我如何知道在创建新钱包时未共享密码或备份信息?
2 个回答
- 投票数
-
- 2019-02-21
如果密钥是在其服务器上生成的,则您将无法知道.
如果密钥是在浏览器中本地生成的,则您可以尝试监视网络以查看钱包发送给服务器的内容.但是,它仍然可能会找到其他方法来获取密钥,例如通过在发送密钥之前等待随机时间,对通信进行加密,或者仅通过限制生成密钥时的随机性,以便以后可以猜测密钥.>
我认为唯一可靠的方法是使用诸如Ledger或Trezor之类的外部设备,它将生成密钥并将其存储在设备内部,这样钱包就永远不会访问密钥,仅使用该设备签名操作.
If the key is generated on their server, you have no way to know.
If the key is generated locally in your browser, you may try to monitor the network to see what the wallet sends to the server. However, it might still find other ways to get the key, for example by waiting a random time before sending it, by encrypting the communication, or just by limiting the randomness when generating the key, so that it can guess it later.
I think the only reliable way is to use an external device, such as a Ledger or Trezor, it will generate the key and key it inside the device, so that the wallet will never access the key, only use the device to sign operations.
-
嗨,您好.我有我的账本,我正在尝试用它创建一个钱包,但是似乎所有人都需要软件来这样做(例如,请参阅[here](https://medium.com/cryptium/how-to-store-your-tezos-xtz在您的帐本中,用纳米大钱包代币3871dc4bd3b7)).也许我把钥匙和钱包弄混了.您在这里所说的话让我感到困惑:"诸如Ledger或Trezor之类的外部设备将生成密钥并将其密钥在设备内部,这样钱包就永远不会访问密钥,仅使用该设备对操作进行签名."如果我只能通过软件创建钱包,那么硬件如何安全?不明白Hi there. I got my Ledger and I'm trying to create a wallet with it, but it seems all requires software to do so (e.g. see [here](https://medium.com/cryptium/how-to-store-your-tezos-xtz-in-your-ledger-nano-s-and-delegate-with-magnum-wallet-3871dc4bd3b7)). Maybe I'm confusing a key with a wallet. Your phrase here puzzles me: "an external device, such as a Ledger or Trezor, it will generate the key and key it inside the device, so that the wallet will never access the key, only use the device to sign operations.". How is the hardware safer if I can only create wallets via software? Don't get it.
- 0
- 2019-03-17
- luchonacho
-
- 2019-02-21
您选择运行的所有钱包软件都带有一定的风险,您应该完全意识到这些风险,以便适当地保护自己.
-
无论运行的是Web,桌面还是移动应用程序,您都在运行别人编写的代码,降低风险的最佳方法是确保您使用的是开放源代码并已通过验证的软件.来自知名开发商的社区.p>
-
接下来,您需要采取步骤来确保您正在运行的代码实际来自开发人员,并且没有错误地从其他地方下载了该代码.这主要意味着要通过仔细检查URL来避免网络钓鱼链接,最好是对已知的良好站点进行书签.
-
使您的计算机远离恶意软件.您的系统感染了什么软件都没有关系.
最后,保护自己的最佳方法是使用硬件钱包设备.这样,密钥就永远不会离开硬件设备,如果您不确定计算机是否感染了恶意软件,这尤其重要.只要您仔细检查每一步的所有输入验证,硬件钱包就会为您提供保护.
Any wallet software you choose to run comes with risks you should be fully aware of in order to properly protect yourself.
Whether its a web, desktop, or mobile app you are running code that someone else wrote and the best way to reduce the risk is to make sure you are using software that is open source and has been verified by the community as coming from a reputable developer.
Next you need to take steps to ensure that the code you are running actually comes from the developer and that you haven't mistakenly downloaded it from elsewhere. This primarily means avoiding phishing links by double checking the URLs and preferably making bookmarks to known good sites.
Keeping your computer free of malware. It doesn't matter what software you are running if your system is infected.
Finally, the best way to protect yourself is to use a hardware wallet device. This way the keys never leave the hardware device, which is especially important if you aren't certain that your computer isn't infected with malware. As long as you are careful to double check all input validation at each step the hardware wallet will keep you protected.
-
嗯,但是如果您已经使用软件创建了一个钱包,那就太迟了.在那种情况下,用硬件创建一个新的然后将所有资金转移到那个钱包会更好吗?Mmm, but if you already created a wallet using software, it might be too late. In that case, would it be better to create a new one from hardware and then transfer all funds to that wallet?
- 0
- 2019-02-21
- luchonacho
-
总体而言,这似乎是软件钱包的一个深层缺陷.老实说,没有人应该使用它们,并且可能不应该被官方区块链基金会认可或建议.Overall, seems to be a deep flaw of software wallets. Honestly, no one should use them, and should probably not been endorser or suggested by the official blockchain foundation.
- 0
- 2019-02-21
- luchonacho
-
软件钱包在任何加密生态系统中都扮演着非常重要的角色,但是人们需要了解风险.如果您担心安全性,特别是如果您不确定如何保护系统免受恶意软件的侵害,最好的建议是购买硬件钱包设备并将重要的资金转入其中.Software wallets play a very important role in any crypto ecosystem, but people need to learn about the risks. If you are concerned about security and especially if you aren't confident about keeping your system safe from malware, the best recommendation is to get a hardware wallet device and transfer your important funds into it.
- 0
- 2019-02-21
- cousinit
-
实际上,Galleon [没有](https://github.com/Cryptonomic/Deployments/wiki/Galleon:-FAQ)发布源代码!Actually, Galleon [does not](https://github.com/Cryptonomic/Deployments/wiki/Galleon:-FAQ) publish the source code!
- 0
- 2019-02-21
- luchonacho
-
加密货币的信誉在很大程度上取决于钱包的安全性,因为这是普通用户最常与之交互的内容.对于像Tezos基金会这样的组织,应该首先确保现有的钱包尽可能安全,而不是仅仅列出一些钱包并声明"我们不认可".实际上,这就是他们在做的事情.不好.The credibility of a cryptocurrency depends heavily on the security of wallets, as that is what common users interact mostly with. It should be of primary concern for organisations like the Tezos foundation to make sure existing wallets are as safe as possible, rather than merely listing some and stating "we don't endorse them". In practice, that's what they are doing. Not good.
- 0
- 2019-02-21
- luchonacho
-
最常见的攻击是网络钓鱼链接,这些链接会导致人们运行错误的软件.Galleon已被社区审查为信誉良好的产品,但不能保证您免受网上诱骗和后端劫持.正如我已经解释的那样,您可以使用硬件设备来显着改善保护.对于大额交易,这确实是必须的,在加密货币世界中,用户应承担个人责任.许多用例都需要软件钱包,但是它们存在风险.The most common attack are phishing links which lead people to running the wrong software. Galleon has been vetted by community as a reputable product, yet that does not guarantee you protection from phishing and backend hijacking. As I have explained you can significantly improve your protection by using a hardware device. For large value amounts it really is a must, in the crypto world users are expected to take personal responsibility. Software wallets are needed for many use cases, but they come with risks.
- 1
- 2019-02-21
- cousinit
一些服务可以创建一个新的tezos钱包/帐户/密钥(
tz1...
).例如,考虑 Galleon Wallet .通过输入密码,它将产生一个新的钱包:然后,您需要选择一组12个单词,用于进行备份并在需要时恢复对帐户的访问.我的问题是,我怎么知道上面的私人信息没有与任何人共享?我想这可以在程序的源代码中看到.但是有些不是开源的.例如, kukai 是创建钱包的网络服务.我们怎么知道这样创建钱包是安全的?当然,这些服务与区块链之间必须存在某种"官方"通信.是否有某种协议可确保这种安全性,或者这些钱包创建服务与区块链的交互完全脱离了一层?