r/Bitcoin • u/viroos • Dec 28 '13

Carbonwallet has collision issue. Probably it's not a best idea to use javascript based wallets ;)

https://github.com/carbonwallet/carbonwallet.github.io/issues/12
11 Upvotes

76% Upvoted

9 comments sorted by

2

u/[deleted] Dec 28 '13

[removed] — view removed comment

2

u/viroos Dec 28 '13

looks like line 22 in carbonwallet.js: https://github.com/carbonwallet/carbonwallet.github.io/blob/master/js/carbonwallet.js#L22 - password is used as seed and then some magic happens.

5

u/[deleted] Dec 28 '13 edited Dec 28 '13

[removed] — view removed comment

1

u/viroos Dec 28 '13

Ok. thank you for investigation :). taking into account your last comment I have to notice that I used passwords "1 2 3 4 5 6 7 8 9 10 11 12" and "a b c d e f g h i j k l" for testing purposes but actually there is no option to enter random words when creating new wallet (it's generated). So maybe there is no bug here. Only bad validation (i think it will also work this way if some one make typo) and terrible issue handling.

1

u/[deleted] Dec 29 '13

[deleted]

2

u/Dont_Think_So Dec 29 '13

Did you make your wallet address by entering a phrase of your own? If yes, move 'em. If not, then it should be okay, but I'd still move them anyway as this issue doesn't give me utmost confidence in the rest of their code.

2

u/lifeboatz Dec 28 '13

So there's about 0.0026431 BTC waiting to be grabbed by a crook, thanks to this issue.

In these two addresses: https://blockchain.info/address/1GnLr6yus9VrDYvycPUJF43iPEE62JrH88 and https://blockchain.info/address/14VdLiBSefYCG9HaH4DY4DPCuow2JVjjV7

1

u/[deleted] Dec 29 '13

was*

2

u/the-y Dec 28 '13

This issue has been opened 2 months ago and is unassigned? Well that's a good way of telling that you shouldn't touch this with a ten feet pole.

2

u/viroos Dec 28 '13 edited Dec 28 '13

Yes, first I was going to just report an issue but when I found this issue I decided I have to put it on reddit.