How can bitcoin be used for all transactions, even with only one confirmation? If bitcoin is ever going to be mainstream, how can we get around the problem of confirmation time? I don't think I like the idea of having to wait an hour for my transaction to be confirmed so I can leave the gas station after filling up. Even with the usual recommendation of waiting for only one confirmation, that's still 10 minutes. Anything over 10 or 20 seconds becomes a problem if all customers are using bitcoin, because it delays every transaction that long.

When you pay with bitcoin using a service that uses Coinbase as a payment processor (such as Humble Bundle), it usually accepts in a short amount of time. The reason they can do this is because they check that your transaction has propagated through the whole network and that there are no competing (double spend) transactions.

Once that has happened, the only way to do a double spend is to mine your own block (because everyone else has accepted your first transaction). Mining a block is very expensive so there is very low risk. Certainly less than the risk of credit card chargebacks.

Now if you are selling something very expensive, then waiting for some confirmations would be good. Also in this case the buyer would likely be in less of a hurry.


Question about “Lost” Bitcoin I understand bitcoin is a ledger.  Everything is accounted for.  If something is debited from one side, it is credited to the other, and vice versa.
If a coin is sent to a wallet, with a public key, that doesn’t exist, the coins are considered “lost”.  But they are still debited from the wallet that sent it and credited to the wallet that doesn’t exist.
If a new wallet is created, and by mere chance, is the same address as the one the “lost” coins were sent, would those coins there when the wallet was created?
Example: coins were sent to wallet “...xyz”.  The coins were dedicated to xyz wallet, which does not exist.  I create a wallet that just happens to be xyz.  Would I have access to those bitcoin?

Would I have access to those bitcoin?

Pieter has answered this but see answers to Is it possible to brute force bitcoin address creation in order to steal money? for an idea of how likely this sort of thing is.
There's some other points raised by your question that I think are worth examining.

I understand bitcoin is a ledger

We all say that but really, in accounting terms, it's not a ledger it's a journal. A transaction journal.

Everything is accounted for.

That is not exactly true. The transaction journal known as the blockchain keeps a record of all the amounts but there's a lot it doesn't account for.

If something is debited from one side, it is credited to the other, and vice versa.

There are no debits and credits in the Bitcoin network itself. That is, there is no carried-forward number in the Blockchain from which an amount is subtracted (debited) or added to (credited).

If a coin is sent to a wallet ...

Coins aren't really sent to wallets, we say they are sent to Bitcoin addresses. A Wallet will have many Bitcoin addresses. But really coins are not sent to addresses, they are locked by a locking script, a kind of simple program. Bitcoin addresses are just a kind of abstraction of a standard script.

... with a public key, that doesn’t exist, ...

That is certainly possible. Though "exists" isn't quite right. You mean a public-key for which no-one knows a corresponding private key.

... the coins are considered “lost”.

Actually, no one can tell the difference between a lost coin and one that is safely stored in a wallet. If someone doesn't know the private-key corresponding to a public key associated only with unspent coins, they have no way to tell if someone else ever did or currently does know such a private key.

But they are still debited from the wallet that sent it and credited to the wallet that doesn’t exist

Yes, but coins are not debited from wallets. The Bitcoin network protocol doesn't know about wallets. It doesn't really do any debiting or crediting. It just keeps track of the creation and destruction of coins and makes sure that only the right number of coins are created when other coins are destroyed. The Blockchain has no information about wallets.

The above will seem like nit-picking. But we regularly see people ask questions here because they have been tricked out of money by people exploiting slight misunderstanding of how Bitcoin actually works.
the kinds of wallets I mean when I write the word wallet are programs like Bitcoin-core or Electrum. Some businesses provide accounts and provide a web-based interface or an app to manage the account and call these a wallet - that is not what I mean.


How is "cumulative PoW" calculated to decide between competing chains? Chain 1 has blocks with targets diff1, diff2, diff3, diff4
Chain 2 has blocks with targets DIFF1 DIFF2 DIFF3
What's the formula to derive the (relative) cumulative proof of works from these chains to find out which one is stronger?
My guess is we take their logarithms and add them up?

First of all, "difficulty" as a concept does not exist in the protocol. It's a unit intended only for human consumption.
Internally, the value that corresponds with it is the target. The target is a 256-bit number, computed for every block, and a block is valid if its hash (interpreted as 256-bit number as well) is less than or equal to the target.
The difficulty is simply defined as the (floating-point, approximate) value of MAX_TARGET / target. MAX_TARGET us (216-1)2208, the maximum possible target (so the lowest difficulty Bitcoin will permit for any block).
To compare chains, a new metric is introduced: work. Work is the expected number of hashing attempts are necessary to construct valid proof-of-work for that block. It is simply 2256 divided by the number of potential hash values that meet the target, namely target + 1. So, the work of a block is defined as 2256 / (target + 1).
The work of a chain is simply the sum of the work values of the blocks in it. This makes sense: we want to make sure that an attacker needs to do as much work as the honest miners needed to produce a valid chain.
At block 678033, with approximate difficulty 23137439666472.1, we have:

Target is 1165190949371886336955396954992052935118810155482873856 (or 0xc2a480000000000000000000000000000000000000000 in hex).
Work is 99376063039054378510219
Cumulative work (sum of all work in the entire chain) is approximately 8.565487⋅1027.

So - perhaps remarkably - this is (approximately) equivalent to just summing the difficulty values of all blocks. No logarithms involved.
For completeness, Bitcoin Core's current rules for picking the best chain:

First exclude all chains with invalid blocks
Then pick the tips of all those chains, and leave only the ones with the highest cumulative work (which may be more than one if there is a fork).
Among those, pick the one for which the full block (not just the header) was received first.


Same entity controlling separated parts of a a lightning path Given the lightning path Alice → Bob → Carol → Dave → Emilee (with Alice being the sender and Emilee being the receiver), assume Dave and Bob to be the same entity.

By pulling funds from Dave to herself, Emilee discloses the secret R to Dave. Bob then knows R, too, because Bob and Dave are the same entity, and pulls funds from Alice.

Bob then broadcasts the channels state between him and Carol to the blockchain. Dave subsequently pulls funds from Carol.

In this procedure, Carol did not get paid. How is this prevented?

The preimage R is the same throughout the entire route, so Bob/Dave would know what R is (from lnd Overview).

However if Bob were to broadcast his commitment transaction for the Bob -> Carol channel, it would have to either be an old commitment without the HTLC-offered output or be the current commitment transaction with the HTLC-offered output. In the case of an old commitment transaction, Carol would be able to claim all of the funds in the channel with the revocation key for the old commitment transaction.

In the case of the second transaction with the offered HTLC output, the offered HTLC output has a timeout on it which prevents Bob from spending the funds for some amount of time, say two days. In that time, Carol could redeem those funds with the preimage R.

In order for Bob/Dave to pull funds from Carol in the Carol -> Dave channel, he would need to give Carol R before the HTLC between Carol and Dave times out. The timeout of this HTLC will be shorter than the HTLC between Bob and Carol (e.g. only 1 day) so when Dave gives Carol R to pull his funds (or R is published in Dave's broadcast commitment transaction if he does that), Carol can then use that R to claim her funds from Bob's offered HTLC output.

In the event that Dave decides to not pull funds from Carol, Carol retracts her HTLC output after it times out and does not lose any money to Dave. She does not then gain any money from Bob and thus has not lost any money at all.

If Dave refused to sign the new commitment transaction, Carol broadcasts her commitment with the Carol -> Dave offered HTLC after the timeout passes and publishes a transaction which spends the offered HTLC output using the HTLC-timeout transaction. If Dave tries to spend the HTLC using R, Carol then learns of R and can then spend Bob's offered HTLC output using said R. In that case, Bob/Dave can actually lose money because Carol's HTLC-timeout transaction could confirm before Dave's HTLC-Sucess transaction (which contains R) and her HTLC-Success transaction for Bob's HTLC could confirm before Bob's HTLC-Timeout and thus gain money from Bob/Dave.

Thus such a scheme would result in Carol effectively being cut out of the route and not losing any money. If Bob/Dave were stupid, they could actually lose money to Carol.


What is Proof of Burn? Can someone explain me:

What is Proof of Burn
What is the difference between Proof of Burn and Proof of Work
How Proof of burn works
Which virtual currency uses Proof of burn technology instead of Proof of Work

Can someone explain these things to me in a understandable manner? I can't understand anything in the (Wiki article on it). Highly appreciate if someone can explain this to me.

Proof of burn simply means you have provably destroyed coins. The only way to destroy coins in a proven way is to send them to an address which is improbable to have been generated from a private key, and thus can not be spent.

Chancecoin is the first I've seen to use this way to generate their coins. The announcement for Chancecoin can be found here: https://bitcointalk.org/index.php?topic=528023.0

In here, they instruct people can burn bitcoins for a certain period by sending them to 1ChancecoinXXXXXXXXXXXXXXXXXZELUFD. The reason why we believe that this is a burn address and not a vanity address is that all but 6 characters seem to have been predetermined. The way you would find an address like this which you could send coins to is by running a loop.

Start with 1ChancecoinXXXXXXXXXXXXXXXXXXXXXXX
Ask bitcoin if that's a valid address
If it's not valid, increment the last character by one and try again

After a billion or so tries (not too much in terms of 'mining') address 1ChancecoinXXXXXXXXXXXXXXXXXZELUFD is found which passes the validity check. For more info on address validity see: https://bitcointalk.org/index.php?topic=1026.0

This address is very unlikely to have been generated with a private key, or if so, it would show a big weakness in bitcoin and many other security practices. So we assume that the nobody has access to this private key.


How long should synchronizing your wallet for the first time take? What is the normal synchronzing time for your wallet when you first start? I am using 4G on a wireless and it seems to be taking forever to count down the number of blocks left until it is properly synchronized.

There are two factors to the time to catch up with the network:

The sheer size of the blockchain
The time to verify the blocks

As Tom mentioned the blockchain is currently about 7GB in size, so no matter what it'll take some time to download it. On the other side you have to verify each block, hence each transaction in the block, which requires random access to the blockchain downloaded so far. Depending on your setup the bandwidth may not be the main issue. Random lookups on spinning disks are not the fastest thing to do, and using an SSD might actually result in a speedup of the synchronization.

So don't worry if your bandwidth is not fully utilized, it just might be that the disk is the bottleneck (especially for later block >180'000 with lots of transactions in them).


Is a digital wallet created by blockchain? Currently reading an article here, I came across the following sentence which really confused me:

  Through the digital "wallet" a blockchain creates around not only
  virtual money but the pieces of data that make up your identity,
  blockchain will act as a gatekeeper of sorts to how we interact with
  the digital world

Does the author really mean: a blockchain creates a digital wallet around 1)virtual money and 2)certain pieces of data, and through this wallet the blockchain acts as a gatekeeper to...? How come a digital wallet is created by blockchain?

The writer of that sentence did a poor job explaining things.

A blockchain (the data structure) does not create a wallet.  It is the data that a wallet uses to determine the state of the money it manages.  It is also the data that new transactions are appended to, thus changing that state, and wallets submit those transactions.

A blockchain does not create a wallet, but wallets do help to create a blockchain.


Should I use a different address for every transaction? Should I use a different address for every transaction? If yes, why? For safety?
What happens I use the same address to get bitcoins from 2 different people, what happens?

The only reason why it is recommended to use a different address for every transaction, is for increased anonymity - it makes it more difficult to trace, and next to impossible to prove, that the recipient of transaction A is the same person as the recipient of transaction B.

If you publish an address to receive payments online, and keep it static, everyone can go to http://blockexplorer.com/ and see all the money you have received, and calculate how much money you got. If you change the address after every transaction, it makes it much more difficult - someone who have to constantly monitor your web page with the published address to know all your addresses you received money on. And if you keep the page with the published address non-public, such as that your customer has to log-in to his account on your system to see the address, that makes it practically impossible for third parties to monitor your income, find out how much money you have and what you spend it on.


How are Ripple transaction fees "destroyed?" What is the exact process by which the transaction fees are "destroyed?" Are they sent to a special account, or simply erased from the ledger?

The sender's account is debited the transaction fee, but no other account is credited the same amount.


Impact on Bitcoin value due to lost bitcoin wallets My question is 2 part:
1. How does somebody know that a set of bitcoins is lost? Merely declaring that I've lost my private key and hence bitcoin makes the coins lost?
2. What impact(and why?) would be on the price of bitcoin if I lose a huge amount of bitcoin today? Say 1 billion?

Only the market knows it
Market will tell you if you lost them


How was Ethereum hard fork's replay attack was handled? On etherum, there was a hard fork which resulted in ETH and ETC.  My reading indicates that it suffered problem of replay-attack.

Question:

How was this problem resolved for Ethereum?  In my understanding, replay-attack protection requires another hard fork, because replay-protection inherently requires making transaction incompatible among the 2 chains.  Was such fork operated?  Or does Ethereum still have possibility of replay-attack if transaction is to be made from the very old wallet (the wallet which have no associated transaction after the fork)?

There's some history when it comes to ETH/ETC replay protection.

  How was this problem resolved for Ethereum?

Initially when ETH hard-forked to invalidate the DAO contract, both ETC/ETH networks did not implement replay protection for transactions. Instead, a split contract was written instead which relies on a split oracle built in Ethereum to identify if the contract was called on the hard-fork (i.e. ETH chain).

The contract logic is quite simple as you can see for yourself, it basically splits the original tokens and sends them into two different addresses depending on which chain the contract is called.

Nowadays, the ETH (hard-forked) chain has effectively implemented replay protection. So transactions executed on the ETC network will not be valid on the ETH network and vice-versa.

  Does Ethereum still have possibility of replay-attack if transaction is to be made from the very old wallet (the wallet which have no associated transaction after the fork)?

No.


What are "tagged" Bitcoins? I was reading about the Sheep Marketplace:

Victims of the theft have attempted to identify the thief by sending "tagged" bitcoins to his accounts, using the public nature of bitcoin transactions to follow these moneys through the "blockchain" record of transfers.

What are "tagged" Bitcoins and how do they work? How do they differ from regular Bitcoins?

Source: https://www.theguardian.com/technology/2013/dec/09/recovering-stolen-bitcoin-sheep-marketplace-trading-digital-currency-money
I think it just means that some users discovered this address: 1Eg8WSxvfeZaKmqhNZrECTUb58x3y1AWYN and maybe few others involved in their past transactions to the darknet market. They tried to send small amounts to these addresses hoping they could track when its moved.


How security is managed in Cryptocurrencies with no mining possibility I know pretty well how the bitcoin and ethereum blockchain works respectively, but I'm seeing a lot of new cryptocurrencies with no mining system. As far I'm aware the blockchain needs miners to give security to transactions, and the miners do their job because of the coin mining reward, so it makes sense from an economic and tech point of view.

But all those cryptos without mining cannot ensure transactions, right? Doesn't it opposite to the basic bitcoin philosophy?
Can anyone provide also a technical answer to blockchain transactions security management, without miners?

Thanks!

when you talk about mining and miner you insinuate by that POW (proof of work) consensus mechanism (a solution to the "Byzantine fault tolerance" problem). Other cryptos use for the same reason (reaching the consensus ) other mechanisms such as proof of stake (currently used in peercoin and Ethereum will switch to it soon) ,Proof of Activity, Proof of Burn, Proof of Capacity etc.

So every consensus algorithm or mechanism has it's own security model to secure the network and prevent double spending problem. POW depends on resolving a puzzle (mining: performing a certain amount of computational work) and an incentive the others has different procedure. Rather than that a proof of stake system requires the prover to show ownership of a certain amount of money.

For example in POS (proof f stake) the participants or the "provers" stake some of their coins so if they cheat they will lose their money (punish the cheater), to enforce the decentrlized consensus. In PoS cryptocurrencies the schema change: the blocks are usually said to be forged, or minted, rather than mined and there is no miner and no block's reward (only the transaction fees).

I suggest you to read more about POS, HERE.

the other consensus mechanism like Proof of Stake are not as safe as pure Proof of Work at an extent but every project is trying to provide a secure implementation.


Safest method while actually logging in and using blockchain.info wallet Please help. I have finally set up my cold storage system for but I am too paranoid to login to blockchain.info wallet to send the funds out.

Let's assume the account is safe and protected from most attacks at this very moment (strong passwords + graphical keyboard, 2FA, using secure network, no online backups sitting somewhere). Let's also assume bc itself can be trusted.

So I feel the wallet is relatively safe just "sitting there" but I am still concerned about attacks during the actual login and while I am sending transactions.

- Would the chrome app or firefox extension be safer than logging in and out of their URL?

-Is it a bad idea to use TORBROWSER? Can an exit node still sniff my data if I'm using https? What about the FF extension AND torbrowser together.

-Even if I take advantage of all best security practices on the wallet itself, my physical system, and my personal network... WHAT OTHER REALISTIC VECTORS SHOULD I BE AWARE OF?

Thank you so much. Security is a huge hurdle for all of us…I hope that others can benefit from your answers.

The key to security questions is asking what you want to be secure from. The most obvious problem you will want to avoid is losing your bitcoin to some attacker. If this is the only objective you have, it is easy to see that TOR will probably not help you: It only introduces more nodes to pass your traffic, not extra encryption security. But if you have some additional objectives, such as maintaining anonymity, TOR might help as part(!) of a much more difficult solution. For the rest of my answer, I will assume that not losing your bitcoin to a cybercriminal is your only concern.

Cold storage is a good start, and by offline storage usually being tangible physical storage, your own intuition is probably rather good at understanding all issues there. Moving to the moment when you move bitcoin back from cold storage to a wallet, the issues are obviously the transport and the execution environment of the bitcoin client through which you use the wallet.

Blockchain.info provides a fairly reputable wallet service that claims to not actually move enough information to their servers for that side to be a security concern (and they appear to run an open source wallet, with code on github). But what guarantees do you have to trust that this is and remains the case for you? If you value safety against being lied to (and be it only by some secret order to blockchain.info or because whoever may hack them might be as vile as to change things without asking for their approval first), then this is not a perfect solution---but you may decide to put more trust in them than in maintaining a safe execution environment for a bitcoin client on your own computer or smartphone. In one aspect, however, their wallet service may be particularly bad, though: Being in large part client-safe based (such that they alone can claim not to have their private key), obviously even using them you are exposed to the risk of your browser/computer being hacked in a way specifically aimed at hijacking your bitcoin transaction by changing its destination.

Using a browser app to access blockchain.info would probably protect against nothing else but you mistyping their URL to something registered by a cybercriminal. As crazy as this sounds, it is not without value, but compare that risk to the risk of forgetting to never install any other browser app (these things can get access to just about anything that happens inside your browser, hence quite likely to everything needed to hijack a transaction you make thourgh blockchain.info).

The best thing would be to have a completely self-contained box where your private key never needs to leave it, but from where you could make bitcoin transactions by entering the necessary info (destination address and unspent input tx), signing them, and outputting the tx that needs to be passed on to the bitcoin network. Such hardware bitcoin clients exist, e.g. TREZOR or Bitcoincard. However, I haven't looked closely at either, so please don't understand this as endorsement about their design or structure---in fact, from just a cursory look, I feel that maybe I should warn you about Bitcoincard pitching the inherent, well, surveillance-like data mining benefits to merchants installing supporting infrastructure. I suspect this list is not complete; I've heard an idea somewhere about putting such a client into (or via a shim on top of) a phone SIM card, and apart from the obvious question of how to secure the rest of the hardware you would use to interact with it, love the idea for its potential low cost yet more-secure-than-a-smartphone-app aspect. If I wasn't busy with another project, I might try to make that happen myself!

But back to the last part of your question: Let us assume that you stop using a third-party service like blockchain.info and run a bitcoin client on your own "physical system" as you write (I'll assume computer/smartphone), and that those best practices you mention are sufficient to keep unwanted malware and the like out of your computer (and whatever internal part of your network might handle sensitive information like your bitcoin address' private key). That may be overly optimistic, as I guess the NSA leaks we've seen make it fairly clear that this situation is very nearly impossible to maintain with personal computing equipment not specifically dedicated to, designed and hardened for a single use, at least not against a sufficiently determined and equipped adversary---but that part of computer security is better addressed elsewhere on stackexchange anyways. Still, if we can assume all that, or are simply not worried about such adversaries becoming interested in petty crime such as taking bitcoins, the obvious remaining attack vector is the bitcoin client itself. If any such client has an undiscovered bug that allows stealing bitcoin, then chances are it could be discovered after an exploit. You would minimized your exposure by using the latest version of such a client offline to create the transaction you intend to make (which may require use of a command-line interface on some clients). In fact, if you then take that new transaction and transfer it to a different system not in possession of your private key, you can completely isolate the first computer from the internet and hence any attack coming from the internet.

Obviously there are non-network based attack or loss vectors, like physically stealing one (or losing all) your cold storage device (paper?). With their own potential solutions.

But there is one well-known (and fairly obvious, to a cryptographer) potential problem that can be exploited even without your wallet being in any way connected to the internet: The private key to your bitcoin address may be weak in the sense that someone can guess it. There are two obvious causes: Either you have a brain wallet with a guessable passphrase---an easy mistake to make accidentally, as it is hard not to see how e.g. a phrase you thought you had invented yourself really happens to be printed somewhere in a book that an attacker uses to guess bain wallets, just because some author stumbled across the same idea for a sentence or phrase. Or else the software you used to generate your bitcoin address has a bug that leads to a weak key, which has already happened, leading to the discovery of a very serious defect (see this Guardian article) in the Android random number generator.


Is there a bitcoin robot? Is there a bitcoin robot that can automatically trade bitcoin for USD?

I see that bitcoin rates fluctuate every day and has different rates at different exchanges, and it could be easily traded like other currencies.

So, is there a bitcoin robot, similar like forex robots?

I tried writing one in 2011-12.  I ended up doing a lot of volume, but I only broke even because of the commission.  I generated a lot of money for Mt. Gox though!

In general, writing an automated trading program is always going to be a difficult task, because anyone who can write a superior program can cut into the profits of the inferior program, which leads to a development arms race.  This is what some hedge funds do (not with Bitcoins), but any models they develop are only expected to make money for a short amount of time.

Even if someone released a high-quality open-source program, it would be difficult to make money by using it because so many people would run it.


Lightning network avoiding bad channels Lets say I open a lightning network channel and the other party goes offline. Lets say I haven't actually used the channel yet. What if I want my bitcoin back from that channel so I can use it.

I payed an on chain transaction fee to open the channel, I can close the channel again but will have to pay another on chain transaction fee to close the channel. Effectively I will have payed for two on chain transactions without actually transferring any bitcoin.

If I go to pay and the other end of my channel is down. It would take me two on chain transactions to be able to make the payment (one to close the channel and one to open a new one) my instant and almost free payment has now become extremely expensive and slow.

What steps do the lightning network implementations take to limit the impact of this kind of thing? When your lightning wallet choses a node to open a channel with, does it take into account how reliable that node is, IE how long it has been online for / how much down time it has had?

Your concern is genuine but the decision to open a channel is not a part of the core specifications. The decision to open a channel with a node is up to the user.


getting public key from any raw transaction - what to take care of? i need to retrieve public key of transaction sender.

now i know there are 03 compressed pubkeys and 04 uncompressed ones.

but how is this working with segwit and multisig addresses?

can you please point me to what possible combinations there could be, so i am ready for any possible trnasaction to always get the right key?

thanks a lot!

I have summarized some popular payment types in my book "Grokking Bitcoin". There are 6 standard payment types:

p2pkh: Pay-to-public-key-hash. The public key is the second (last) item in scriptSig.

p2sh: Pay-to-script-hash. The public key(s) are packed into the redeem script which is the last item in scriptSig. To get them you need to parse the redeem script (which itself is a script) and look for key patterns (push of 33 bytes).

p2wpkh: Pay-to-witness-public-key-hash. The public key is found in the witness of the transaction. More specifically in the second item of the witness field with the same index as the input you're investigating (the witness contains one witness field for each input. There's only one witness field in this example, because there's only one input).

p2wsh: Pay-to-witness-script-hash. The public key(s) are packed into the witness script which is the last item in the input's corresponding witness field. To get them you need to parse the witness script (which itself is a script) and look for key patterns (push of 33 bytes).

p2wpkh nested in p2sh: The pubkey is in the same place as in p2wpkh.

p2wsh nested in p2sh: The pubkey is in the same place as in p2wsh.

I hope this helps


Who specified the Bitcoin protocol? I went through the original paper by Satoshi, which outlines the Bitcoin protocol. However, the paper is a high level overview of Bitcoin, and does not specify important parts of the protocol.

Who specified the details of the Bitcoin protocol? Which person or group is in charge of defining the standard of the protocol as of now?

However, the paper is a high level overview of Bitcoin, and does not specify important parts of the protocol.

That's true, and Hal Finney noted this when the bitcoin paper was published to the metzdowd cryptography mailing list. (The Bitcoin paper was published before the Bitcoin source code.)

  Unfortunately I am having trouble fully understanding the system. The paper describes key concepts and some data structures, but does not clearly specify the various rules and verifications that the participants in the system would have to follow.

  Who specified the details of the Bitcoin protocol?

I'd say that Satoshi specified 95% of the Bitcoin protocol in the source code that was initially published. There have been changes made since then, but the majority of Bitcoin is unchanged.

  Which person or group is in charge of defining the standard of the protocol as of now?

Essentially, you make a Bitcoin Improvement Proposal. Here's a summary of the process:

Debate the issue in the community

  The BIP champion (a.k.a. Author) should first attempt to ascertain whether the idea is BIP-able. Posting to the bitcoin-development@lists.sourceforge.net mailing list (and maybe the Development&Technical Discussion forum) is the best way to go about this.

Write a draft of the BIP

  Once the champion has asked the Bitcoin community as to whether an idea has any chance of acceptance, a draft BIP should be presented to bitcoin-development@lists.sourceforge.net. This gives the author a chance to flesh out the draft BIP to make properly formatted, of high quality, and to address initial concerns about the proposal.

The BIP editor (Currently Gregory Maxwell) reviews it

  If the BIP editor approves, he will assign the BIP a number, label it as Standards Track, Informational, or Process, give it status "Draft", and add it to the git repository. The BIP editor will not unreasonably deny a BIP. Reasons for denying BIP status include duplication of effort, being technically unsound, not providing proper motivation or addressing backwards compatibility, or not in keeping with the Bitcoin philosophy.

  ...

  For a BIP to be accepted it must meet certain minimum criteria. It must be a clear and complete description of the proposed enhancement. The enhancement must represent a net improvement. The proposed implementation, if applicable, must be solid and must not complicate the protocol unduly.

Complete the reference implementation

  Once a BIP has been accepted, the reference implementation must be completed. When the reference implementation is complete and accepted by the community, the status will be changed to "Final".


Is this how I should calculate a Double SHA256 So I have a function called sha256 which will take a string and return the SHA-256 hash.

var First = sha256('myfirstSHA');

And the output is the hex:

9b2b95b24dd9149480ebda21aafe3f1a3c0370798ceec3c4d09c6a16adfe01c8

All feels good here, but if I want a double SHA-256 how should I go abut calculating it? Can I just use the same function as above twice? like this...

var Second = sha256(sha256('myfirstSHA'));

What should the value of Second be?

I get the feeling I may need to get the value of the first hash and convert it to something before putting it back through the sha-256 function a second time??

So my question is, what should I convert it to, before feeding it back in again?

Any advice is most welcome!

Yes you should convert your first output before feeding it back in: A hash function is typically a function which takes in an array of bytes (of arbitrary size) and spits out an array of bytes (of fixed size). When making the first call first = sha256('myfirstSHA'), it is likely that the string argument is implicitly converted to an array of bytes, whereby each character is substituted by a single byte encoding. However, the string output you are getting (which is a string, not an array of bytes), clearly represents a hex encoding of a 32 bytes array. You need to convert this hex encoding into a 32 bytes array. If you have a Linux terminal, as indicated by this post, a very useful command is xxd -r -p which converts your hex encoding into actual bytes:

$ echo -n myfirstSHA | sha256sum
9b2b95b24dd9149480ebda21aafe3f1a3c0370798ceec3c4d09c6a16adfe01c8 -
$ echo -n myfirstSHA | sha256sum | xxd -r -p | sha256sum
96082208e341446bb8ba032486d142cbe73f1a66276b96c18ff815f31293fe0d -

If you are worried about the trailing '-' which appears in the output of sha256sum, you can cut it out:

$ echo -n myfirstSHA | sha256sum | cut -d' ' -f1
9b2b95b24dd9149480ebda21aafe3f1a3c0370798ceec3c4d09c6a16adfe01c8

and then proceed as before:

$ echo -n myfirstSHA | sha256sum | cut -d' ' -f1 | xxd -r -p | sha256sum
96082208e341446bb8ba032486d142cbe73f1a66276b96c18ff815f31293fe0d  -

In case you do not trust that xxd -r -p does the right thing, you can store the output in a file:

$ echo -n myfirstSHA | sha256sum | xxd -r -p > temp

then use hexdump -C temp or indeed xxd temp to check the content of the binary file:

00000000  9b 2b 95 b2 4d d9 14 94  80 eb da 21 aa fe 3f 1a  |.+..M......!..?.|
00000010  3c 03 70 79 8c ee c3 c4  d0 9c 6a 16 ad fe 01 c8  |<.py......j.....|
00000020


Logo: "Bitcoin accepted" but not "here" One can find lots of logos on the internet that say "Bitcoin accepted here".  In some contexts, including, but not limited to, selling things over the internet, it seems appropriate to omit that last word and just say "Bitcoin accepted".  Are there some of those?

From the comments on the question, here is the one that Nick ODell created:

And another with the accepted moved a bit to the right, I just created:

For comparison, the original:


Build a wallet for Android and iOS for a self-made cryptocurrency I've built a cryptocurrency of my own using this video guide. I did the first 4 steps out of 6, as the 5th level is about building a wallet for Windows platform.

I have started creating this cryptocurrency so it would be able to trade using it only on mobile devices running Android and iOS. Right now I would like to start to develop it for Android platform.

My question is how can I create a wallet for Android using Java that will support my self-made cryptocurrency? By wallet I mean to store the coins, send and receive them, and ability to open new wallets.

You first should learn how to create an android app if you don't know how to do that already. There are lots of resources available for this and better places to ask questions than the bitcoin stackexchange.

Then once you are comfortable with that most android wallets are built using bitcoinj. I don't know of any nice step-by-step guide. Here is a sample github project for bitcoin that should give you a good starting point. https://github.com/thinkmobiles/BitcoinJ-Wallet-Sample-Android. I don't know anything about your coin but you will obviously need to make some fairly critical changes.


Understanding Shares in Pool Mining I just started mining today at Dogechain pool. I wanted to see what mining was like, so I'm only using minerd with my CPU. I don't expect a lot until I get a GPU rig going, but something doesn't seem right.

For instance, I'm averaging 8-10 kH/s hashing rate (sometimes as high as 15, sometimes as low as 5). On minerd, after about 6 hours I'm over 200/200 accepted, but on Dogechain pool, I've only earned 21 Dogecoin. During the last block round, my shares went over a 100, and in the pool stats, it shows my hashrate as averaging between 225 and 250 doge/day. At this rate, I'll only be earning about 80 a day. According to coinwarz at 8 kH/s, I should at least be earning 108 a day.

It seems like the rate of reward is really low, even for CPU mining. Can anyone give me an idea why?

The income you earn will vary from what you would expect to earn on a given day.  In order to earn income a block must be found and until a block is found you will earn nothing.  For example, let's assume your pool on average founds a block every 2.5 hours and each block you earn 11.25 doge.  You would have earned about 22.50 doge in the timeframe of 6 hours.  In the first 24 hours,  you would earn about 101.25 doge.  The next day you would earn about 112.50 and the next day would be 101.25 doge, but your daily average over 5 days is 108 doge.

Of course, in reality you would never see blocks found with such regularity.  Instead, you might find only 7 blocks on day one and then 13 blocks on day 2 and so on.  Blocks are found randomly and so you can expect your income to be all over the place.  Overtime, you will see your average income reflect your expected income with a lower variance depending how many days you factor in.

So far, you have no basis to be concerned and it seems your low income is just example of bad luck, but over time luck becomes a lesser factor.  You should get to 108 a day and on some days you will earn more.  Happy mining :).


A clarification about Wallet and Addresses (In Armory) I've just a dumb (Probably) question about bitcoin wallet and addresses (in Armory):

If I've understood correctly (Correct me If I'm wrong), a wallet works as a "container" where you can store different addresses (With their respective private keys). So for example, through Armory, I can create a wallet and inside the wallet I can create as many addresses as I want, right?

So, If I've created ten different addresses to receive payments, I just have to give one of the addresses (Of the wallet) to a person that has to send a payment to me. Let's say that I've received a payment of 1 BTC for each address; so I would have 10 BTC inside the wallet. When I want to send these 10 BTC to an X address, I just have to click on "Send Bitcoins" (then insert the requested data) and then Armory will send the 10 BTC (1 for each addresses) to the other address?

(BTW: Do I ever need to insert the bitcoin private key of an address to send a transaction, or I only need to insert the password for the wallet to be able to send the transaction?)

Therefore 10 different transactions would appear on the blockchain? (1 transaction for each Address that I have inside the wallet). And someone can know that these 10 transactions have been sent by the same wallet, or not?

Thanks in advance for any answer, as always :)

Your understanding is mostly correct, the only thing that is incorrect is that there would be only one transaction that would be sourced with ten different inputs. You only have to input your password, you don't have to manually enter any private keys, unless you are importing new private keys to your wallet.

Since there would only be one transaction that would be accessing all ten addresses for inputs, the ten addresses would be known to be belonging to the same owner.

Also, strictly speaking the BTC aren't "in" the wallet: Rather, the wallet only contains the keys, while the BTC are stored decentrally on the blockchain. The BTC are "in the wallet" only in so far that they can be sent with the keys from the wallet, and that the wallet software keeps an account of what your balance is.

This results in the distinction that you only have to keep safe the keys to protect your spending power, the "history" part of your wallet is only for your information.


What is Mastercoin? Why does it exist? What is Mastercoin? What is its raison d'être? Have there been any real world examples of its use?

http://wiki.mastercoin.org/index.php/FAQ#What_is_Mastercoin_and_why_is_it_needed.3F

Mastercoin is both a new type of currency (MSC) and a platform. It is a new protocol layer running on top of bitcoin like HTTP runs on top of TCP/IP. Its purpose is to build upon the core Bitcoin protocol and add new advanced features, with a focus on a straight-forward and easy to understand implementation which allows for analysis and its rapid development.

The primary features of the Mastercoin layer are different ways for user to create their own custom currencies straight from the client. The new user currencies include a variety of different usecase, including Smart Property, Pegged currencies (e.g. pegged to the value of the stable US Dollar or Gold), and Decentralized Applications where tokens include not just a financial aspect, but also decision making power.
For more info, please see mastercoin.org.

See also this presentation (video + slides).


What does it mean by Public Key on the Vanitygen Pool? When I wanted to request a vanity address from https://vanitypool.appspot.com/ it asked me for my public key. I tried my main address, but it said it was too short. What should I put there?

ThePiachu explains it like this:

  The idea is, that you can generate a vanity address without even
  knowing what private key it will actually belong to. One party grabs a
  random ECDSA keypair and saves the private key for themselves. They
  later can issue a request for a vanity address to be created, by
  supplying the public key form that keypair, their desired pattern and
  so forth. A person takes with looking for the vanity address is
  required to brute force random ECDSA private keys, get their
  corresponding public keys, add them to the provided public key, and
  proceed normally with SHA, RIPEMD and base58 until they receive the
  desired pattern. Then they give the private key they found to the
  first person, which adds the two private keys in order to get their
  vanity address. The best thing about it - the person looking for the
  solution won't know what the resulting private key is! This means that
  you can outsource your vanity key generation without needing to trust
  any third party.

  An example (available from gobittest website): We have a private key:
  18E14A7B6A307F426A94F8114701E7C8E774E7F9A47E2C2035DB29A206321725 which
  maps to public key:
  0450863AD64A87AE8A2FE83C1AF1A8403CB53F53E486D8511DAD8A04887E5B23522CD470243453A
  299FA9E77237716103ABC11A1DF38855ED6F2EE187E9C582BA6

  and say we want to find a pattern "166". One of the solutions takes a
  form of a private key
  B18427B169E86DE681A1A62588E1D02AE4A7E83C1B413849989A76282A7B562F
  mapping to public key:
  049C95E0949E397FACCECF0FE8EAD247E6FD082717E4A4A876049FB34A9ADED110DFEA2EF691CC4
  A1410498F4C312F3A94318CD5B6F0E8E92051064876751C8404

  If we add the two public keys (like the person looking for the
  solution would do), we get a public key:
  0436970CE32E14DC06AC50217CDCF53E628B32810707080D6848D9C8D4BE9FE461E100E705CCA98
  54436A1283210CCEFBB6B16CB9A86B009488922A8F302A27487 which is
  equivalent to this address: 166ev9JXn2rFqiPSQAwM7qJYpNL1JrNf3h

  If we add the two private keys (like the person requesting the address
  would), we get:
  CA65722CD418ED28EC369E36CFE3B7F3CC1CD035BFBF6469CE759FCA30AD6D54 which
  maps to the same public key as the sum of the public keys, and thus -
  to the same address.

  Since this is a model that requires basically no trust from any party,
  I've decided to create this "Vanity Pool" to enable people to easily
  outsource their vanity address creation, as well as enable people
  wanting to earn some Bitcoins to use their machines for something
  different from traditional mining.

The simplest option to get the keypair to get started with the vanitypool is to go to https://www.bitaddress.org/ and generate a new address. Note down the private key. Now switch the tab to "Wallet Details" and enter the private key. One of the resulting fields is the "Public Key (130 characters [0-9A-F])" which has exactly the required format that is needed for the vanity pool.

Once a solution is found just combine the result that is mailed to you with the private key you noted before and you can import it into your Bitcoin client.


Bitcoin Rich List - Reliable or not? I'm doing an essay on Bitcoin and other cryptocurrencies and came across the Bitcoin Rich List ( https://bitinfocharts.com/top-100-richest-bitcoin-addresses.html). However, I only want to use reliable sources of information.

Therefore, I would be very grateful for your comments on how reliable a source this is. If anyone knows of other sources regarding Bitcoin's distribution, I would be grateful for help with this as well. Thank you very much!

I can’t really offer much insight into the reliability of the website you’ve linked, but if you’re really keen to verify what is posted there, you could run your own node, and then find/write some code to index and organize all addresses by their balance. More generally, questions asking about the reliability of a certain website or service are off-topic here.

That said, it’s important to understand what the list actually represents. Namely: this is not a list of how much BTC the top 100 BTC holders own. It is a list of how much BTC is stored in the 100 richest addresses.

This difference is important, as bitcoin users do not map 1:1 onto bitcoin addresses. Many of the addresses on that list are likely the cold storage wallets of bitcoin exchanges, meaning the balance of the address is in fact owned by a great number of users (customers of that exchange). Likewise, some very wealthy users may store their coins spread out across a great number of addresses (in order to maintain better financial privacy, for example).

So while it may be interesting to see what addresses hold the most bitcoin, this metric does not tell us much in terms of who (or how many people) actually own those coins.


How do you get a Bitcoin Public Key from a Private Key How do I, in extreme specificity, convert a given private bitcoin key into a public bitcoin key (Talk to me like I'm 5 and I have to do this step by step or the evil witch will cook me alive in her oven).  NOT where can I find a program that will do this, but if I were to do it myself, what would I do?

Private Key:

18E14A7B6A307F426A94F8114701E7C8E774E7F9A47E2C2035DB29A206321725

supposedly results in the public key:

0450863AD64A87AE8A2FE83C1AF1A8403CB53F53E486D8511DAD8A04887E5B23522CD470243453A299FA9E77237716103ABC11A1DF38855ED6F2EE187E9C582BA6

Others have asked how to get private to public, I haven't seen a really specific answer, just more general direction, but no answers explain all the variables.  I understand this is rather complex and if a given individual thinks its too much work to answer, I totally respect that.  Note:  I do not care for the Bitcoin Address, just interested in Privatekey to Publickey and the specifics of how.

Variables such as the "a" and "b" in the ECDSA Curve Algorithm are already designated by Bitcoin (according to https://en.bitcoin.it/wiki/Secp256k1).  the "base point" aka "G" is also specified on that page.  the "private exponent" or "k", I have yet to find.  Some of these variables are supposedly "random" which appears to be false as every generator that you can put a private key into seems to always spit out the same public key...so....  all the variables are either already preset or are derived from the private key.

Thanks for any help on this. I've been trying to research and understand this for days, but it seems sometimes I don't understand the terms and or notations, but I think I've gotten past that and now am just missing parts of the equation.

EDIT ADD:
This is the previous stated private key in Decimal:

11253563012059685825953619222107823549092147699031672238385790369351542642469

This is the previous stated public key (x and y values) in decimal:

36422191471907241029883925342251831624200921388586025344128047678873736520530
20277110887056303803699431755396003735040374760118964734768299847012543114150

All I want to know is how to go from that private key to the public key.  Supposedly it is a simple equation that doesn't involve bit shifting or xor etc.  It may include "point multiplication" (which I don't see how you can multiply a point defined as having both an x and a y).  No one seems to understand the intricacies of this.  Do you guys suggest I actually offer some fraction of a bitcoin to whoever explains it clearly?

I'll try answering this again in a different way,
using small numbers to keep it readable.

convert the private key to binary representation, so decimal number 105, which is 0x69 in hex, becomes  01101001.

calculate this list of points, by repeatedly doubling the Generator point G:
1*G
2*G = G+G
4*G = 2*G + 2*G
8*G = 4*G + 4*G
16*G = 8*G + 8*G
32*G = 16*G + 16*G
64*G = 32*G + 32*G

write the bits of the private key next to this list like this:
privkey    pointlist
   1          1*G
   0          2*G
   0          4*G
   1          8*G
   0         16*G
   1         32*G
   1         64*G

now start adding only those points which hava a 1 written next to them.
    9*G = 1*G + 8*G
   41*G = (9+32)*G = 9*G + 32*G
  105*G = (41+64)*G = 41*G + 64*G

now you have calculated the public key for privatekey 105 by using only point doubling and point adding operations.

The actual value will be:
(0xf219ea5d6b54701c1c14de5b557eb42a8d13f3abbcd08affcc2a5e6b049b8d63,
 0x4cb95957e83d40b0f73af4544cccf6b1f4b08d3c07b27fb8d8c2962a400766d1)

The public key will then be in one of two formats:

full, this is a 65 byte number, starting with a byte 0x04
compressed, this is a shorter form, 33 bytes, starting with either 0x02 or 0x03.

The full public key is 0x04, followed by 32 bytes of the x-coordinate, followed by 32 bytes of the y-coordinate.
The compressed public key is 0x02 or 0x03 depending on whether the y-coordinate is an even or odd number,  followed by 32 bytes of the x-coordinate.
Then some more notes on your question:

Some older texts used to refer to scalar point multiplication, as exponentiation, that is why sometimes the private key is referred to the private exponent.

the parameters of the curve were chosen randomly once. meaning that the designers of the secp256k1 curve tried to unsuccessfully convey that there is no specific structure to this curve. Meaning that the NSA could or could not have put a mathematical backdoor in the curve parameters.

when using this curve and generating your public key, -you- have to choose your private key randomly, in a way that it is impossible for anyone to guess it.

the generateor G is a specific point on the elliptic curve, defined in the secp256k1 curve.


TCP vs HTTP in Bitcoin Why does bitcoin use TCP instead of creating a web server and using HTTP to comunicate between the nodes?

What's the advantage of using TCP over a HTTP server?

Is that important?

Http is a protocol that works on TCP.
So if you have an http-server, it uses TCP to communicate anyway.
The better question would be "Why should they use an http-server if they don't need it?".

They don't need/want to show a website. They just want to send binary information easily and want to be sure that the other peer received it completly/correctly. And TCP is the perfect protocol for that.


How are pools protected from a client "pretending" to mine? I understand that the GetWork JSON API is used to get a block that needs to be hashed.

I also understand there are many pool payout methods (PPS, etc).

With regard to mining clients and the pool server, what protections are there to prevent software from pretending to mine  (calling the pool equivalent of GetWork()) and getting a larger share than is otherwise required?

Pools don't measure mining rate by how many times a client calls GetWork. They measure mining rate by how many shares are submitted. A share is just like a normal block solution, except that it is million times easier to find. If you don't mine, you don't find shares.

Related.


Litecoin mining hardware Does readily available hardware exist which is capable of at least 25MH/s for litecoin mining?

So basically, I am after hardware which can mine scrypt type coins which can do at least 25MH/s.

Here is a quite detailed Litecoin mining performance collection for different hardwares.

https://litecoin.info/Mining_hardware_comparison


How do I set 'txindex = 1' in bitcoincore? How do I set 'txindex = 1' in bitcoincore?

I installed it on linux ubuntu.
I can not find the /home/bitcoin/bitcoin.conf file.

Path to '/home/bitcoin/share/examples/bitcoin.conf'The bitcoin.
conf file is found, but there is no place to set txindex = 1 inside.

If you installed Bitcoin Core on linux, the config file is most likely found in ~/.bitcoin/bitcoin.conf

Edit bitcoin.conf file and just add txindex=1 anywhere you like on a new line, just make sure it's not commented out.


How is the size of a bitcoin transaction calculated From what I understand, the fees set on bitcoin transaction are based on a recommended fee (mostly, from a 3rd party service) per byte of the transaction size. What I am curious about is how do wallets arrive at the size of a transaction?

Since the activation of Segwit, transaction size is expressed in Weight Units (WU). Weight Units can be converted to a "virtual size" or virtual bytes (vB) by dividing by 4 and rounding up. The virtual size dictates how large your transaction is when paying fees.

Non-Segwit Transactions

For now, let's focus on Non-Segwit transactions. Each Non-Segwit byte of data is counted is 4 WU when determining size. Each transaction consists of the following fields:

Version (4 bytes)
# of Inputs (VarInt, 1 byte for numbers up to 252)
Inputs (varies)
# of Outputs (VarInt, 1 byte for numbers up to 252)
Outputs (varies)
Locktime (4 bytes)

Let's break each of these fields down by looking at a non-segwit raw transaction:

0200000001d2eed35b0d55763981c635cab7788c28e3683af3d329947a17d7f6005390e6ef010000006a47304402200ffaac8f12e56f4af66109220812b76c7d6bb0e5906cf2de235b79496b3e080b0220037304894b648fa0b50e0d82ef9f58b537233ee282ab31fc04fb3d169d2c97cc0121030120a287eb98922752a89b39df64f7f3314036f6f096341c9189b0cb3c692aaeffffffff02404ff200000000001976a9140b818b11f9624e6a2d5b757a3e8fe45db3f6647788ace0b4b401000000001976a914a1e5e47fce1c5c0868107dba3851eb696c2ead5388ac00000000

Version

The version of this transaction is 02000000 (2 in little-endian). The version is always 4 bytes (16 WU).

# Of Inputs

The number of inputs is 01 (1 in VarInt notation). This indicates there is 1 input being spent by this transaction. This adds 1 byte (4 WU).

Inputs

All Inputs consist of the following fields:

Referenced Transaction Hash (32 bytes)
Output Index (4 bytes)
Script Length (VarInt, 1 byte for numbers up to 252)
ScriptSig (varies)
Sequence (4 bytes)

For our example transaction, the values are:

RefTX: d2eed35b0d55763981c635cab7788c28e3683af3d329947a17d7f6005390e6ef
Output Index: 01000000 (1 in little-endian)
Script Length: 6a (106 in VarInt notation)
ScriptSig: 47304402200ffaac8f12e56f4af66109220812b76c7d6bb0e5906cf2de235b79496b3e080b0220037304894b648fa0b50e0d82ef9f58b537233ee282ab31fc04fb3d169d2c97cc0121030120a287eb98922752a89b39df64f7f3314036f6f096341c9189b0cb3c692aae
Sequence: ffffffff

In total, this input adds 147 bytes (588 WU).

# Of Outputs

The number of outputs is 02 (2 in VarInt notation). This indicates there is 2 outputs being created in this transaction. This adds 1 byte (4 WU).

Outputs

All Outputs consist of the following fields:

Value (8 bytes)
Script Length (VarInt, 1 byte for numbers up to 252)
ScriptPubKey (varies)

For our example transaction, we have 2 outputs. The first output is:

Value: 404ff20000000000 (15,880,000 satoshi, in little-endian)
Script Length: 19 (25 in VarInt notation)
ScriptPubKey: 76a9140b818b11f9624e6a2d5b757a3e8fe45db3f6647788ac

In total, this output adds 34 bytes (136 WU).

The second output is:

Value: e0b4b40100000000 (28,620,000 satoshi, in little-endian)
Script Length: 19 (25 in VarInt notation)
ScriptPubKey: 76a914a1e5e47fce1c5c0868107dba3851eb696c2ead5388ac

In total, this output adds 34 bytes (136 WU).

Locktime

For our example transaction, the locktime is 00000000 (0 in little-endian). Locktime is always 4 bytes (16 WU).

In total, this transaction is 900 WU. Converting to vB gives us 225 vB. With an Input Value of 0.4491 BTC and a combined Output Value of 0.445 BTC, the total miner fee is 0.0041 or 410,000 satoshi. Converting this to sat/vB gives us a feerate of 1,822 sat/vB. (incredibly high!)

Segwit Transactions

A Segwit Transaction is any transaction which spends a Segwit input (aka an address beginning with "3" or "bc1"). Segwit Transactions include a few extra pieces of information like Witness data. Segwit Data is counted as 1 WU/byte and is therefore cheaper to include in transactions. This is why Segwit saves on fees. A Segwit Transaction consists of the following fields, with fields counting as Segwit Data being bolded:

Version (4 bytes)
Marker (1 byte)
Flag (1 byte)
# of Inputs (VarInt, 1 byte for numbers up to 252)
Inputs (varies)
# of Outputs (VarInt, 1 byte for numbers up to 252)
Outputs (varies)
Witness Data (varies)
Locktime (4 bytes)

Again, let's break each section down in an example Segwit Transaction:

02000000000101caba4ccb61cca412fe29ec553d286134a02335c04355a9cc1e056fe2403692cf1400000000fdffffff026406010000000000160014093c864a10516154d18d2accd61c6b2920a2040f60361e000000000017a9140195e8dd3d1527038a0a77e0b0e4515d6c8ab195870247304402200760efedbcee3bbd913661fb40c364caed622b331ee3b5bc70ac25df2d3763d5022020efdb41ef325089d146eb48948b6aaec85c086fa38a3df4d2a51ee729645ebc012102be338e0362fb01101a873a7502012cb82f7d9d303b4943fa0702829a763e49762b550900

Version

The version is, like before, 02000000 (2 in little-endian) and is always 4 bytes (16 WU).

Marker

The marker is 00 (0 in VarInt notation). The Marker indicates that this Transaction is a Segwit Transaction. Nodes running Segwit will see this marker and know to parse the transaction appropriately, and nodes not running Segwit will treat the marker as the "# of Inputs" field, discarding it as invalid for having 0 inputs. This adds 1 byte (1 WU).

Flag

The flag is 01 (1 in VarInt notation). The Flag indicates that Witness Data will be present in the transaction, and adds 1 byte (1 WU).

# Of Inputs

The number of inputs is 01 (1 in VarInt notation) indicating this transaction has 1 input. This adds 1 byte (4 WU).

Inputs

The first (and only) input is as follows:

RefTX: caba4ccb61cca412fe29ec553d286134a02335c04355a9cc1e056fe2403692cf
Output Index: 14000000 (14 in little-endian)
Script Length: 00 (0 in VarInt notation)
ScriptSig: [EMPTY]
Sequence: fdffffff

This input adds 41 bytes (164 WU).

# Of Outputs

The number of Outputs is 02 (2 in VarInt notation) indicating there are 2 outputs created in this transaction. This adds 1 byte (4 WU).

Outputs

The first output is as follows:

Value: 6406010000000000 (67,172 satoshi, in little-endian)
Script Length: 16 (22 in VarInt notation)
ScriptPubKey: 0014093c864a10516154d18d2accd61c6b2920a2040f

This output adds 31 bytes (124 WU). The second output is as follows:

Value: 60361e0000000000 (1,980,000 satoshi, in little-endian)
Script Length: 17 (23 in VarInt notation)
ScriptPubKey: a9140195e8dd3d1527038a0a77e0b0e4515d6c8ab19587

This output adds 32 bytes (128 WU).

Witness Data

The witness data consists of Data Pushes. I will not go into the details of Witness Programs in this answer. The witness program for this transaction is:

02 47 304402200760efedbcee3bbd913661fb40c364caed622b331ee3b5bc70ac25df2d3763d5022020efdb41ef325089d146eb48948b6aaec85c086fa38a3df4d2a51ee729645ebc01 21 02be338e0362fb01101a873a7502012cb82f7d9d303b4943fa0702829a763e4976

The Witness Data adds 107 bytes (107 WU).

Locktime

The locktime for this transaction is 2b550900 (611,627 in little-endian) and is used as the Block height at which this transaction's outputs can be spent. This adds 4 bytes (16 WU).

In total, this transaction is 565 WU. Converting to vB, that's 142 vB. With an Input Value of 0.02118172 BTC and a combined Output value of 0.02047172 BTC, the transaction fee is 0.00071 BTC (71,000 satoshi). The feerate of this transaction is 500 sat/vB. (also extremely high!)

Estimating Fees

With this knowledge, how does a wallet know how much to use as a fee given a feerate?
It's quite simple. See this answer for information on how a wallet handles this information given different address types. Your wallet estimates how much satoshi to set aside as fee based on the inputs, outputs, address types, and desired feerate before signing the transaction.

As for how wallets create transactions with the lowest fee possible, and how fee estimation algorithms that look at the current mempool work, they are wallet-dependent.


Security and recover issues in blockchain.info wallet I have a wallet in blockchain.info. I'm quite new to bitcoin and would be happy if someone would explain me :

(1) what should I do in order to save my bitcoins if something happens to blockchain.info. Can I access to my bitcoin with ANY wallet, if I know my address and private key, or if I know my address and password? if so, how do I find my private key?

(2) I've also noticed a backup option in blockchain.info wallet. If I use it, can I get access to my bitcoins with this backup, with every wallet? should I save a new backup after every transmission of bitcoins from my blockchain.info wallet?

(3) Wha'ts the best way to prevent a situation where a malware "reads" my password when I enter it?

Thanks!

(1) what should I do in order to save my bitcoins if something happens
  to blockchain.info. Can I access to my bitcoin with ANY wallet, if I
  know my address and private key, or if I know my address and password?
  if so, how do I find my private key?

You should backup your wallet, using one or more of the options blockchain.info provides.

  (2) I've also noticed a backup option in blockchain.info wallet. If I
  use it, can I get access to my bitcoins with this backup, with every
  wallet? should I save a new backup after every transmission of
  bitcoins from my blockchain.info wallet?

With wallets that are compatible with the format, such as Multibit, yes. I think it's safe to say that there'll always be some tool on the Internet you can use to read the file, but downloading the Multibit client (even if you don't plan to use it right now) wouldn't hurt.

As for how often to backup, I'm unsure of blockchain.info's setup...if you only have one address, then you only have one private key, and you don't need to rebackup. If you have multiple addresses, then you need to backup periodically or even after every transaction. You can see if the backup file is any different to see if you actually needed a different export.

Blockchain.info has the following instructions for accessing your backup, even if blockchain.info is permanently offline:

  Download the Multibit desktop client available for Windows, Mac OSX
  and Linux.
  Launch the application. Choose Tools -> Import Private
  Keys.
  Click the "Choose Import File" button and navigate to your
  wallet.aes.json file. Change the file format to *.aes.json and open
  the file.
  Enter the wallet password and press unlock. If required
  enter the second password and press unlock again.
  Click The Import
  Private Keys Button to complete the process. Your balance will be
  restored once the blockchain has downloaded.

  (3) Wha'ts the best way to prevent a situation where a malware "reads"
  my password when I enter it?

Make sure there's no such malware when you enter your password. One way to be sure this is true, is to work from an offline Linux Live CD. E.g. see How to set up a secure offline savings wallet and/or bitBuntu. You can decide for yourself, based on how likely you think it is that you're infected and how much money you're dealing with, whether that's worth the trouble to you.


Reusing same address on same/different recipient on security compromise? Does it make a difference if I reuse the same bitcoin address with the same recipient or with a different recipient?

Example, I did a transaction with Alice with my ABC address.
Then...
Scenario A: I did my 2nd transaction with Alice (again) using the same ABC address.
Scenario B: I did my 2nd transaction with John using the same ABC address.

Will both scenarios compromise the security of my ABC address just the same, or will Scenario B impair the security much less?

In other words, can an attack/hack be done on my used address by anyone or just by the recipient/counterparty of the transaction?

Note:
This is not a question on being anonymous/private. This is a question on security/compromise.

I'll try answering this question in a way that allows you to re-use the technique on other privacy related questions. Generally any question about privacy boils down to WHAT information is divulged to WHO. Answering questions like this requires creating a model and taking each perspective into account. I'll take a simple model, we have three parties:

You (Bob)
Alice/John (receiver)
Passive observer of the blockchain (someone analysing the blockchain)

  Scenario A: I did my 2nd transaction with Alice (again) using the same ABC address.

Alice already knows the ABC address, so there is no information leak there.

The passive observer however sees a repetition of the address, it can link the two transactions to a single identity.
This is terrible if they know the real name of that single identity, but even if they don't, it could someday become useful information.

Another issue arises, especially empirically, since address re-use is slowly becoming a thing of the past. The few services that do re-use addresses are also putting the finances of the senders at risk (Alice).

Generally only one sender belongs to all transactions going to ONE address.

This is because most services generate an address for each customer, which they re-use.

  Scenario B: I did my 2nd transaction with John using the same ABC address.

This would confuse the passive observer, as it could wrongly categorize the transaction from John and the one from Alice to come from the same sender.

However, the privacy leak to John is a lot larger and real. John can see how much Bob (you) received in the past. Re-using the address has exposed your transaction history and linked this address to you identity.

There are also situations where parties collude and share information, but that brings this question to the next level.

Scenario A is in most cases, the least worse of the two. In scenario B you divulged the real identity behind the address to two people, in scenario A only to one person.


Bitconnect balance not showing on my wallet I sent from Bitconnect platform to my QT wallet and still showing 0.00 BCC, even though the transactions is confirmed and sent since yesterday. Could anyone help me with this? This is all the info I have for the transaction in case it helps.

Bitconnect Wallet Address: 8QDhQ1vWkuR4L5h7E6vKm1tGVmsFzWUyW3
Transaction: 58066e3767dbc02c219d24ab2995723f88f552889c0e60385f607487c10b0acc
Block: 289640
Day/Time: 1/17/2018 14:06
Amount: 3.35790826

You need to fully sync the wallet for it to show your balance.

If you'r using Windows there is a tutorial on how to sync your wallet.


do i need to fully download the blockchain before operating commands on litecoin daemon or dash daemon I am setting up a website that needs to process commands like creating new addresses, do transactions even maintain wallet balance and get notifications on incoming transactions to address created. I want to use RPC but i see that it is not working as expected. I want to know if i need to fully synchronise the blockchain for the daemon to work and also how to force synchronise lite coin daemon via command line. Thanks

I figured out we only need to sync to download new transactions rest we can add listen=0 to keep band-with minimum and continue as usual without contributing.

transactions anyway are broadcasted by node and will be visible in the network.


Automated Testing using bitcoind in regtest mode, problems due to race condition So I have multiple instances of bitcoind in regtest mode. 1 instance is for the app wallet and one stimulates a wallet of a possible user.

I want to perform various functional and integration tests of the app.

Basic example, if user sends bitcoin from his wallet is that bitcoin correctly received by the app.

The problem though is that there is a time delay before that receiving node notices the transaction (even when both instances are on same machine). This screws up my tests, I tried putting in a sleep(10) function in my test code and that increases the success, but sometimes they still fail and I cant have my automated tests taking so long. (plus its seems very inelegant).

I'm wondering how others deal with this.

I would separate out the unit tests and the integration tests.

If the function needs to go out to the internet or wait for the blockchain, I make them integration tests which I can run less frequently like every five minutes. The functions that are fast I like to run every 10 seconds.

Linking the errors to sensible time stamped logs like pm2 and key-metrics allows you to see what has been going on while you were sleeping.


Is it possible to explore the blockchain without downloading the blockchain? I'm doing some experiments involving bitcoin and the blockchain, and I need to access some informations about addresses, block, and transactions. The problem is that I need a lot of data, so I can't use online APIs such as blockchain.info.
I know it is possible to do such things by downloading and accessing directly the blockchain, but this solution is pretty impracticable, given its size. Is it possible to access this data without downloading the full blockchain? For example by directly making some kind of request to the nodes?

To get anything other than blocks, you will need to download the entire blockchain. The only things you can request from a node is a block if you know the block hash, and transactions, if you know the transaction id AND the transaction is still in the node's mempool. Transactions which have already been confirmed cannot be requested as the node will have removed the transaction from its memory and stored it to disk with the block. Everything else requires the full blockchain as they are mostly human abstractions of the blocks and transactions that are not relevant to the network.

The "balance" of an address (besides technically not existing) can only be found by having the entire blockchain and reading through the blockchain and scanning all transactions for any inputs and outputs that are associated with that address. Getting the transactions that an address is involved in requires doing the same thing. This is because addresses don't exist to the network as they are only abstractions for humans to more easily think about transactions. Balances don't exist either as Bitcoin does not use an accounts or balance system for tracking money. Rather it is all based on transaction outputs.


How is a multisig transaction transferred between multiple signers? I'm trying to learn more about doing multisig transactions.
The examples I've seen show the signing of the transaction with 2-of-3, or 3-of-3, where the signatures are added, essentially, at the same time, and same place.
I'm wondering how does one, using rpc or cli, perform a multisig spend from physically separate machines?
How does a signer know that there is a transaction that he/she needs to sign?
Can a 2-of-3 transaction, that initially only contains 1 signature be broadcast, then updated by the 2nd or 3rd signatory?

I'm wondering how does one, using rpc or cli, perform a multi sig spend from physically separate machines?

It is the usually the same exact process, just doing the signing command(s) on multiple devices. The software should be able to handle when it can't fully sign and will produce as many signatures as it can for that transaction.

How does a signee know that there is a transaction that he/she needs to sign?

He has to be given the transaction to sign. If using PSBT, the transaction will usually contain an identifier for the signer that the signer can look for to know whether to sign.

Can a 2-of-3 transaction, that initially only contains 1 sig be broadcast then updated by 2nd or 3rd signatory?

No, the transaction is not fully signed so it cannot be broadcast to the network. It must be given to one of the other signers and they must sign the transaction before it can be broadcast.


How long would it take to break a 32 bit key / encryption I was actually wondering...
How long would it take to crack/brute force a 32 bit key/encryption and a 16 bit key/encryptions respectively?

Way too fast.
It's only 4,294,967,296 combinations for 32 bit and 65,536 for a 16 bit. I assume it can be cracked in seconds/minutes by a high-grade consumer laptop.
The resources required for a brute-force attack grow exponentially with increasing key size, not linearly.
I would also suggest reading the article about breaking mnemonic seed where author had to calculate SHA-256, SHA-512, RIPEMD-160, EC Addition, EC Multiplication in every iteration and he was able to check ~143,000 mnemonics per second.


Distinguishing bitcoin deposits If i had a central Bitcoin wallet, and then allowed 3 different people to deposit bitcoin into that address, would there be anyway to distinguish who they are, without knowing who's address is who, i know sending messages with transactions isn't supported by all wallets so i was just wondering if there was a different way.
Like i said i've tried passing a message through the transaction but that isn't always possible from the wallets.
Maybe theres another way to check someone is the owner of a wallet. Other than signing a message of course.

Generally speaking, the only way to distinguish incoming payments is by some combination of

sending address (usually arbitrary and not always known in advance)
amount (could be same for many people if you are selling fixed-price widgets)
receiving address (no good if you give everyone the same address to send money to)

That is one reason why best practice is to generate a new receiving address per transaction.


How to get the private keys out of old wallet.dat without syncing blockchain I have old wallet.dat files of Bitcoin, Litecoin, Bitcoin Cash, Omnicore. My Bitcoin Cash wallet.dat has unbroadcasted transactions inside, so I am afraid that others might also have unbroadcasted transactions.

So, currently nodes are not running and I want to dump private keys of those wallets and import into new wallets in a way so that old unbroadcasted transactions are not sent.

What would be the best way to get private keys without loosing funds and without syncing blockchain (don't want to sync because of a risk that transactions will be broadcasted to the network)?

Thanks!

From bitcoin-qt, click Help->Debug and open the Console tab. Type in dumpwallet <outputFileName>, making sure that of course, the output filename isn't wallet.dat or it may overwrite your wallet.

This command creates a plain text version of your wallet with all private/public key pairs in WIF format.

You may need to configure your clients to point to the correct directory containing your wallet.dat with the -datadir command line option, or if you have a custom config file use -conf.

You can also use the dumpwallet command with bitcoin-cli if you have a bitcoind running.


Bitcoin pool and getwork data validity Bitcoin pools need to check data returned with getwork for validity (proper hashing result, etc.). Bitcoind that issues the initial getworks is also able to perform some data checking, but it might not be enough for pools (for example, it might not validate difficulty 1 shares used for crediting miners).

What getwork data checking is usually done on the bitcoind side, and which on the pool side? This would include:

Checking message validity
Checking if submitted work originated from the pool (whether block data was tempered with)
Checking what difficulty the work solves (for generating shares and solving blocks)
Check if work is acceptable as a block (for example, if timestamp is not too big)

The GetWork request includes only the block header, containing exactly the fields shown here and no others.  This is all the miner ever sees.  Notice that the transactions are not in the block header -- just their (Merkle) hash.  The miner doesn't actually know what transactions it is mining.

The pool checks that the block header of the submitted work exactly matches the header of some GetWork previously issued by the pool.  Some pools (Eligius) give the miner permission to alter the timestamp field only, and only according to very strict rules.

The pool always checks that the block's hash ends with 32 zeroes (note that this is "below" difficulty zero!  Every block in the chain has more than 32 trailing zeroes in its hash).

Some pools check other things (for example, that you didn't request work using one account and submit it using a different one), but the checks above are the only ones that are both mandatory and universal.


Why a Bitcoin transaction that refers its own output as an input is computationally infeasible? It was asked to us as in an assignment : Explain why it is computationally infeasible for anyone to generate a Bitcoin that refers its own output as an input.
Inspite of searching throught various resources,I was unable to find a satisfactory answer to it.

A transaction input is an unspent transaction output from an existing transaction.

A transaction's output is the creation of an unspent transaction output from one or more inputs.

It's computationally infeasible because an input MUST exist before an output.

The tricky part is the terminology, input vs output. They are both outputs but in different states.  Essentially everything is an output existing in the ever-changing Unspent Transaction Output (UTXO) set, inputs are simply referring to a previous UTXO. An output cannot exist without coming from an input, which can be validated all the way back to its coinbase transaction.

EDIT:
To dig a little further why it's technically not possible, when building a basic raw bitcoin transaction you need the transaction ID, and N out value of the input being used. Creating a transaction with an invalid or non-existent transaction ID would be rejected if broadcast to the network. Since we know an input must come before an output, one cannot refer to its input as its own output as the transaction ID would not exist yet.

How To Create a Raw Transaction


Not able to open BTC Wallet My friend lost his PRIVATE Keys. Any way we can still retrieve the BTC Wallet? No other info can be provided only BTC Address.

No, private keys are randomly picked from the space of 256-bit numbers. A private key cannot be recovered from the address, otherwise anyone could take any other user's funds at will. If your friend doesn't have additional information such as e.g. a set of seed words, or a backup, it is infeasible to rediscover the private key.


I sent a bitcoin to a non coinbase email address How do I retrieve a bitcoin sent to an email address from coinbase and the email address is not registered with coinbase...

If you used the bitcoin network to send coins there is nothing you can do, once you send them you you no longer own them.
If you send bitcoin with coinbase with their service then you should contact their support service.


How to handle multiple inflight transactions from same address? How are multiple inflight transactions from the same address handled? From my understanding, there are two options depending on how change is handled, but both seem to have substantial drawbacks:

If change for each transaction generates a new address for the change - the usual handling - then you can't handle two transactions since they will both want to use the same unspent output address. And they will both use it entirely by definition. The ergonomics of this seems poor - I can only ever do one transaction from an address at a time. In that case I would want bitcoins sent to me to always be shredded (no bills larger than $20 please).
If I have change sent sent back to the original address, does it matter in what order they are added to the chain? I can't see why. This however allows everybody to track my wallet and where I'm transacting. Also I don't know if all wallets support this.

Is my understanding correct? (This all started with me diving down the rabbit hole on how Lightening and Plasma worked.)

Addresses are a construct of wallets. The bitcoin system itself doesn't know or care about them.  Coins being spent are identified by their creating txid and output-index.

The network verifies that the provided signature is accepted by the required scriptPubKey, but the scriptPubKey (nor the addresses that wallets map to scriptPubKeys) is never used to lookup or in any way reference the coins being spent.

The model you seem to be imagining is more like some other altcoins and can indeed have poor ergonomics.

Normally change goes to a new address and those coins can be immediately spent without waiting for the first transaction to confirm.  It sounds like from your question that you might have thought the change could not be spent before the transaction creating it was confirmed, but this is not the case.

I am not aware of any reason why reusing an old address for change would benefit a user, but the system will let you do it without it causing any problems.

In Bitcoin for privacy and security reasons users are advised to avoid reusing addresses, but this doesn't have any interaction with the kinetics of spending coins.


Are nodes that don't accept inbound connections necessarily leechers? Gavin Andresen and James Lopp seem to think that nodes that don't accept inbound connections could be called "leechers" in the same way a torrent leecher takes but doesn't give (or at least they did 5 years ago). I see no reason why leeching or seeding has anything to do with whether you accept inbound connections or not.

Is this actually true in some way I haven't thought of?

An outbound connection is functionally equivalent to an inbound connection except in the respect that you initiated it.  An outbound only node provides the same resources to the network except that it doesn't provide incoming connection slots.  Outbound-only nodes forward blocks and transactions just like any other node. I think it is generally misleading to describe them as leeches.

You could consider one to be a connection slot leech but not a leech in any other respect.  There have been times in the past when the Bitcoin network has been short of inbound connection slot capacity, and a troubling percentage of listening nodes are concentrated in a few datacenters (and many appear to be run by parties with ill intent for Bitcoin users)... so it is certainly good for you to accept connections if you at all can.

Nodes without open inbound also provide important DOS and privacy protection to the network: It is much more difficult for an attacker to get connected to nodes that don't accept random connections, since the attacker must wait for the victim to come to them. So the presence of outbound-only peers has the advantage of strengthening the network against some kinds of attack. (That said, the network has more than enough out-only peers to achieve those benefits already...)


Is there a paper wallet for all crypto-currencies? I am relatively new to crypto-currencies and I am just wondering if there is inherently a paper wallet for all crypto-currencies made?
Do they all have public and private keys that you can write down on a piece of paper to store?

The reason I ask is because I am looking into diversifying my portfolio and I have my eye on some coins but I cannot confirm that they have paper wallets.
An example: MaidSafeCoin can be kept on Bitcoin address. There are a lot of ways to store bitcoin addresses. Paper wallet being one of them. So MaidSafeCoin can be stored on paper.

If all coins use public/private then it is just a matter of writing those down. Am I missing something?

Essentially yes. Paper wallets are just storing the private key in written format, and you can encode just about any data into a QR code. The limitations to this would be centralized alternative coins where users are unable to hold their own keys.


Bitcoin RPC works in bitcoin-cli but not in python-bitcoinrpc: No JSON object I'm running a testnet node. I can use bitcoin-cli just fine:

>bitcoin-cli.exe getinfo
{
    "version" : 100000,
    "protocolversion" : 70002,
    "walletversion" : 60000,
[... snipped]

But when I run this python code:

from bitcoinrpc.authproxy import AuthServiceProxy, JSONRPCException
import logging

rpc_user = "rpcuser"
rpc_password = "xxxxx"

logging.basicConfig()
logging.getLogger("BitcoinRPC").setLevel(logging.DEBUG)

rpc_connection = AuthServiceProxy("http://%s:%s@192.168.1.39:8332/" % (rpc_user, rpc_password))
print(rpc_connection.getinfo())

I get this error:

DEBUG:BitcoinRPC:-1-> getinfo []

Traceback (most recent call last):
  File "<path>\rawtransactiondemo\raw.py", line 11, in <module>
    print(rpc_connection.getinfo())
[... snipped]
  File "C:\Python27\lib\json\decoder.py", line 384, in raw_decode
    raise ValueError("No JSON object could be decoded")
ValueError: No JSON object could be decoded

This is my bitcoin.conf:

testnet=1
rpcuser=bitcoinrpc
rpcpassword=xxxxx
daemon=1
rpcport=8332
rpcallowip=192.168.1.39
bind=192.168.1.39

I'm using the python-bitcoinrpc library.

I added some code to debug what bitcoin was sending back - it turned out to be a 401 error.

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">

<TITLE>Error</TITLE>
<META HTTP-EQUIV='Content-Type' CONTENT='text/html; charset=ISO-8859-1'>

401 Unauthorized.

Why was this triggered? If you look in my bitcoin.conf, and my python code, you can see that the username is different (bitcoinrpc vs. rpcuser). Changing that fixed it.

Anyways, if you get the error ValueError: No JSON object could be decoded, this might be your problem.


Non standard transaction value negative, empty sigScript, empty Pubkeyscript? Lets consider this 3 possible transaction cases:

Tx1  output value is  negative
Tx2  sigScript is empty
Tx3  Pubkey Script is Empty

Is this non-standard transactions is allowed in Blockchain and can be included inside new block ( at example by miner ), according to Bitcoin protocol?

Tx1 output value is negative

Definitely not.

  Tx2 sigScript is empty

Yes, so long as the script evaluates to true.

  Tx3 Pubkey Script is Empty

Yes, the scriptPubKey is not validated.

Tx2 and Tx3 will both be spendable by anybody in the network, other users will attempt to spend it instantly and miners will attempt to finney attack it out from under you even if you make the first spend with a high fee.


How to use UTXO of xpub derived addresses? I'm new in Bitcoin, this is something I'm confused with.
If we are deriving children, i.e. public keys, from xpub, without private keys, for the purpose of receiving outputs, how are we able to spend UTXO if we don't have private key?
In this example:
https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch05.asciidoc#using-an-extended-public-key-on-a-web-store
xpub is set up on server to generate public keys to receive money on e-commerce website. But how do we access that money if we don't have private keys?

Gabriel’s HD wallet offers a much better solution through the ability to derive public child keys without knowing the private keys. Gabriel can load an extended public key (xpub) on his website, which can be used to derive a unique address for every customer order. Gabriel can spend the funds from his Trezor, but the xpub loaded on the website can only generate addresses and receive funds.

The link you mentioned describes how you can use XPUB to get new address for each order on your website and the address will belong to your wallet setup maybe on a hardware wallet or elsewhere to spend.

But how do we access that money if we don't have private keys?

You don't access it on the web store but you access it using hardware wallet or maybe wallet setup on a different machine etc.
You can try this with btcpayserver


Installing Bitcoin Armory on Ubuntu I installed Bitcoin Armory on Ubuntu 13.10. I get the following output when I try to run it:

root@cloud-server-07:/BitcoinArmory# python ArmoryQt.py
********************************************************************************
Loading Armory Engine:
   Armory Version:       0.91.1
   PyBtcWallet  Version: 1.35
Detected Operating system: Linux
   OS Variant            : ('Ubuntu', '13.10', 'saucy')
   User home-directory   : /root
   Satoshi BTC directory : /root/.bitcoin/
   Armory home dir       : /root/.armory/
   LevelDB directory     : /root/.armory/databases
   Armory settings file  : /root/.armory/ArmorySettings.txt
   Armory log file       : /root/.armory/armorylog.txt
   Do wallet checking    : True
ArmoryQt.py: cannot connect to X server

Does anyone have any idea why?

You should not run Armory as root. If you want to run armory as another user, pick a user other than root. You can use "sux" (which you can apt-get install) to become that new user.


Losses when trading with bitcoins When investing in bitcoins can you lose any more than the total amount of currency with which you invested?

Gentlemen, I see my original question has caused a bit of debate. I have been asked by someone to be more specific as the question seems to be causing some confusion. Let me give an example. If I invest 500 US dollars into buying bitcoins; let's say this is not money loaned, but my own money from my own personal savings account; let's also say that I do not trade or buy anything with these bitcoins. This is purely a financial investment with the hope of gaining a return one day of say, 600 US dollars; is it possible (maybe even likely?) that I could lose not just the 500 dollars invested, but also more than this, say 520, 550 or 600 dollars? You experts, please take account of all possible scenarios, fees and other hidden costs when answering my question. Thanks!

Yes, absolutely. Here's just one example of how this can happen:

You invest Bitcoins worth $100 in some kind of high interest scheme.
You cash out of the scheme and get Bitcoins worth $200.
You invest those Bitcoins.
You lose them.
The high interest scheme turns out to be a Ponzi scheme. You are sued to clawback the $100 value of the Bitcoins that were fraudulently paid to you.
You lose that suit and now owe $100 on top of the $100 you invested.

Another example would be if you unknowingly withdraw funds from an exchange that's insolvent, then reinvest and lose those funds. If the exchange declares bankruptcy, your withdrawal could be ruled a preferential transfer and you would have to repay it.


Can't get into my MultibitHD wallet. I have the 18 recovery words but can't recover the wallet I'm trying to login to my MultibitHD wallet and its saying the password won't unlock the wallet. I might have forgot the password, but I have a feeling I'm using the right password.

I have the 18 words to recover the wallet (I regret making it 18 words, I should have stuck with 12 words so I could import it using another wallet) but heres what happens when I try to recover the password:

It just gets stuck on that last page, nothing happens. Over the years I'm always running into problems like this with MultibitHD, usually I can recover it with the words though. This time I can't. I have about €100 of bitcoins in there so this is a problem. I tried to restore the wallet from a backup point but that didn't work either. Is there anything else I can do?

Since MultiBit HD uses BIP 39 for its "wallet words" (everywhere else these are known as the mnemonic or the seed phrase), you can import them into any wallet that supports BIP 39 mnemonics.

I suggest that you import your mnemonic into Electrum. Note that by default Electrum does not use BIP 39 nor does it use the same BIP 32 derivation paths as MultiBit HD.

To import, download Electrum and create a new standard Electrum wallet. Choose the option for "I already have a seed". Then enter your seed phrase. Before clicking "Next", click the "Options" button and in the pop up dialog, choose "BIP 39 Seed". On the next page where it asks about derivation, delete everything in the text box and enter exactly m/0'. Continue the rest of the wallet setup as normal. In the end, you should have an Electrum wallet with your MultiBit HD seed phrase for the private keys. You should see your Bitcoin in your wallet now.

Here is a video produced by MultiBit that shows this entire process.


Cryptsy account got hacked About 14 hours ago I had about 700 Cat coins and 500000 Doge coins on my Cryptsy account. I have sold 0.02725061 BTC worth of DOGE and withdraw it to another address. Soon after as expected I received an email to verify the withdrawal.

About 30 minutes later my account got hacked. All of my Doge coins ware withdrawn from my account, All of my Cat coins ware sold to BTC and then they were also withdrawn from my account.

All of this happened while I was using my PC, therefore it can't be a remote desktop program. Secondly, this account has two factor authentication which requires access to my phone, which means that simply having my user name and my password would not help in this case.

The most disturbing thing hare is that I did not receive a verification email for any of these 2 withdrawals. As far as I know after every withdrawal from Cryptsy I'm supposed to get a email to verify the withdrawal, which clearly did not happen. Whoever did this managed to withdraw from my account without needing to access to my email account, which indicates that there is a serious security hole in Cryptsy.

By the time I found out about this all of the transactions ware already confirmed. I opened a support ticket, but I did not receive an answer yet. I just can't wrap my mind around this. How on earth did this happen? He bypassed my two factor authentication,  he did it while I way using my PC, and he did it without needing to access my email.

Any Ideas?

I figured this out a while ago. Couple of weeks after I got hacked I noticed an unknown process in the task manager. After googling the name of the file that was linked to that process (I don't remember the file's name) I found out it was a trojan horse. Afterwards I deleted it, changed my passwords, and checked out from time to time for unfamiliar processes.
I suspect that whoever did this, connected to my accounts through my session, thus bypassing my two factor authentication both on my Cryptsy account and my Gmail.
Update:
After some digging I found an infected file named Bitcoin.Trading.Botv4.6.exe. This is probably what caused the Trojan to appear in some random temp folder. I don't remember where I downloaded this, or when I ran this, and I'm pretty sure that it wasn't identified as a threat back when I first ran it. I included a link to the scan results here.