The Silent-Vault wallet client is built as an application for Java webstart. This means that it can be installed and invoked from within your browser, but runs in a JVM (Java virtual machine) independent of your browser. After you've installed it, you can start it from the icon installed on your desktop without needing to use your browser at all.
Running a client which handles secure data (such as vouchers representing money, and the keys needed to access them) only outside of a web browser is very important. A browser is a wonderful tool for obtaining and executing content, but it is also a highly insecure sandbox which can easily be compromised by downloaded malware, malicious javascript, hostile extensions or plugins, or even bugs in the browser itself (which is a very complex program). Although in-browser wallets are arguably more convenient than external applications, particularly when making payments on websites, we believe that where money is concerned security is more important than convenience.
The Silent-Vault wallet communicates with the network using XMPP (aka Jabber), an extensible protocol designed for instant messaging applications. This means that the wallet client can operate without reliance on this or any other website, except for downloads and updates. Instructions for installing the client on your computer follow below.
Install the Java Runtime Environment
First, you will need the Java JRE installed on your system. If you do not already have it, please see this page. Version 7 or higher is required (latest version 7u181+ recommended).
Install the Silent-Vault Wallet Client
To download and install the client, please use this link:
Note: in order for this link to work, your browser must associate the '.jnlp' file extension with the javaws (Java WebStart) application. This association is normally set up automatically when you install Java on your computer.
As usual when installing third-party software, you will see some security warnings, which you will need to click past. You will need to accept the "Silent-Vault" project software signing key, which will also be used to authenticate future updates. The client download consists of two Java archive library files, silentvault-client.jar and svcsupport.jar. The former contains code written by us, while the latter contains supporting code written by several other open source projects. Because the latter archive seldom changes, the distribution is broken in two so that automatic updates will be faster. Every time you start your client, an update check will be made. Updated files will download automatically, after authenticating our signing key on the archive(s).
NB: you can manually verify the signature and integrity of a downloaded signed JAR file by using the command:jarsigner -verify <jarfile>
Special Security Step for Windows Users
As of Java-7u51, released 14th January, 2014, Oracle Corp. in its "wisdom" has decreed that RIAs (rich internet applications, such as ours) which are not signed by an "official" Certificate Authority (CA) are blocked from running under the default security settings. Since the only real source for Java on Windows is Oracle, unfortunately this affects you. We believe this policy to be seriously misguided, because:
- CA-signed site certificates which can be used to sign software are much more expensive than mere web content certificates used for https access, and the application process is much more invasive. This is burdensome to open source projects both for cost reasons, and also (as in this case) in regards to developer privacy.
- Site certificates are frequently obtained by third party intermediaries (such as web hosting or DNS providers) and resold to customers as part of a package. This implies that the signing CA often knows little or nothing about the actual website operator anyway.
- The CA security model is seriously flawed to begin with. In particular, an unexpired certificate signed by any recognized CA will tacitly be accepted by the browser without notice to the user, even if the certificate changes. (NB: you can install plugins such as Certificate Patrol to detect unexpected cert changes.)
- As a consequence, anyone capable of producing or obtaining a site certificate, from any recognized CA in the world (of which there are hundreds), can perpetrate a MITM attack without the user being the wiser.
- As international hero Edward Snowden has amply demonstrated, the most likely attacker (particularly for a crypto-currency wallet application!) is unquestionably governments. Any major government plausibly has access to a "captive CA" within their jurisdiction that they could simply order to provide them with a bona fide certificate for any site or purpose they wished. Therefore, perversely, the only way to prevent MITM attacks is to avoid using certificates from official Certificate Authorities.
- Self-signed certificates, coupled with fingerprint checking, are therefore best. But for software run on users' computers, ultimately the only valid way to earn trust is to publish the application source code.
We have chosen to use a CA-signed certificate for this informational website, but utilize a "self-signed" certificate to sign the Java JAR files for the client web-app. We have also published all source code which runs on your computer, and invite you to examine it (see the Client Files file gallery) or build the client yourself.
Unfortunately Oracle (a large US company) is obviously in bed with the certificate mafia, or the US government, or both. As the saying goes, it is what it is.
Here is what you can do to allow the Silent-Vault client to install and run with the latest Java version on your Windows system:
- Open your Control Panel or System Preferences, and click on Java.
- Select the tab labeled "Security."
- Click on the Edit Site List button. (This button was added in 7u51 and will not appear in previous versions.)
- Click on the "Add" button near the bottom.
- In the dialog box which pops up, enter our website: 'https://silentvault.com/'. Do not include the single quotes, make sure that you include the trailing slash ('/'), and specify https, not http.
- Click OK.
- Click Continue on the security warning dialog.
- Try the installation link again. It should now install and run.
This process is described in more detail here. A version including screenshots can be found here.
You will still see an annoying popup warning each time you start the application. In previous versions, and on other platforms, it is possible to check a box once to silence this warning for good. But not on Windows. Evidently someone thinks that Windows users are too stupid to know what they're doing. You should probably be offended. 
Special Note for Windows7 Users
On Win7, the Oracle JRE 7u51 was bugged. It will tell you, even after you've done all of the above, that self-signed apps are prevented from running on an "outdated" version of Java. (Despite the fact that update 51 was the latest version of Java at the time.) It appears that Oracle has fixed this bug as of Java 7u65. But if you see this error, you will need to set your security slider to Medium in order to run the Silent-Vault application. XP, Vista, and Win8.1 work correctly with the above instructions.
Mirrors
At present, we have the client download mirrored in only one place. The good people at Voucher-Safe.org have agreed to mirror our application here:
Install from Voucher-Safe.org mirror
Note that whichever site you use for the install is also the one that your installed app will ping for updates at each invocation. (Windows users note: if you install from a mirror, you must add the mirror's https URL to your exception list, as per the "Special Security Step" section above.) To avoid confusion, we suggest that you do not install the client multiple times from different locations. Other mirrors may be added in future, using the same project signing key.
Running the Client
Once you have the wallet client up and running, you will need to connect to the network. (It will attempt a connection to the default gateway at startup, unless you turn this feature off in Edit/Preferences.) At present there are three XMPP server gateways defined, through which you can connect. These are specified in the signed JNLP file for the RIA, and therefore cannot be changed without downloading an update. These "OFS gateways," which access Openfire XMPP servers, are shown in the Connection/OFS Gateways menu as follows:
- ofs.silentvault.com:5233 - live network access via a PageKite on this website.
- pks.vm.to:5233 - live network access via a backup PageKite at pks.vm.to.
- digitalcash.to:5233 - live network access via a backup PageKite at digitalcash.to.
- ofs.oto.money:5233 - live network access via a backup PageKite at oto.money
- ofs.cryptowealth.com:5233 - live network access via a backup PageKite at cryptowealth.com
- 172.31.254.114:5233 - another backup network access at this IP, via a private VPN (must be connected to use).
- sds.vm.to:5233 - a backup network access Pagekite at sds.vm.to.
- ofs.travelcash.cc:5233 - a separate live network OFS run by TravelCash
- ofs.voucher-safe.org:5233 - access to the TEST demo network, hosted at voucher-safe.org.
There is also a manual entry option; but the above is an exhaustive list of current access points.
If you simply wish to play around with the client, we suggest that you connect to the test network first (@voucher-safe.org). This is analogous to the Bitcoin TestNet, in that no actual value circulates there. You can however create wallets and mint your own vouchers of several types, via the "Exchanges" tab. When you are ready to deal with real value, connect to the live network (@vouchi.com) and create one or more wallets there. More detailed instructions are available on our sandbox page.
For more details and instructions on running the client, please see the pages found under the Documentation menu heading above.
If you would prefer our wallet client embedded into a fully functional Jabber chat client, please have a look at our Spark-based client.