The LTB Network Forum

RushWallet...Noob Perspective

Pages: 1 2

Comments

Offline
Posts: 29

By now you may have heard that the folks at KyrptoKit created an in-browser HTML5 wallet. Its viewable in all browsers I tried it in AND works for iPHONE.

Like KryptoKit, it puts all the security in YOUR hands and It IS very easy to use the use images/infographs to guide you through the whole process. But, noob that I am, I have questions about a few things.

The site indicates there is a way to import a BRAIN WALLET and it does this via URL.

"HOW TO IMPORT YOUR BRAIN WALLET:

(1) In your URL type : www.rushwallet.com/#.

(2) Then type in your brainwallet : www.rushwallet.com/#YOUR BRAIN WALLET.

*Please note you can even include spaces for personalized brain wallets."

These instructions couldn't be simpler.

My confusion comes in when I import my BRAIN WALLET from my KryptoKit and enter it into the URL for RushWallet, It creates a address that is different from the one in KryptoKit. Is that normal? Why is that happening?

For example if I 'Reset Address' in KryptoKit, then import my BRAIN WALLET, it gives me the correct address for my BRAIN WALLET.

Dumb it down for me please.

Posted on August 7, 2014 at 7:18 AM
Last Edited: August 7, 2014 at 7:18 AM

2 likes

therealtwig

Offline
Posts: 97
Location: Bloomington, IN

@erreip

I do not currently use Kryptokit, but just just checked with a hypothetical brainwallet and it worked for me.

In the brainwallet website I created the passphrase: this&is&a&test&wallet&for&rushwallet&erreip and tested with the following URL:

www.rushwallet.com/#this&is&a&test&wallet&for&rushwallet&erreip

I found the public key to be exactly as predicted. I did have to refresh the browser page though to see the right public key, so you may want to check that.

Just as a heads up, and I am quite sure you have considered, I would NEVER feel comfortable having anything North of a few millibits on this hot wallet. I know the brainwallet is only on the client side URL, just gives me the heebie jeebies.

Posted on August 7, 2014 at 3:45 PM
Last Edited: August 7, 2014 at 3:47 PM
Permalink

1 like
erreip

Offline
Posts: 29

@therealtwig @erreip

I do not currently use Kryptokit, but just just checked with a hypothetical brainwallet and it worked for me.

In the brainwallet website I created the passphrase: this&is&a&test&wallet&for&rushwallet&erreip and tested with the following URL:

www.rushwallet.com/#this&is&a&test&wallet&for&rushwallet&erreip

I found the public key to be exactly as predicted. I did have to refresh the browser page though to see the right public key, so you may want to check that.

Just as a heads up, and I am quite sure you have considered, I would NEVER feel comfortable having anything North of a few millibits on this hot wallet. I know the brainwallet is only on the client side URL, just gives me the heebie jeebies.

I figured out what the problem was. the brainwallet phrase was too short! When the phrase is 5 or more words, it works fine.

Thanks for the help @TheRealTwig

Posted on August 7, 2014 at 4:55 PM
Permalink

0 likes
Trebia

Offline
Posts: 8

I was impressed by RushWallet! It so easy to use brainwallet nowadays. That I wonder why so bitcoin don't mainstream yet.

Posted on August 8, 2014 at 12:25 AM
Last Edited: August 8, 2014 at 12:25 AM
Permalink

0 likes
PRISMicide

Offline
Posts: 36
Location: France

It so easy to use brainwallet nowadays. That I wonder why so bitcoin don't mainstream yet.

Perhaps because online brainwallets are the worse security architecture you can think of.... perhaps.

(yeah, counterwallet included)

I was impressed by RushWallet!

... and I am too. It is so absurd.... OMG, rushwallet... why... but WHYYYYY...

Kryptokit is a great product... but this... rushwallet thing is so wrong in so many ways...

"Make sure you bookmark this page to access your wallet in the future"

yeahhh... for sure... and by doing that... let people have their private keys stored in clear text somewhere on their disk most of users don't even even know... yeahhh...

oh... but I see... you can add password protection to your key... so the UI will probably ask...oh no... It simply adds an exclamation mark to the url to throw it away the same way directly... what the Hell ?

Seriously ? Didn't we have enough past horror stories ?

What is so difficult to understand in this simple basic two rules 101 security guideline ?

1) Users should never upload their private keys online

2) Private keys should never be stored unprotected

Rushwallet : WORSE SECURITY AWARD 2014 for now

Posted on August 8, 2014 at 2:31 AM
Last Edited: August 8, 2014 at 2:57 AM
Permalink

2 likes
erreip

Offline
Posts: 29

@prismicide

It so easy to use brainwallet nowadays. That I wonder why so bitcoin don't mainstream yet.

Perhaps because online brainwallets are the worse security architecture you can think of.... perhaps.

(yeah, counterwallet included)

I was impressed by RushWallet!

... and I am too. It is so absurd.... OMG, rushwallet... why... but WHYYYYY...

Kryptokit is a great product... but this... rushwallet thing is so wrong in so many ways...

"Make sure you bookmark this page to access your wallet in the future"

yeahhh... for sure... and by doing that... let people have their private keys stored in clear text somewhere on their disk most of users don't even even know... yeahhh...

oh... but I see... you can add password protection to your key... so the UI will probably ask...oh no... It simply adds an exclamation mark to the url to throw it away the same way directly... what the Hell ?

Seriously ? Didn't we have enough past horror stories ?

What is so difficult to understand in this simple basic two rules 101 security guideline ?

1) Users should never upload their private keys online

2) Private keys should never be stored unprotected

Rushwallet : WORSE SECURITY AWARD 2014 for now

@prismicide Soooo. Mark you down as: Not a fan. :)

That should be a real thing. The WSAs kinda like the Rassys.

Was looking at your product. Seems interesting. Are those different than RFID technology? I know that that has been breached pretty badly.

Posted on August 8, 2014 at 3:40 AM
Permalink

1 like
PRISMicide

Offline
Posts: 36
Location: France

Rushwallet : WORSE SECURITY AWARD 2014 for now

@prismicide Soooo. Mark you down as: Not a fan. :)

At least :)

That should be a real thing. The WSAs kinda like the Rassys.

Was looking at your product. Seems interesting. Are those different than RFID technology? I know that that has been breached pretty badly.

RFID is a generic name for different contactless technologies. So "breached RFID" do not mean anything. But yes a few RFID/contactless/NFC based technologies have been broken. Like MIFARE Classic for example. Anyway, we are not using RFID.

We'll use pure-contact-only smart cards though a Bluetooth 4.0 BLE card small portable reader. Private keys NEVER leave the smart cards, even the portable readers never know/use them... so private keys can't be stolen. (and no sensible information goes on the air).

Posted on August 8, 2014 at 3:59 AM
Last Edited: August 8, 2014 at 4:06 AM
Permalink

0 likes
mdw

Offline
Posts: 126
Location: orphaned block

That's horrible, can it be true? Storing the brainwallet phrase right there in your browser history?

Worse yet someone could compromise their webserver and steal the money from every visitor with a quick look through the server logs.

You're right @PRISMicide this sounds even worse than the site I thought was the worst: http://www.tools4noobs.com/online_tools/encrypt/

Posted on August 8, 2014 at 4:13 AM
Permalink

0 likes
PRISMicide

Offline
Posts: 36
Location: France

@mdw That's horrible, can it be true? Storing the brainwallet phrase right there in your browser history?

Worse yet someone could compromise their webserver and steal the money from every visitor with a quick look through the server logs.

You're right @PRISMicide this sounds even worse than the site I thought was the worst: http://www.tools4noobs.com/online_tools/encrypt/

yeah... clear password storage... local history... server log.... simple MITM attack...

like I said : Rushwallet : WORSE SECURITY AWARD 2014

Posted on August 8, 2014 at 4:18 AM
Permalink

0 likes
steve_kryptokit

Offline
Posts: 1

@prismicide

@mdw That's horrible, can it be true? Storing the brainwallet phrase right there in your browser history?

Worse yet someone could compromise their webserver and steal the money from every visitor with a quick look through the server logs.

You're right @PRISMicide this sounds even worse than the site I thought was the worst: http://www.tools4noobs.com/online_tools/encrypt/

yeah... clear password storage... local history... server log.... simple MITM attack...

like I said : Rushwallet : WORSE SECURITY AWARD 2014

Rushwallet dev here. The brainwallet is stored as your URL if you choose to not set a password. If you set a password, the URL will be useless without it.

-Steve Dakh

Posted on September 4, 2014 at 10:51 AM
Permalink

0 likes
PRISMicide

Offline
Posts: 36
Location: France

Hi @steve_kryptokit,

Why at least don't you make the password mandatory for a start ? (and restrain people to choose 1234)

Why for f*** sake do you provide a tool with such poor security, with so many obvious flaws ? (I think this is probably the first wallet that you can hack through simple browser history... wow... very security.... such facepalm)

Kryptokit web plugin was a great start, and we spoke with some Kryptokit members, and they were thinking about improving its security again...

Believe me, I am not the only one to think this rushwallet initiative was such a bad move... For now, sorry, but this wallet system still deserves its WORSE SECURITY AWARD of the year.

Posted on September 5, 2014 at 12:32 PM
Last Edited: September 6, 2014 at 12:50 AM
Permalink

0 likes

Jump to top

Pages: 1 2