've got a few OTPs that I can use to disable 2fa (or for any other 2fa-required action) if at some point in the future I lose my Google Authenticator, and at the same time I don't have to enable any other 2fa method.

Next, have there been any thoughts on 2fa hardware tokens, e.g. YubiKey NEO (which would work nicely with the mobile app w/o the silliness of having the second factor be on the same phone as the app)?

Lastly, how about an option to require 2fa during the initial login? The intent would be to prevent a loss of privacy in the event the mnemonic were compromised (e.g. via malware).

I look forward to your thoughts, thanks!

Well said, put this guy on ignore.

You have no idea what you are talking about do you, in all of your posts round this site you are just casually giving people bad advice in every thread I see you posting in. Sorry, but someone had to say it.

For example your moronic thread about making cold storage which involved making a paper wallet at blockchain.info  I don't know how some people can try and advise other people when they don't know what they are talking about.

Here, you are asking where are multisig wallets, IN A THREAD SPECIFICALLY DEDICATED TO A MULTISIG WALLET! I don't think it gets any more dumb than that, unless you really are a troll, but I don't believe you are...

How do you think Greednaddress.it are stealing your private key? This I am interested to know.

Hmm look good.

FrozenBit, why don't you have an SSL? Registration isn't working either.

Anyone have any thoughts on the security of this service?

Greenaddress IS a multisig wallet.
Why are there so much trolls?

 I would recommend if you have any coins in here you do what I did.

 PULL THEM OUT


 This guy is pulling an elaborate scam, and the service holds your keys!

 It appears GreenAddress is attempting to run a scam, or just using children tactics.

It appears FrozenBit has been brought into this mix somehow. I have greater assumptions of why this is, mostly because greenaddress is pointing fingers.

If this is about what was on the front page of reddit yesterday which I've been messaged about I never clicked on that link and didn't know in detail what it was about. If you respond to bad criticism by feeding the troll you're just hurting yourself. Don't point fingers, instead address it which I haven't seen you do. However, I can assure you we are NOT behind this.

 Anyway I invite you to read about our service http://frozenbit.io, and wait for launch. Since we're both multisig I don't see what you're complaining for. Multisig is about awareness. All of my talks with https://www.BitGo.com have been about spreading awareness not crying when someone comes into the mix who does things a little different. I think you could learn some things from that playbook.

 Anyway the Gist is, don't point fingers and address what this guy is saying. It's not that hard is it?

 Now you can put your finger down.

EDIT: Link to Greenaddress using deceptive buissness practices - https://bitcointalksearch.org/topic/m.7587965

EDIT: Link to Greenaddress using peddlers to hide that on reddit - http://www.reddit.com/r/Bitcoin/comments/29fdhu/greenaddress_is_using_peddlers_to_hide_bad/

 However, lawrence appears to be trolling, must not feed trolls.

EDIT: It doesn't matter if they're affiliated with FrozenBit or not. It's a matter of their opinion on what they see above, if you can't take criticism you're in the wrong business.

 To answer your questions

1.) Is that a question?

2.) Is that a question?

3.) Ok

4.) No, I just see this as something people just aren't doing. It's much easier to just let users control all their keys instead of lying to them.


Your more fake than your reddit accounts : http://www.reddit.com/r/Bitcoin/comments/29fdhu/greenaddress_is_using_peddlers_to_hide_bad/

You surely have no problem scamming people with a central server, do you understand how big of a risk your putting on people with that?!?

also did you already forget?

http://www.reddit.com/r/Bitcoin/comments/29fdhu/greenaddress_is_using_peddlers_to_hide_bad/

You have no problem using shills, and sock puppets. Do you think people are stupid enough not to notice?

You must of glossed over your criticism thread, alot of people saying they don't trust greenaddress.

Alsono one knows greenaddress, you have yet to make news. If you want multisig awareness don't cry over things, address them then start a campaign to spread awareness.


   -Calvin

Server assisted multisignature sir!

You should know, you are trying to create a multisig wallet yourself! Let us know if you want any tip of code sharing! We are on github!

I just noticed something disturbing?


"Server assisted bitcoin wallet which runs in your browser or on your phone or as a local unminified/inspectionable App."


 Server assisted, doesn't this mean you control all keys and could easily steal funds?

 I also just seen this on reddit:


EDIT: Link to Greenaddress using deceptive buissness practices - https://bitcointalksearch.org/topic/m.7587965

EDIT: Link to Greenaddress using peddlers to hide that on reddit - http://www.reddit.com/r/Bitcoin/comments/29fdhu/greenaddress_is_using_peddlers_to_hide_bad/


 I'd think twice before using greenaddress.

You can always set a Gauth code which you can keep in a safe place as a backup or you can set some other 2FA option.
To disable a 2FA you need 2FA so you are advised to configure two or backup your gauth if you use that alone.

what if i lose my phone (my "telephone number") , so i cant get the sms to the  Two factor authentication  ( so i cant make any "action"/change )
How can i access to my bitcoins  (for sending) ?