Topic: Proton launches self-custody bitcoin wallet (Read 898 times)

Many thanks to you too.

You can find it in my thread too.
How many Bitcoin confirmations is enough?

Initially, I did not know it too but our legendary member @o_e_l_e_o gave me that second tool. A first tool is from Jameson Lopp, with a mini bug and he fixed it after our forum member informed him about that.

His post.

I was looking for this page everywhere and I couldn't remember the URL. I had already given up finding it but then I found this post. Many thanks.

51% attacks don't happen in Bitcoin and are getting more expensive as the global hashrate increases. So I wouldn't worry myself with that too much.

However, the tool you shared by J. Lopp that considers the dominance of mining pools in terms of the global hashrate shows that 6 confirmations aren't enough if dominant mining pools were to turn bad and keep their hashrate percentages (both scenarios are unlikely). It estimates that the risk of a reorg attack is over 64% after 6 confirmations. You need 12 confirmations if you want to bring that number down below 50%.

Literally how many Bitcoin confirmations are enough, it depends on value of your fund in that transaction. The bigger value the fund is, the more confirmations you need to consider that transaction is done, finalized and won't be reversed.

How many Bitcoin confirmations is enough?

• https://github.com/jlopp/bitcoin-confirmation-risk-calculator
• https://web.archive.org/web/20181231045818/https://people.xiph.org/~greg/attack_success.html

It's clear from their customer support reps' reply that they are quite new to Bitcoin and how it works. Anastasija tells you that, on average, it takes one hour for a bitcoin transaction to be confirmed. That's not correct. She probably thought of transaction finality. Many sources have claimed throughout the years that a bitcoin transaction requires 6 confirmations to be considered final and irreversible. Assuming that, on average, a new block is found every 10 minutes, a bitcoin transaction will reach finality in one hour, but the first confirmation, on average comes after 10 minutes assuming that high-enough fees were spent.

I agree, ideally we shouldn't rely too much on single company. But at least it's better than seeing people use Google apps/services.


Looking at https://github.com/protonwallet/, it's open source. But AFAIK nobody audit it.

Agreed, proton is reputable company in general   but their wallet  is ^still  from the class of custodial ones in which users don't posses keys to their stash should they confided it by inmost soul to proton-custodial-service thus they may be hooked at any moment. Email/VPN service is one thing ^{(though an important one)}, wallet with money is another

P.S. Just checked this wallet once more ^{as I didn't use}. In fact it has the opt to safe your SEED phrase ^{though the question remains how they generate it}, thus it is indeed self-custody, thus I was wrong at this assessment.

Proton VPN, Proton Email, Proton Wallet, etc... I don't like the idea of creating multiple privacy-oriented apps and centralizing them under the same company/management. That's what Mullvad does recently too and I don't like it.
By the way, I was expecting this to be an open-source wallet like Electrum but it's required to register on Proton before you use it. I only wish that developers of Electrum and Sparrow copied some UI elements from Proton's wallet, both, mobile and desktop version.

I don't know what to say about his possible arrest because there is a guy named Craig Wright who claims to be Satoshi Nakamoto and at the same time abuses numerous courts and proved himself to be a scammer and a liar but no one arrests him.

You're absolutely right. That feature does exist. BUT!! It doesn’t work in Safari. There’s simply no option to select anything. However, in the app, this choice worked, and my funds were sent within five minutes. Unfortunately, I lost around $150 across two transactions due to exchange rates and accelerator fees.

  Hmm, I'll double-check this now. I’ve made transfers twice, and I didn’t see anything like that there. I’ll update here in the thread a bit later.

Hm, this author says it do has.


I have activated this wallet  in my proton account bit don't want to top it up to check who is correct, you or Frank Corva who published his article on bitcoinmagazine, So, who is correct?

There's nothing of the sort. If there were, I'd have definitely chosen the highest priority instead of shelling out an extra $30 to Binance's accelerator to push the transaction through. Here's the response from Proton Wallet's technical support.

AFAIK, this wallet doesn't have the "continuous attenuator" to adjust  transaction fee but it has gross-motion switch with  three options (namely, high priority, modern priority and low priority) which controls  the fee. Did you say that  0.00000111 BTC fee is applied to any transaction no matter which priority is chosen?  ^{(What option did you choose for stuck transaction?)}. P.S. I do not use it. just wondering.

As a long-time user of Proton's services, I wouldn't recommend using their Proton Wallet—at least not right now. I decided to try it out, and I regret it. I've been waiting for four days already for my transactions to be confirmed—four bloody days! All because there’s no option to adjust the transaction fee. As a result, every transaction goes through with a fee of 0.00000111 BTC, and nobody gives a damn about them. And Proton as a company doesn’t seem particularly bothered by this either.

About them making a web version that is part of the Proton family of apps, I also thought that if they were to ever release one it would not have been a web version wallet. Maybe they will not contemplate creating a stand-alone wallet as a side product because it will be isolated from the Proton apps that are accessible after signing in to the Proton account.

This is great and all but exactly what does this have to do with Proton's Bitcoin wallet software? I mean, I can't see Andy Yang or any other people inside Proton getting arrested for releasing a Bitcoin wallet (which would've happened to Satoshi probably, if not surely, after the Silk Road bust).

Actually, I would've thought they would have made this thing as a stand-alone app, not as a web version.

These examples of cooperating with governments and refusing to work with government with consequent arrests, jails and so on, are good reminder to all Bitcoiners about the super importance of Satoshi Nakamoto's big decision to disappear.

He (yeah let me call Satoshi Nakamoto as he, but we don't know who is or are Satoshi Nakamoto), decided in very early months of Bitcoin history and that decision is super helpful for us, and surely for himself too. Assume Satoshi Nakamoto is a well-known person, he would have been arrested a long time ago by either the USA government or others.

Satoshi's lesson
After WikiLeaks, he wrote this.

How Bitcoin’s Founder Satoshi Nakamoto Disappeared: The Untold Story
Eleven years ago today
Satoshi's last email to Gavin Andresen

Why are you posting this here?

I think it is REALLY hard nowadays to use any Service or even technology generally with out having to worry about Law Enforcement spying on you.  It is the case not only for Services but even for Tor.  I am a Tor user and I am pretty convinced it is very likely that I have at least once been browsing on a malicious Tor Node initiated by non Tor friendly Governments.  It sucks.  And it sucks even more when Services that PROMISE you exactly this, which is NOT cooperating with Law Enforcement, are generally precisely those who actually cooperate.

It feels like there is no way you can feel liberated from this B S.  It is all around you and there is pretty much no way you can 100 percent run away from it.  You can try, but slowly they may be catching up with you.

Yeah. Many of these so called "tech giants" or services that we see that appear to not be harassed by the law enforcement are already fully cooperating with the law enforcement! Like the case with bitcoin mixers. They are either honeypots that continue to exist or they refuse to cooperate and get shut down. Like the Wasabi wallet versus Samourai wallet case. Or Meta versus Telegram. One is cooperating with them, the other had its founder arrested.

Sure there is a difference but when it comes to large corporations you would expect them all to plead ignorance citing a wide array of excuses regardless of their actual involvement (or lack of) in others breaking their terms and conditions.

As for the excellent analogy you stated, I think giving you the car as a loan without knowing you were going to rob a bank does not provide defence because the prosecution will try their best to demonstrate there was collusion even though I was innocent. Would a jury accept it? I do not know but I would not be the only innocent person imprisoned.

Many people view this as double standards being implemented by law enforcement agencies that allow some tech giants to get away with dubious conduct but aggressively pursue others for reasons that cannot be understood.

There is a difference between a platform being hardly moderated and the police / government showing up and saying your platform is being used for a crime here is the what we have about when and where and how the crime is being committed and all you have to do is show us who.

If ask to borrow your car and you say yes and then I use it to rob a bank you are probably not going to be charged with anything.

If the cops show up BEFORE I ASK and tell you that I rob banks and borrow peoples cars to do it and they found out I am going to rob a bank later today and you still loan me your car then yeah, they are coming after you too.

-Dave

I think the issue about the climate activist was down to a Swiss court forcing Proton to adhere to the ruling/request. They did state later that the French authorities would never have been able to identify/locate the climate activist if he had used a VPN as they would have handed over the VPN IP address rather than the IP address of the mobile phone the climate activist was using at the time. Still, they published one piece of information about their no-logging policy but breached it and removed it entirely from their website after the backlash.

If he had access to the decryption keys at the time of the arrest in France then many Telegram users will certainly be worried but I doubt he would carry them with him. It seems the problem France have against Durov is the lack of moderation on Telegram. If that is the case they have against him then owners/operators and shareholders of Microsoft, Meta, Google and many others should have been arrested when they stepped foot in France too because platforms they provide are hardly moderated.

You are approaching this from the wrong angle. Of course Proton Wallet isn't as safe as hardware wallets, airgapped systems, or most quality desktop/mobile wallets, but you shouldn't compare it with those superior products. It should only be compared with other web wallets because that's what it is.

What you did is like saying I don't like this new skateboard. It's not as safe as my car, is much slower, offers me no protection against rain and heat, and I get tired pushing myself constantly on the road. That's because you are comparing it to a car, which it isn't meant to be tested against. It's only for skateboard enthusiasts.

This is more of a problem with France than with Proton. Just yesterday, they also arrested the Telegram founder Pavel Durov for not giving them the encryption keys to decrypt all of their user's messages.

And you know what would happen once one government gets a hold of the decryption keys, they share them with all the other governments upon request.

When weighing up all the benefits related to the company behind it, the fact remains it is still a web wallet and that will entail a degree of concern even for the most open minded crypto enthusiasts.

Keeping that aside, though not directly relevant to their Bitcoin wallet it is important to mention in the past Proton had to face massive negative publicity for claims they made on their website (we do not keep any IP logs) but only to remove the words from their Privacy Policy after the backlash.

It may have happened in 2021 but apparently it seems Proton handed over email related information including IP addresses to French authorities that requested them via a Swiss court. When that request arrived, the Swiss judge forced Proton to log and disclose the IP and browser fingerprint of a specific person. That basically is shocking even though they provided mitigation by saying they had no choice as it was a legal request they had to comply with. All that because the French authorities were seeking information on a climate activist.

Back to their web wallet, I would advise against using it for the same reasons you have cited.

Which is also a bad idea if you ask me.  Particularly if older people are involved, which are also easier to fool.  A few ideas popped up in my mind for potential Scams and I am sure some idiots will not only think the same but put the Scams into practice too.

Maybe it could be an interesting way to introduces bitcoin to older people.

Maybe my father will find Interesting to receive bitcoin using an email  . And if he wants to know more, he can just look further in the same wallet

I think overall this wallet is similar and even a competitor to blockchain.info . However,  it looks better and safer


This could be a nice idea .
I can send you 5 usd using my email in this wallet to your email, and then you can send me back. Then we can share the experience.

But I will only be able to it in a few days because I am traveling now   

I am not impressed so far.
This is just another web wallet that I wouldn't consider safe enough for my daily use.
In case Proton server is down you won't be able to use Proton wallet either, only you can do is importing seed words to your own wallet.
Receiving Bitcoin with email is cool. but this sounds worse to me than using single wallet address, and I don't know anyone who offered to send/receive BTC with proton email.

I'm not interested with the invites. But do you plan to make a short review or impression? While i wouldn't use it, i certainly hope it's more promising than other web wallet out there.

Hey, I finally got access to my proton wallet!!

I have 5 invites. Anyone wants?

It looks a nice wallet. It supports 12-24 words and also a passphrase.

We have the visionary but would never attach a BTC wallet address to the mail account

/KX

+1 on this one. While I understand that having centralized services is great for the overall population - after all most people that I know really want to have all their services in just one place (let it be e-mail, documents, photos, etc) - this kind of business also becomes really interesting from a data gathering point of information. Albeit that Proton has all the motives to avoid doing this considering that it actually acts as a pillar of protecting their customers so any kind of leak or news that could scratch this image would surely mean the company demise.

Anything centralized should be considered fishy when it comes to privacy related matters. There is just no way there can be a company with a physical location (centralized point of failure) that the government is not going to visit and put pressure on then owners to cooperate with the authorities.

We simply don't need any other reason than that in my opinion.

Interesting, last time I experimented with creating a Proton Account I met this issue where I was obliged to either use a Mobile Phone number as verification or to abandon the process entirely.  I did not know of this pretty recent article.

-----

I have to agree, only up to the point where Proton advertises themselves in various ways that attracts a specific type of Customers.  Almost any where you look on their website, they advertise themselves as the Service that frees you from the Big Tech.

https://proton.me/blog/create-an-email-account-without-phone-number-verification

https://proton.me/

More importantly, on the front page they mention this,


Java Script is a deal breaker for me.  Even if it is as Private and Secure as they make it seem, Java Script being mandatory is instantly a no go.  It can be exploited, so the entire 'no body should be able to exploit your data, period' argument falls short in my eyes.

I am really skeptical about Proton generally anyway.  The motive of the entire project is a question mark for me.  They had scandals and controversies in the past too which further raised more questions for me.  They promised they would not hand out any IP to any body and then they handed IPs for a case of the Authorities and after being under fire for it they deleted the statement from their Policy.  I find it very suspect to have a project that 'promotes Freedom and Privacy' not being subject to a lot of hatred from Governments.  It is being praised even by the United Nations.

Fishy if you ask me.

Just a nitpick from the one letter I bolded above.
Your Proton VPN account does NOT have to be the same one you send & receive mail through.
You can setup & configure the VPN though an account you set up at that point in time and then create another one while VPNed in to create an email.

I think the web / hot wallet thing has been discussed to death. It's a hot insecure wallet, just like the one in your pants. Don't leave more in then you are prepared to loose.

-Dave

I've seen some people complaint about it. They claim it it's done to prevent spam or abuse of their free tier, but AFAIK they doesn't provide choice to pay for non-free tier during registration. And i just found they write blog about register email without phone number[1], which is ironic.


Which apply to most modern website. And this part isn't surprising since they have their own CAPTCHA system[2].

[1] https://proton.me/blog/create-an-email-account-without-phone-number-verification
[2] https://proton.me/blog/proton-captcha

I do not know.  I have very mixed feelings about this but they are mostly leaning toward a negative one.  Proton has been looking kind of sketchy in my eyes particularly over the last years.

They have a VPN they advertise as providing Privacy and Freedom to their Users.  However.  The VPN requires a Proton Account.  How does that work?  How do I have Privacy if all my connections are directed through the same Account that I have?  It is also increasingly harder to create a Proton Account without involving personal information such as a Mobile Phone Number.  It was all nice and great before, back when you could have an Account in a few clicks.  Now it just seems sketchy.

I wanted to give this a try.  So I click the link and the first thing I am met with is a Sign In page telling me they need my Java Script enabled to proceed.  Web Wallets are not my preference anyway.  In fact, they are some where at the bottom of the list of preferences, close to Custodial Wallets.  A Web Wallet can not be more Secure than an Open Source Wallet such as Electrum.

Fuck that.  I do not trust them any more.

They added BIP39 to their email recovery option back in 2022, it sure took them long enough to add bitcoin wallet feature.

In any case this sounds intriguing to have a bitcoin web wallet that you can access just through your email account while you also access all the other tools (VPN, storage, etc.) that this company offers. As long as you don't store your coins there and only use it for pocket change, it's a cool tool.

Proton can't give people your emails (they are E2E encrypted, except for the subject header and other metadata), but they can give up your IP address. Just use ProtonVPN whenever you want to check your mail, or any other VPN.

PS. John McAfee had gone complete wacko towards the end of his life. It makes me doubt later claims made by him.

Do you mean giving activist data[1] or something else?


People could create separate Proton account to avoid that, but we know only few people would do that,


That's not impossible. But he probably just lying, just like his claim about his "unhackable" wallet[2].

[1] https://www.wired.com/story/protonmail-amends-policy-after-giving-up-activists-data/
[2] https://www.cnet.com/news/privacy/john-mcafees-unhackable-wallet-is-hackable-company-finally-admits/

Did everyone suddenly forget how Proton mail worked with feds which lead to doxxing of their users?  
Using Proton wallet increases a risk of connecting email addresses with real identity and with your bitcoins.
John McAfee once said that the three letter agency was behind protonmail, we can't verify that, but I also don't trust the people working for Proton, especially their board members.

Since their lowest tier paid plan now has custom domains allowed: https://proton.me/mail/pricing you don't know if the address is proton or not.

[email protected] could be at gmail or proton, unless you look at the MX records or the headers of something sent to you you will not know.

As for the web wallet, it's the same as any hot wallet on your phone, treat it as cash you are able to loose with not worrying about it any you will be fine.

Everyone will have a different pain point about getting hacked / loosing funds.

-Dave

if you take a look at the github repository of the Proton wallet, the terms 'lightning' and 'coinjoin' quickly catch your eye
especially after the shutdown of the two popular coinjoin coordinators of zkSNACKs and Samourai wallet, a large new coordinator based in switzerland would certainly be an important step for many who value privacy

https://github.com/ProtonWallet/andromeda

I could trust them more than random custodial or closed-source web wallet out there, but generally using web wallet isn't good idea. Besides, i feel they offer too many services these days even though i hear complain about poor support for Linux.


I also don't know how popular is it these days. But it's still frequently recommend to people who want email with better privacy (usually better than gmail).

Me neither, to be honest. I am using a combination of hardware wallets, desktop, and mobile wallets, and see no reason to bring a web wallet into the mix. Regardless of the company behind it and its non-custodial nature, it remains a web wallet that relies heavily on storing sensitive data on centralized servers. A leak, hack, or an unhappy employee could cause a lot of problems.

The seed phrase is actually generated automatically when you first open the wallet, but they don't show it you you immediately. Probably because they want you to rely on your Proton Account as much as possible to access the wallets. But you can see the seed phrase, after clicking on a few buttons.


The payment system is like the Lightning Network, but it requires both participants to be using Proton Wallet. So it kinda cancels out the advantage to be fair.

Is Protonmail still popular? I remember that there was a boom in 2016 and almost every privacy-oriented guy was using it. Is the situation still the same? I haven't seen a proton mail address recently.

To be fair, I think it would be better if they prioritize improving their current products instead of creating a new Bitcoin wallet. There is no single reason that will push me and many other people to use Proton Wallet instead of Electrum and Sparrow. If Proton Wallet was a software wallet or an airgapped hardware wallet, I might use it but it's a web wallet, it's no safe choice. Despite the fact that it's open-source, it's still a web wallet and it's not a smart idea to use it but I believe it will definitely be better than blockchain.com if that's the case.

I have a few invitations for Proton Wallet. PM me your Proton email if anyone wants to try it. I'll give preference to high ranked users.


AFAIK it's very limited only now during early access. It will probably be free later. They frequently give access to new services to Lifetime and Visionary accounts first.

I don't know what is special about this wallet so we have to be paid for it. even if it is a hot wallet, better look for free ones, or use a cold wallet like Core or Electrum which is absolutely free and safe.

Just heard about it today and I wanted to test it out, but it's not available unless I pay them for access, and I won't to do that.
What I found out so far is that Proton wallet probably won't be fully open source despite them releasing github link, but let's wait and see.
It's certainly interesting to see one mail provider supporting bitcoin ecosystem.

Proton server is going to be used for saving data, so be careful with this one.
They are going to use some Proton Address Verification system and they explained it more in their blog post:
https://proton.me/blog/proton-wallet-security-model

Even if it open-source and verifiable, I still don't like the idea of generating a seed phrase in a web-app.  A browser extension would be a bit less of a risk, but even those aren't to my liking.  But like Bitmover said; different types of wallets have their place and it all depends on the individual users use case for that wallet.


That's a pretty cool feature.

All in all, I wouldn't be opposed to using this wallet for small sums.

The wallet is supposedly both non-custodial and open-source.

Proton Wallet is a BIP39 compatible wallet that provides users with a 12-word seed phrase. On top of that, there is some sort of master seed, which they call recovery phrase of your Proton account. You can also extend your seed with passphrases and activate 2FA.

If both the sender and receiver use Proton Wallet, you only need the e-mail address of the receiver to send bitcoin. The wallet automatically selects a new and unused bitcoin address that belongs to the receiver in the background. As soon as it gets funded, it gets removed from circulation to never be used again (to avoid address reuse). You can, of course, also send your BTC by manually entering bitcoin addresses of any other wallets and services. 

I think it just depends.

If you have money in a hardware wallet locked inside a bunker 20m under the ground it is very safe, even from a nuclear war.

But do you need to keep all your money there? Will you go to the bunker everyday when you want to buy a simple bread and a coffee?

You can have many different wallets, with different degrees of security, for different purposes.

I use mobile wallets for funds which wouldnt hurt me if I lose...

Web wallet are most vulnerable to attack.

I posted this on another forum:


Be it open or close source, I do not recommend web wallets. I prefer a wallet that I do not need email, username and password to login. Just seed phrase or private key is enough to access my coins.

There is a raffle for a Lifetime account every year IIRC. Normally they cost around €800 but you obviously can't buy them anymore because that was only for sale during the 2014 fundraiser.

The visionary plans go on sale every Black Friday and renew bi-annually.

It is open source:
https://github.com/protonwallet/

Amazing that you are a visionary. I find that quite expensive, I would like to make a one time paymnet to become a supporter with some new features , but they do not have such plan...

Visionary and Lifetime users can use it right now:



Granted, I am a Proton enthusiast. But I would not want to use this wallet. This is effectively a web wallet in the style of Bitamp, so any extension or userscript or some other malicious code that compromises your web browser can add a stealer.

I don't think the wallet is open source either. I don't know. I just wrote to customer support asking about that.

You've probably all heard of the popular privacy-based email and VPN provider Proton.

Today, they have announced they're launching a self custody bitcoin wallet[1] which you can access from here[2]. I tried to join but apparently it's not available yet:


[1] https://techcrunch.com/2024/07/24/proton-releases-a-self-custody-bitcoin-wallet/
[2] https://account.proton.me/wallet