26

What is my seed? Think about your seed as the combined username and password that grants access to your bank account. If anyone obtains your seed, they can login and access your funds. Seed: You must generate a random 81 character seed using only A-Z and the number 9. It is imperative that your seed be an 81 character random assortment of A-Z and 9. Use ...


18

No, a node cannot steal your seed When you send a transaction to the node you are connected to, you don't send the seed to it. The tx (=transaction) gets created locally on your PC/Smartphone/other device and it also gets digitally signed with the seed*. So it doesn't matter if you trust the node you are connected to or not. The only thing that could happen ...


18

Fragments of the private key of that reused address are leaked. An attacker could find a bundle hash (via brute-forcing) that can be signed with the leaked fragments. Luckily for the user, the window for the attack is short (only while the spending transaction is not confirmed). But if more iotas come to the reused address the attacker can spend them right ...


16

To expand on CFB's answer, because IOTA uses Lamport signatures, half of the private key is leaked each time. This halves the security level of the address (from 54 trytes of security to 27 trytes for a typical address with security level 2), making it exponentially easier to brute force the remainder of the private key with each key reuse. While after a ...


15

IOTA does not use traditional asymmetrical (public-key) cryptography algorithms which depend on not being able to efficiently computing discrete logarithms or factoring numbers (which are believed to be easy on a quantum computer). Instead, its signatures are based on the Winternitz signature scheme (slightly modified for ternary) which only depend on the ...


13

For digital storage, I would recommend using an offline password manager such as Keepass which can encrypt your key behind a password. For paper storage, it may be good to print out a copy of your seed in a QR code or otherwise stored and printed out and kept in a safe or safety deposit box. For hardware storage, hopefully options arrive soon such as ...


13

IOTA uses 81-tryte (243-trit) addresses. We assume that 81-tryte seeds (shorter seeds can be considered as 81-tryte seeds after being padded with "9") map to 81-tryte addresses uniformly and hence longer seeds would give several seeds mapping to the same address (because of https://en.wikipedia.org/wiki/Pigeonhole_principle). To "hack" an address one needs ...


12

Never send your seed over the network, just explain to your friend how to generate it's own seed securely offline. Ask him one address and transfer the iotas. Securing transfer is one of the main purpose of the iota network. It would be a very bad signal (from an educational perspective) to send him a seed over the internet (or even by any other way).


12

You should never send iota to an address that was already spent. This will make it possible for an attacker to steal your iotas. This rule is uninfluenced by any snapshot. The problem after a snapshot is, that every node deletes the transaction history, only the balances are saved. Usually your wallet doesn't show any spent addresses anymore (thus ...


10

Anyone can issue a transaction for any amount from any address. Such a transaction won't be confirmed without knowledge of the private key. Your case is about an attempt to pretend that funds have been stolen.


10

Simplified, Lamport One-Time-Signatures (OTS) work as follows. For illustration purposes I am using Bits and not Trits. Assume you have a private key PRIV that consists of 100 (random) pairs of numbers, so a total of 200. To create your public key PUB you hash each of these 200 numbers, giving you a new sequence of 100 pairs. Now if you want to sign any ...


10

First, a subseed is derived from the seed Treat the seed as a (little-endian) number and add the index to it (a seed starting FEDCBA... and an index of 1 therefore results in GEDCBA.... Hash the result of the previous step with Kerl (keccak) Then, a private key is derived from the subseed. The private key consists of multiple blocks (number depends on ...


9

In their official statement, the IOTA team stated: "With Coordinator IOTA's security depends on one-wayness of Curl-P, without Coordinator the security depends on collision resistance." However, before the collision nonresistance of Curl-P was identified and published by DCI, these Curl-P properties were kept secret. For this reason, in the beginning ...


8

While one single transaction is pending, there is no threat to your balance (apart from the obvious, that if the transaction confirms later, your balance will decrease by the transaction amount). However, if you have more than one transaction spending from the same address pending (where the transactions have different bundle hashes, i. e. the second one is ...


8

Every double-spending is an address reuse but not every address-reuse is a double-spending. Let's say you have an address with a balance of 100i Double Spend You send 100i from the address to another address and 100i from the address to yet another address. or You send 40i to from the address to another address and 70i from the address to yet another ...


8

It's safe to keep your seed. Even if you double-spend or reuse your address, your seed doesn't get exposed, only the private key of one address of your seed is partially revealed. You can generate an infinite amount of addresses with one seed. What's the difference between a private key and a seed? What is the difference between "double-spending&...


8

There was a bug in the wallet software related to absence of https://github.com/Come-from-Beyond/ISS/commit/de1a279450558848a81858fd57b023719eb9a0d3. "M" should be avoided to prevent leakage of the corresponding (and following) private key fragments.


7

As others already stated, these transactions are not valid as they do not have the correct signature (some of them even have some text - stating that they don't have the correct signature - tryte-encoded in the signature field). The reason why creating these transactions is so successful: Currently tangle explorers do not validate transactions well enough (...


7

What works best for me is storing the seed encrypted in a KeePass database file (or the offline password manager of your choice) on my computer and on an USB-Stick in another place (backup in case of fire, theft, ...). Hardware Wallets Having IOTAs on a Ledger Nano or Trezor would be great and they (Ledger or Trezor or both) will add IOTA eventually. ...


7

"Hype aside it's a minor change that's equivalent to transaction chains in Lightning Network or Raiden, offering exactly the same advantages (asynchronous) and disadvantages (lower security)." - this is a https://en.wikipedia.org/wiki/Straw_man argument. All the rest is based on this fallacious foundation, no surprise the resume is fallacious too.


7

What PoW means in practice is that cost spent on mining = security. Ie. $100 fees per hour? Spend >$100 (in energy used for mining) to rewind these transactions. It's better with asics as that adds 'has access to asics'. To buy Security with huge costs of transactions is not reasonable anymore. Fiat Cash or anything else is cheaper. This would be dump ...


7

According to this answer to another question, I can just reattach my transaction again without signing it, so the answer is no. I cannot be forced to reuse my address for spending this way.


7

No. The data signed in a transaction don't include parent and branch transaction hash. So when you reattach a transaction the signature is unchanged. It means that the portion of the private key disclosed when you reattach is exactly the same as the portion disclosed during first "attach to tangle". This design choice (to not include parent and branch ...


6

IOTA's development team has explicitly recommended only two seed generation methods. They are: /dev/urandom (available on Linux/MaxOS) Keepass' password generator The first option may be too outlandish for most. If you prefer a point-and-click solution, you'll want to go with Keepass -- a popular & trusted password manager with a vetted generation ...


6

Nobody can count the amount of full nodes (Because of that, there are also no sites that track them) Why? Every square is a full node. Connected nodes are neighbours. F has 3 Neighbours: E, H and G. F knows is that there are at least 4 nodes in the network. F does not know how many or which neighbours E, H or G have. F has no idea that J or C or D ...


6

Cannot think of any problems. Obviously the database dump should be created while your node is down, and the new node should be down too, while you are copying the database. The database might contain stale (unreferenced) transactions which would not get synced when you did not use a database, but those should not hurt either (if you have the disk space). ...


6

With every spend a random 50% of the private key is exposed. The reason that it is a one-time signature follows from what a second spend can reveal: The overlap of the 2 random 50% reveals can be anywhere from 0% to 100%. Since it is random, the distribution for this will be on a bell curve. Which makes 0% overlap (left/bottom of bell curve) and 100% (...


6

Depending on how thorough the malware is, following could work: don't save the last/first/middle part of your seed in your pw (=password) manager, memorize it and just manually put it in save the encrypted seed in your pw manager and recode the lightwallet so that it decrypts the seed !!! Although the above solutions could work, "well programmed" malware ...


6

After one signing of a transaction, you reveal 50% of your key, but it's still astronomically impossible to crack. You need 2^256 tries on average after 1 signing, which is the same amount as SHA-256 encryption which is widely accepted as cryptographically secure (for comparison, SHA-256 is what encrypts bitcoin). After the second use of an address, it is ...


6

The "problem" is, anyone is free to send funds to any address they want, even if this address has been emptied before (the protocol is agnostic to the source & destination address). A partial solution/safeguard could be a warning message in the GUI wallet. In any case, as noted here https://iota.stackexchange.com/a/441/249 there is a future plan to ...


Only top voted, non community-wiki answers of a minimum length are eligible