Hacker News Reader

Comment by juujian | Hacker News Reader

Are people typing Bitcoin addresses by hand? Aren't they far more likely to c&p a spoofed Bitcoin address?

Shameless plug: we created an OSS "Clipboard Firewall" for Windows [1] to protect against those attacks but feel free to fork it.

[1] https://github.com/CoinFabrik/ClipboardShield

People use this against cryptocurrencies. It should be an argument against stupidity instead. You get a confirmation popup as well asking if you are sure about the address in many wallets.

Even when I copy and paste, I triple check the beginning and end of the addresses shown.

Same. I triple check the beginning and the end. Just like I am supposed to when handling money. In cases of many cryptocurrencies, you should focus more on the last characters instead of the first. In terms of Bitcoin, it usually begins with "bc1" (yes, depends) and ends with whatever. Triple check either way. Sometimes I would clear my clipboard and copy paste anew.

Generating an evil wallet where the last six characters or so match the original is probably feasible. I heard of this being done to SSH host keys. Someone invented randomart images to make it easier for humans to compare binary strings [1], but I'm not sure how well they fare against similar attacks.

[1] https://bytes.zone/posts/what-is-the-randomart-image-for/

I have been targeted by scammers who generated wallet addresses with 15 of the same characters.

I am sure it is, but oh well. You always have to be careful about money.

People are stupid, and there's no way around that. If bitcoin can't protect stupid people against themselves, then that's a pretty major flaw.

No number of confirmation dialogs going to help anyone in determining that their 27+ digit address is mistyped.

Copy paste, and triple check the first and last 4 characters.

Not good enough, scammers will make copycat look-alike addresses that have the same first ~7 and last ~7 characters.

What about something like VisualHostKey but for the bitcoin address?

I doubt that would help much. People should clear their clipboard, and copy & paste, then double check the whole thing, or at least the first and last few characters.

What does this mean in practice though? If you need to be certain, make sure you copy the right address.

Bad actors can easily pregenerate adresses that mach those ahead of time.

Bad advice scammers/malware have huge tables of addresses they've generated that agree in the first N and last N characters. If a user is going to compare a subset they should make an effort to make it be an unpredictable subset.

There's a reason folks in ethereum use ENS. It supports BTC / Solana addresses too.

Reply on news.ycombinator.com