Topic: Mycelium Bitcoin Wallet - page 85. (Read 586368 times)

I absolutely LOVE Mycelium.

Great to hear, thanks!

Open my SAFE, take out my paper wallet scan and the KEY QR code (This changes my cold storage from view mode to Send/Receive mode) I now send the small funds to my spending wallet and then DELETE the key rendering my cold storage wallet back to VIEW only mode.

This works of course, but there will be a slightly better way. Currently at beta test is a cold spending button, it allows you to scan the key, spend, and it deletes the key again after sending, so you don't have to remember to make the address watch-only again on your own, and the priv key never gets persisted.

My question is, this is pretty secure but if I had some trojan on my phone [I am pretty positive I do not]. BUT if there was a sophisticated trojan lying in wait that captures screenshots Eg; QR codes screenshots, then this is a Leak and can be compromised. (Is there some protection against this?) I know I am being a little paranoid , but it pays to be sometimes.

It is pretty secure, but not 100%, malicious code could in fact attempt to read the camera data, especially on rooted phones. Besides making sure to use a non-rooted, malware-free phone, you could use a BIP38 encoded private key to add extra security. Even if someone got that QR code (in which way ever), he would not be able to use it without knowing your password. When scanning such an encrypted key, Mycelium will ask for your password to decrypt it.

Quote from: Rassah on August 05, 2014, 01:49:07 PM

Is there somehow signing transactions offline. I LOVE mycellium and would love to keep using this.

Not yet

Newar

legendary

Activity: 1358

Merit: 1001

https://gliph.me/hUF

Quote from: Newar on August 03, 2014, 01:23:03 AM

Minor bug report:

In "Settings" the explanations are cut off after 4 lines of text. (look at "Expert mode" and "Aggregated View" for example)

I can see all 4 lines on my device. May be device specific (I'm on Nexus 4)

I can see all 4 lines too. However if you try and read the text you'll notice that the sentence is cut off and doesn't make sense.

Code:

With aggregated view you
operate on all keys and
addresses in parallel. With
segregated view you operate

gtraah

sr. member

Activity: 420

Merit: 250

Hi Guys,

I know this possibly was covered in the 40 pages somewhere...

I absolutely LOVE Mycelium.

I have a paper wallet cold storage, where the only time this has ever been online was on my Phone, for no more than 40 seconds and then removed again.

I have this cold storage in VIEW only mode. I have used it once to send a small amount out into my daily spending wallet. How I do this is : Open my SAFE, take out my paper wallet scan and the KEY QR code (This changes my cold storage from view mode to Send/Receive mode) I now send the small funds to my spending wallet and then DELETE the key rendering my cold storage wallet back to VIEW only mode.

My question is, this is pretty secure but if I had some trojan on my phone [I am pretty positive I do not]. BUT if there was a sophisticated trojan lying in wait that captures screenshots Eg; QR codes screenshots, then this is a Leak and can be compromised. (Is there some protection against this?) I know I am being a little paranoid , but it pays to be sometimes.

Is there somehow signing transactions offline. I LOVE mycellium and would love to keep using this.

Rassah

legendary

Activity: 1680

Merit: 1035

Quote from: Newar on August 03, 2014, 01:23:03 AM

Minor bug report:

In "Settings" the explanations are cut off after 4 lines of text. (look at "Expert mode" and "Aggregated View" for example)

I can see all 4 lines on my device. May be device specific (I'm on Nexus 4)

Quote from: trasla on August 04, 2014, 06:51:04 AM

Quote from: RoadStress on August 01, 2014, 09:34:18 AM

...here's a possible scheme: generate the private key, encrypt it with gpg, import it to mycelium through the clipboard, and decrypt it in mycelium.

Would it help if we would accept BIP38 encrypted private keys from the clipboard?
I somehow feel like a "enter priv key" button is something which would never get used...

I was just about to suggest that. We already support importing BIP38 keys from QR codes, so why not from clipboard?

trasla

hero member

Activity: 707

Merit: 500

So you can actually send the change to the same address where it came from? I had no idea about this and now it seems strange that the bitcoin-qt client was using a separate address for change which caused a bit of problems. Tell me more about the aggregated mode. I see that I can have multiple keys/addresses, but from the looks of it I can only send money from a single address, not multiple so the change address is always the same. Am I wrong? Can you send money from multiple addresses in one transaction?

Yes, change can get back to the address it came from. It is considered good practice to use new addresses for everything, and in fact we will do that once HD gets released.
At the moment, when expert mode is activated, you can switch between segregated and aggregated view, when aggregated view is active your balance will be the total of all your addresses balances and when sending coins those addresses will all be used as necessary, so yes, a transaction can contain inputs and outputs from different addresses.

Quote from: Newar on August 03, 2014, 01:23:03 AM

Minor bug report:
In "Settings" the explanations are cut off after 4 lines of text. (look at "Expert mode" and "Aggregated View" for example)

Thanks, I put an entry into our bug tracker, will have to check how long which translations are

Quote from: Newar on August 03, 2014, 01:09:09 AM

I'm also not sure if the "share" function makes use of the clipboard.

It does not

The devs are busy working on the upcoming HD implementation, and I wouldn't want to distract them from that.

Nice thought

But while everything compiles, I can read through bitcointalk without cutting back on HD dev time

Quote from: validium on August 01, 2014, 12:29:44 PM

...here's a possible scheme: generate the private key, encrypt it with gpg, import it to mycelium through the clipboard, and decrypt it in mycelium.

Would it help if we would accept BIP38 encrypted private keys from the clipboard?
I somehow feel like a "enter priv key" button is something which would never get used...

How does one get to be a beta tester? i can volunteer if you want. Just to show my love for this app.

Great to hear, just follow the steps as already posted by Newar (thanks for that).

Newar

legendary

Activity: 1358

Merit: 1001

https://gliph.me/hUF

Minor bug report:

In "Settings" the explanations are cut off after 4 lines of text. (look at "Expert mode" and "Aggregated View" for example)

Newar

legendary

Activity: 1358

Merit: 1001

https://gliph.me/hUF

Quote from: RoadStress on August 01, 2014, 09:34:18 AM

Quote from: RoadStress on August 01, 2014, 03:31:15 AM

How is the change managed in this wallet?

In segregated mode, change is sent back to address where the inputs came from. In aggregated mode, change is sent to the address which provided the biggest total sum of inputs to the transaction. In upcoming HD accounts, a new address will be derived from the master seed on the 'internal addresses branch' for each change.

So you can actually send the change to the same address where it came from? I had no idea about this and now it seems strange that the bitcoin-qt client was using a separate address for change which caused a bit of problems. Tell me more about the aggregated mode. I see that I can have multiple keys/addresses, but from the looks of it I can only send money from a single address, not multiple so the change address is always the same. Am I wrong? Can you send money from multiple addresses in one transaction?

An example:

Add1 1BTC

Add2 2BTC

Add3 4BTC

In aggregated mode you can send 6.5 BTC and the change will go back to Add3. It doesn't matter which one you select. The selected key is there for receiving purposes only in aggregated mode. If you select a key in the Keys tab there is a short pop-up message explaining this when you select a key.

Newar

legendary

Activity: 1358

Merit: 1001

https://gliph.me/hUF

Quote from: validium on August 01, 2014, 12:29:44 PM

How does one get to be a beta tester? i can volunteer if you want. Just to show my love for this app.

https://github.com/mycelium-com/wallet/blob/ac7a6be60a735fae9dd4bb7a7b1284ceed875ba4/README.md

Quote

Beta channel

In order to receive updates quicker than others, you need to do two things:

to be eligible for testing you need to join the g+ group at

https://plus.google.com/communities/102264813364583686576

after joining, you need to explicitly enable beta versions for the software at

https://play.google.com/apps/testing/com.mycelium.wallet

Newar

legendary

Activity: 1358

Merit: 1001

https://gliph.me/hUF

Quote from: Opperdienaar on August 02, 2014, 11:36:51 AM

In general, it would be worthwhile to have the ability to work in text.

[...]

There's manual entry for the address when sending already, so maybe that could be added to private key import. Then you just have to flick between the app windows. Talk about _work_

This app can "scan" QR codes from image files: https://play.google.com/store/apps/details?id=appinventor.ai_progetto2003.SCAN&hl=en

You then still have to "share" the result with Mycelium, which was talked about before (for addresses anyway), but there are some URI issues, IIRC. It'll be even worse with private keys as I think there is no URI for them at all.

Could Mycelium be set to MIME type text/plain (AndroidManifest.xml) ? Of course it would then show up in the chooser every time you want to "share" plain text within apps.

I'm also not sure if the "share" function makes use of the clipboard.

birr

hero member

Activity: 870

Merit: 585

In general, it would be worthwhile to have the ability to work in text.

As a special illustrating case, and if you read my post attentively, the device generating the key to the brainwallet may be the same device running mycelium. In this case it's impossible to use a qr code.
Or there might be people who still use mobile devices without a camera.

One can generate a private key on his tablet and copy it to clipboard, but this entails prohibitive risk, so for all practical purposes mycelium now can only import a key in the form of a qr code (from a second device or from a paper wallet).

The devs are busy working on the upcoming HD implementation, and I wouldn't want to distract them from that. But just to move the conversation along, here's a possible scheme: generate the private key, encrypt it with gpg, import it to mycelium through the clipboard, and decrypt it in mycelium. I'm not suggesting the devs should devote resources to implementing symmetrical encryption for text private keys, I just want to bring attention to the issue of importing text.

Maybe there's a simple and secure way of importing text which wouldn't be too hard to implement. Surely there's no harm in considering it.

Newar

legendary

Activity: 1358

Merit: 1001

https://gliph.me/hUF

Import of private key from clipboard is disabled. You can only import through a QR code, but as far as I know, there is no safe way to generate a QR private key without using some web interface.

It's not disabled (v1.2.12), but as long as there is no private key in the clipboard, the button will be greyed out.

There are offline QR generators, such as QtQR, I'm sure there are some for Windows too.

Opperdienaar

newbie

Activity: 2

Merit: 0

Import of private key from clipboard is disabled. You can only import through a QR code, but as far as I know, there is no safe way to generate a QR private key without using some web interface.

Richy_T

legendary

Activity: 2576

Merit: 2267

1RichyTrEwPYjZSeAYxeiFBNnKC9UjC5k

Quote from: birr on August 01, 2014, 08:57:43 AM

I have to generate the private key of a brain wallet and import it into mycelium on the same device, which means I don't have a way to scan the qr code. You're telling me not to use the clipboard,

Quote from: trasla on August 01, 2014, 04:45:44 AM

This is insecure as hell. Every App can always access and alter the clipboard content.

and mycelium offers no way to type in a private key.

I'm on the road, so I can't fire up a PC and generate a qr code of one of my brainwallets. I have an android tablet and a flip phone.

Scenario:
I have the bitaddress.org code saved; after turning off data and wifi I locate the file using ES File Explorer and open it in Chrome. The bitaddress.org code generates a key. Now I need to import the key to mycelium.

I have considered taking a photo of the qr code with my flip phone, then scanning the flip phone's screen (tested this and it actually works).

Looking for further ideas, like some way to get the private key into mycelium without copying it to clipboard. Out-of-the-box ideas that I haven't thought of.

As a text file on the sd card or on and external usb drive using USB OTG?

I noticed my phone has a setting to have apps request permission to access the sd so that would be an interim level of security though really any file containing a key should be encrypted.

validium

sr. member

Activity: 350

Merit: 250

Decentralized thinking

Quote from: validium on July 23, 2014, 12:16:49 PM

Been waiting for the new version of this wonderful wallet, is there any E.T.A

Soon

New version is just being made available to beta testers, in case everything is fine it will get out after we received enough positive feedback

How does one get to be a beta tester? i can volunteer if you want. Just to show my love for this app.

RoadStress

legendary

Activity: 1904

Merit: 1007

Quote from: RoadStress on August 01, 2014, 03:31:15 AM

How is the change managed in this wallet?

In segregated mode, change is sent back to address where the inputs came from. In aggregated mode, change is sent to the address which provided the biggest total sum of inputs to the transaction. In upcoming HD accounts, a new address will be derived from the master seed on the 'internal addresses branch' for each change.

So you can actually send the change to the same address where it came from? I had no idea about this and now it seems strange that the bitcoin-qt client was using a separate address for change which caused a bit of problems. Tell me more about the aggregated mode. I see that I can have multiple keys/addresses, but from the looks of it I can only send money from a single address, not multiple so the change address is always the same. Am I wrong? Can you send money from multiple addresses in one transaction?

birr

hero member

Activity: 870

Merit: 585

I have to generate the private key of a brain wallet and import it into mycelium on the same device, which means I don't have a way to scan the qr code. You're telling me not to use the clipboard,