Hacker News Reader

Comment by jimrandomh | Hacker News Reader

Using a Bitcoin address provided by a web site to store your coins is Extremely Unwise. You would be giving the owners of that site the power to steal your money later.

Promoting a site which gives a small convenience in exchange for the power to steal your Bitcoins is not okay. Even if the site's original creators are trustworthy, it can be broken into and perverted. You risk creating a repeat of MyBitcoin (an "online wallet service" run anonymously that predictably ran off with everyone's deposits).

View on HN

To be fair, at the bottom of the page he links to source and a zip that you can use to run internally if you so desire.

If it concerns you, then run it on your own machine.

The generation could still be deterministic in some way. I haven't looked over the code yet, so I don't know.

Even if it is securely created, there's nothing stopping the code being modified to some clients.

It would be neat to have something like this as JS application. Of course again you have to check the code or trust the author, but I think an audit would be possible.

This of course is JavaScript application. And it is downloadable and locally runnable (read footer on the website).

Great! Sorry for not checking.

That's the point of distributing the source code.

So you are saying even hybrid wallets like blockchain.info are unsafe?

Look at how bitcoin.org handles it, see the [?] boxes there: http://bitcoin.org/en/choose-your-wallet

But some hybrid wallets like blockchain.info are so secure.

They do client side encryption, js verifier makes sure any server attacks don't affect the wallets directly, allows user to backup their wallets the way they want, has some redudant backup options, two-factor authentication, and so much more. I don't see a reason why not to trust such wallets.

I agree there have been past instances where the server was comproised and users lost their wallets, but with such hybrid wallets if you are taking regular backups of your wallets you are pretty safe.

There have also been several bitcoin services where the owners ran away with the users' money.

I doubt any significant potion of the user base uses the client side verifier.

Reply on news.ycombinator.com