6

So last week I went on live.ether.camp and clicked the "Get Address" button then entered a seed phrase which I saved and still know.

Then it told me my address was ready. I then bought 78 ethers on shapeshift.io and had that sent to my address on ether camp.

Since then I tried withdrawing some of my ether by sending them to another address I created with a chrome extension, but the transaction never goes through; it gets stuck saying "Please wait while we are processing your transaction". I left this running overnight and it stayed at the same screen and didn't send. All the identification the "transfer balance" form asks for is the SEED, which I believe should be the one I entered to create my account? My question is, did I make a mistake somewhere? Should I be able to withdraw from an account created on live.ether.camp and has anyone else been able to?

Perhaps I did this the wrong way and my balance can't be withdrawn but I just want to know if that is the case or not.

Screenshots of how I made my account and attempted to withdraw:

http://imgur.com/a/xHRAa

  • Reddit thread for reference (no answers there yet) : reddit.com/r/ethtrader/comments/45cm2x/… – tayvano Feb 12 '16 at 5:07
  • You sent nearly $1000 worth of ether to a service you didn't know anything about, without testing it first?! – Nick Johnson Apr 13 '16 at 15:21
  • Hello same difficulty I'm using the live.ethercamp wallet to send same action Not using Mist I saw so many complaints of transactions not going through. – user2312 May 26 '16 at 21:05
2

Follow that one:

https://www.youtube.com/watch?v=DLSyP_pE4gY

be sure you are entering the receiver address with no 0x prefix

  • Thank you for your response. I entered the receiver address without the 0x 20 minutes ago and clicked the preview button after pasting my SEED, and the transaction still says "Please wait while we are processing your transaction . . ." My friend has the same problem and I am 100% certain I am using the same seed as when I created the account because I am just copying and pasting it from a document I saved it in when I created my account. – Daniel E Feb 12 '16 at 20:30
  • How is that different from the youtube example ? – Roman Mandeleil Feb 13 '16 at 2:58
  • The difference is that the transaction never finished. The ethers in my account on live.ether.camp never sent to the recipient address that I entered. – Daniel E Feb 14 '16 at 1:37
  • if you enter the receiver correctly and the signature correctly, no reason the tx will not go through. I myself have done several like this today – Roman Mandeleil Feb 14 '16 at 1:48
  • I was actually able to successfully send from my account today. I'm not sure what the problem was before, but I've got it working now. Thank you for your help! – Daniel E Feb 14 '16 at 6:49
2

Use Keccak-256 hashing algorithm with your seed. You can install it from npm or use online tools (but don't trust your account after exposing you seed elsewhere online). To avoid problems use shorter seed in the future. I don't know exact limit but expect 50 chars to be fine.

2

Brain wallets are dangerous.

As a blockexplorer, ether.camp is very useful with features such as showing the VM trace: this author adores those features and have posted screenshots of ether.camp on this site. However, it is the opinion of this author that withdrawal and brainwallet features of ether.camp are dangerous and should be avoided. This point cannot be emphasized enough (for those who do wish to use these features, it is wise to limit it for testing purposes with small amounts of wei only, and even if you do this on morden.ether.camp, you have to be mindful of replay attacks.) This feature is also suspect because part of the security of brainwallets is being able to use long seeds, but they don't allow that: How to produce a hash from a very long seed on ether.camp?

That said, I'll explain why people have run into difficulties with withdrawing from ether.camp. When you paste in an address with '0x', ether.camp would cut off the last 2 characters of the address. So when you remove the '0x', the last 2 characters of the address are not there, and you have to add them back manually.

1

You can get the private key to output on live.ether.camp by...

  1. Generate a new wallet (any wallet)

  2. View the wallet

  3. Right click and say inspect element

  4. Go to console.

  5. type ethUtil.sha3(" your_seed_here ").toString('hex')

  6. This will output your unencrypted private key.

  7. Import that key into Mist and transfer ALL funds to a new wallet ASAP.

Here is how to import this raw key into Mist: How to import a plain private key into geth or Mist?

edit: they have updated to use 2031 hashes instead of 1. Updated code for step #5 is:

s='YOUR_SEED_HERE';for(i=0;i<2031;i++){s=ethUtil.sha3(s)}console.log(s.toString('hex'))

Don't let their "our keys are now more secure" intentions fool you. Hashing this does next to nothing.

Mist/geth hashes 262,144 times + salt which takes about 5-10 to decrypt in browser.

Adding additional rounds to your key/passwords only makes it harder to discover which encryption method + how many times hashed in large data dumps. As everyone knows how many times the key has been hashed, it doesn't make anything anymore safe in this case.

If you stretch the keys enough using various methods, the amount of time it takes to test a single increases enough to not be worthwhile for an attacker. This is the case with Mist. 5-10s per key is very different than 5-10ms. However, 2031 is not enough to make any significant difference for the ether.camp keys.

Honestly, the fact that keys are labeled sha3 but actually Keccak and the "security by obscurity" that applies to all Ethereum (in the grand scheme of things) will protect you better than 2031 hashes. It won't protect you against any attacker who specifically want your ETH...which are the attacker you need to worry about.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.