Quote from: NotATether on Today at 04:22:31 AM

Bump, with a radical security idea. There is no point in using a wallet if you can't feel secure updating it, as you will then be exposed to security vulnerabilities.

Quote from: giszmo on March 12, 2021, 12:51:06 AM

Quote from: DaveF on March 11, 2021, 10:12:49 PM

Nobody has it, that I know of in the crypto space and that is the issue.
Yeah, possibly the big players [Coinbase, Gemini, Kracken, etc]

The standard claim by all of them is "We have the best security in the industry". I'm so tired of reading superlatives in every wallet description.

Specifically so that wallets can't say exaggerations like this, a wallet security commitee needs to be formed.

Its members should include contributors to various open-source wallets, as well as security professionals working for the big wallet companies.

Their sole function would be to review the source code of every wallet (an audit) and then assign it a rating like A+, A, etc. It would also give out 0 ratings to wallets which aren't code-signed (not a problem as you can buy these from second-hand TLS sites for $60/year). In my opinion, all wallets should be code-signed by a reputable CA (even Electrum, eventually).

The rating would be the only benchmark you are allowed to advertise in your wallet.

It worked with UL Benchmarks I don't see why it wouldnt work wih code & software.

Quote

Unfortunately most people in the space are not at all literate about cryptography.

That's not going to help someone against a rouge wallet.

IMO, it still goes back to what I have been saying. Code is only part of the battle. The procedures and processes are the other part. Everyone looking at the code today does not matter if one person with the ability to sign it goes evil tomorrow.

In addition to the code review an audit of the process and procedures done to run everything is also needed.

Kind of like a conversation I had with someone making collectable coins that had pre-generated private keys:

Them: "All keys are generated from a secure offline computer"

Me: "So it's BIOS password protected, boots from a read only device like a DVD that you verify the checksum on every boot, and nobody else has access to the room where it is, and you you verify the printer that it prints to has not been modified tampered with, and the cables are good and you are sure they have not been compromised by anything like this: https://hak5.org/products/omg-adapter

Me some more: And you have custom made holograms so if someone else gets a hold of the coin they just can't peel copy and stick on another hologram that looks the same?

Them: No, are you paranoid or just an ass?

Me: Both....

At a guess, I have no proof but it just looks like it from what I see here. Bad wallets, that were not deliberately malware / stealing from the start, have caused such a small percentage of loss vs user error, malware in general. I could be wrong but it really seems like although this is a good battle, there are bigger more important ones out there.

-Dave