3 ms·

> There's no need to download or install a magic bean client when options such as blockchain.info and xapo are available. You mean the same blockchain.info wh

> There's no need to download or install a magic bean client when options such as blockchain.info and xapo are available. You mean the same blockchain.info which was making http requests to random.org to generate their rng, and when the http requests became a 301 redirect to https, it just used the first 32 bytes of the redirect message to generate the rng, hence producing the same random seed for all their wallets since may 2014 or such? And all other online wallets also have problems. From what I've seen, using an online wallet is highly discouraged due to security risks. > Wallet security is pretty much the same you'd be practicing with your bank accounts, Frankly, that's bullshit. Wallet security is a really complicated topic, which often starts with, 'get a laptop disconnected from the net, and do a blank install of a linux VM'.

ryanlol 11y ago
Maybe you should look more into the blockchain bug, it was caused by fucked up android phones having broken /dev/urandom for whatever reason. IMO it's a pretty fair assumption to make that all modern linux distributions would ship with /dev/urandom. How exactly is wallet security any different from bank security? Bank transactions don't tend to be reversible either.
- aliakhtar 11y ago
  So they were not using the 32 bytes of the 301 redirect message from random.org as the rng seed for all their wallets? > How exactly is wallet security any different from bank security? I don't need to start by installing a blank linux VM on a permanently offline computer, to have a secure bank account.
  - ryanlol 11y ago
    No they weren't. The bug affected a very small minority of the apps users running broken android versions. Why would you have to do that with bitcoins? How are bitcoins any easier to steal than your bank credentials?
    - aliakhtar 11y ago
      https://reddit.com/r/Bitcoin/comments/37p2gm/security_advisory_all_addresses_made_with_the/ https://reddit.com/r/Bitcoin/comments/37p2gm/security_adviso... "[SECURITY ADVISORY] All addresses made with the Android Blockchain.info wallet application since 1 May 2014 are potentially compromised, your funds are at a direct risk of theft." I've answered your 2nd question already: > I don't need to start by installing a blank linux VM on a permanently offline computer, to have a secure bank account.
      - ryanlol 11y ago
        >[SECURITY ADVISORY] All addresses made with the Android Blockchain.info wallet application since 1 May 2014 are potentially compromised, your funds are at a direct risk of theft. This is incorrect, posted by some random guy on reddit. Check out the source code he links to, it should be obvious that on any sane platform the random.org generator is used in conjunction with /dev/urandom. > I don't need to start by installing a blank linux VM on a permanently offline computer, to have a secure bank account. I don't even know where to begin here, why would you have to do this with bitcoins? How is storing your bitcoins on your computer any different than using online banking? In both scenarios you risk losing everything if you get hacked.

ryanlol 11y ago

Maybe you should look more into the blockchain bug, it was caused by fucked up android phones having broken /dev/urandom for whatever reason. IMO it's a pretty fair assumption to make that all modern linux distributions would ship with /dev/urandom. How exactly is wallet security any different from bank security? Bank transactions don't tend to be reversible either.

aliakhtar 11y ago
So they were not using the 32 bytes of the 301 redirect message from random.org as the rng seed for all their wallets? > How exactly is wallet security any different from bank security? I don't need to start by installing a blank linux VM on a permanently offline computer, to have a secure bank account.
- ryanlol 11y ago
  No they weren't. The bug affected a very small minority of the apps users running broken android versions. Why would you have to do that with bitcoins? How are bitcoins any easier to steal than your bank credentials?
  - aliakhtar 11y ago
    https://reddit.com/r/Bitcoin/comments/37p2gm/security_advisory_all_addresses_made_with_the/ https://reddit.com/r/Bitcoin/comments/37p2gm/security_adviso... "[SECURITY ADVISORY] All addresses made with the Android Blockchain.info wallet application since 1 May 2014 are potentially compromised, your funds are at a direct risk of theft." I've answered your 2nd question already: > I don't need to start by installing a blank linux VM on a permanently offline computer, to have a secure bank account.
    - ryanlol 11y ago
      >[SECURITY ADVISORY] All addresses made with the Android Blockchain.info wallet application since 1 May 2014 are potentially compromised, your funds are at a direct risk of theft. This is incorrect, posted by some random guy on reddit. Check out the source code he links to, it should be obvious that on any sane platform the random.org generator is used in conjunction with /dev/urandom. > I don't need to start by installing a blank linux VM on a permanently offline computer, to have a secure bank account. I don't even know where to begin here, why would you have to do this with bitcoins? How is storing your bitcoins on your computer any different than using online banking? In both scenarios you risk losing everything if you get hacked.