Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to build a Bitcoin Wallet

helloblock.io

Post reply on HN
Print view View original

11–17 of 17 posts

Re: How to build a Bitcoin Wallet

#11

Post by dobbsbob »

sida wrote: post #7
bmoresbest55 wrote: post #2

What kind of security concern would there be with using JS to implement your wallet? Or building the wallet yourself as opposed to a solution with updates and whatnot?

Looking at the two popular web wallets as an example. Blockchain.info and Coinbase. Blockchain.info is a client-side wallet implemented in JS Keys are encrypted client-side and encrypted keys stored in the server. There are good good benefits there because if blockchain.info is hacked, your keys are still with you and not compromised (Different story if the server starts serving malicious JS though) The server-side w…

A lot of casinos and exchanges are using blockchain.info as a hot wallet instead of rolling their own multi sig hot wallet. Crazy risk

Re: How to build a Bitcoin Wallet

#12

Post by mappum »

This is fine for learning about Bitcoin, but don't use this is in production. No matter how secure you think you are, someone can likely get into your server and serve their own JavaScript (making your clients send all their money and/or keys). Also, this tutorial uses a Bitcoin centralized service to communicate with the network, and you have to trust that they won't feed you false information/withhold transactions/perform malleability attacks.

Re: How to build a Bitcoin Wallet

#13

Post by chill1 »

locksley wrote: post #6
SomeCollegeBro wrote: post #4

Earlier quoted context omitted.

Building static pages using a javscript framework seems to be the new thing. Doesn't really make sense to me - this page is hardly dynamic (as opposed to a single page app).

There's also a block explorer - https://helloblock.io/latest

I assume your point is to justify the fact that this page does not load if JavaScript is disabled, because the domain has a web app on it at a separate URL? It is possible to have both static document pages, viewable without JavaScript, and a web application that requires JavaScript to function.

Re: How to build a Bitcoin Wallet

#14

Post by adrianmacneil »

sida wrote: post #7
bmoresbest55 wrote: post #2

What kind of security concern would there be with using JS to implement your wallet? Or building the wallet yourself as opposed to a solution with updates and whatnot?

Looking at the two popular web wallets as an example. Blockchain.info and Coinbase. Blockchain.info is a client-side wallet implemented in JS Keys are encrypted client-side and encrypted keys stored in the server. There are good good benefits there because if blockchain.info is hacked, your keys are still with you and not compromised (Different story if the server starts serving malicious JS though) The server-side w…

Generally server-side wallets don't keep all user funds online. Most are stored offline in cold storage, which requires multiple signatures to access.

Re: How to build a Bitcoin Wallet

#15

Post by battani »

mappum wrote: post #12

This is fine for learning about Bitcoin, but don't use this is in production. No matter how secure you think you are, someone can likely get into your server and serve their own JavaScript (making your clients send all their money and/or keys). Also, this tutorial uses a Bitcoin centralized service to communicate with the network, and you have to trust that they won't feed you false information/withhold transactions/…

> No matter how secure you think you are, someone can likely get into your server

Well if that happens you're in deep shit in any case whether you use this service or not...

Re: How to build a Bitcoin Wallet

#16

Post by battani »

adrianmacneil wrote: post #14
sida wrote: post #7

Earlier quoted context omitted.

Looking at the two popular web wallets as an example. Blockchain.info and Coinbase. Blockchain.info is a client-side wallet implemented in JS Keys are encrypted client-side and encrypted keys stored in the server. There are good good benefits there because if blockchain.info is hacked, your keys are still with you and not compromised (Different story if the server starts serving malicious JS though) The server-side w…

Generally server-side wallets don't keep all user funds online. Most are stored offline in cold storage, which requires multiple signatures to access.

They still have to keep at least the amount the richest user owns online in case that user decides to withdraw all their coins.
Post reply on HN