I can not install Electrum - Bitcoin Crypto Currency Wallet

Support
161

Hello, i want install last electrum version, because

Warning: Versions of Electrum older than 3.3.3 are vulnerable to a phishing attack, where malicious servers are able to display a message asking users to download a fake version of Electrum. Do not download software updates from another source than electrum.org. In order to reach users of vulnerable versions, we have started to use the same vulnerability, and to direct them to electrum.org.

But with following this instruction Electrum Bitcoin Wallet possible install only 3.1.3 version.
If following official instruction

Install dependencies:
sudo apt-get install python3-setuptools python3-pyqt5 python3-pip
Install Electrum:
sudo python3 -m pip install https://download.electrum.org/3.3.3/Electrum-3.3.3.tar.gz#egg=electrum[fast]

as i understand, it’s not secure.

So what i can do?

162

Installation on Whonix XFCE 15.0.0.0.9 after following the directions in the wiki shows that the AppImage cannout be mounted, because of “Fuse”, and gives this link for further information.
“FUSE · AppImage/AppImageKit Wiki · GitHub”

The electrum appimage ran after running “sudo apt-get install fuse”, but the question remains is this secure?

163

I would also like to get involved with this project, I think it is amazing! Should I update the wiki after finding the solution to this, so anyone else coming along has an easier time? Can anybody submit changes to the wiki?

2 Likes
164

feel free to do so , but make sure you dont damage the content and try your best with organizing things. Thank you :upside_down_face:

cc @0brand @torjunkie

165

Thanks for your interest. Yes anyone can help out. When coming up with instructions, make sure you include appimage signature verification steps so users are not running a tainted version. Feel free to post on our wiki edits mega-thread for input on contributions:

1 Like
166

Hey HulaHoop, thank you for packaging everything up for us regular people. I believe software such as this will become very mainstream in the future, as people start to become aware of the extent of mass-surveillance.

HulaHoop - do any security precautions come to mind with installing “fuse”? I’m not seeing much from my searching.

167

Yes like anything you would install. Fuse is a package available from Debian repos so you should be able to retrieve it safely by following the instructions on the page you linked to.

sudo apt install fuse

Next you need to adjust group permissions because the fuse package interacts with filesystems in the kernel. (also in that guide)

168

Hey HulaHoop, thanks for the reply.
I am still learning, so sorry if these are stupid questions. Hopefully soon I will become proficient and involved.
I did not understand what those further commands did, so after doing “sudo apt install fuse”, I tried to run the appimage, and it started up just fine. Is this a security risk to not do the further commands listed, since it is interacting with the file system in an unsecure way?

Also of note, there is a further option of extracting the appimage if you do not want to install fuse, appending “–appimage-extract” to the command. I did this and it outputted a bunch of commands, and created a new folder, but still would not run. The folder was called “squashfs-root” and inside contained a bunch of files.

169

These are the commands for adding fuse:

sudo apt install fuse
sudo modprobe fuse
sudo groupadd fuse

user="$(whoami)"
sudo usermod -a -G fuse $user

when using the command

user="$(whoami)"
sudo usermod -a -G fuse $user

Does the username have to be in the quotations?
Does the username require the money symbol ($) in front?

Thanks in advance

170

No, but you’ll need to run the rest of them for it to work properly I think.

Yes i has to be quoted. The $ symbol means it is a variable - meaning it should take on whatever the username of your system happens to be set to.

171

Command substitution allows the output of a command to replace the command itself. Command substitution occurs when a command is enclosed like this:

What $(whoami) is doing is running whoami. You could run that command yourself in a terminal.

Instructions for verification of electrum appimage are already included here:

172

@userapp3

How are you making out with updating electrum for Whonix 15? If you would like help with anything please let me know.

0brand,

Electrum wiki maintainer.

1 Like
173

@userapp3 thanks for the reply bro! so I was able to get it installed and working, but I am curious why I had to do the steps I outlined above. Do you think that poses any type of security risk to install those packages? As far as I am aware, appimages are self contained and dont need any dependencies, so I am hesitant to use it because of the fact that I had to install dependencies.

I don’t have enough knowledge to help contribute, but I am working on increasing my skill set so I can contribute to this amazing project

174

Hi userapp3

Sorry for the late reply. For the appimage to function, package fuse Debian -- Details of package fuse in buster must be installed on the system. If you run the following command in Whonix-Workstation 14 you will see that fuse is installed.

sudo apt --list installed | grep fuse

So fuse is ok to install in Whonix 15 as long as you use apt to install the package.

If fuse is not installed by default in Whonix 15 instructions to do so will be needed in the Whonix Electrum wiki. :wink: :wink:

1 Like
175

Merged most existing threads of electrum into this thread to cleanup the forum and to notify everyone interested in electrum.

Instructions on how to install electrum in Whonix were recently heavily simplified and can be found here:

In near future, electrum will be installed by default in Whonix. (Already done in testers repository.)

176

I love Electrum but I think the Console feature, (easily accessible from the View → Console menu) poses an unnecessary security risk.

It allows running any arbitrary python code that can affect not only the wallet but the whole system. A one liner can easily download and execute malicious scripts. I tested a simple PoC of it.

Electrum treated this concern by adding a warning displayed at the first launch of the Console.

Can we do anything else about it, perhaps using Apparmor?

177

I think it goes without saying if any user runs malicious code on there system (in Whonix konsole… or any application) they run the risk of system compromise and / or de-anonymization (if run from whonix-gateway). I’m willing to make a bet Whonix devs could come up with a few one liners that would be a disaster if run from whonix-gateway (for de-anonymizaion) or whonix-workstation (for system compromise). We can’t prevent stupid.

178

The Terminal / Whonix Konsole and specifically root on Terminal granting absolute power over the system is I think a very well understood and accepted concept even for the average user.

I can come up with such one liners as you mentioned. No need to post them here, someone might actually run those by mistake.

But a bitcoin wallet easily allowing the user to run any script that affects the whole system isn’t a naturally accepted behaviour. A bitcoin wallet should have absolute power over the content of the wallet, not over the rest of the system. That should belong in some kind of developers addition perhaps, not on the mainstream software.

Isn’t that the whole point of Apparmor and similar restrictive methods?

I am not aware of any other GUI application that (will now be) installed by default in Whonix that has the same power with the same ease (where no software download is expressly done by user, no obvious installations etc).

179

Can anyone figure out how to use either,

  • a newly created, OR
  • the existing firejail profile /etc/firejail/electrum.profile

in combination with electrum AppImage?

Related, previous work with upstream firejail: GitHub - netblue30/firejail: Linux namespaces and seccomp-bpf sandbox

180

I see “average” users run any code snippets they find on various forums to fix application x. They’ll do just about anything they are told that will “fix” their problem

I’ not sure how someone could mistakenly copy/paste + enter? The problem is users (average or otherwise) don’t follow best practices i.e. If you don’t know what you are doing, don’t do it.

Locking down any application is a good idea. Locking down an app just because a user might shoot themselves in the foot not so much. Whonix can’t protect users from mistakes such as this (shooting in the foot).

Locking down electrum would be great because its popular app. The point i’m trying to make is:

  • foolish user behavior, by itself, is not good reason to divert dev resources.
  • Sandboxing app that is easilty compromised by malware, yes good idea.
  • Sandbox from phishing attacks, no. This falls under follow best practices or you’ll learn a hard lesson.
2 Likes