I received my presale wallet via email. The private key is encrypted using my password, but I don't remember encrypting it.
So who did encrypt it? Is it possible they have a copy of my private key? Does that mean I should move my ICO coins to a new address?
I've not seen this recommended anywhere, so I'm guessing there's no need. But I can't see why my fear isn't warranted. Is it a matter of trust?
0 ·
Comments
Edit: if I misunderstood and you do have possession of your password, then you're all good. The wallet json file you received via email is your encrypted private key, encrypted with, you guessed it, your password. If your password was compromised, your coins would already be long gone.
What I am saying is that I didn't encrypt my private key. The private key was emailed to me already encrypted.
So that makes me think that whoever *did* encrypt it also knows the unencrypted version of it, and could spend my coins if they wanted to.
What I am looking for is an explanation of why that shouldn't be a concern. What (if anything) stops whoever encrypted my private key for me before emailing it to me from spending my coins?
All that said, a touch of paranoia is a good thing in crypto, and for peace of mind you might do well to send the coins to another address you control, just as a matter of policy. Yet even there, unless you personally review all the code and compile the client yourself, you are in a sense ultimately 'trusting' that your software (eth, geth, or whatever) is clean. Final note, you might find it interesting to read up on asymetric key cryptography, and client-side encryption. Oh, and, full disclosure, I cannot claim to have peered under the hood of the crowdfund and the way it was coded. I was however prepared to assume that they are not idiots.
Thanks for your input, but I was hoping for something a little more clear cut.
I'm surprised nobody seems to have any definitive information about how the presale wallets were created. In my experience with crypto so far it is unfortunately far safer (and more accurate) to assume they are idiots or crooks (or both) than that they are not.
So the reality is that even after much due diligence, we still make decisions based on incomplete information. Like poker players. My 'not idiot' premise is based on the fact that it was technically possible to generate priv keys without any critical info being shared with the other end. And that this would be the obvious technical choice, since there were many capable eyes watching. There was a strong incentive on the part of Ethereum to play fair, for the credibility of the crowdfund, the reputation of its creators, and the future of the project in general.
Edit: the typical mechanism would work like this: Your keypair (public address and encrypted priv key) would be generated on your end from your password, in your browser. This keypair would go back to their server and your public address would be funded. Neither your password nor your raw priv key would leave the browser.