Topic: Stake your Bitcoin address here - page 33. (Read 1460855 times)

What if my account gets hacked and the new owner stack a new address?  
fillippone_hacked signs the old address.
fillippone the new one.

Would the situation be sorted with: the old address always wins?

What if the old address gets compromised after I sign a new message?

It's complicated...but signing a new address without having proof of ownership of the old one is a weak practice, in my humble opinion.



EDIT: @odolvlobo posted a great suggestion of nested addresses while I was posting it. Wondering the technical feasibility of nested signature.
EDIT2: @odolvlobo is that a typo? two  in the signed message? One of them should be the  , you might want to check it, I will eventually delete this edit.

Here is my understanding:

The point of posting an address is to give you the ability to use that address later to prove that you were the owner of the account at the time that the address was posted.

Posting a address does not prove that the account holder controls the address, but that may be a reasonable assumption if a signed message stating that fact is posted.

Quoting the post helps to ensure that any subsequent change to the post can be detected.

Signing a message has a minor benefit. It allows the address owner to make a statement (but note that the statement can be false). Typically, the address owner asserts that they control the account and that a signed message is sufficient proof of ownership of the account. It is assumed that the account holder would not post the signed message if they did not accept it.

In short, the user should post this signed message and it needs to be quoted:


In posting a signed message containing the new address, the current account holder proves that they are the original account holder and presumably states that a message signed with the new address is also sufficient proof. This effectively makes messages signed with the new address as good as messages signed with the old address.

Posting a new address not signed with the old address gives the current account holder a way to later prove that they owned the account, but it does not prove that they are the original account holder.

I think your suggestion is good, but I would do it more like this because it is more secure. Note that the message signed with the new address is contained in the first signed message. This prevents anyone, including mods and hackers, from substituting a different new address. On the other hand, if the new address is signed with both addresses separately like you did, I suppose that works just as well.


Edit: nested signatures work if the signing software modifies markers of the interior message as above.

You may not want to sign a message from your old address. That's okay, but if you ever need to prove you're the owner you'll have to sign from the old one. You could do what you say if you want to get rid of the old address as a proof of ownership.

There might have two cases for signing with a new address without proofing the sign of old address. 1. the owner of the address lost access of old address/private key. Didn't know that need to proof by his/her old address first.

Sorry to nitpick, but I think the whole point of this thread is securing the ownership of a bitcoin address. What is the point of signing a NEW address without proof of ownership of the OLD address?

I think we should do like this:

Quoted and verified (on Electrum)

Can you please try once more? Thanks!

I can't verify it.

Signed using Electrum. Please verify. Thanks in advance.

Quoted and verified.

Please verify, thank you.

Quoted again then and verified.

Jeez, that was quick.  Thank you.  I was going to edit this with a signed message:

You're quoted.

I am staking a new address:  bc1q5r0seek6vyuuslvl2wrpr57udw4wmps28nahkd.  Someone please quote me, thanks!

It's Ok Verified using Electrum.

Electrum 4.1.2 - I downloaded it to Windows desktop 30 minutes ago

---

If I do it on my wallet it says Signature verified

[moderator's note: consecutive posts merged]

I am still not able to verify your signed message "Message failed to verify!"
Maybe there is some space or double quote that you have lost by mistake? Which wallet are you using for signing this message?

-----BEGIN BITCOIN SIGNED MESSAGE-----
Date: 10/05/2021
This is the real owner of the bitcointalk account :Martin958
My bitcointalk profile is: https://bitcointalksearch.org/user/martin958-314728
-----BEGIN SIGNATURE-----
bc1q5x06na8urh3f9sx6j8d9js00zrltsn4uzp5r6r
H2c46zCwwE0ujWlCuA5k0TKZcOCdGpq8TAiEEpJVykXKWVmBD+g1F057ONiogY0KRTgW9JCqpULvwq11uOHdPQg=
-----END BITCOIN SIGNED MESSAGE-----

it's doesn't work even with message you provided,bro. Check it all again and submit a whole new post, maybe ?