bitcoin/bitcoin.org — pull request #663 by saivann (2014-11-30 02:31:24+00:00)
Title: Revisit blockchain.info listing

Blockchain.info received a relaxed review by being in the first wallets added on bitcoin.org. For basic fairness with other wallets, I think it should be revisited with reasonable criterias at least as demanding as other wallets.

After some review and research, I have found several important issues summarized below.

**Bugs and losses**: BC.i has suffered from concerning issues during the past year (e.g. iOS denomination bug, weak key stretching, sizeable number of users losing funds, and more issues I haven't verified yet)

**Backup/Password Security**: BC.i hasn't adopted security features included in other wallets which are slowly becoming standard (e.g. BIP32, random passphrases, backup on setup, rotating addresses, 2FA by default).

**Transparency**: Source code of the app has been reset or not updated repeatedly, making bitcoin.org often relay the false claim that the app is open-source.

To be fair, each of these issues would have blocked or delayed listing BC.i if the wallet was submitted today. Accordingly, I think the logical next step to incentivize security and reduce risks for the user is to raise the bar for BC.i like other wallets. I suggest 7 days for BC.i to review/comment the list of issues below (@zootreeves), then suspend BC.i listing for at least 60 days. After this period, the wallet could be re-submitted for review.

Note: This pull req is **not** for bashing BC.i, I know they are having a bad image lately and not interested to feed that. If anything, I hope this can give them an opportunity to show they can address these issues.

In the absence of critical feedback, this pull request will be merged on December 6th.

--

Some issues for which I think fixes would be reasonable in the future:

BC.i's security relies on strong passwords (way more than a custodial wallet due to bruteforce attacks), yet BC.i's wallets are stored online (BC.i, email, Google drive, dropbox) and:

- Don't use truly random mnemonic passphrase, instead rely on users' passwords known to be weak.
- Allow weak passwords such as 0000000000.
- Password strength warnings are optional (and blue).
- Password strength information makes false claims (126 years to crack 123456789123456789).
- It is unclear to me yet if the new key stretching is secure enough.

BC.i does not remind or require the user to enable 2FA.

BC.i currently still has unpublished source code for their Android app (4.0.17 on Google play, 4.0.12 on GitHub).

BC.i does not enable HSTS (seems to me this could be a simple change to reduce MITM attacks).

--

Some issues that may not meet future requirements:

The wallet does not rotate addresses.

The wallet does not uses BIP32 wallets.

--

Some issues that may require to be fixed to avoid downgrading the control score:

BC.i does not let the user backup and access their wallet offline.

BC.i does not encourage or tell the user to download or print a copy of their wallet during setup.

BC.i requires recurrent manual backup, and automated backups is not set by default.

(BIP32 again could fix those issues altogether)