Quote from: DevaVictrix on June 17, 2017, 09:38:00 AM

When searching for a wallet/s I quickly learned that downloading the full node for each respective currency is a sure way to fill up my 128gb harddrive.

Yeah, just the bitcoin blockchain will eat up around 120gigs on it's own Wink

If you are storage space limited, you definitely want to be looking at "SPV" or "light" wallets.

Quote

First quick question... If the private keys are stored locally how come when I installed Jaxx on my android phone did I just have to enter the 12 word pass phrase to get access to my private keys? They must have been downloaded from somewhere which means they are stored at a location other than 'local'. Is this a vulnerability (surely, 'Yes' ?).

No. They are not downloaded from somewhere. Seeds work by using the 12 'random' words out of a defined list of 2048 words to calculate a (very large) random number. This is your 'seed'. All of your private keys/addresses are then calculated from this seed in a deterministic and repeatable way.

Quote

Jaxx was reported to have been insecure earlier this week but I dont know exactly how. Some of what I have read seems to suggest the security issue comes from thieves accessing your harddrive for the 12 word pass phrase. Most of my reading was on forums, and news websites I have never heard of so I concluded I might be contaminating my mind with potentially misinformation and just swallowed that Jaxx could be insecure. I'm assuming the locally stored private keys are kept in C:\Users\%User%\AppData\Roaming\Jaxx. Does my encrypted C: help my security? Couldn't the developers just code Jaxx so that this folder can be kept on a USB stick so that the private keys are offline until you need to use them?

They could just as easily implement a password/passphrase functionality into the Jaxx application that encrypts your wallet file instead of leaving your 12 word seed in plain text for hackers to come and steal... but apparently they were "happy with the way things were"... this may have changed after all the publicity and backlash from their userbase.

Essentially the vulnerability stems from the fact that your 12 word seed is very easy to retrieve from your wallet file if a hacker gains access to your system.

Quote

My frustration with Jaxx started yesterday when I tried to use Shapeshift to exchange some ZEC for ETH. The transaction debited my ZEC wallet and I knew I would have to wait a little while for it to appear in my ETH wallet. So I went to bed only to find this morning that the ZEC had been returned to my ZEC wallet and nothing credited to my ETH wallet. The transaction failed. No real loss to me other than ETH was a relatively good price given my point of entry to the cryptocurrency game. But I cant find any record of the attempted exchange or the return of the ZEC. The transaction history in Jaxx only shows the very first payment from the pool. So I reset the Jaxx cache. Still only one entry in the transaction history only now its the most recent payment from the pool, oh and the value of my ZEC coins now says £0.00. The ZEC balance is there (all of what I have mined) but no figure for £ or $. Long story short... bar a few minor differences, the same happened with the Jaxx android app too. I have typed my public address into the ZCash block explorer and it reports 6 transactions received but nothing sent. I kind of expected to 1 sent (my exchange) and 7 received (my 6 pool payments and the returned exchange).

Sounds like your transaction sending to ShapeShift never confirmed or was rejected by the network... like most blockchain related transactions, if it isn't actually recorded into the blockchain (by being confirmed in a block) then your transaction doesn't exist. This is why there is no record of it in your account... because there is no actual record of it. Why that might be, I couldn't say, you'd need to contact Jaxx and/or ShapeShift Support and see if they can explain why your transaction failed.

Quote

Another thing that has me scratching my head is when I view my private keys. When I first tried mining to my wallet address. It failed, it wouldn't mine. So I clicked on 'view private keys' and there were two private keys, each with a different public key. I just selected one the of the public keys and mined to that. Its been working fine. I have read that its a good idea to change the wallet address for each transaction so expected this to change after each transaction. Sure enough this has changed but its changed to the other public key (the one I didn't use to mine to). I'm confused by this because that new wallet address is an existing public key that is derived from a different private key. I thought that your wallet has/is a private key. From this, you get a public key and from that you get a wallet address. Even if the public key changes too I expected the private key to always be the same. Is this normal?

Your understanding of HD (Hierarchically Deterministic) wallets and private keys is a bit lacking... an HD wallet, as I explained above, uses a "seed". From this starting point... all your private keys (and matching public keys/addresses) are then calculated.

Every address has it's own matching private key... they are often referred to as a "private key/address pair".

Your wallet is really just a collection of private keys. Most of the HD wallets will automatically generate a new address, when the previous address gets "used" to try and minimise address re-use (what you read about it being a good idea to change wallet addresses etc). So what has happened, is that after the one you selected received some coin from your mining, the wallet automatically switched to the next unused address. If you were to send some coins to that address, the wallet would automatically generate a new private key/address pair and give you a 3rd public key.

So, your "seed" will always stay the same... but each public key/address has it's own private key.

Quote

Is Jaxx just buggy and worth steering clear of? Am I just not well enough read. Or both!? I suspect both but Jaxx really isnt helping my understanding.

My personal opinion is that Jaxx is not a great wallet... But that is mostly because it isn't suitable for me and my use cases. I don't really deal much with altcoins and mostly just use BTC... so my needs are different to yours.

Quote

Am I right to expect just one private key with a public that may, or may not, change and a wallet address that does change after each transaction.

No. As explained, private key -> public key/wallet address.

If the public key (aka wallet address) has changed, so has the private key. Your wallet is just a collection of private keys.

Quote

Should I expect to see a complete list of all transactions made to and from my wallet or just the most recent since a cache reset?
Does a failed/returned transaction get logged as a transaction so that the attempt can be traced?

You should expect to see all transactions that are recorded in the blockchain for your private keys/addresses. If the transaction failed and nothing got confirmed into the blockchain, the transaction effectively "never existed".

Quote

(The convenience of only having to remember the passphrase is great (no backing up of files, and backing up the backup etc!) but it seems to me that you can access all my crypto-wealth by forcing the discovery of the 12 word passphrase. Couldn't you just write some code to punch in 12 word combos repeatedly until you hit gold? There are only so many words in English dictionary. EDIT, well 171,476, but as time goes on there will be a lot of wallets created and thus increasing the chances of finding an active combination. EDIT again, actually, there are about 1.348x10^54 combinations! Quite a few!)

It isn't quite that high... it should be more like: 2048 * 2047 * 2046 * 2045 * 2044 * 2043 * 2042 * 2041 * 2040 * 2039 * 2037 * 2038 = 5.27x10³⁹

Most wallets don't repeat words in seeds as far as I know... but there isn't anything stopping that... so Danny's maths here: https://bitcointalk.org/index.php?topic=1623339.msg16320050#msg16320050 would probably be more accurate.