<p>My Wallet's warning for watch-only addresses ("<em>You will not be able to send bitcoins from this address without later providing the private key</em>") can be a bit confusing.</p>

<p>It's possible to specify an address and watch it. And it's possible to import a private key to be able to use the associated address as if it was generated with the My Wallet client.</p>

<p>But these two features are really unrelated. You don't "send out of a watch-only address", rather you import a private key thus making it no longer a watch-only address.</p>

<p>So the question is really whether My Wallet's "Import Private key" feature is safe. I don't have the official answer, but I see no reason why it shouldn't follow the same policy as other keys - the private key is encrypted in your browser (and as needed, decrypted and used to sign) and never leaves your computer in plaintext. If that's true, it is safe as the server never sees your plaintext key.</p>

CC BY-SA 3.0
2013-02-03T16:25:59.073Z
Thank you Meni. You were the only person who actually made a real effort to answer my question. My concern is that even though the private key reaches blockinfo's server in encrypted form, it probably is stored. And whatever is stored on a server, becomes much less secure, for example could be decrypted using a brute-force attack with a comprehensive dictionary. So I think the way to go with this would be to use a watch only address while I do not use it at all to transfer the funds out. As soon as any amount is transferred out, I consider such a wallet compromised and I will have to create a
Vitro
CC BY-SA 3.0
2013-02-03T16:49:36.667Z
@Vitro: You choose which password to use for the encryption. If you use a strong password (random and long enough that you have to write it down) brute-forcing is impossible. Cracking the encryption algorithm is conceivable, but you'd know in advance when weaknesses are found. The main vulnerability would be a virus on your machine that steals the key/password. I'd say it's pretty safe - but I agree it's a bit less safe than when the key exists only in a properly made paper wallet.
Meni Rosenfeld
CC BY-SA 3.0
2013-02-03T16:49:56.417Z
@Vitro: It looks like your comment was cut off, you can write the rest in a new comment.
Meni Rosenfeld
CC BY-SA 3.0
2013-02-03T21:52:59.750Z
Oops, my bad, I didn't notice that the message was cut off when I converted it from an answer to a comment. The complete last sentence was: "As soon as any amount is transferred out, I consider such a wallet compromised and I will have to create a new watch only address, and move all remaining funds to it."
D.H.
CC BY-SA 3.0
2013-02-02T18:41:48.917Z
2013-02-02T18:41:48.917Z
Meni Rosenfeld
<ol>
<li><p>blockchain doesn't record on their server any private key, or any key at all; or, they do, but they are encrypted and they can't access them, only you can</p></li>
<li><p>"watch only" addresses are public keys only anyway</p></li>
</ol>

CC BY-SA 3.0
2013-02-02T01:42:34.613Z
Lohoris. Thanks for the reply,but I am looking for a real answer. Also please do not assume that I'm a noob if I'm asking a question. I am well aware that the "watch only" wallets are based on public keys, but if you would have read my question more closely you would notice that the question is about the usage of such a wallet to send BTCs , i.e. private key is used for the transaction of the BTCs out of the "watch only" wallet.

Would anyone else please, answer my question?
Vitro
CC BY-SA 3.0
2013-02-02T01:49:56.477Z
He actually answered your question, if anyone would not tell his public asymmetric cryptography would have been broken a long time ago. The whole point of a public key is to be guess what public, hence your address is safe when you give it to anybody.
Gopoi
CC BY-SA 3.0
2013-02-02T04:15:59.230Z
When a "watch only" wallet is used to send the BTCs a user must provide a private key, hence the private cryptographic key is exposed during the transaction. My question was and remains: will this private key be stored/cashed by the website.
Vitro
CC BY-SA 3.0
2013-02-02T06:29:44.467Z
No you NEVER provide the private key when doing a transaction, you provide the public key and then SIGN with the private key.
Gopoi
CC BY-SA 3.0
2013-02-02T09:07:26.793Z
@Vitro I do not assume anything: you asked a noob question, so you got a noob answer. Please don't assume you know something if you don't, sorry.
o0'.
CC BY-SA 3.0
2013-02-02T18:36:08.827Z
@Lohoris: You and Gopoi have completely missed Vitro's point.
Meni Rosenfeld
CC BY-SA 3.0
2013-02-02T18:46:36.183Z
@Gopoi: The OP was talking about "upgrading" a watch-only address to a managed address by importing the private key. The interface warns that such importing will be needed if one ever wants to send from the watched address. He wanted to be sure that the key he imported never leaves the browser unencrypted.
Meni Rosenfeld
CC BY-SA 3.0
2013-02-01T22:34:25.757Z
2013-02-01T22:34:25.757Z
o0'.
<p>Blockchain.info wallet is opensource <a href="https://github.com/blockchain" rel="nofollow">https://github.com/blockchain</a></p>

<p>So you can verify it yourself, that it is indeed not storing your private key.</p>

CC BY-SA 3.0
2013-02-02T19:35:57.160Z
It's better to verify in the JS that the private key never leaves his computer.
Meni Rosenfeld
CC BY-SA 3.0
2013-02-02T18:58:05.527Z
2013-02-02T18:58:05.527Z
KoKo
<p>Does anyone know if it is safe to use blockchain.info "Watch Only" addresses?
The real question is what happens after I perform a transaction - sending BTCs out of such a wallet. Will blockchain.info record the "offline" private key used for such transaction somewhere on the server?</p>

CC BY-SA 3.0
2013-02-02T01:52:58.247Z
Why would it store the private while you only gave the public key?
Gopoi
CC BY-SA 3.0
2013-02-02T04:18:12.317Z
When a "watch only" wallet is used to send the BTCs a user must provide a private key, hence the private cryptographic key is exposed during the transaction. My question is: will this private key be stored/cashed by the website.
Vitro
CC BY-SA 3.0
2013-02-02T06:23:01.050Z
What? Never ever a private key is compromised during a transaction NEVER. You sign the transaction with the private but the STAYS private. You miss understanding public key cryptography.
Gopoi
CC BY-SA 3.0
2013-02-02T06:28:45.263Z
If you use "watch only" it is only to see the balance nothing is compromised EVER.
Gopoi
<blockchain.info><blockchain-wallet-app>
Is blockchain.info storing paper wallet (offline) private keys?
Vitro
# Is blockchain.info storing paper wallet (offline) private keys?

(Asked by: username_0 on 2013-02-01)

Does anyone know if it is safe to use blockchain.info "Watch Only" addresses?
The real question is what happens after I perform a transaction - sending BTCs out of such a wallet. Will blockchain.info record the "offline" private key used for such transaction somewhere on the server?

**Tags:** blockchain.info, blockchain-wallet-app

> **Comments:**
> **username_1**: Why would it store the private while you only gave the public key?  
> **username_0**: When a "watch only" wallet is used to send the BTCs a user must provide a private key, hence the private cryptographic key is exposed during the transaction. My question is: will this private key be stored/cashed by the website.  
> **username_1**: What? Never ever a private key is compromised during a transaction NEVER. You sign the transaction with the private but the STAYS private. You miss understanding public key cryptography.  
> **username_1**: If you use "watch only" it is only to see the balance nothing is compromised EVER.  

---

## 3 answers

### Answer by username_2 on 2013-02-02. Score: 6

My Wallet's warning for watch-only addresses ("*You will not be able to send bitcoins from this address without later providing the private key*") can be a bit confusing.

It's possible to specify an address and watch it. And it's possible to import a private key to be able to use the associated address as if it was generated with the My Wallet client.

But these two features are really unrelated. You don't "send out of a watch-only address", rather you import a private key thus making it no longer a watch-only address.

So the question is really whether My Wallet's "Import Private key" feature is safe. I don't have the official answer, but I see no reason why it shouldn't follow the same policy as other keys - the private key is encrypted in your browser (and as needed, decrypted and used to sign) and never leaves your computer in plaintext. If that's true, it is safe as the server never sees your plaintext key.

> **Comments:**
> **username_0**: Thank you username_2. You were the only person who actually made a real effort to answer my question. My concern is that even though the private key reaches blockinfo's server in encrypted form, it probably is stored. And whatever is stored on a server, becomes much less secure, for example could be decrypted using a brute-force attack with a comprehensive dictionary. So I think the way to go with this would be to use a watch only address while I do not use it at all to transfer the funds out. As soon as any amount is transferred out, I consider such a wallet compromised and I will have to create a  
> **username_2**: @username_0: You choose which password to use for the encryption. If you use a strong password (random and long enough that you have to write it down) brute-forcing is impossible. Cracking the encryption algorithm is conceivable, but you'd know in advance when weaknesses are found. The main vulnerability would be a virus on your machine that steals the key/password. I'd say it's pretty safe - but I agree it's a bit less safe than when the key exists only in a properly made paper wallet.  
> **username_2**: @username_0: It looks like your comment was cut off, you can write the rest in a new comment.  
> **username_3**: Oops, my bad, I didn't notice that the message was cut off when I converted it from an answer to a comment. The complete last sentence was: "As soon as any amount is transferred out, I consider such a wallet compromised and I will have to create a new watch only address, and move all remaining funds to it."  

---

### Answer by username_4 on 2013-02-01. Score: 3

1. blockchain doesn't record on their server any private key, or any key at all; or, they do, but they are encrypted and they can't access them, only you can
2. "watch only" addresses are public keys only anyway

> **Comments:**
> **username_0**: Lohoris. Thanks for the reply,but I am looking for a real answer. Also please do not assume that I'm a noob if I'm asking a question. I am well aware that the "watch only" wallets are based on public keys, but if you would have read my question more closely you would notice that the question is about the usage of such a wallet to send BTCs , i.e. private key is used for the transaction of the BTCs out of the "watch only" wallet.  Would anyone else please, answer my question?  
> **username_1**: He actually answered your question, if anyone would not tell his public asymmetric cryptography would have been broken a long time ago. The whole point of a public key is to be guess what public, hence your address is safe when you give it to anybody.  
> **username_0**: When a "watch only" wallet is used to send the BTCs a user must provide a private key, hence the private cryptographic key is exposed during the transaction. My question was and remains: will this private key be stored/cashed by the website.  
> **username_1**: No you NEVER provide the private key when doing a transaction, you provide the public key and then SIGN with the private key.  
> **username_4**: @username_0 I do not assume anything: you asked a noob question, so you got a noob answer. Please don't assume you know something if you don't, sorry.  
> **username_2**: @Lohoris: You and username_1 have completely missed username_0's point.  
> **username_2**: @username_1: The OP was talking about "upgrading" a watch-only address to a managed address by importing the private key. The interface warns that such importing will be needed if one ever wants to send from the watched address. He wanted to be sure that the key he imported never leaves the browser unencrypted.  

---

### Answer by username_5 on 2013-02-02. Score: 0

Blockchain.info wallet is opensource <https://github.com/blockchain>

So you can verify it yourself, that it is indeed not storing your private key.

> **Comments:**
> **username_2**: It's better to verify in the JS that the private key never leaves his computer.  

---

