Feed for category: wallets
Improving SPV Security With POW Fraud Proofs

Bitcoin full nodes require increasing computer resources that are not available to most of the public, therefore most users tend to use SPV. Simplified Payment Verification is a way for users to check the validity of a block without downloading the whole blockchain, only needing a copy of the block headers of the longest chain.

This schema makes SPV clients vulnerable to forks as it is secure under the assumption that the longest chain is valid and as attacks like Segwit2x have shown and this is not always a safe assumption. A new schema has been proposed on the Bitcoin-dev mailing list that allows invalid blocks to be rejected as long as there are enough honest miners to create a block within a reasonable time frame. The new schema doesn’t fully protect clients against dishonest miners but is an improvement over the current SPV.

ColdCard Wallet
ColdCard is another Bitcoin hardware wallet developed by a team in Canada, its used to sign transactions and can be used both online and offline, it runs PSBTs natively so it can run completely offline for its entire lifecycle.
BTCPay Server Payment Request: Invoice Clients and Get Paid in BTC by Sharing a Simple Link

The team at BTC Pay Server published an article introducing their Payment Requests feature.

It allows you to get paid in cryptocurrency just by sharing a simple URL using a new type of time-sensitive inoice page built into BTCPay.

BTCPay Server is an open-source cross platform, self-hosted bitcoin server compatible with Bitpay API.

Ledger's Nano S 1.5.5 Firmware Update Causes Troubles

The Ledger Nano S’ firmware has been recently updated to 1.5.5, while this update brings several features like the support of Groestl and Blake2b as new hashes, Schnorr with Zilliqa as a new signature scheme, Bip32-ed25519 as a new derivation scheme and several other major security updates.

It also caused troubles for its owners wanting to update. As this firmware is slightly larger in size than old ones, HSM servers hosting this update became unresponsive as many users were simultaneously trying to update their device, causing access to the Manager and installing apps to be slower than usual, a significant amount of users reported their device getting stuck during the update which would be later addressed with another update and an apology from Ledger.

Electrum Fishing Scheme Warning

A fishing malware scheme has been spotted targeting electrum wallet users. Electrum users are advised to read the warning explainer that has been setup here.

A malicious notification popup with a clickable link.

Users of many versions of Electrum released may see messages as pictured when attempting to send a transaction with their wallet. The message, or some variation of, purports that a security update is required to continue.

This is not the case.

The message is generated by the server you are connected to, and contains a link to a malicious modification of the wallet which, if installed, will result in the immediate theft of all of your money. If you install any software shown in a message such as this you have no recourse to recover your funds.

Card Shuffle to Bitcoin Seed
Bitcoin seed generation is the most important event for any Bitcoin holder, as without this seed your wallet and ultimately your money is lost. We as users trust hardware and air gapped wallets to be correct and honest in their seed generation, which is hard to verify. A new bring-your-own-entropy method was proposed on the Bitcoin dev mailing list by developer Ryan Havar to allow users to create randomness they trust.