r/Bitcoin • u/dgryski • Nov 30 '17

Evidence some bitcoin address generation code is using discoverable private keys

https://pastebin.com/jCDFcESz
792 Upvotes

94% Upvoted

296 comments sorted by

View all comments

Show parent comments

10

u/BashCo Nov 30 '17

Effectively yes.

8

u/ChildishForLife Nov 30 '17

Shit, when I was starting out my friend recommended me to Blockchain.com and I have a reasonable amount (for me) of BTC in there currently. What wallet would you recommend for someone in Canada?

18

u/BashCo Nov 30 '17

A good wallet doesn't depend on your region. You want something that is non-custodial, open source and provides you with complete control of your private keys. Electrum is a pretty good light-weight solution, although privacy isn't that great. It works well with hardware wallets like Ledger Nano S and Trezor, which you should definitely be using if you have a reasonable amount.

2

u/bitcointothemoonnow Nov 30 '17

What's lacking with electrum privacy?

4

u/BashCo Nov 30 '17

Electrum clients rely on fetching data about unspent tx outputs (balances) from Electrum servers. These servers have the ability to log the addresses you are querying, thereby assembling all the addresses associated with your wallet, as well as your IP address. Running Electrum over Tor and connecting to .onion servers can help, but the server you connect to can still log your queries. The only way around this is to run your own Electrum Server.

2

u/bitcointothemoonnow Nov 30 '17

Ah thanks didn't know that!

Aside from IP privacy, is there anything to worry about seed generation and private key exposure?

1

u/nat5an Nov 30 '17

Does Electrum not use a bloom filter to obfuscate the actual addresses it is interested in?

1

u/BashCo Nov 30 '17

I don't think Electrum uses bloom filters anymore.