Thanks for the detailed explanation. I am very interested in this.
So is it also possible to grab that wallet file created by sparrow and copy it into the same directory on another computer? Or do i need to use the Export option for that?
Thanks for the detailed explanation. I am very interested in this.
So is it also possible to grab that wallet file created by sparrow and copy it into the same directory on another computer? Or do i need to use the Export option for that?
Either should work. You can copy the file directly from ~/.sparrow, IIRC, or export in Sparrow format.
Will try that. Is there any risk involved in moving files around that cointain xpub data? Obviously not going to upload it to the cloud but it will live on multiple devices
Leaking your XPUB is a privacy risk. Whoever gets that knows every address that belongs to your wallet: past, present and future. They donât necessarily know those addresses belong to *you* personally, but they know the addresses go together.
The most likely way youâll leak your XPUBs is by connecting to an Electrum server, or a vendorâs wallet that collects this data.
When you start up Sparrow, itâll ask how you want to connect to your node. Options include Bitcoin Core, private Electrum server, and public Electrum server. For maximum privacy and speed, itâs best to run your own Electrum server. Iâve used ElectrumX and Fulcrum. Iâve heard good things about electrs but I havenât tried it.
If your wallet has previously been connected to some other service, like, say, your hardware vendorâs app, then your XPUB has in all likelihood already been leaked. The only way to keep this private is to set up your own wallet from scratch and ensure that your wallet software (Sparrow) only connects to a private Electrum server (preferred self-hosted).
Awesome infos. You helped a ton đđȘ
Planning to spin um my own node soon (hardware is on the way). But i didnât know that i have to set up a completely new seed then
Well, you donât *have to* set up a new seed. Only if youâre concerned about privacy.
Iâm pretty extreme on the seed security front. Personally, I advocate rolling oneâs own seeds offline. That way you know for sure the entropy couldnât have been known by anyone else. But like I said, this is an extreme position. If you use a passphrase with your hardware-wallet-generated seed youâre probably fine.
Iâm also an advocate of multivendor multisig for similar reasons. But here again it increases the complexity of the setup.
Wow! Ton of information here indeed!
I mean. Using the XPUB to generate a watch-only wallet (for instance on Blockstream green) comes in handy I think. But indeed⊠it âleaksâ all your addresses to some software you donât own. However, that software being open source is âsaferâ?
If you donât control the Electrum server you connect to, you canât know what logging or monitoring theyâre using.
For example, they could be running a free and open source Electrum server implementation like Fulcrum, but put it behind a reverse proxy that logs all traffic.
The software running on your wallet and/or hardware signing device canât protect you against a logging third-party server.
So if youâre running your own node and connect your wallet to electrs, you should be good to go then. Only problem is, I canât run my node at the moment đ
Thanks again for your huge help đ
I thought through this and have another question:
When i set up a completely fresh keysore because i am afraid my xpub was leaked and then send the funds to the new keystore, arenât they still trackable by the entity that knows the previous xpub? canât they just link the transaction to the new adress? đ€
Most likely yes⊠I mean, with logical thinking people could assume that youâre sending it to a new wallet you still own
From the public blockchain perspective, the viewer knows that the coins got sent to a new address, but not that that address belongs to the same entity as the sender. They may infer this, but they canât know it for sure.
Also, while the viewer knows all the addresses from the previous wallet, at most they can infer one address of the new wallet. Every transaction after that is a mystery. So IMO, youâre better off, even if all you do is shift to a new wallet with a keystore you rolled yourself.
There are other things you can do to mildly improve privacy on chain, such as avoiding exact values in either fiat or Bitcoin terms. Avoiding payments of, say $100 exactly or 0.001 BTC etc.
On-chain privacy is its own field of study. People who are serious about it use CoinJoins to obfuscate UTXO history. Sparrow implemented support for Whirlpool, the backend to Samuraiâs CoinJoin implementation, but I havenât tried it.
Personally, I would say that rolling your own seeds and connecting to your own node is more important.
I see. Thanks for the good explanation đđ«đ
I heard about coinjoins but i havenât tried it yet because i also heard of people having trouble sending their btc to exchanges after a coinjoin. Not that i plan to cash out, i know what i have, but maybe someday i want to exchange a bigger amount to buy a house.