15
votes
Accepted
Why is Stellar on HTTP and not HTTPS?
As you can see from the developer documentation, SDF does serve both Horizon instances through HTTPS.
When they say "RESTful HTTP API" it's to signal to developers that they use standard web ...
- 1,386
12
votes
Accepted
How to find the public key given only the seed?
Java Script
let StellarSdk = require("stellar-sdk");
let keypair = StellarSdk.Keypair.fromSecret("S...");
console.log(keypair.publicKey());
http://stellar.github.io/js-stellar-sdk/Keypair.html#....
- 3,868
11
votes
Accepted
How do I use the flag: authorization revocable
Haven't tested it myself, but here is quote form Stellar documentation:
Controlling asset holders
As an anchor, you can mark the issuing account AUTHORIZATION REQUIRED. With this setting, the ...
- 6,886
9
votes
Accepted
What is the Safest Way for Users to Sign Transactions Over the Web?
You are right, the scheme you described is far from being secure. User should sign the transaction on the client-side.
I can see three options for your case:
Build and sign the transaction in the ...
- 6,886
8
votes
Accepted
How many public addresses can be generated for a stellar public key?
1) As per Orbit Len's comment: Stellar uses ED25519 keypairs. There is only one public key that matches the given secret key. Source
2) Here is an example for bitcoin and someone trying to guess your ...
- 442
8
votes
Accepted
Securing Stellar node
TL;DR: only expose port 11625 on stellar-core.
Stellar Core Port 11625
Port 11625 of stellar-core must be exposed outside your network to allow it to communicate with peers.
The stellar-core ...
- 1,080
7
votes
How many public addresses can be generated for a stellar public key?
Going by the actual source code, there are 32 secret keys that generate the exact same public key -- only 251 bits of the seed hash are used in the elliptic curve exponentiation. For signing, another ...
- 1,947
7
votes
Accepted
Storing Secret Key for Smart Contracts
Generally speaking, if you're owning all the accounts and everyone trusts you then I'd suggest adding your own private keys to the accounts instead of taking theirs.
If you add your own key that is ...
- 396
7
votes
Accepted
Can an inflation pool be hacked to send all weekly lumens to 1 address? [third-party]
In short, yes. The inflation pool wallet can be hacked just like any other crypto wallet can be hacked. You would need the private key. Thus, the security implications are the same and it is up to the ...
- 1,009
7
votes
How does Stellar solve the problem of "double-spending"?
Double spending in Stellar is dealt with at two layers:
SCP guarantees that the "blockchain" (ledger chain really) is made of only one chain, and doesn't have forks (in other systems temporary forks ...
- 2,203
7
votes
How does Stellar solve the problem of "double-spending"?
The digital currency is an Asset on Stellar's public ledger only. You can not download it, clone it and spent it again. It exists as a balance on an account that can be transferred to another account ...
- 1,300
5
votes
Web Wallet requirements
Something you could do is to host the site directly on github pages so users can inspect the code as well as clone the wallet and run it locally.
A project that has implemented this is Ark whose ...
- 922
4
votes
Accepted
How to find a secure wallet
The security considerations for choosing a Stellar Wallet is same as the ones you consider when storing other crypto assets.
Make sure you install an open source client/wallet whose code is audited ...
- 221
4
votes
Accepted
Secured ways to check if a node is up working?
You can get the latest ledger header from horizon, for instance the following command would work from the command line:
curl 'https://horizon.stellar.org/ledgers?limit=1&order=desc'
Obviously ...
- 1,221
4
votes
Can the Horizon Server be hacked?
That's a broad question. How can you guarantee that Google Mail is not hacked? Potentially, any service can be hacked, and not necessarily on the server side. For example, DNS hijacking allows hacker ...
- 6,886
4
votes
Accepted
What is asymptotic security and why does Stellar, but not POW exhibit this?
As a practical matter, SCP's asymptotic security follows from the fact that it depends only on digital signatures (and hash functions) for security, and that these can be tuned to resist arbitrarily ...
- 1,221
3
votes
Accepted
What tool is used for browser interactivity?
Right now I believe SEP-7 is the best answer. It defines a link format that an app such as yours can use to create a transaction that you'd like a user's wallet to sign and submit. The flow is this:
...
- 176
3
votes
What is asymptotic security and why does Stellar, but not POW exhibit this?
You're mixing up two completely different concepts here. One is about transaction finality, and the other is about resistance to sybil attacks.
POW has probabilistic finality, since there's always ...
- 1,947
3
votes
Accepted
How does the Stellar Network prevent an actor with small quorum intersection from halting the network
tl;dr: the rest of the network can still reach consensus and it will not halt the network.
In your case, there is only one non-compromised validator. Any node outside the set of compromised nodes ...
- 1,080
3
votes
Accepted
Why does the high level threshold level for quorum have to be above 66%?
This is by analogy with symmetric Byzantine agreement protocols (in which everyone has the same quorum slices). You need any two quorums to intersect at an honest node. If your threshold is 2/3 or ...
- 1,221
3
votes
How do 2 people sign a transaction from different clients?
Maybe this flow is working on the backend process. You create transaction with signed rootKeypair and save transaction object somewhere else waiting for person B to signed that transaction ?
- 31
3
votes
Accepted
Inflation pool ledger protocol
If the start of the hash displayed by the ledger is the same of the one displayed on laboratory, then is just a visualization bug
You can check here
Just to be safe, after you sign a transaction, ...
- 1,009
2
votes
Can an inflation pool be hacked to send all weekly lumens to 1 address? [third-party]
All of the concerns you have are the same for any wallet this is not just confined to an inflation pool.
Making the website separate from the wallet helps keep the two separate and reduces the ...
- 619
2
votes
Accepted
Formal Verification of Smart Contract in Stellar
The official testnet's Horizon is a free tool to test your code. It involves no real costs to you.
The Laboratory is another good testing tool with a good UI, and you can use it without coding ...
- 1,527
2
votes
Accepted
Do sequential secret seeds create a security risk?
That's alright as long as your Master Secret Seed is truly random.
Remember that thousand of seeds is still a drop in the ocean of all possible keys.
Even though seeds will be sequential - you won't ...
- 938
2
votes
Best Practices for Securing Secret Keys in a Tier-3 DLT App Built on Stellar
There is a catchphrase that says: Not your keys, not your coins. Private keys should only be known/managed/used by their owner and nobody else.
If you want it the trustless crypto way: Pass an ...
- 2,534
1
vote
How can I preg_match a Stellar public address in PHP?
A stellar address begins with "G", followed by "[A-D]" and then 54 characters from this base32 alphabet "[ABCDEFGHIJKLMNOPQRSTUVWXYZ234567]", so:
preg_match('/^G[ABCD]{1}[...
- 2,534
1
vote
Storing Secret Key for Smart Contracts
If you can avoid taking the secret key from the user it will reduce your liability and the user will be likely to trust your application or service.
SEP-0007 introduces a custom URI Scheme web+...
- 1,080
1
vote
How is Stellar network protected against spam? Are there scalability solutions?
I have no clue for the 2nd question. For the first one...
Horizon server submits transactions to the Stellar network. This server does not let you to sustain 1000tx/s from the same IP for more than ...
- 1,527
1
vote
Is it possible to run Stellar over Tor?
It may be feasible - Stellar uses TCP for its peer discovery protocol.
- 392
Only top scored, non community-wiki answers of a minimum length are eligible