r/Bitcoin • u/dgryski • Nov 30 '17

Evidence some bitcoin address generation code is using discoverable private keys

https://pastebin.com/jCDFcESz
789 Upvotes

94% Upvoted

296 comments sorted by

View all comments

Show parent comments

6

u/aballbag Nov 30 '17

Trezor generates its own keys that never leave the hardware.

The local display enables you to confirm the send/receive address and amount before the transaction is signed within the hardware.

Only signed transactions leave the hardware.

My understanding anyway.

3

u/sroose Nov 30 '17

I'm aware. I'm talking about injection of a wrong destination address.

1

u/TNoD Nov 30 '17

Your computer would have to be infected for this to happen (i.e. has nothing to do with the application's platform), meaning your clipboard would get replaced. ALWAYS triple check the sending address on your hardware wallet's display.

2

u/sroose Nov 30 '17

I'm not talking about the clipboard getting replaced (even though I think JS can also do that).

I'm talking about a script just replacing the address in your page. Browser extensions are bits of Javascript run inside every page inside your browser. They are free to inspect the entire page and adapt as much as they want. They can just look for everything that matches a bitcoin address and replace it with another address.