<p>I'm the owner of StrongCoin.</p>

<p>Ben has detailed just about every possible risk with StrongCoin. You can read about how we handle server security in our <a href="https://www.strongcoin.com/blog/frequently_asked_questions">FAQ</a>.</p>

<p>It's not in my interests to defraud my customers, I'm pretty easy to trace and I don't fancy having angry users knocking on my door</p>

<p>So with Bitcoin like cash there are risks with storage, I lost a wallet.dat which spurred me to build StrongCoin.</p>

<p>StrongCoin is a convenient way to store and spend Bitcoins. I recommend you hold your spending Bitcoins in StrongCoin and use an <a href="https://www.strongcoin.com/blog/the_easiest_way_to_create_secure_offline_bitcoin_transactions">offline mechanism</a> for your savings or high value holdings.</p>

CC BY-SA 3.0
2013-04-24T22:59:26.703Z
Ian I'd like to do a lecture for my class on bitcoin covering strong wallet. Could you review my lecture after it is finished for improvements or addtions?
Charles Hoskinson
CC BY-SA 3.0
2011-12-20T19:07:34.587Z
2011-12-20T19:07:34.587Z
Ian Purton
<p>I agree with the answers of both Ian and Ben. Let me point out that I like the StrongCoin service. As former CEO of Hushmail, I would like to add some relevant information because Hushmail is like an encrypted wallet for email and we faced a similar set of issues.</p>

<p>The other risks that need to be addressed with services such as StrongCoin are:</p>

<ol>
<li><p>Spoofed applet - The browser-based java applet that is served to you should be published as source code so that users may compile it themselves and/or seek review from cryptography peer-review groups, as Hushmail did. You should also have the ability to store locally a version of the trusted applet for your own use. This is important if you still want to use the service after StrongCoin receives a court order to serve compromised applets to certain persons suspected of 'something'.</p></li>
<li><p>Weak password - Since the private keys are stored on StrongCoin servers encrypted and protected with a passphrase, you would be subject to brute force attacks from anyone that gained access to the server data so a strong password is essential.</p></li>
<li><p>Keyboard sniffers and cameras - You are only as secure as your physical surroundings so be aware of keyboard loggers (hardware and software) and cameras that may have been inconspicuously placed above your computer work station to capture your passphrase.</p></li>
<li><p>Legal and physical jurisdiction - The StrongCoin servers are subject to court orders of the jurisdiction in which they they are located. If StrongCoin is legally domiciled in a different jurisdiction than the physical servers, then that country's courts could also have jurisdiction. Both jurisdictions should be examined for their privacy and data protection statutes.</p></li>
</ol>

<p>Also see:</p>

<p>(a) <a href="http://www.hushmail.com/about/technology/security/">http://www.hushmail.com/about/technology/security/</a> </p>

<p>(b) <a href="http://www.schneier.com/essay-191.html">http://www.schneier.com/essay-191.html</a></p>

CC BY-SA 3.0
2013-05-03T13:15:41.347Z
As this is client side javascript, the source code is already published with every view of the page.
Roy
CC BY-SA 3.0
2012-04-11T07:35:49.950Z
What Java applet are you talking about? I haven't seen one on neither Strongcoin nor My Wallet.
passy
CC BY-SA 3.0
2012-04-25T08:15:33.343Z
I am referring to the javascript code that Ben discusses in his first paragraph above. If the original javascript code were published somewhere for these online wallets, they could be vetted by the crypto community and the published source could serve as a check against a malicious wallet operator (or a good wallet operator acting under a court order/subpoena from law enforcement).
matonis
CC BY-SA 3.0
2012-02-17T16:12:23.950Z
2012-02-17T16:12:23.950Z
matonis
<p>In addition to the points made in the other answers on this page, <strong>the key derivation function used by StrongCoin to derive an AES encryption key from the user's password (which is then used to encrypt the user's private wallet key) is very weak.</strong></p>
<p><a href="https://strongcoin.com/blog/decrypting_private_keys_generated_with_strongcoin" rel="nofollow noreferrer">This page</a> on StrongCoin's blog explains how users' private wallet keys, which are encrypted by StrongCoin's client-side javascript, can be decrypted using <code>openssl</code>, by way of the following command:</p>
<pre><code>openssl enc -d -aes-256-cbc -in key.txt -a -k password
</code></pre>
<p>This <code>openssl</code> command is notorious for using a very weak key derivation function - i.e. just one round of MD5 hashing, as explained <a href="https://security.stackexchange.com/questions/29106/openssl-recover-key-and-iv-by-passphrase/29139#29139">in this post on security.stackexchange.com</a> in 2013.  To quote from the accepted answer:</p>
<blockquote>
<p><strong>This is quite weak!</strong> Anybody who knows how to write code on a PC can
try to crack such a scheme and will be able to &quot;try&quot; several dozens of
millions of potential passwords per second (hundreds of millions will
be achievable with a GPU). If you use openssl enc, make sure your
password has very high entropy! (i.e. higher than usually recommended;
aim for 80 bits, at least). Or, preferably, don't use it at all;
instead, go for something more robust (GnuPG, when doing symmetric
encryption for a password, uses a stronger KDF with many iterations of
the underlying hash function).</p>
</blockquote>

CC BY-SA 4.0
2020-12-22T14:30:18.350Z
2020-12-22T14:30:18.350Z
mti2935
<p><a href="https://strongcoin.com/" rel="noreferrer">Strongcoin</a> claims it is &quot;The Safest way to store your Bitcoins. The only Bitcoin e-wallet service that's not vulnerable to security breaches. Your Bitcoin keys are encrypted in the browser.&quot;</p>
<p>As I understand it, with their system your private keys are essentially encrypted by your browser before they are sent to the website. They also appear to have a method of creating an encrypted paper copy of your wallet so you can restore your wallet if the website disappears.</p>
<p>Even so, it seems you're still potentially vulnerable if you access your wallet from an infected computer (i.e. through keystroke loggers and more advanced logging techniques).</p>
<p><strong>What other risks are there in using such a service?</strong></p>
<p>Note: I have not used Strongcoin, and have no affiliation with them in any way.</p>

CC BY-SA 3.0
2013-04-24T23:35:53.157Z
Related, April 2013 incident: http://bitcoinmagazine.com/ozcoin-hacked-stolen-funds-seized-and-returned-by-strongcoin/
Stephen Gornick
<wallet><attack><e-wallet><wallet-security>
What are the risks of using Strongcoin.com as an online wallet?
Highly Irregular
# What are the risks of using Strongcoin.com as an online wallet?

(Asked by: username_0 on 2011-12-15)

[Strongcoin](https://strongcoin.com/) claims it is "The Safest way to store your Bitcoins. The only Bitcoin e-wallet service that's not vulnerable to security breaches. Your Bitcoin keys are encrypted in the browser."

As I understand it, with their system your private keys are essentially encrypted by your browser before they are sent to the website. They also appear to have a method of creating an encrypted paper copy of your wallet so you can restore your wallet if the website disappears.

Even so, it seems you're still potentially vulnerable if you access your wallet from an infected computer (i.e. through keystroke loggers and more advanced logging techniques).

**What other risks are there in using such a service?**

Note: I have not used Strongcoin, and have no affiliation with them in any way.

**Tags:** wallet, attack, e-wallet, wallet-security

> **Comments:**
> **username_1**: Related, April 2013 incident: http://bitcoinmagazine.com/ozcoin-hacked-stolen-funds-seized-and-returned-by-strongcoin/  

---

## 3 answers

### Answer by username_2 on 2011-12-20. Score: 14

I'm the owner of StrongCoin.

Ben has detailed just about every possible risk with StrongCoin. You can read about how we handle server security in our [FAQ](https://www.strongcoin.com/blog/frequently_asked_questions).

It's not in my interests to defraud my customers, I'm pretty easy to trace and I don't fancy having angry users knocking on my door

So with Bitcoin like cash there are risks with storage, I lost a wallet.dat which spurred me to build StrongCoin.

StrongCoin is a convenient way to store and spend Bitcoins. I recommend you hold your spending Bitcoins in StrongCoin and use an [offline mechanism](https://www.strongcoin.com/blog/the_easiest_way_to_create_secure_offline_bitcoin_transactions) for your savings or high value holdings.

> **Comments:**
> **username_3**: Ian I'd like to do a lecture for my class on bitcoin covering strong wallet. Could you review my lecture after it is finished for improvements or addtions?  

---

### Answer by username_4 on 2012-02-17. Score: 5

I agree with the answers of both Ian and Ben. Let me point out that I like the StrongCoin service. As former CEO of Hushmail, I would like to add some relevant information because Hushmail is like an encrypted wallet for email and we faced a similar set of issues.

The other risks that need to be addressed with services such as StrongCoin are:

1. Spoofed applet - The browser-based java applet that is served to you should be published as source code so that users may compile it themselves and/or seek review from cryptography peer-review groups, as Hushmail did. You should also have the ability to store locally a version of the trusted applet for your own use. This is important if you still want to use the service after StrongCoin receives a court order to serve compromised applets to certain persons suspected of 'something'.
2. Weak password - Since the private keys are stored on StrongCoin servers encrypted and protected with a passphrase, you would be subject to brute force attacks from anyone that gained access to the server data so a strong password is essential.
3. Keyboard sniffers and cameras - You are only as secure as your physical surroundings so be aware of keyboard loggers (hardware and software) and cameras that may have been inconspicuously placed above your computer work station to capture your passphrase.
4. Legal and physical jurisdiction - The StrongCoin servers are subject to court orders of the jurisdiction in which they they are located. If StrongCoin is legally domiciled in a different jurisdiction than the physical servers, then that country's courts could also have jurisdiction. Both jurisdictions should be examined for their privacy and data protection statutes.

Also see:

(a) <http://www.hushmail.com/about/technology/security/>

(b) <http://www.schneier.com/essay-191.html>

> **Comments:**
> **username_6**: What Java applet are you talking about? I haven't seen one on neither Strongcoin nor My Wallet.  
> **username_4**: I am referring to the javascript code that Ben discusses in his first paragraph above. If the original javascript code were published somewhere for these online wallets, they could be vetted by the crypto community and the published source could serve as a check against a malicious wallet operator (or a good wallet operator acting under a court order/subpoena from law enforcement).  
> **username_5**: As this is client side javascript, the source code is already published with every view of the page.  

---

### Answer by username_7 on 2020-12-22. Score: 0

In addition to the points made in the other answers on this page, **the key derivation function used by StrongCoin to derive an AES encryption key from the user's password (which is then used to encrypt the user's private wallet key) is very weak.**

[This page](https://strongcoin.com/blog/decrypting_private_keys_generated_with_strongcoin) on StrongCoin's blog explains how users' private wallet keys, which are encrypted by StrongCoin's client-side javascript, can be decrypted using `openssl`, by way of the following command:

```
openssl enc -d -aes-256-cbc -in key.txt -a -k password

```

This `openssl` command is notorious for using a very weak key derivation function - i.e. just one round of MD5 hashing, as explained [in this post on security.stackexchange.com](https://security.stackexchange.com/questions/29106/openssl-recover-key-and-iv-by-passphrase/29139#29139) in 2013. To quote from the accepted answer:

> **This is quite weak!** Anybody who knows how to write code on a PC can
> try to crack such a scheme and will be able to "try" several dozens of
> millions of potential passwords per second (hundreds of millions will
> be achievable with a GPU). If you use openssl enc, make sure your
> password has very high entropy! (i.e. higher than usually recommended;
> aim for 80 bits, at least). Or, preferably, don't use it at all;
> instead, go for something more robust (GnuPG, when doing symmetric
> encryption for a password, uses a stronger KDF with many iterations of
> the underlying hash function).


---

