Topic: I think I can build a more secure web wallet than any other so far. (Read 1317 times)
I think using of web wallets can never be safe so i prefer just filling mine with the amount needed at a particular time and for that blockchain is doing well so far, so i guess another online wallet is not what's needed right now. Good luck with your project though and hope to see it soon in action.
March 29, 2014, 11:02:02 PM
greenaddress.it is more secure than your suggested method.
March 29, 2014, 10:09:41 PM
If you really after a web wallet, then watch out myTREZOR.
It will be as easy to use as any web application with no sign-up. Your keys will be in your hand, literally, in a high security special purpose device, safe from any hacks.
http://www.bitcointrezor.com/news/2014-02-10-mytrezor-bop-bitcoin-server
Here you have its first public demo in Berlin:
http://vimeo.com/90026733
It will be as easy to use as any web application with no sign-up. Your keys will be in your hand, literally, in a high security special purpose device, safe from any hacks.
http://www.bitcointrezor.com/news/2014-02-10-mytrezor-bop-bitcoin-server
Here you have its first public demo in Berlin:
http://vimeo.com/90026733
Agreed. TREZOR and other hardware wallets are strong security made simple, they're what's needed for bitcoin to go mainstream
I am really looking forward to the Trezor (I ordered 2 last year) but I think it will not be for everyone. The retail price for this thing is yet TBA and I doubt that it will be anything below $100! Not much for total security if you are a "whale" and have lots of bitcoins in your wallet, but too much for the bitcoin starter.
So there is still room for another "middle security" wallet solution, easy to use for the average joe but still secure enough so that it is not easily hacked.
March 29, 2014, 08:55:03 PM
If you really after a web wallet, then watch out myTREZOR.
It will be as easy to use as any web application with no sign-up. Your keys will be in your hand, literally, in a high security special purpose device, safe from any hacks.
http://www.bitcointrezor.com/news/2014-02-10-mytrezor-bop-bitcoin-server
Here you have its first public demo in Berlin:
http://vimeo.com/90026733
It will be as easy to use as any web application with no sign-up. Your keys will be in your hand, literally, in a high security special purpose device, safe from any hacks.
http://www.bitcointrezor.com/news/2014-02-10-mytrezor-bop-bitcoin-server
Here you have its first public demo in Berlin:
http://vimeo.com/90026733
Agreed. TREZOR and other hardware wallets are strong security made simple, they're what's needed for bitcoin to go mainstream
I am really looking forward to the Trezor (I ordered 2 last year) but I think it will not be for everyone. The retail price for this thing is yet TBA and I doubt that it will be anything below $100! Not much for total security if you are a "whale" and have lots of bitcoins in your wallet, but too much for the bitcoin starter.
So there is still room for another "middle security" wallet solution, easy to use for the average joe but still secure enough so that it is not easily hacked.
March 29, 2014, 12:33:04 PM
If you really after a web wallet, then watch out myTREZOR.
It will be as easy to use as any web application with no sign-up. Your keys will be in your hand, literally, in a high security special purpose device, safe from any hacks.
http://www.bitcointrezor.com/news/2014-02-10-mytrezor-bop-bitcoin-server
Here you have its first public demo in Berlin:
http://vimeo.com/90026733
It will be as easy to use as any web application with no sign-up. Your keys will be in your hand, literally, in a high security special purpose device, safe from any hacks.
http://www.bitcointrezor.com/news/2014-02-10-mytrezor-bop-bitcoin-server
Here you have its first public demo in Berlin:
http://vimeo.com/90026733
Agreed. TREZOR and other hardware wallets are strong security made simple, they're what's needed for bitcoin to go mainstream
I am really looking forward to the Trezor (I ordered 2 last year) but I think it will not be for everyone. The retail price for this thing is yet TBA and I doubt that it will be anything below $100! Not much for total security if you are a "whale" and have lots of bitcoins in your wallet, but too much for the bitcoin starter.
So there is still room for another "middle security" wallet solution, easy to use for the average joe but still secure enough so that it is not easily hacked.
March 29, 2014, 12:21:58 PM
If you are looking to build a secure wallet, you may take a look at the 2-of-3 multi signature approaches by trustedcoin.com and bitgo.com.
March 29, 2014, 08:52:04 AM
If you really after a web wallet, then watch out myTREZOR.
It will be as easy to use as any web application with no sign-up. Your keys will be in your hand, literally, in a high security special purpose device, safe from any hacks.
http://www.bitcointrezor.com/news/2014-02-10-mytrezor-bop-bitcoin-server
Here you have its first public demo in Berlin:
http://vimeo.com/90026733
It will be as easy to use as any web application with no sign-up. Your keys will be in your hand, literally, in a high security special purpose device, safe from any hacks.
http://www.bitcointrezor.com/news/2014-02-10-mytrezor-bop-bitcoin-server
Here you have its first public demo in Berlin:
http://vimeo.com/90026733
Agreed. TREZOR and other hardware wallets are strong security made simple, they're what's needed for bitcoin to go mainstream
March 29, 2014, 08:43:10 AM
Well you've got my attention and many others will come I'm sure. Wallet security is always a good thing and if you can outdo the current top wallets in you opinion I'd like to know more about it. Subscribed.
+1Agree with what you said, I also very the attention of the wallet safe.
March 29, 2014, 04:46:00 AM
If your service can withstand someone stealing your wallet.dat file without losing funds, you are headed in the right direction.
qt can withstands this as far as I know if you use a nice pass-phrase!
March 29, 2014, 04:42:15 AM
Wallet security is always a problem if more secure than it is now purse, I think is definitely good.
March 28, 2014, 04:34:25 AM
If your service can withstand someone stealing your wallet.dat file without losing funds, you are headed in the right direction.
March 28, 2014, 02:59:23 AM
Use a local wallet is the safest!
March 28, 2014, 01:48:39 AM
Well you've got my attention and many others will come I'm sure. Wallet security is always a good thing and if you can outdo the current top wallets in you opinion I'd like to know more about it. Subscribed.
March 28, 2014, 01:41:23 AM
If you really after a web wallet, then watch out myTREZOR.
It will be as easy to use as any web application with no sign-up. Your keys will be in your hand, literally, in a high security special purpose device, safe from any hacks.
http://www.bitcointrezor.com/news/2014-02-10-mytrezor-bop-bitcoin-server
Here you have its first public demo in Berlin:
http://vimeo.com/90026733
It will be as easy to use as any web application with no sign-up. Your keys will be in your hand, literally, in a high security special purpose device, safe from any hacks.
http://www.bitcointrezor.com/news/2014-02-10-mytrezor-bop-bitcoin-server
Here you have its first public demo in Berlin:
http://vimeo.com/90026733
March 28, 2014, 12:20:45 AM
So difference vs. blockchain.info is:
- no sending without 2FA
- GPG encryption of password
?
- no sending without 2FA
- GPG encryption of password
?
March 27, 2014, 05:22:23 PM
To become mainstream a simpler solution must be made, to encrypt, save it on external harddisk and use a os securer than windows. This might apply us that are into the technology, but others its to much hasle.
I don't really understand why anybody uses web wallets.
Use a local wallet. Keep it encrypted. Unencrypted keys are never stored, and keys encrypted or not never leave the local machine. Keep it on removable media and remove it when you're not using it. Then just run an OS more secure than Windows to keep keyloggers etc off of it.
I don't really understand why anybody uses web wallets.
Use a local wallet. Keep it encrypted. Unencrypted keys are never stored, and keys encrypted or not never leave the local machine. Keep it on removable media and remove it when you're not using it. Then just run an OS more secure than Windows to keep keyloggers etc off of it.
March 27, 2014, 02:17:26 PM
I don't really understand why anybody uses web wallets.
Use a local wallet. Keep it encrypted. Unencrypted keys are never stored, and keys encrypted or not never leave the local machine. Keep it on removable media and remove it when you're not using it. Then just run an OS more secure than Windows to keep keyloggers etc off of it.
March 27, 2014, 06:07:34 AM
If I build the following web wallet, it will be the most secure web wallet currently on the market. Agree or disagree ?
1. The client will be a 1 page backbone.js app deployed directly from the repository on github. The page would be signed with my PGP public key.
Why?
a. Because it would then be possible to write a chrome or firefox plugin to verify the wallet downloaded to your machine corresponds to the code on the repository. Blockchain.info has a form of this already but without the PGP signing.
b. If any third party such as github/cloudflare tampered with the wallet the user would be able to see and flags would be raised.
2. All javascript in plain text and easy to read. (unobfuscated).
Why ? Because the wallet is then open for peer review. Like all solutions that use cryptography peer review is the way to go.
3. No naked private keys stored on the server. No naked keys ever passed to the server.
Why ?
a. Search for “Bitcoin wallet hacked” on google then come back here.
b. Because there is no technical reason why we should ever do this again. And that includes exchanges too.
4. Users shouldn't pick their own passwords.
Why ?
a. Because a lot of users, pick either very week password or re-use passwords on other sites.
b. Because we can then pick passwords with sufficient entropy to properly encrypt private keys.
5. Users should not be able to send coins to the wallet until 2FA is enabled. All operations requiring spends should also be protected with 2FA.
Why ? To defend against malware such as key loggers.
6. A way for users to recover their wallet if the operator goes away.
Recovery procedure should be quick and simple. i.e. electrum passphrase.
1. The client will be a 1 page backbone.js app deployed directly from the repository on github. The page would be signed with my PGP public key.
Why?
a. Because it would then be possible to write a chrome or firefox plugin to verify the wallet downloaded to your machine corresponds to the code on the repository. Blockchain.info has a form of this already but without the PGP signing.
b. If any third party such as github/cloudflare tampered with the wallet the user would be able to see and flags would be raised.
2. All javascript in plain text and easy to read. (unobfuscated).
Why ? Because the wallet is then open for peer review. Like all solutions that use cryptography peer review is the way to go.
3. No naked private keys stored on the server. No naked keys ever passed to the server.
Why ?
a. Search for “Bitcoin wallet hacked” on google then come back here.
b. Because there is no technical reason why we should ever do this again. And that includes exchanges too.
4. Users shouldn't pick their own passwords.
Why ?
a. Because a lot of users, pick either very week password or re-use passwords on other sites.
b. Because we can then pick passwords with sufficient entropy to properly encrypt private keys.
5. Users should not be able to send coins to the wallet until 2FA is enabled. All operations requiring spends should also be protected with 2FA.
Why ? To defend against malware such as key loggers.
6. A way for users to recover their wallet if the operator goes away.
Recovery procedure should be quick and simple. i.e. electrum passphrase.
Jump to: