Quote from: rjk on June 27, 2012, 01:10:14 PM

Quote from: jl2012 on June 27, 2012, 05:03:04 AM

Quote from: TORwallet on June 25, 2012, 09:35:33 PM

Quote from: jl2012 on June 25, 2012, 03:43:00 AM

Although you do not have a wallet on torwallet.net, hacking of torwallet.net will expose the secret code, and thus the balance of the accounts of those who use torwallet.net.

Quote from: TORwallet on June 22, 2012, 08:34:40 PM

It is impossible for google or anyone else to find the link to a TORwallet unless it has been posted somewhere. Those instawallet links were most likely indexed by google visiting instawallet.org and being redirected to a new wallet.

We are working on adding an optional password field to the site. We are waiting for our developer to get back from vacation.

Hacking of torwallet.net will expose absolutely nothing. https://torwallet.net is nothing more than a proxy, and actually has more in common with a port forward in your router. It doesn't even understand http and does nothing more than pipe data through tor.

In fact, here is the command we use.
socat openssl-listen:443,fork,reuseaddr,su=nobody socks4a:127.0.0.1:nci2szjrwjqw2zbi.onion:80,socksport=9050

Hacking of nci2szjrwjqw2zbi.onion would reveal current balances, however the attack surface is limited to a single port.

Just for example, I have the following wallet: https://www.torwallet.net/w/c85f0c2c5347caf6b302cebabed0e93c3ce023d6739b1e502128cbaa7042eddb

Therefore, anyone who knows the code "c85f0c2c53.............." can redeem all coins in my wallet.

A hacker can obtain the private key of torwallet.net's certificate, and he will learn the code "c85f0c2c53.............."

However, he cannot obtain the private key by hacking torwallet.net. He can only obtain it by hacking the onion site itself. That socat tool is pretty damn cool; I've added it to my arsenal.

Most .onion sites don't bother having SSL enabled because Tor provides encryption... but for external access, this is a perfect example of how to use it.

The hacker don't need the wallet private key to withdraw BTC. Only the secret codes are needed