Quote from: Xephan on August 04, 2011, 03:43:35 AM

Playing the role of the malignant admin again

3. Sounds like the perfect way for a rogue admin to backup a wrong/empty wallet over-writing the user's backup. Or it might not even need to be malicious, a bug could cause the backup wallet to be wiped. Furthermore, sending it to yet another external system seems to be increasing the vectors by which the wallet could be stolen/attacked.

Two things:
(a) lost data: I think an automatic backup/export button is safer, rather than less safe. Sure horrible code might overwrite data, but at least you can have it backed up everywhere. Also, just to be clear each bitcoin address only needs to be backed up once, even if used for many transactions.

(b) backup getting hacked: Bitcoin already exposes all of its encrypted data publicly, in the block chain. As long as encryption is sufficient, you're just as safe backing up this server elsewhere. Further, knowing this is incentive to provide strong safe encryption instead of a misguided reliance on the server never getting hacked. Security through open approach instead of security through obscurity is always better.

Quote from: Xephan on August 04, 2011, 03:43:35 AM

6. Doesn't stop a rogue admin from capturing the user's passwords in the first place to use for decryption Cheesy

Yes, this is the risk. However as long as the right Ajax code is used, the rogue admin never has access to the user's passwords. Ideally, this Ajax code could be hosted by a 3rd party open source repository, unrelated to the data admin.

This is the way I would envision it:
User browses to "SuperAwesomeBitcoinWallet.com", which is registered and maintained by trusted community members.

- SSL Certificate on server A confirms identity and secures the transaction.
- JS code is loaded from server B, an open source repository
- User logs in, and the ajax loads their bank provider of choice server C
- Server C loads custom graphics, branding, super awesome user interface, etc, but the Ajax is still from server B

Server C runs the "business" of branding, customer experience, database storage, etc. But server C never has access to the user password or unencrypted data.

Newton

Posts

Merits