From the ground up, bittr was built to offer the easiest possible way to save bitcoin straight into your own wallet. Our aim was to make the sign-up process as easy as possible and not ask for any more data than strictly necessary, hence our convenient four-step sign-up process as you know it:

4 step sign up process of bittr

The reason bittr didn’t implement extended public keys from the start

Initially, we believed there isn’t much difference whether your weekly deposits all arrive to the same bitcoin address or to a new address for each deposit. After all, in both cases bittr still knows where the bitcoin is going so from a privacy perspective between the customer and bittr, there are no improvements. However, by implementing the support for extended public keys, only bittr knows how much is in your bitcoin piggybank (which we knew anyways), as opposed to anyone who gets to learn the bitcoin address you gave during sign-up with bittr! It also makes the sign-up process slightly more complicated than it currently is, which is why we’ve left the default option to enter a single address and added a button for advanced users to enter an extended public key.

Why is it better to sign-up with an extended public key?

While asking for a single address makes our sign-up process quick and easy, it has one major drawback; it harms your privacy and security! As explained here, it is generally unadvised to re-use an address for two specific reasons. First of all, as the bitcoin blockchain is publicly accessible data, if an attacker were to find out a specific address belongs to you, the attacker would know exactly how much is in your bitcoin piggybank that you’ve set up with bittr as all the bitcoin are in the same address. Furthermore, in order to spend your bitcoin, a signature of your private key belonging to the address of your bitcoin piggybank will be on the blockchain. While this doesn’t pose an immediate threat on the security of your bitcoin, it may one day in the future as most cryptographic algorithms only have a limited lifetime. One day, the hashing algorithms of bitcoin might be broken, and your private keys may be obtained through brute-forcing the key with the signature information. It is therefore strongly recommended not to receive bitcoin to an address from which you have previously spent bitcoin. In simple terms, it’s almost like an old-fashioned piggybank which you can’t use anymore after you break it open to spend the money inside of the piggybank!

Lessons learned from implementing extended public key support

First and foremost, a bitcoin address is simple! We can easily verify whether the address is valid, and all three types of addresses are supported by bittr (legacy, P2SH or bech32). An extended public key on the other hand can come in all sorts of forms and shapes, starting with xpub, ypub or zpub. In theory, the initial letter (x,y,z) is supposed to indicate what kind of addresses should be generated:

xpub6CZcSujFdNJkp…: 16fMWsNo5RTtAN4fkrUxdRz7QpV5uVFf5G
ypub6Y9SS2p2P9DMa…: 3D7nhpkNJjYAjGnQbAcoixSsF6ocU5ovHK
zpub6sAr1xVNaq8iu…: bc1qeudj5k6rg6p9x69pgs6rrhw4wgywjgw675s336

Unfortunately, while testing our initial implementation, we figured out that Trezor and Ledger derive addresses in a different way. On both the Trezor and Ledger device, it’s extremely easy to create an additional account to your wallet and only use this account for transactions with bittr! Therefore, we’ve pre-generated the configuration options so you only have to paste in the xpub and select the Trezor/Ledger option! If you use a different wallet, you can also manually select the type of addresses you’d like us to generate, as well as the exact derivation path. We will show you the first three addresses that we’re able to generate based on your preferences so you can verify whether these addresses match with the ones shown in your wallet.

Since bittr is a financial industry company, we are required to keep your data for 7 years, as well as an additional 5 years should you wish the cancel our relationship. Because of this we wanted to be extremely careful when it comes to your privacy! Improper use of extended public keys may lead to exposing all of your historical and future bitcoin transactions. We have therefore implemented a tool to check whether the extended public key you’re about to submit to bittr has been used before. If the key has been used, we will not store it and you cannot continue the sign-up process, in the interest of your own privacy.

Can I use my extended public key to update my current deposit code?

The personal deposit code you’ve previously created during sign-up with bittr is tied to the bitcoin address you’ve signed up with and cannot be changed after the deposit code has been used. However, we strongly urge you to register again and use our new extended public key functionality to improve your privacy and security!

Are you having difficulties, or did you spot a mistake we’ve made in the process? Do let us know!