PaperCoin - paper offline Bitcoin wallets • Hacker News Board

PaperCoin - paper offline Bitcoin wallets

#1

Post by stickac » Sun, Mar 31, 2013, 2:14 PM UTC

PaperCoin - paper offline Bitcoin wallets
papercoin.org

Re: PaperCoin - paper offline Bitcoin wallets

#2

Post by zrail » Sun, Mar 31, 2013, 2:41 PM UTC

Safari gets redirected to a URL like this: blob:http://papercoin.org/some-big-hash

This, of course, doesn't work. When I try to remove the "blob:" it throws a 404.

Edit: works in Chrome, just not in Safari. Neat idea!

Re: PaperCoin - paper offline Bitcoin wallets

#3

Post by patio11 » Sun, Mar 31, 2013, 2:44 PM UTC

I hate dinging hobby projects, but then it's Bitcoin and people seem to be actually trusting hobby projects with non-trivial fractions of their (extremely notional) net worth, so I'll just point out that transferring a public/private key pair which allows people to spend money together over HTTP is not a security best practice.

Re: PaperCoin - paper offline Bitcoin wallets

#4

Post by subway » Sun, Mar 31, 2013, 2:52 PM UTC

patio11 wrote: post #3

I hate dinging hobby projects, but then it's Bitcoin and people seem to be actually trusting hobby projects with non-trivial fractions of their (extremely notional) net worth, so I'll just point out that transferring a public/private key pair which allows people to spend money together over HTTP is not a security best practice.

This appears to generate the wallet in your browser, so the key is never sent over HTTP.

That said, I still have difficulty trusting hobby crypto.

Re: PaperCoin - paper offline Bitcoin wallets

#5

Post by jimrandomh » Sun, Mar 31, 2013, 2:58 PM UTC

Using a Bitcoin address provided by a web site to store your coins is Extremely Unwise. You would be giving the owners of that site the power to steal your money later.

Promoting a site which gives a small convenience in exchange for the power to steal your Bitcoins is not okay. Even if the site's original creators are trustworthy, it can be broken into and perverted. You risk creating a repeat of MyBitcoin (an "online wallet service" run anonymously that predictably ran off with everyone's deposits).

Re: PaperCoin - paper offline Bitcoin wallets

#6

Post by niggler » Sun, Mar 31, 2013, 3:00 PM UTC

jimrandomh wrote: post #5

Using a Bitcoin address provided by a web site to store your coins is Extremely Unwise. You would be giving the owners of that site the power to steal your money later. Promoting a site which gives a small convenience in exchange for the power to steal your Bitcoins is not okay . Even if the site's original creators are trustworthy, it can be broken into and perverted. You risk creating a repeat of MyBitcoin (an "onl…

To be fair, at the bottom of the page he links to source and a zip that you can use to run internally if you so desire.

If it concerns you, then run it on your own machine.

Re: PaperCoin - paper offline Bitcoin wallets

#7

Post by nwh » Sun, Mar 31, 2013, 3:03 PM UTC

niggler wrote: post #6

jimrandomh wrote: post #5

Using a Bitcoin address provided by a web site to store your coins is Extremely Unwise. You would be giving the owners of that site the power to steal your money later. Promoting a site which gives a small convenience in exchange for the power to steal your Bitcoins is not okay . Even if the site's original creators are trustworthy, it can be broken into and perverted. You risk creating a repeat of MyBitcoin (an "onl…

To be fair, at the bottom of the page he links to source and a zip that you can use to run internally if you so desire. If it concerns you, then run it on your own machine.

The generation could still be deterministic in some way. I haven't looked over the code yet, so I don't know.

Even if it is securely created, there's nothing stopping the code being modified to some clients.

Re: PaperCoin - paper offline Bitcoin wallets

#8

Post by sltkr » Sun, Mar 31, 2013, 3:14 PM UTC

subway wrote: post #4

patio11 wrote: post #3

I hate dinging hobby projects, but then it's Bitcoin and people seem to be actually trusting hobby projects with non-trivial fractions of their (extremely notional) net worth, so I'll just point out that transferring a public/private key pair which allows people to spend money together over HTTP is not a security best practice.

This appears to generate the wallet in your browser, so the key is never sent over HTTP. That said, I still have difficulty trusting hobby crypto.

That's true, but the code that generates the wallet is still sent over HTTP, so there is an opportunity for an attacker to insert malicious code. It would be a lot better if this was served over HTTPS, but then you still need to trust the author.

Re: PaperCoin - paper offline Bitcoin wallets

#9

Post by jgeralnik » Sun, Mar 31, 2013, 3:23 PM UTC

patio11 wrote: post #3

I hate dinging hobby projects, but then it's Bitcoin and people seem to be actually trusting hobby projects with non-trivial fractions of their (extremely notional) net worth, so I'll just point out that transferring a public/private key pair which allows people to spend money together over HTTP is not a security best practice.

You're back! Good to have you here again.

Re: PaperCoin - paper offline Bitcoin wallets

#10

Post by DoubleMalt » Sun, Mar 31, 2013, 3:26 PM UTC

nwh wrote: post #7

niggler wrote: post #6

Earlier quoted context omitted.

To be fair, at the bottom of the page he links to source and a zip that you can use to run internally if you so desire. If it concerns you, then run it on your own machine.

The generation could still be deterministic in some way. I haven't looked over the code yet, so I don't know. Even if it is securely created, there's nothing stopping the code being modified to some clients.

It would be neat to have something like this as JS application. Of course again you have to check the code or trust the author, but I think an audit would be possible.