(Sep 16, 2019 06:56 AM)Kill Joy Wrote:  Please fix the link in the OP.

Users be aware that a 3rd party is generating the private key for any address given out. There are safer methods for doing this.

(Sep 16, 2019 02:44 PM)M0HX Wrote:  there is. offline bruh.

(Sep 16, 2019 02:54 PM)Orca Wrote:  Thank you for the feedback, but why do you recommend they not use it if we have a secure split-key implementation?

Surely you are referring to services that do not use this feature.  🤝

(Sep 16, 2019 02:50 PM)Orca Wrote:  Offline is not a service - nor would it provide any more security than a cryptographically secure split-key generation

(Sep 16, 2019 09:03 PM)XMR Wrote:  There is nothing stopping you from generating the real private key, saving the real one, then encrypting it with the user's public key and sending them that. There is no known secure way to have someone else generate private keys for you, because you should never trust someone else with your private keys.

Anyone reading: do not trust any online service with your keys. If you can't generate your own vanity addresses, you're better off without them.


Actually yes it would be more secure. It is extremely easy to backdoor a website or implement something like what I've outlined above. It's a lot harder to backdoor a specific computer, let alone the thousands of computers who would be generating their own addresses rather than trusting an online service to do it for them. At that point, you're practically asking to get robbed.

(Sep 16, 2019 09:25 PM)JoeJonas Wrote:  ya op sorry but no one ever is using this as takes 2 mins for you to steal a users bitcoin. even with your "split key tech"

(Sep 17, 2019 03:41 AM)Kill Joy Wrote:  Split-key is way safer but I will look into how you are doing it myself later and may redact what I said.

(Sep 16, 2019 09:15 PM)Orca Wrote:  Hi XMR,

Thank you for the feedback. While your claims may be true for non split-key generation that is not the case for split-key generation.

When using split-key generation, we never even have access to your keys so backdooring is mathematically impossible.

We will be providing more information on split-key on our website soon.  🤝

(Sep 17, 2019 08:38 PM)XMR Wrote:  I don't think you understand. Split key generation still has you generate the private key. You then encrypt it with the user's public key. Between these steps, you have access to the unencrypted private key. Nothing is stopping you from saving it and sending the user the encrypted one.

Again, if you can't generate your own vanity addresses, you're better off without one.

(Sep 17, 2019 08:52 PM)Orca Wrote:  The process you described is called SSL, and we use that also by default.