Critical Electrum vulnerability

Printable View

7 January 2018, 5:31 am
sweetbet

Critical Electrum vulnerability

If you are using the Electrum wallet, then you might want to visit the following thread.
https://bitcointalk.org/index.php?topic=2702103.0
7 January 2018, 5:39 am
Sherlock

It does not affect users who have set password.
8 January 2018, 2:48 am
DaftDog

Quote:

Originally Posted by Sherlock

It does not affect users who have set password.

Apparently that is not true. See update one in OP's link.
8 January 2018, 3:09 am
wonderpunter

Anyone with a significant amount of btc should be using a hardware wallet anyhow, but also a password.. people still leave financial tools open without pass?
8 January 2018, 3:30 am
Cash Bonus

Quote:

Originally Posted by wonderpunter

people still leave financial tools open without pass?

Yes, you're absolutely correct, and all very much too often, unfortunately :(
9 January 2018, 9:01 am
Sherlock

Quote:

Originally Posted by wonderpunter

Anyone with a significant amount of btc should be using a hardware wallet anyhow, but also a password.. people still leave financial tools open without pass?

I do not trust HW wallets for anything else than hot or tepid wallets. Have you seen the HW keyloggers in keyboards, cable extensions and so on? IMO just a matter of time until someone adds something like that into the plastic box between the HW wallet and microUSB jack for example. The attacker then does not collect some random data. He knows that all data and keystrokes on HW wallet are significant.

With open source wallets there is just one attack vector - just the software; with HW walets there are two.
9 January 2018, 9:14 am
wonderpunter

Quote:

Originally Posted by Sherlock

I do not trust HW wallets for anything else than hot or tepid wallets. Have you seen the HW keyloggers in keyboards, cable extensions and so on? IMO just a matter of time until someone adds something like that into the plastic box between the HW wallet and microUSB jack for example. The attacker then does not collect some random data. He knows that all data and keystrokes on HW wallet are significant.

With open source wallets there is just one attack vector - just the software; with HW walets there are two.

But trezor smart pin is immune to keyloggers it changes every time, the logger would alo need a spy camera to catch the screen realtime which would change on the next use anyhow
9 January 2018, 9:35 am
Sherlock

What I am trying to tell is that you just trust to some people that it really is as they say it is. I am not telling the hw wallet can be spied by keylogger. I am saying (for example) the wallet itself can have keylogger inside of it. How do you know what exactly is inside of your HW wallet? The software wallets is under constant reviews. The software of opensource HW wallets is as well, but who is checking the hardware of every piece?<br><br>The guy who is doing my IT security confirmed me that security of HW wallets is overhyped and that he does not trust the HW wallets for the reason above. HW wallets are significant improvement of security, but it is not a perfect solution for storing big money.