Preventing the exposure of public addresses on a website

Rather than having a single, fixed address, I want to generate a new address on my website every time a user request comes in.

I'm concerned about google or another web crawler indexing my website and tying my Bitcoin address to my website address.

I've thought about pregenerating the addresses, storing them in a database, and only showing one to each user. I think there's probably a better way.

I use node.js, so a solution using bitcoinjs or another node.js package would be preferable.

I would prefer to use multisignature addresses.

I would rather not depend on blockchain.info or an exchange - it introduces a single point of failure.

ken Code

Posted 2014-10-23T11:08:18.850

Reputation: 41

PS: Are you OK with having the private keys to the addresses stored on your website? – Nick ODell – 2014-10-23T15:00:04.037

no. private keys bitaddress/bulkwallet) must be stored locally, the public addresses can be stored in mongodb on the server, hidden from google etc. we built a website for an old man that runs a novelty shop, he doesn't know doodly about tech so this has got to be dumbed down automated for him, yet as anon as possible. – ken Code – 2014-10-23T15:13:19.450

Answers

You should try using BIP32 to generate addresses.

There's a node.js implementation here: http://cryptocoinjs.com/modules/currency/hdkey/

Nick ODell

Posted 2014-10-23T11:08:18.850

Reputation: 26 536

One time keys are standard practice on some exchanges. E.g. when you top up the exchange wallet the receiving address is recycled after it receives one transaction. You can generate receiving addresses on the fly, there is no need to pre-generate them.

You need to put receiving addresses behind something which stops the crawler. If you only target web crawlers, putting the payment page behind HTTP POST form is enough. If you want to stop malicious visitors you need to have CAPTCHA before the visitor can get the payment address.

Also you might want to make sure that there are no log entries of QR codes and such. This is best accomplished by generating the QR code image on the client side using JavaScript. Here is an example library for it. Some popular solutions, like Google's QR code generator, have QR code content in URL, thus leaving log entries containing the address.

Mikko Ohtamaa

Posted 2014-10-23T11:08:18.850

Reputation: 2 417

I hate captcha's, so does everyone else, so that's out. Using an Exchange is also no longer an option. Form method=post sounds like the only option then for hiding the key? So, what library do we use then for what I am trying to accomplish.. – ken Code – 2014-10-23T11:50:19.477

bitcoinaddress.js also displays everything on the page in plain text, not good. see my question above for why etc thanx :) – ken Code – 2014-10-23T12:02:04.220

There is no difference if you display it as plain text, QR image or voice clip with some lady reading every character. You need to give the public address out if you want to receive anything to it and thus, it really doesn't matter which method you use as all of them are equally secure. – Mikko Ohtamaa – 2014-10-23T12:30:39.657

Here is one JavaScript based multisig wallet as open source https://github.com/bitpay/copay/

– Mikko Ohtamaa – 2014-10-23T12:33:26.057

I disagree. Displaying the public key as an image in a compiled jpeg would be more secure than displaying it as raw copy-able clear plain text on the page. Most people will just scan the qr code before they will copy/paste a key... – ken Code – 2014-10-23T12:35:42.357

2@kenCode: Unfortunately that is not true. Both are copyable with a simple right mouse click. Emphasizing the fact that the image is safer would be building your security on wrong principles and undermine your promise of secure service. – Mikko Ohtamaa – 2014-10-23T12:41:39.677

google can read svg files, even raw text on a pdf, but i do not see google reading the text that is drawn onto an image as of yet. (ie: captchas) i just can't think of an easier way to show the public key. maybe skip showing the text of the key altogether and just show qr codes from now on? that might make the customer on the website a bit suspicious tho, not sure if they are sending money to the correct address. i personally read the first 5 or 6 chars myself just to make sure it matches what my wallet is about to send btc to. so, how do we hide that key text from google et al? ideas? – ken Code – 2014-10-23T13:44:28.413

Just make your payment page not accessible by Google and other bots using CATPCHA, as explained in the answer – Mikko Ohtamaa – 2014-10-24T05:57:12.390

Output the address with Javascript, crawlers cannot see that. e.g. document.WriteLn(addressHere); Hiding the page behind a POST will stop most crawlers but not all.

Alternatively you could do some simple obfuscation, e.g. split the address in two and ask the user to combine it, or leave off the '1'/'3' prefix and ask users to add that manually. Kinda like when people list their email address as userATdomainDOTcom.

Alternatively, you could use a payment processor that pays out in bitcoin e.g. snapcard.io

George

Posted 2014-10-23T11:08:18.850

Reputation: 586

I ended up on this page because I was looking for a solution so that my public bitcoin address would not be indexed by search engine bots.

I have found a solution to that.

The idea is to serve the bitcoin addresses via js or ajax, and disallow the access to the file to the bots by using a robots.txt rule.

You write your html (template) with placeholders for the bitcoin adress(es). And either use a plain js file holding adresses in variables or make an ajax call to get addresses (generated on the fly may be) via json, and display (via js) the adresses on the page in the browser.

But you add a Disallow rule to your robots.txt to forbid the bots to download either the js or the ajax url.

This has been tested with GoogleBot and works fine. (explicitly tested in Search Console with "Explore like Google" feature). All well-behaved bots that follow robots.txt should not be able to see the addresses and could not render the page properly.

This doesn't work for bots that don't care about robots.txt or ignore it to render the page.

solsTiCe

Posted 2014-10-23T11:08:18.850

Reputation: 101