A receive address is made public for donations, how do I safely withdraw funds?

Question

I have a receive address that I have given out to other people, both for payments and donations;

After transferring the funds to a new address, someone has donated to the previous address.

How can I safely withdraw the funds a second time or ensure that people do not emit transactions to an address that has already been used-up?

Answer 1

How can I safely withdraw the funds a second time ?

Second withdraw will be less secure. The security decrease exponential with every withdraw. There is nothing you can do against that.

How can I ensure that people do not emit transactions to an address that has already been used-up?

As far as I know, there is nothing in IOTA protocol that prevent an actor to send funds to an address that was already used for withdraw.

Obviously, as soon as you publish your address publicly, you do not know what people will do with it. But if you can assume that they won't keep a copy of it for days/weeks before using it, then you just have to "unpublish" your address some days/weeks before the transfer. ("unpublish" or "publish a new one")

see also What information is leaked if I reuse an address?

Answer 2

As far as I know Lets say you were receiving donations on Address X, my recommendation is to not use this address till you REALLY need to withdraw from it. After you withdraw from address X, make sure you never use it again to send/receive funds from/to address X. Generate a new address Y and update donation address wherever you've posted it. Another recommendation is to have one seed for a "donation wallet" and another seed for "personal wallet" to which you transfer funds from donation wallet.

Answer 3

For now, you need to make sure that you consider an address a temporary place to receive funds for the exact reason you bring up: You will be compromising your security by withdrawing from a static address multiple times.

There have been discussions for a future possibility of creating "alias" addresses. An alias would be able to dynamically move between addresses so they don't get reused, while staying static so people can reliable donate to them.

Answer 4

Here is a proposition to overcome this issue: https://medium.com/@EricHop/solving-the-iota-donations-problem-by-using-iota-cheques-ebfd79f721d4

Answer 5

You can receive many times on that donation address. Just don't spend from that address.

Simply change the address after withdrawing IOTAs from that address.

Answer 6

I do not understand, why this concept was choosen. The poeple at IOTA tell, that one major goal of IOTA should be, to make machine to machine payments possible on the IoT. But how does this fit into the fact, that you are not allowed to re-use addresses?

Assuming, you have a „data-source“ - for example a sensor - and you want, that this “data-source“ is payed for each value it serves to a „consumer“ - an actor -. Let‘s assume, that this „data-source“ is meant to serve 100 values (information-entities) to 100 „consumers“ each second.

Should the „consumer“ ask the „data-source“ each time, it wants to receive data, for the address, it should transfere the money to and should the „data-source“ create a new address for each request? 10000 adresses per second? How mny adreesses can be generated for each seed?

Answer 7

Here are several my proposals for address aliases, which are going to solve this problem:

1) Masked Authenticated Messaging https://medium.com/@alexpods/iota-address-aliases-masked-authenticated-messaging-65d352a5389d

2) obsoleteTag field https://medium.com/@alexpods/iota-address-aliases-9f6d9894f74e

Answer 8

You can keep your receiving address untouched. Then, generate a new address every time you want to withdraw funds. As long as you do not use twice the same address to withdraw, your funds should be safe.