Quote from: d5000 on July 21, 2025, 07:26:49 PM

Quote from: pooya87 on July 21, 2025, 04:39:53 AM

[...] the security of Bitcoin as a whole doesn't rely on how many addresses are vulnerable. It is based on whether any of them are. In other words if one address were vulnerable then the whole system would have been considered vulnerable.[...]This is why I've always said the move to a new algorithm should be done through a hard fork with a deadline and any coins that don't move before that deadline should be considered unspendable.

Thanks for your explanation. I can understand the logic now even if I don't really agree. For example, we have already some vulnerable addresses now such as these created with low entropy. That's a small percentage (hopefully) but they exist, but I wouldn't consider them a security threat.

I agree that the logic is clear, but the conclusion is completely false. There have always been and there will always be vulnerable addresses. There is nothing that can be done about this. This is not how Bitcoin's security model works. What matters primarily is whether the system or protocol as a whole is broken or not.

Quote from: d5000 on July 21, 2025, 07:26:49 PM

My stance against Jameson Lopp's approach is based on simply trying to evaluate the "catastrophe potential" of the following threats:

- market disruptions and feelings of unsafety due to massive sales of quantum hacked vulnerable coins
- disruptions and inefficiencies due to the (much) higher data consumption of post-quantum signatures like FALCON-512
- the possibility that one of the "post quantum" schemes discussed today isn't as secure as thought (which was one of the main points in the early BIP360 discussion)

And I think Lopp underestimates the problems of the second and third threat. That's why I'm favouring an optional approach. A stricter "no reuse" policy in wallets including warnings would fit with this approach.

Optional new address type and stricter "no reuse" policy combined with social educational campaigns would be a good combination, and much less controversial. Don't let perfect be the enemy of good. Still, the question remains open as to what kind of signature type should we use for the new address type.

Quote from: d5000 on July 21, 2025, 07:26:49 PM

Quote from: Satofan44 on July 21, 2025, 11:56:20 AM

I think it would be worthwhile to do a deeper analysis of this situation,

I had (last year or so) seen a better analysis, but unfortunately I lost the link and haven't found it. I agree that a more detailed view would be desirable to really assess the magnitude of the problem.

If you do find it, please share it here.

Quote from: d5000 on July 21, 2025, 07:26:49 PM

Quote from: Satofan44 on July 21, 2025, 11:56:20 AM

Do you have an idea what an exchange could do instead of their current setups? I don't think not reusing cold storage wallets is feasible for them right now.

I'm no expert at that matter. From my knowledge it should be possible to create a setup where a cold wallet only receives coins (this doesn't add the vulnerability of course) and regularly, when coins are needed for the hot wallet, is "renewed" (i.e. all coins sent to another address, dividing the coins between "hot wallet" and "continue in cold wallet". But of course this could create higher fee costs than a single, re-used cold wallet where utxos could be directed individually to the hot wallet.

Multisig wallet looks like a good idea to improve security.

Imagine this. All your wealth is in a single bank vault, the best bank vault that you could make. Every time you need some extra money in your wallet, you move all your wealth to another bank and take some money for yourself. Doing this each time creates a huge surface for human error and security compromise. This is why I don't believe there is a good and practical solution for exchanges and institutions.

Quote from: d5000 on July 21, 2025, 07:26:49 PM

@Forsynth Jones: Thanks for the mention of Sparrow. It's a wallet I always wanted to test but never did (because at the end it didn't deliver the features I would consider important in comparison to Electrum). I may take the opportunity to do that finally Wink

and check out their warning policy.

Off topic, but what is it that it is missing for you compared to Electrum?

Quote from: Ambatman on Today at 02:47:16 PM

Not quite perse.
Here you can see where there was a flaw in random number generator for ECDSA and some addresses were affected
https://bitcointalk.org/index.php?topic=581411.0

It is just users who weren't there rehashing text that they have read elsewhere. Just because someone isn't aren't aware of something that doesn't mean that it didn't happen. Address reuse is both a privacy and security mistake, always has been.