Ensuring security of funds and preserving anonymity when using Bitcoin for e-commerce

Submitted by jbrown on Wed, 01/21/2015 - 08:01

When configuring an e-commerce website to accept Bitcoin, it is important to be aware of the extra security considerations relating to private keys. Each payment needs its own Bitcoin address so these need to be readily available on the system providing the e-commerce functionality. This is not true of the private keys. Unless payments need to be made in an automated manner in response to user actions on the website, the wallet that holds them can be stored in a much more secure environment. This can make it significantly harder for a hacker to steal the funds.

Using HD Bitcoin wallets with Drupal Coin Tools

Submitted by jbrown on Wed, 01/07/2015 - 13:10

Each Coin Tools payment needs its own Bitcoin address. This is necessary so that it is clear whether or not the payment has been completed. It is also important for preserving anonymity.

In order to participate in the Bitcoin network, a Drupal website must talk to a Bitcoin node. Currently Coin Tools utilises the reference implementation, bitcoind.

bitcoind has wallet functionality built in. In fact, it was originally released as a desktop wallet for Microsoft Windows. By default, bitcoind will pre-generate a pool of 100 pairs of addresses and corresponding private keys. This pool will be increased as necessary.

This presents a number of problems. If data-loss were to occur on the server, the private keys could be unrecoverable and therefore the funds stored on the addresses would be unspendable. If a hacker gains access to the server they could copy the keys and steal the funds. The private keys can be encrypted, but the password is exposed on the server when generating new keys and spending funds.

Drupal / Bitcoin BIP 70 / PKI certificates

Submitted by jbrown on Mon, 11/03/2014 - 14:00

BIP 70 provides a mechanism so that a customer can be sure that they are sending a Bitcoin payment to the correct place. Before BIP 70, the customer would simply be presented with a Bitcoin address to send the amount to. This address could potentially be tampered with so the funds get sent to someone else. It is also not very user-friendly to be sending money to a random collection of letters and numbers.

Update on Drupal / Bitcoin Payment Protocol (BIP 70) integration

Submitted by jbrown on Thu, 10/30/2014 - 17:03

BIP 70 describes a high-level payment system for Bitcoin. It uses Protocol Buffers and X.509 certificates for the following major improvements:

  • Human-readable payment destinations instead of Bitcoin addresses
  • Resistance from man-in-the-middle attacks
  • Payment received messages sent back to the wallet
  • Refund addresses

Pages