Hacker News Reader

Comment by johnisgood | Hacker News Reader

People use this against cryptocurrencies. It should be an argument against stupidity instead. You get a confirmation popup as well asking if you are sure about the address in many wallets.

View on HN

No number of confirmation dialogs going to help anyone in determining that their 27+ digit address is mistyped.

Copy paste, and triple check the first and last 4 characters.

Not good enough, scammers will make copycat look-alike addresses that have the same first ~7 and last ~7 characters.

What does this mean in practice though? If you need to be certain, make sure you copy the right address.

What about something like VisualHostKey but for the bitcoin address?

I doubt that would help much. People should clear their clipboard, and copy & paste, then double check the whole thing, or at least the first and last few characters.

Bad advice scammers/malware have huge tables of addresses they've generated that agree in the first N and last N characters. If a user is going to compare a subset they should make an effort to make it be an unpredictable subset.

Bad actors can easily pregenerate adresses that mach those ahead of time.

People are stupid, and there's no way around that. If bitcoin can't protect stupid people against themselves, then that's a pretty major flaw.

Even when I copy and paste, I triple check the beginning and end of the addresses shown.

Same. I triple check the beginning and the end. Just like I am supposed to when handling money. In cases of many cryptocurrencies, you should focus more on the last characters instead of the first. In terms of Bitcoin, it usually begins with "bc1" (yes, depends) and ends with whatever. Triple check either way. Sometimes I would clear my clipboard and copy paste anew.

Generating an evil wallet where the last six characters or so match the original is probably feasible. I heard of this being done to SSH host keys. Someone invented randomart images to make it easier for humans to compare binary strings [1], but I'm not sure how well they fare against similar attacks.

[1] https://bytes.zone/posts/what-is-the-randomart-image-for/

I have been targeted by scammers who generated wallet addresses with 15 of the same characters.

I am sure it is, but oh well. You always have to be careful about money.

Reply on news.ycombinator.com