Bitcoin Security

Quite recently a Bitcoin scam was in progress until it was noticed that somebody’s wallet had been stolen. The software was a Trojan that deletes a Bitcoin wallet and mails the copy to the scammer. Fortunately, the criminal’s stupidity allowed that some of the stolen bitcoin to be returned to its rightful owner, although 30 bitcoins could not be recovered.

The victim in question learned from his loss. However, as the community grows, newbies will be caught unaware by scam attempts. It’s also worth noting that even the most security aware could lapse and forget that he should not just download software. After all, we’re all human beings.

Still, I believe that Bitcoin clients could do better by addressing security concerns and making it easier for the average bitcoiner to secure their money. Here are some of the security proposals that are floating around in the Bitcoin community:

1. Bitcoin wallets should be encrypted by default.
2. Bitcoin wallets should be split into saving wallet and spending wallet to limit the amount of damage that could be caused by Trojan. This should also be default behavior too.
3. An application should not be able to write, copy, and read a Bitcoin wallet without user authorizing or without being notified.
4. Backup should be built-in and obvious to users.

I think the forum community could aid in this process.

1. There could be Bitcoin security firms that download new software and place it in the VM, then observe what’s happening. Bonus point for analyzing the source code, posting security flaws, certification, and other practice that minimize security problems in the bitcoin economy. Of course, for proprietary software, they would need to pay high fees to the firm because the source code are not available for inspection.
2. The source code for software that interact with Bitcoin wallet should be open to examination. If not, avoid it like a plague. Use MD5 hashes to verify the integrity of files.
3. A news source for Bitcoin security would be useful in disseminating information to bitcoiners and new publishing organizations could pop up exclusively for security news.
4. It should be a community norm for bitcoiners to spotcheck potential risk and educate new bitcoiners about security. For example, if a new software is released by a new forum member, bitcoiners would swing in to warn others of potential risk.

I am sure these proposals have risks and flaws. For example, if a keylogger is smuggled in, a cracker now have access to the password needed to crack the system. If the user forgot his password, he would be unable to access any of his wallet.

There will be continuous loss of Bitcoins due to fraud and security compromise, but we can minimize and educate people about securing their Bitcoin. One less testimony about bitcoins getting stolen means that it will be easier for the bitcoin economy to succeed.