Post
Topic
Board Service Announcements
Re: [ANN] bitaddress.org Safe JavaScript Bitcoin address/private key
by
programmer-frank
on 05/11/2021, 18:51:51 UTC
This sounds interesting.

I wouldn't say it sounds interesting, sounds fishy to me. Looks like the source code is mostly the same from the original webpage. For example compare this script from the new program:
https://github.com/boomdev/billify/blob/d472db85683b30f1b63dc84122234e43e0a055bd/js/ninja.paperwallet.js
with this from the original page:
https://github.com/pointbiz/bitaddress.org/blob/72aefc03e0d150c52780294927d95262b711f602/src/ninja.paperwallet.js
Nothing wrong with it, the licence allows to use the code, and the new repository cites everything correctly in the licence file, as required.

But the point of an address generator is to be sure that it is safe. The application in the deb file is an Electron app. It includes a large amount of binary executable for the Chromium extension. It would be (relatively) easy to modify Chromium, to modify one of the JavaScript programs to generate addresses which are unsafe and predictable.

With the original website, you can examine each JavaScript file that it is safe, and then just open it in an unmodified webbrowser of your choice on an internet disconnected computer to generate your wallet. This would be the safest way. There is no need for an Electron app. Even more so because it generates a paper wallet, so you can't verify it. For example if it would provide the a brain wallet functionality as well, then you could test a brain wallet address with the old site, and then compare it with the new site to check if it works, before using it for your secret brain wallet.

That said, the deb file might be innocent. But it is simply not needed and I wouldn't install or run it.