3 ms·
Author here. Somebody did set up a website somewhere that allowed users to see if their private key was in the "database". It would jump them to the correct pa
by fiveturns 13y ago
Author here.
Somebody did set up a website somewhere that allowed users to see if their private key was in the "database". It would jump them to the correct page, and, steal their private key in the process.
I didn't like them potentially stealing my revenue, so I implemented this feature myself. The pluses beside the private key are permalinks.
For example: http://directory.io/warning:understand-how-this-works!/5HpHagT65TZzG1PH3CSu63k8DbpvD9KsvQVUCsn2t55TVA1jxW7 http://directory.io/warning:understand-how-this-works!/5HpHa...
That's the private key in Bitcoin's importprivkey format.
I purposely didn't add a search box and named the URL's path to discourage its use.
http://directory.io/faq http://directory.io/faq
(I don't actually check the logs)
- enscr 13y agoThanks for clarifying. Even though you may not have bad intentions, there are several points of failures e.g. server logs falling into wrong hands, man-in-the-middle-attack (using http) etc. Maybe put a big disclaimer in red on top of every page.