Topic: MultiBit - page 24. (Read 336309 times)

Hi Jim,

regarding wallets and keys, I'd like to have the possibility to drag and drop an address from one wallet to another one (inside multibit) as a form of coin control.

For example: let's say that I got a sizeable sum from a trade on an address and I want to move that address to my encripted/safe wallet removing it from my day-to-day one which is not encrypted.

Would this be feasible?

There is a second question now, in the transaction grid I can resize columns but when I restart multibit, columns get resized back to their default. Can column sizes be made permanent?

Thanks!

spiccioli

It's probably simpler to allow wallets with no keys in so that the only key in there is the one you want.
In general there is not a single 'originating' address in Bitcoin.

There is little point in putting a warning in the import private key because:
+ the user may be doing something different: false positive warning
+ the user is focused on importing, not spending. The warning is 'far away' from where the mistake occurs.

congrats to the brilliant description of use case with imported key, spending and deleted wallet.
could you allow sending change back to originating address (if it was an imported address) in the long run?
that might save troubles to folks who import keys from paper wallets and expect the unspent balance to magically reappear there after use. or highlight this risk in the import key tab? I don't know if multibit internally distinguishes between imported and locally created addresses. electrum does distinguish between them but they use seed & deterministic wallet approach.
or keep hoping/wishing for educated user base?

I've found your instructions on manually importing keys on the Multibit.org site to be rather ammenable to bastardization for this purpose.

I didn't do this for noble purposes though. I just wanted a vanity profanity wallet...

Yeah I was going to put 0 as an option for the number of keys in the create wallet wizard.

I don't want to put the import key in the create wallet as it would just repeat the existing tab. 99% of the people going to a 'create wallet' wizard just want to create a wallet, if you see what I mean.

Jim

Thank you very much for your answer.

So, at least for that kind of person who want's to spend a fraction of a paper wallet, it will be much safer if he can create a wallet where the only key/address pair corresponds to the imported key from the paper wallet.
That will eliminate the possibility of change being sent to some other address.
1 address, and no room for errors when using a paper wallet.

Maybe the wallet wizard can suggest to set number of addresses = 0 if the user is planning to import a key from a paper wallet.

The ideal (in my opinion) will be that the wizard had an option to import key right there on the wallet creation, so that the first address will correspond to that imported key.

Thank you again for your answer,
and congratulations for the good work.

Your technique will work yes if you have all the steps (key creation, key encoding etc) working 100% and reproducibly.

Your usage is much more advanced than the average user for whom the idea of 'private key' is a bit fuzzy. One little error or typo with a private key and money can be made permanently unspendable.

Unfortunately in some of the support emails I have had people have lost bitcoin where they, say, import a paper wallet, send some bitcoin from their paper wallet (and change is sent back to their wallet) and then they have deleted their MultiBit wallet. The change address private key was deleted too.

MultiBit is targeted to people who want to buy stuff with bitcoin and send it, say, to their friends.
A lot of people rely on learned behaviour rather than a deep understanding of things.
You don't have to grok how a rollercoaster works to enjoy it. This is who MultiBit is for.

If you are the sort of person that knows 'jerk' is the derivative of acceleration and IT'S derivative is called 'jounce' then sure private keys are another tool for you to use.

For me, the main reason to import keys is: To use my own kind of deterministic keys. I know the dangers related to this approach, but I like the Idea that I can re-create (if I remember the how) my whole wallet, anytime, anywhere.
So, if for instance, someone completely loose access to the device were the wallet was installed, and lost all backups at the same time or event. That person can then, re-create, import keys, and have completely recovered the wallet.

The same situation applies if the person had the keys backed up somewhere (paper wallet for example).

So, for me, the ability to create a wallet completely from imported keys is a good feature to have.
And, If I know the approximate date when the keys where created, I can "Reset blockchain and transactions" from that date, and all transactions should be recovered.

Can someone correct me if I have something wrong?

Thank you!

I plan that when you click on 'New Wallet' you get a new wallet wizard in a tab.

There you'll be able to create a new wallet and encrypt it straight away. I will probably add a combo box to choose the number of addresses to add initially too. Also set the description.

The balance per address I would like to do but I dont think it will go in the next round of UI work (it is a bit of work under the surface).

For private key import/ export I don't think it will change. As Mike says, the way MultiBit / bitcoinj works you cannot just 'press a button' to import a private key. It is *so* easy to get confused with private keys.

Also TBH Armory does such a good job with more advanced private key work there is little point in duplicating it. If you want to do more than just 'backup your keys' and 'restore your keys' I recommend installing bitcoind and Armory.

Guys, importing keys is fraught with danger and there are lots of ways things can go wrong. If you want to switch from another wallet, the best way to do it is just send the money via a regular transaction.

There isn't an easy way to do what My Wallet does and just immediately show up a balance for an imported key, at least not in a purely peer-to-peer manner. It'd take a lot of work to change this unless Jim just relies on blockchain.info working and doing it for him. But then again, importing keys has many issues, so why would you want that?

Hi,

This is a features request (two things), It seems that you are already working on it, but anyway, what I will like to see is:

1- Add the possibility to create a completely empty wallet (no address/key in it), so then I can import the keys I really want to use.
 As it is now, we have to use the label to "DO NOT USE" an address, but it will be nice to just don't have unwanted addresses.
Other possibility will be that you add an option to delete a key/address pair from an existing wallet.

2- Show/view balance per address.

With that two features included, Multibit may have all I want for a bitcoin client.

Congratulations for the new site!   Looks really nice.

Hi Jim,

Will you be implementing a single-key import function somewhere in the future? so not how it currently is by exporting,editing and importing the file. But more how it works with mywallet, where you are just prompted for the private key and thats it.

Greets roland.

Norton has stopped blocking 0.5.9 and so I was able to install it today.
Thanks for simplifying the wallet encryption for people like me!

At the moment there is a 'chink in the armour' in that you cannot create an encrypted wallet directly, you create the wallet first, unencrypted and it has a single private key in it. Then you encrypt. This means in theory the first key could be read from your wallet unencrypted.

(I will be fixing this in the next round of UI work with a 'Create Wallet' wizard).  

To be sure that your private keys have never ever been written to disk unencrypted you have to:

1) create a wallet. This will have a single private key in.
2) add a label 'DO NOT USE' for that address just in case. Never use that address.
3) encrypt your wallet
4) add however many private keys you want.

Then when the wallet is saved the new private keys will be saved encrypted. They are only decrypted in memory when you do things like a spend or export private keys etc.

Other attack vectors you want to be aware of:
+ you accidentally install a Trojan wallet stealer (ie like from the fake MultiBit site I posted about today). Checking the installer signatures is a good way of spotting this.
+ an encrypted wallet gets stolen, and a keylogger sniffs your password. Malware getting onto your machine is the big problem here. If your machine is compromised then it is not safe to use Bitcoin on it IMO.
+ social attacks: you tell someone you trust your password and they break your confidence.
+ rubber hose attacks: someone knows you have a lot of BTC so they threaten violence against you.

For the last two I suggest you don't mention to anyone that you have that 1,000,000 BTC your Uncle Satoshi gave you for your birthday. Just don't mention it.


The other half of Bitcoin safety is BACKUPs.
I recommend:
+ add 'more than enough' addresses to your wallet (so your backups don't get invalidated by you creating more addresses)
+ close down MultiBit so all your wallets are written cleanly
+ make a TrueCrypt volume on a couple of USB drives.
+ copy all the .wallet, .info and .key files from your machine onto each of the USB drives.
+ store the backups somewhere safe, in two separate locations.

There are lots of variations you can do of course for backing up - the main thing is to have copies of your private keys somewhere safe.

Finally : Do not forget your password ! There is no backdoor to recover a wallet with a forgotten password.

I don't own a single coin yet, just looking at my options before pulling the trigger and buying.

So if I disconnect this PC from the net, create a new wallet with Multibit, inc password, then reconnect to the net, is there *anything*, anywhere, in the way of an unencrypted key? Anything in any temp folder, cache, anything like that?

Or in simple terms, is Multibit now as secure as the QT client or not? Or more secure?

(and I cannot use armory for various technical reasons)



thanks

You can import a single key, as outlined here:

https://multibit.org/en/help/v0.5/help_importASingleKey.html

It is not exactly what you want though as you want a watch-only address i.e. no private key present, only the public key/ address.
MultiBit does not support these yet.

You could import it into an encrypted wallet and the private key would be encrypted but that is not quite the same.

If you have a sizable amount in your offline address then I would not put the private key on your machine AT ALL for maximum safety. In which case MultiBit does not really give you what you want - probably Armory would be the best client for you as it has extensive offline capability.

Cheers

OK, thanks.

Is there any way of importing an address?

I created an address offline with that bitaddress thing, and am keeping my key offline. Is it possible to use multibit to see my balance for that address, even if it can't send/spend?

Yes it really means "encrypt your wallet" but I have simplified the language a bit for new users.

The encryption on the wallets is:
  scrypt to convert your password to an AES key
then
  256 bit AES encryption of your private keys.


The encryption on the private key exports is also 256 bit AES but it uses an openssl algorithm for the key derivation. This is so that you can use the command line 'openssl' to encrypt and decrypt them.

I think both bitcoind and Armory use 256 bit AES but am not sure how they convert their passwords to AES keys TBH. There are various different algorithms to do it.

Forgive the silly question but where it says 'add password', is that the encryption? And is so just how strong is it? Is it the same kind of 256 bit thingy as the main bitcoin QT thingy?


Thanks

Agreed it does not look right but it was the best I could come up with.
There are six visual elements:


< avail to spend BTC>

Only the top left two are guaranteed to be present.
The user may not have fiat conversions switched on.
The available to spend may be the same as the balance, so the bottom row disappears.
The width of the localised text varies.

I ended up right aligning the text, left aligning the BTC and left aligning the fiat. With the point size smaller for available to spend so that the balance was dominant.

Everywhere else the BTC amount is followed by the fiat amount in brackets to the right of it so I wanted to keep the same layout in the header.

You can flick quickly between the wallets using shift-up and shift-down. You want the absolute positions of the elements to be the same otherwise everything shimmies around as you move between wallets.