We have a little animation and that was cute. In this segment of "Down the
Rabbit Hole" I'm going to ask me the question that you haven't asked me yet
which is... Hey Andreas if I'm doing e-commerce or receiving
payments online doesn't that put my keys at risk? If I put my keys on a server
can't that server be hacked? So now let's talk about a really interesting and very
important feature that exists in crypto currencies but also in cryptography
which is asymmetric cryptography or public/private key systems. Public key
cryptography is a mechanism invented in the 1970s that allows you
to have two keys: a public key and a private key. You can produce the
public key from the private key in order to receive, in the case of cryptocurrency
payments, or messages and the person who has your public key cannot unlock your
funds or your messages. You can then share that comfortably. Bitcoin addresses
are effectively a public key that is wrapped up in some hashes but otherwise
they're just the public key. So what happens when you're trying to do
ecommerce? Well if you simply give someone a Bitcoin address the main risk
you have is that if you keep reusing that [same] Bitcoin address other people can
see who has paid you and when, and how many Bitcoin you have, or have received
through that Bitcoin address. And they can also then trace where you send it
afterwards; so that creates some privacy risk. But no one can steal your Bitcoin
or crypto just because they have an address or public key. Now if you wanted
to give a fresh address to everybody who visits your
website for example to run e-commerce or an online billing system or an invoice
system or something like that you'd probably use some software software.
Software might include something like BTCPay Server or some kind of integration into
Electrum or some other capability like that. Now what all of these systems have
in common is that they do not store your private keys online. In fact they don't
even need your private keys at all! Instead what you give these programs is
what is called an extended public key or XPUB. An extended public key
is basically the the root key of a hierarchical deterministic (HD) wallet or
usually the sub key for a specific account within a hierarchical
deterministic wallet. So if you're using an HD wallet which is probably what
you're using if you've got a mnemonic phrase, a 24 word seed as some people
call it, to initialize your wallet. Whether it's a software wallet on your
smartphone or hardware wallet that is building a hierarchical deterministic
wallet and you can export the XPUB, the extended public key, from one of your
accounts. If you then load that external extended public key on to some kind of
e-commerce site or web software that can generate invoices or manage e-commerce
payments, that software can then generate addresses to receive payments from the extended
public key -- unique Bitcoin addresses or Ether addresses or whatever other currency -- for
every single incoming payment, cart, or customer. It keeps track of all of
those. Now when someone pays those [invoices] your website doesn't have the
private keys to unlock them so even if someone hacks your website they can't do
anything. They might be able to see all of the addresses you've generated and
what payments you've received on those addresses because they can steal your XPUB
and generate the same addresses, but they can't take your money.
Now the beauty of this effectively, if you think about it, is that you could
have a hardware wallet or even a completely offline wallet where you've
generated a mnemonic phrase on a hardware wallet and you've exported the
XPUB and then you've wiped that hardware wallet and just kept the
mnemonic phrase back up in a safe. And effectively when someone pays you the
keys that allow you to spend that money is sitting in your
safe -- safely away from prying eyes -- and the only thing on the website is an
extended public key. And that's how we can do e-commerce without using a hot
wallet on a server which is extremely vulnerable. Whether you're doing invoices
and just copying a single Bitcoin address or you're doing a full-blown
e-commerce site where you're serving thousands and thousands of customers, you
do not have to risk your private keys with a hot wallet. And that segment is
"Down the Rabbit Hole" where I ask myself the question you haven't yet asked me. Thank you!
If you enjoyed this video, please SUBSCRIBE, LIKE, & SHARE. All of my work is
shared for FREE, so if you want to support it
join me on patreon.com/aantonop
Thank You!