Post
Topic
Board Development & Technical Discussion
Merits 1 from 1 user
Re: How bad (or good) my privacy is if I run a SPV wallet?
by
hatshepsut93
on 07/07/2018, 22:05:48 UTC
⭐ Merited by ETFbitcoin (1)

Just use Bitcoin Core as a wallet too, but in a separate airgapped safe computer. In an online computer, you run the full Bitcoin Core node, here you have watch-only addresses to see actually how much money you have and keep track of finances. In an airgapped computer, you run Bitcoin Core node offline, and store the keys there for offline raw transaction signing. This is the best possible scenario that I can think. Electrum's seed thing is unsafe due possible key derivation schemes and having your wallet.dat safe is a better alternative unless someone can prove me wrong.

Electrum is by no means "unsafe" in the strict cryptographic meaning of this word, if it was, there would be tons of warnings by experts, like it happened when the last vulnerability was found. If I understand you correctly, you are referring to the vulnerability that requires the knowledge of both master public key and any of the individual private keys. To obtain those keys, attacker would need to either break into the system or use some social engineering to convince the victim to give those keys up, which essentially would mean that any crypto system would be defeated, because they all rely on total secrecy of crypto keys. Realistically, this vulnerability could only be exploited in some big organization when multiple people need to access the same wallet, and someone decided to just give individual private keys from different addresses, not knowing that when combined with master public key, all other addresses get broken. But if someone uses Electrum as their own private cold storage, there's no huge difference in security between it and Core, and this is why Electrum became so popular - it has very good user interface with good functionality, especially for cold storage.