Hacker News Reader

Comment by herpderperator | Hacker News Reader

Bitcoin is all online. The analogy doesn't work: your gold bars are being driven around town all day and night in public view, already.

In this case, it's just the fact that the access was granted at the application level when the user logged into their wallet, which is like giving someone keys to your car by mistake.

View on HN

No. One can store keys offline. That's what hardware wallets do.

In order to do anything with Bitcoin, which appears to be what the author wanted, you would have to be connected to the Internet. Keys being stored in hardware wallet sure, but the gold bars are still in public view.

Hardware wallets aren't without their flaws. With an application-level vulneravility in a hardware wallet, you are still screwed. Here is just one example: https://www.ledger.com/improving-the-ecosystem-disclosure-of...

You can sign transactions offline and hand deliver the file if you felt so inclined.

Signed transactions cant be modified.

Someone needs to make sure nodes see it that transaction and add it to the database, eventually.

This user experience has not been refined, but is very possible. A system with fewer nodes, like if the internet was attacked and not available, would still work for this currency.

> You can sign transactions offline and hand deliver the file if you felt so inclined.

How big is that signature/file? Can it be encoded in a QR code or something simpler to bridge the airgap?

The specific transaction this post refers to was 1813 bytes. It had 12 inputs that had to be signed for making it larger than average. For $10M I'd be willing to manually type out the 3626 hex digits, or if feeling lazy splurge on a $10 USB stick. Only 3 inputs account for almost all of the balance, so really it could have been moved for under 1000 bytes, which I happily write longhand on paper with a quill in triplicate before I'd even consider exposing the secret key to the internet.

It's usually less than 300 bytes. A comically huge QR code could handle that.

Like the Coldcard wallet where you can choose to only transfer the transaction via an air gap on a MicroSD.

It just doesn't work that way. The wallet has a secret which can be used to sign a transaction to spend the balance. It doesn't need to be connected to do this. The transaction is a serialized piece of data which can be broadcast to the network. The size varies depending on certain factors, but it's usually about 250 bytes. Electrum can create this transaction and show you a hex dump of it which you could copy off and submit to the network from a different system that is online. An attacker who controls the online system would be unable to modify the transaction. With more than $10M at stake it is prudent to do that, just like it would be best to use an armored truck to move $10M in cash.

Reply on news.ycombinator.com