3
1
Does anyone know if it is safe to use blockchain.info "Watch Only" addresses? The real question is what happens after I perform a transaction - sending BTCs out of such a wallet. Will blockchain.info record the "offline" private key used for such transaction somewhere on the server?
6
My Wallet's warning for watch-only addresses ("You will not be able to send bitcoins from this address without later providing the private key") can be a bit confusing.
It's possible to specify an address and watch it. And it's possible to import a private key to be able to use the associated address as if it was generated with the My Wallet client.
But these two features are really unrelated. You don't "send out of a watch-only address", rather you import a private key thus making it no longer a watch-only address.
So the question is really whether My Wallet's "Import Private key" feature is safe. I don't have the official answer, but I see no reason why it shouldn't follow the same policy as other keys - the private key is encrypted in your browser (and as needed, decrypted and used to sign) and never leaves your computer in plaintext. If that's true, it is safe as the server never sees your plaintext key.
Thank you Meni. You were the only person who actually made a real effort to answer my question. My concern is that even though the private key reaches blockinfo's server in encrypted form, it probably is stored. And whatever is stored on a server, becomes much less secure, for example could be decrypted using a brute-force attack with a comprehensive dictionary. So I think the way to go with this would be to use a watch only address while I do not use it at all to transfer the funds out. As soon as any amount is transferred out, I consider such a wallet compromised and I will have to create a – Vitro – 2013-02-03T16:25:59.073
@Vitro: You choose which password to use for the encryption. If you use a strong password (random and long enough that you have to write it down) brute-forcing is impossible. Cracking the encryption algorithm is conceivable, but you'd know in advance when weaknesses are found. The main vulnerability would be a virus on your machine that steals the key/password. I'd say it's pretty safe - but I agree it's a bit less safe than when the key exists only in a properly made paper wallet. – Meni Rosenfeld – 2013-02-03T16:49:36.667
@Vitro: It looks like your comment was cut off, you can write the rest in a new comment. – Meni Rosenfeld – 2013-02-03T16:49:56.417
Oops, my bad, I didn't notice that the message was cut off when I converted it from an answer to a comment. The complete last sentence was: "As soon as any amount is transferred out, I consider such a wallet compromised and I will have to create a new watch only address, and move all remaining funds to it." – D.H. - bitcoin.se – 2013-02-03T21:52:59.750
3
blockchain doesn't record on their server any private key, or any key at all; or, they do, but they are encrypted and they can't access them, only you can
"watch only" addresses are public keys only anyway
Lohoris. Thanks for the reply,but I am looking for a real answer. Also please do not assume that I'm a noob if I'm asking a question. I am well aware that the "watch only" wallets are based on public keys, but if you would have read my question more closely you would notice that the question is about the usage of such a wallet to send BTCs , i.e. private key is used for the transaction of the BTCs out of the "watch only" wallet.
Would anyone else please, answer my question? – Vitro – 2013-02-02T01:42:34.613
1He actually answered your question, if anyone would not tell his public asymmetric cryptography would have been broken a long time ago. The whole point of a public key is to be guess what public, hence your address is safe when you give it to anybody. – Gopoi – 2013-02-02T01:49:56.477
When a "watch only" wallet is used to send the BTCs a user must provide a private key, hence the private cryptographic key is exposed during the transaction. My question was and remains: will this private key be stored/cashed by the website. – Vitro – 2013-02-02T04:15:59.230
1No you NEVER provide the private key when doing a transaction, you provide the public key and then SIGN with the private key. – Gopoi – 2013-02-02T06:29:44.467
@Vitro I do not assume anything: you asked a noob question, so you got a noob answer. Please don't assume you know something if you don't, sorry. – o0'. – 2013-02-02T09:07:26.793
1@Lohoris: You and Gopoi have completely missed Vitro's point. – Meni Rosenfeld – 2013-02-02T18:36:08.827
1@Gopoi: The OP was talking about "upgrading" a watch-only address to a managed address by importing the private key. The interface warns that such importing will be needed if one ever wants to send from the watched address. He wanted to be sure that the key he imported never leaves the browser unencrypted. – Meni Rosenfeld – 2013-02-02T18:46:36.183
0
Blockchain.info wallet is opensource https://github.com/blockchain
So you can verify it yourself, that it is indeed not storing your private key.
It's better to verify in the JS that the private key never leaves his computer. – Meni Rosenfeld – 2013-02-02T19:35:57.160
Why would it store the private while you only gave the public key? – Gopoi – 2013-02-02T01:52:58.247
When a "watch only" wallet is used to send the BTCs a user must provide a private key, hence the private cryptographic key is exposed during the transaction. My question is: will this private key be stored/cashed by the website. – Vitro – 2013-02-02T04:18:12.317
1What? Never ever a private key is compromised during a transaction NEVER. You sign the transaction with the private but the STAYS private. You miss understanding public key cryptography. – Gopoi – 2013-02-02T06:23:01.050
If you use "watch only" it is only to see the balance nothing is compromised EVER. – Gopoi – 2013-02-02T06:28:45.263