Electum allows you to open many wallets at once, all of them seem to open the same settings window which shows the same electrum server, so I guess all instances use the same electrum server to query the blockchain BUT does each of them use the same tor circuit?
Because if that is the case, whoever runs the server can see that all those wallets are used by the same end IP, hence probably by the same person.
So, privacy decrease.
Its hard to say. To find out you can install onioncircuits from jessie-backports. You can find instructions for adding backports to the sources.listhere
Whonix 14 (upcoming release) onioncircuits is installed by default
Probably not unless they designed it to explicitly support Tor and documented that somewhere.
Make a separate snapshot for each identity to be absolutely safe. Also backup all keys so your accounts don’t get destroyed if you accidentally rollback or corrupt a snapshot.
I followed this guide How-to: Use Electrum Bitcoin Wallet in Whonix ™ and installed electrum from debian stretch-backports repository, but it installs version 3.1.3 which is old version, the latest version is 3.3.3. I tried to install the latest version following the instructions from electrum site, but it needs python 3.6, and the installed version of python is 2.7. I found some guides which show how to install python 3.6 from debian testing repository, which i haven’t tested, but will this break whonix security?
Since there is not possible to install the latest 3.3.3 version via apt, what can happen if i use version 3.1.3? The warning from electrum site is:
Warning: Versions of Electrum older than 3.3.3 are vulnerable to a phishing attack 1, where malicious servers are able to display a message asking users to download a fake version of Electrum. Do not download software updates from another source than electrum.org. In order to reach users of vulnerable versions, we have started to use the same vulnerability, and to direct them to electrum.org.
Which means that if i don’t download fake version of electrum i will be safe. Is there any other risks of using version 3.1.3?
As long as you use APT to install/update electrum (sudo apt-get install electrum // sudo apt-get update && sudo apt-get dist-upgrade) this vulnerability will not affect you.
As far as any other risks, there are always risks and/or unknown vulnerabilities.
Yes, but updating electrum using apt will not be possible until debian include version 3.3.3 in its repository, correct? Which i think will not happen with the current debian stretch version, because electrum 3.3.3 needs python 3.6, and debian stretch do not use python 3.6.
It is always a pleasure to read you and I really appreciate the help & time you provide when somebody needs some support
Well, I’m still over there, reading & learing but you are right I haven’t posted for some time.
I’m gonna to have a look on your documentation but just to be sure, you wanted to point out the Electrum (3.2.3-1) version and not Electrum-3.3.2 which I am allready using ?
Correct. That was a typo. (my bad) Its electrum-3.2.3-1 installed from Debian unstable (sid). Keep in mind the older versions are vulnerable to the fishing attack vulnerability but that will not be a problem as long as you update your packages using APT.