Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.212.47 as permitted sender)
	client-ip=209.85.212.47; envelope-from=etotheipi@gmail.com;
	helo=mail-vw0-f47.google.com; 
Message-ID: <4EBBF7A7.8030708@gmail.com>
Date: Thu, 10 Nov 2011 11:11:19 -0500
From: Alan Reiner <etotheipi@gmail.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US;
	rv:1.9.2.23) Gecko/20110921 Thunderbird/3.1.15
MIME-Version: 1.0
To: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Content-Type: multipart/alternative;
	boundary="------------040906040300090304080306"
Subject: [Bitcoin-development] Wallet encryption issue
Precedence: list

This is a multi-part message in MIME format.
--------------040906040300090304080306
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Sorry guys, I just realized I should've posted this to the dev list 
first, before/instead of putting it on the forums.

    https://bitcointalk.org/index.php?topic=51474

*I still have some of my private keys in plaintext. *I would guess that 
BSDDB sometimes will "overwrite" data by just discarding a pointer to 
the old data, and writing the replacement to a new location within the 
file.  In that case, examining the file with a BSDDB library tool is not 
going to find this problem.  You'll have to examine the raw binary file 
as I did.  Instructions for verifying this problem are in the post.

Can someone please verify that this is a real problem?  (and should we 
maybe remove my post until there's a remediation plan?  This is problem 
the best kind of problem to disclose after it's fixed)
-Alan



--------------040906040300090304080306
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
  </head>
  <body bgcolor="#ffffff" text="#000000">
    Sorry guys, I just realized I should've posted this to the dev list
    first, before/instead of putting it on the forums.&nbsp; <br>
    <br>
    &nbsp;&nbsp; <a class="moz-txt-link-freetext" href="https://bitcointalk.org/index.php?topic=51474">https://bitcointalk.org/index.php?topic=51474</a><br>
    <br>
    <b>I still have some of my private keys in plaintext.&nbsp; </b>I would
    guess that BSDDB sometimes will "overwrite" data by just discarding
    a pointer to the old data, and writing the replacement to a new
    location within the file.&nbsp; In that case, examining the file with a
    BSDDB library tool is not going to find this problem.&nbsp; You'll have
    to examine the raw binary file as I did.&nbsp; Instructions for verifying
    this problem are in the post.<br>
    <br>
    Can someone please verify that this is a real problem?&nbsp; (and should
    we maybe remove my post until there's a remediation plan?&nbsp; This is
    problem the best kind of problem to disclose after it's fixed)<br>
    -Alan<br>
    <br>
    <br>
  </body>
</html>

--------------040906040300090304080306--