Topic: IDEA: Bitcoin address database (Read 2138 times)

This isn't forever, but this is better than the other ways, of just using firstbits which encourages more spam on the blockchain and payb.tc which we have no idea how it is stored. You have could easily put me out of business with a BCdns system, yet no one has taken that up so this is the best of centralized storing.

And you think the entire market is going to trust this position? For either of you?

Seriously, this needs a collaborative effort to built bcDNS into the protocol. We need to have simple bitcoin addresses people can send money to. It will help drive adoption and make us all rich.

But unfortunately, I don't think this is the way.

If you think you can change my DNS with social engineering please try, someone has already tried to hack it, and has failed... so please if you think DNS is the weakest point, then go ahead change it and own me, make me eat my words.

Also I am very trustworthy, and you don't even need to trust me cause that is what my system brings.

Dude you just said I use some fancy crypto to make it sound secure... That is slander, that is how I am taking it. DNS take over is very hard to do especially since the hosting, is hosting the DNS name servers and it would require taking over my account which the password is very strong, and a different username then this. It really unfeasible.


If you realized my service is to help the level of paranoia people that would being sending 1 or 1000 coins and checking sites and address a million times.


Actually that has nothing to do with anything my service is better in the encryption, market doesn't doesn't decide on facts, I am just stating facts. Also you don't need to spend $1million just more time

I'm actually with qxcn on this. The weakest link here is your DNS. Bit of social engineering at more than one failure point and you're in. Encryption isn't going to count for much.

You're actually providing a sort DNS service -- people using familiar names to look up an address. DNS for bitcoin. That needs *a lot* of trust.

This is a service that BitCoin desperately needs to drive adoption, but I don't see how it can be provided by a single party. No-one would trust a single company to run the Internet's DNS. Why should they trust someone for BTC?

In terms of trust, can you really run DNS on top of a web site? DNS should be the most basic, trusted service there is.

I think getting a Bitcoin DNS into the P2P network is what we really should be looking at.

Oh, sorry, I didn't describe how to use my mockup. Go to http://qcl.me/1. Then try http://qcl.phauna.org/1. That's all I've implemented -- the lookups from short name to long name. No alerts go off telling the user that the address they are looking up belongs to a hacker.

I'm not trying to slander, sorry if I've overstepped, or misunderstood you. I'm happy to give your security measures the benefit of the doubt. All I'm saying is that a hacker who owned your server or DNS could respond to queries with his own address(es), and it wouldn't be hard for the hacker to do it.


Okay, that's your business. Personally, I think the level of paranoia for sending thousands of coin should be sufficiently high not to trust *any* third party site to give you the address, regardless of their security practices.


I plan and hope to stay well ahead of the curve. It doesn't make sense for me to be as secure as the NSA right now.

Maybe you'll understand if I put it another way. There is a cost to each security measure. For a million bucks I could make the service very very difficult to attack, but it's obviously not worth that right now. The measures we've taken are a good match for the size and scope of the project right now.


oh, is that what this is about to you? I see our two services as not really competing -- they do different things (yours is a shortener, mine is an email-keyed database). If that's what this discussion is about for you, I'm done. I'm happy to let the marketplace decide.

Now your just slandering my security that I employ, that isn't cool. Also I wasn't talking about the URL obviously I was talking about the bitcoin address, if I submit a bitcoin address, I get a completely different bitcoin address, I think people would notice that.

Also I didn't make up any crypto, hashing and salting to cover up the shortname, yet still look it up, and AES-256 to encrypted using the shortname and a different salt, are straight forward techniques. Now that is different from saying I just made up some crypto to make it sound secure. I would never do that, and you can guarantee, I would stand by that with my rep. Also I never said it was impervious to a hacking, that would be impossible, but I have made it very difficult, and probably not worth the time of hacker. That would be the correct way to say it, and the only way I have said it during this entire thread.

Also with my rep I can say that sending 1000 coin with my service is probably the most secure out of the two and don't require much checking. Now stop with the slander and discuses this like you were doing before otherwise, I will stop responding cause that is just dirty.



Ladies and gentlemen this is the kind of security that is employed on a sub par site, for a sub par user. I think that is an insult, to your project and the users that use it, and I hope they see that. When you think a hacker will hack it then you will do something. I always have security in my mind, if 1 person is using it or a million, that what makes my service superior to yours.

To a degree you're right, but there's another side to it as well. Nobody would bother hacking our site right now, because with only a handful of users they're not going to earn any coin by doing so. So we're not a target. Once we have a significant number of users, the story starts to change.

Of course it's a different address, because I haven't taken over qcl.me. The point is that if I *did* hack your server or DNS, it would be trivial to put up a site that doled out bogus addresses, and yes, with all the right URLs. You continue to claim that this is somehow not true, even though I've just demonstrated that with 5 minutes of work I can get 90% of the way there. Please note also that I'm not claiming that thewalletlist.com isn't susceptible to this sort of attack. It is. I think it's important for site operators to only claim their site is as secure as it actually is.


Of course we don't store passwords in plaintext. We use bcrypt like anyone sensible. What I don't do is make up some crypto that I can't / am not willing to explain and then claim that my site is somehow impervious to hacking.


Don't get me wrong -- I think the security practices are decent at thewalletlist.com. Bcrypt passwords, public-key authentication to the server, etc. But I will also confess there's a little more we could do, in particular in terms of setting off alarms if there was a breach of security.

I'm confident enough that for reasonable amounts of coin, I'm happy to tell people "send it to my thewalletlist.com address." I would not ask someone to send 1000 bitcoins without triple-checking the address, whether it was determined through thewalletlist.com, qcl.me, or any other service.

Maybe so, and maybe all that fancy crypto you're using is doing something other than giving you a headache. But what it's not doing is stopping a hacker from responding to all queries with whatever bitcoin address he wants.


It really doesn't get too much more secure then this, if I had maybe special hardware to hold the database offline. So yeah. I see you run thewalletlist.com, with a guy whose site was hacked. Can you talk about your security? Do you have a verifiable database like my system?