Search content
Sort by

Showing 14 of 14 results by sendbit.io
Post
Topic
Board Bitcoin Discussion
Re: 50 BTC Just Moved for First Time Since 2009 -SATOSHI NAKAMOTO
by
sendbit.io
on 22/05/2020, 00:42:09 UTC
Interesting after 11 years!! 50 bitcoins are finally moved and this really gets me thinking.

An early Bitcoin miner has moved 50 Bitcoin that were mined in a Feburary 9, 2009 block reward. Some have speculated these Bitcoin might belong to Bitcoin’s creator, Satoshi Nakamoto. Analysis of Bitcoin blockchain data, however, puts this rumor to rest :-) what gets me is why after 11 years??..
Post
Topic
Board Wallet software
Re: Online Wallet: Sendbit
by
sendbit.io
on 10/05/2020, 22:20:53 UTC
BOB123 Majority websites on the internet don't need to encrypt passwords beforehand using javascript because it will store your password as the hash LOL and if the server SQL gets dumped the encrypted hash is your password LOOL.

We are not talking about standard web applications.
We are talking about a web wallet.

The whole sense of a web wallet should be that everything will be handled client-side (key generation and encryption) and then uploaded to the server.
This obviously is NOT the case here.
And that is the point here.

sendbit is claiming to not have access to the private keys. However they also admit that they have the encrypted file AND the password to decrypt it. That's the point.

Take a look at blockchain.com.
As much as i dislike web wallet, they are at least doing everything (kind of) right. Key generation and encryption is done client sided. Transaction signing is as well done client-side. The server actually never can access the private key. This is NOT the case with sendbit.io, even tho they claim otherwise.
And i am not even going to talk about open vs closed source now.





Hello,


All password hashing encryption is now generated on the client-side, you can check our headers are secured using bcrypt cost 12 example below

user_name: 31006e07-40f7-4657-a778-4d635ce0fc1a
email: xxxxx@xxxxxxxx.com
password: $2y$12$UsrnjwCpNxVvWyAd170WDeVUydp79FDxdvpn34J.YgpgSfAaPGp6G
csrf_token: 7662e1313fbf1db64b27648bfaa9b95a145dcd1b727562168b41c951d20435ff
register: REGISTER

CSRF is in place and TSL encryption,

 
Post
Topic
Board Wallet software
Re: Online Wallet: Sendbit
by
sendbit.io
on 10/05/2020, 14:19:44 UTC
Hello,

I have added a CSRF token on the register (client-side) the element is hidden you can right click view-source and see it for yourself the CSRF token is generated when user enter registration page and is stored in a $_SESSION variable - this will prevent any middle party in the middle of attack.

Feel free to tamper with the CSRF token on your register page Smiley

Thank you for your constructive criticism and i have given you 3 merits merit.



Post
Topic
Board Wallet software
Re: Online Wallet: Sendbit
by
sendbit.io
on 10/05/2020, 13:36:03 UTC
Lets put an end to this talk .. Example Coinpayments.net below highlighted in red coinpayments is been seeing as the Goliath of crypto processing. Password revealed on form. this is a normal practice and this does not mean we have access to your password..its just a form input ready to be hashed into database with Bycrypt 12.

-H "referer: https://www.coinpayments.net/register" ^
  -H "accept-language: en-GB,en-US;q=0.9,en;q=0.8" ^
  --data "step=step2^&type=0^&a21bbfce8b67995c75d27d3884a097bf=bdcc0672cd7e196468cc7d1940d17000f50d4f241e12a9e75b83b766ad3^&username=thisisnothack^&first_name=skeptical^&last_name=user1^&email1=thisisnothack0101^%^40gmail.com^&email2=thisisnothack0101^%^40gmail.com^&pass1=thisisnothack0101^&pass2=thisisnothack0101^&country=CA^&timezone=America^%^2FToronto^&agreetos=agreed^&newsletter=agreed^&captcha_code=BI5W^&screen_res=1280x720" ^
  --compressed &



Post
Topic
Board Wallet software
Re: Online Wallet: Sendbit
by
sendbit.io
on 10/05/2020, 11:28:55 UTC
Hello,

Let us breakdown our previous replies for you: once our server gets the "plaintext" password over HTTPS it is then encrypted with BCRYPT with a cost price of 12 to get stored into a database that is not linked to the wallet and looks something like this: $2y$10$.vGA1O9wmRjrwAVXD98HNOgsNpDczlqm3Jq7KnEd1rVAGv3Fykk1a ) and therefore impossible for us intercept your original password and as per our previous replies client-server communication is encrypted as per TLS so your password is never actually exposed to us.

Below is image to show all necessary encryption is in place!





That being said and moving on to your second question "We use SQL injection filters to prevent CSRF attacks […]” I have answered this in post in #7 however i will break it down for you.

Our custom build framework has built in CSRF AND SQL injection filters in place additionally to that we store CSRF tokens in a cookie named “SENDBIT_SECURE_SESSION” you can verify this by going over to https://sendbit.io and click on the lock icon next to the URL input, Open the cookies folder and this should be visible to you.

You should consider looking into key/iv pair using EVP, with a dynamic number of rounds this will better your understanding on wallet.dat file encryptions.

All inputs are cleaned by our server-side "Request::cleanInput($input)” before anything is transmitted to the database we hope this answers your questions in regards to private keys, passwords, CSRF and SQL injections.

In our upcoming update we are going to intorduce JSON rpc calls to rpc.sendbit.io so you can access your wallet instance remotely this will be useful for many people and here are some benefits

No Blockchain Download - Save on bandwidth and disk space.
No Need to run Bitcoind - Some VPS and shared hosting plans do not allow you to run custom processes

./bitcoin-cli -rpcconnect=rpc.sendbit.io -rpcport=443 -rpcssl -rpcuser=Wallet-UUID -rpcpassword=YourPassword getinfo
{
    "balance" : 437.50100000,
    "errors" : "",
    "paytxfee" : 0.005,
    "proxy" : "",
    "connected" : 0,
    "testnet" : false,
    "difficulty" : 1733207.51384839,
    "blocks" : 179602
}

And HAPPY  Wink Halving

Regards
Sendbit.io
Post
Topic
Board Wallet software
Re: Online Wallet: Sendbit
by
sendbit.io
on 09/05/2020, 15:10:54 UTC
Hello,

It is standard practice to send "plaintext" passwords over HTTPS. The passwords are ultimately not plaintext, since the client-server communication is encrypted as per TLS.

Once our server gets the "plaintext" password over HTTPS it is then encrypted with BCRYPT with a cost price of 12 to get stored into a database that is not linked to the wallet.

Yes the encrypted wallet file is stored on our servers and has no use to hackers since it's encrypted with your password. The passphrase is converted to a key/iv pair using EVP, with a dynamic number of rounds
This key/iv pair is used to encrypt a randomly-generated master key, using AES-256-CBC
The secret part of wallet keys are then encrypted using that master key, again with AES-256-CBC

The sendbit.io wallet is mainly used for accepting crypto payments rather than storing funds (storing funds online is a risk no matter what wallet you use), we are working on a offline storage device for users whom wish to store a large number of crypto funds.

If you haven't already signed up - you may do so to stay updated with our latest developments and newsletters


Regards,
sendbit.io
Post
Topic
Board Wallet software
Re: Online Wallet: Sendbit
by
sendbit.io
on 09/05/2020, 14:29:22 UTC
Hello,

Just to clarify we do not have access to your private keys we use something called "createwallet" (https://bitcoincore.org/en/doc/0.17.0/rpc/wallet/createwallet/) using JSON RPC and your wallet.dat file is encrypted with your masterkey & password which can be found under sendbit Dashboard > Security Centre leaving us with no access to your funds or private keys.

However, we do store copies of your wallet.dat file offline every 2 hours during our backups and this is done with full encryption using AES-256. We recommend users to back up their wallet each time you create and address or you receive funds in case sendbit.io is offline you will still be able to access your funds.

We store encrypted backups of wallet.dat offline for our & customer safety since our platform is responsible for loading and unloading wallets and in case of an emergency such as DDOS attacks and FRA network expansions and mitigation so sendbit wallets can be back up and running in no time.

You can always email us at support[at]sendbit.io and we appreciate any constructive criticism as this make us a better wallet and to grow our trust with the community.

How we secure CSRF attacks and SQL injection:
sendbit_generateAntiCSRFToken() Generates a secure anti-CSRF token and stores it at $_SESSION['sendbit_token'].
sendbit_verifyAntiCSRFToken($input_token) Verifies the token for integrity and returns a boolean.

Request::GET('query', $filtered = false) Returns a GET value set in the URL.
Request::POST('data', $filtered = false) Returns a POST value set in the page.
Request::COOKIE('session', $filtered = false) Returns a COOKIE value set in the headers.
Request::cleanInput($input) Cleans the input and returns it. Useful to avoid attacks like XSS.

Regards,
Sendbit.io
Post
Topic
Board Wallet software
Merits 2 from 1 user
Re: Online Wallet: Sendbit
by
sendbit.io
on 09/05/2020, 13:50:24 UTC
⭐ Merited by cryptoworld99 (2)
Hi

I am the admin of sendbit we are independent blochain based crypto wallet with high security API. im here to clarify regarding password hashing upon form registration. Client side hasing can be enabled using java script as many members do not have java script enabled in there browser so therefore we go back to stage one and this is why i have created a secoundry pin 2FA and upcoming sms login. Now its upto users to secure there laptop/PC fron hackers and update in the sendbit security centre with 2FA pin activation and master key.

Client-side hasing is rare becuase we use SSL instead


So, the problem with client side hashing is that it effectively makes the result of the hash the password rather than the password. There is nothing to stop an attacker from bypassing the official client and simply sending the finished hash to the server directly. It provides no additional (or loss) of security during the authentication, but under the situation that hashing is designed to protect against, it offers nothing since the hash stored in the DB is actually the shared secret transmitted to the server.

Many browsers includes better real-time phishing protection. ... in the sync settings in Chrome..The biggest addition is that Chrome will now warn you when your password has been stolen as part of a data breach.


Now lets get abit deeper have you heard about bitpay they had a java script vulnerabilities in 2018 alot of private keys where stolen. As you must be aware they use copay thirdparty wallet.  https://cyware.com/news/a-bug-in-the-copay-and-bitpay-apps-enables-a-hacker-to-steal-bitcoins-cdf92aba

I do not want to go into to much conclusions.

https://sitecheck.sucuri.net/results/https/sendbit.io

List of tests performed (10/10)
 Fingerprinting the server software and technology...
 Checking for vulnerabilities of server-side software...
 Analyzing the security of HTTP cookies...
 Analyzing HTTP security headers...
 Checking for secure communication...
 Checking robots.txt file...
 Checking client access policies...
 Checking for directory listing (quick scan)...
 Checking for password auto-complete (quick scan)...
 Checking for clear-text submission of passwords (quick scan)...

Another thing i must raise if location login has changed our system will detect and alert useremail. . . We are continously working on sendbit and improving sendbit.


Any other suggestions /bugs welcome to our support email on support[at]sendbit.io . We offer attractive bounties for any critical bugs found.



Regards
Senbit.io

Post
Topic
Board Service Discussion (Altcoins)
Topic OP
Decode Bitpay URL
by
sendbit.io
on 06/05/2020, 22:08:39 UTC

Decode Bitpay URL

https://sendbit.io/resources/bitpayurl/

I have created Bitpay decode url on sendbit for now will up the design work to work on mobile verions hope this makes things easy  Roll Eyes many newbies do get frustrated with this bitpay URL having to force signup!



Post
Topic
Board Bitcoin Discussion
Why Satoshi Nakamoto Lied About His Name When His Amongst Us
by
sendbit.io
on 06/05/2020, 21:52:13 UTC
I dont believe a person name Satoshi Nakamoto ever existed. He never had intention to face the world so why would he leave a trace behind. This a myth that will never be known. This was not a 1 mans game

Why i believe he lied about his name

1. He claimed to be a thirty-six-year-old Japanese man. The pic that i seen of him dosent look 36 well in the late 40s

2. Driven in part by anger over the recent financial crisis..Revenge attack on economy BANKING SECTOR!!

3. He invited other software developers to help him improve the code, and corresponded with them, he never revealed any personal details

What make me angry is his amongst us! his around in seminars on many other forums.

My question to  Shinichi Mochizuki why 21 million coins?

Stefan Thomas, a Swiss coder and active community member, graphed the time stamps for each of Nakamoto's 500-plus bitcoin forum posts; the resulting chart showed a steep decline to almost no posts between the hours of 5 a.m. and 11 a.m. Greenwich Mean Time. Because this pattern held true even on Saturdays and Sundays, it suggested that Nakamoto was asleep at this time, and the hours of 5 a.m. to 11 a.m. GMT are midnight to 6 a.m. Eastern Standard Time (North American Eastern Standard Time). Other clues suggested that Nakamoto was British: A newspaper headline he had encoded in the genesis block came from the UK-published newspaper The Times, and both his forum posts and his comments in the bitcoin source code used British English spellings, such as "optimise" and "colour".[13]

An Internet search by an anonymous blogger of texts similar in writing to the bitcoin whitepaper suggests Nick Szabo's "bit gold" articles as having a similar author.[29] Nick denied being Satoshi, and stated his official opinion on Satoshi and bitcoin in a May 2011 article.[38]

In a March 2014 article in Newsweek, journalist Leah McGrath Goodman doxed Dorian S. Nakamoto of Temple City, California, saying that Satoshi Nakamoto is the man's birth name. Her methods and conclusion drew widespread criticism.[39][40]

In June 2016, the London Review of Books published a piece by Andrew O'Hagan about Nakamoto.[41] The real identity of Satoshi Nakamoto still remains a matter of dispute.


Post
Topic
Board Bitcoin Discussion
Topic OP
Who thinks Bitcoin will hit $250,000 by early 2023
by
sendbit.io
on 06/05/2020, 21:06:03 UTC
Tim Draper predicts bitcoin will hit $250k?? Grin
 
"That's my prediction. Sticking with it. I'm very confident that that is going to happen. That’s happening. It's kind of funny."

My prediction bitcoin will be around $25 - $30k by 2023 becuase there will be alot of certainty regarding the economy.. Smiley


Luke FitzpatrickContributor
Crypto & Blockchain


Bitcoin, born from the Global Financial Crisis (GFC) of 2007-08, is now outperforming stocks and gold. With the bitcoin halving event scheduled to take place in 5 days, all eyes are heavily focussed on bitcoin, an asset that has only 21 million bitcoins in existence.

During the bitcoin halving, block rewards are cut in half from 12.5 to 6.25. To recoup the block reward reduction price loss, bitcoin miners postpone selling their bitcoins in order to sell them at a more profitable price several months, up to a year later.

In effect, supply is reduced on a month-by-month basis and each month after the halving, bitcoin becomes extra scarce. As a consequence, assuming that the demand stays the same, then the price of bitcoin will naturally increase each month. And, this is exactly what happened during the 2 previous bitcoin halvings.

First bitcoin halving: During 2012, the price of bitcoin increased from $11 to $1,000.
Second bitcoin halving: From 2016-17, the price ballooned from $700 to $20,000.
Third bitcoin halving: Scheduled on May 12, 2020 (the price impact is still yet to be seen).

After what we all seen the economy crashing oil price in the minus where does this leaves us??
Post
Topic
Board Development & Technical Discussion
Re: Blockchain Dev Cost
by
sendbit.io
on 06/05/2020, 11:52:59 UTC
Firstly you need a good trusted team and very good developers! no room for errors. I have developed a few in the past and now they are pretty much know in the crypto industry.

What you need

1. Finance in place

2. Developers starting with even 1 or 2 gradually increasing

3. Your own frame work

4. List of features what makes you different to others why would i use your service over other crypto payment providers. USP Unique selling point

5. Trusted hosting company

Now you need to decide the best route.. Crypto blockchain development for Industrial example API based for websites buying and selling or individual using to send and recieve payments.

DevCosting: from $45,000 Stage one
Building somthing like coinbase average time 9 months which is broken down in stages 3 months + 3 months R&D then another 3 months testing the waters.. Website live real time customer feed backs is very important before heavy marketing. Total 9 Months is fine.

Security Costing: $5k to $10k intial startup
Hosting nodes keeping them entirley seprate from the web application server. You can learn alot by watching IvanOnTech Youtube how important security is.

Marketing Cost $20,000 Minimum:

It all depends how fast you want to be known. cointraffic coinzilla amazing advertising platform will get you know int the market fast. before you even advertise you need to build articles build a marketing team for google keywords youtube content.

Security is very important and must never be taken so lightly and many other things to consider as the list goes on and on.


Post
Topic
Board Bitcoin Discussion
Re: You own a decent amount of Bitcoin, How would you increase it
by
sendbit.io
on 06/05/2020, 09:55:33 UTC
I would wait for the halving to happen in the next 5 days :-) increasing bitcoin can be tricky.. I would rather sit on them for some time for decent amount that you have maybe in the 1000s :-).

Back in 2009 i met Amir Taaki the legendary bitcoin developer.. As developers of chain we never seem to be greedy. Innovating in technology ahead of time was priority he Mr Taaki said just mine and sit on them as long as you can even though he didnt mine much or sold them for pennies back in the day. Now imagine i owned maybe a few thousand + Bitcoins back in the days then and todays worth is unimaginable and thanks to Amir we never spent much time after 2010 he just vanished :-) i went into mining coins so i started to mine and then went on to developing some core dev and helping in mining rigs with 2 of his top EU coders and 1 was from USA early days based in iceland genesismining Marco streng and i happened to mine many coins back in the days. I also became lucky when ripple lab was selling at around 0.003 and and took a dive into buying loads of Ripple with bitcoins exchanger was gatehub XRP Ledger protocol.

So overall i looked for opportunity in other coins and then the growth came. Trading is good too with USDT you can simply lock your rate 0 risk buy and sell with ease.

Now check this out pm2btc is making around 10704.96 PM = 1 BTC when the coin on coinmarketcap $9,069.35. PM2BTC exchangers buy btc +2 +3% on localbitcoin or top traders and then charge upto +10%. If you hold many bitcoins you can start as a mini exchanger and follow similar steps.

So Below is what i would do

1. Sit back let your bitcoins grow.. Chances are bitcoin will only grow... after China and India regulated Bitcoin and many will follow those who banned bitcoin will mostly get approval during this pendemic crisis. Looking at the world GDP and then here we have bitcoin on the rise shows bitcoin is the safest option right now :-) i do not want to go into too much details as i will end up going off topic.

2. Sell your assets for bitcoin. Is always a risk!

3 Exchanger buy and sell online..Utalise your coins

4. Public trader within your community buying and selling

5. Look at some cool projects genuine projects new technology buying coins.

Some info what bitcoin could be worth?
The billionaire investor predicted bitcoin will reach $250,000 (£193,000) by 2023 – a figure he first forecast in November 2018 when the price of bitcoin was around $5,000. Bitcoin has since experienced a remarkable price recovery, rising from below $4,000 at the start of 2019 to today's price of $8,100

Bitcoin's 2030 market cap is decided by the number of bitcoin holders multiplied by the average bitcoin value held. Bitcoin's 2030 supply will be about 20 million. Bitcoin's 2030 price and user count will total $500,000 and 400 million, respectively.
Post
Topic
Board Bitcoin Discussion
Merits 7 from 2 users
Re: Leaving Bitcoin as inheritance
by
sendbit.io
on 05/05/2020, 22:00:44 UTC
⭐ Merited by cryptoworld99 (6) ,Timelord2067 (1)
Some usefull information can be found here https://news.bitcoin.com/how-to-bequeath-your-digital-assets-to-your-descendants/

Its vital to keep your private keys in a safe place. For example you had 100k worth of bitcoin on site A and this happened to go down or vanish over time..With private keys you can retrieve your coins from the bitcoin network into another wallet or site B. Bitcoins are always safe if you keep your private keys safe from hackers or greedy family members.

My advise is buy a mini saftey deposit and place you private keys inside. Instruction with the deed lawyer. Lawyer dosent need to know what asset are being written down. if tax has been already paid no need to worry!. some countries do require inheritance tax to be paid. In the bitcoin law im not to certain.

Trezor is another safe device..the issue is firmware updates are required on regular basis.

The other method is time lock bitcoins. :-)

Regards