You guys are hopeless, nevermind that I discarded the initial approach on the first page I have explained how the system works time and time again, the users password is hashed+salted with bcrypt and sent through an RSA-2048 secured connection to the server. Impossible to sabotage unless direct access to the main server is gained and maintained while users try to connect to their account (as the hashes aren't stored on the machine), thus every account is in cold storage until he is needed.
If somehow hackers gain a momental access to all the wallets on the server and obtain a copy, most of the users could be sent messages through sms asking them to change the password before the hackers would bruteforce a single one.
I am wondering what is the best method to encrypt individual accounts within a wallet...
If somehow hackers gain a momental access to all the wallets on the server and obtain a copy, most of the users could be sent messages through sms asking them to change the password before the hackers would bruteforce a single one.
I am wondering what is the best method to encrypt individual accounts within a wallet...
Yes we are hopeless, we are trying to understand your logic, first off can't encrypt individual accounts within wallet. Second SSL is good but if your not securing the server well, you could still be hacked. Third you can't brute force bcrypt it is impossible no computer can do that. The problem would be users lossing there password or the hacker copying the wallet.dat file.
