2 paper wallets - same password. Still Secure? Also, how do you secure your BTC?

DannyHamilton

legendary

Activity: 3528

Merit: 4945

Quote from: Chris! on December 09, 2015, 06:39:22 PM

If I were to have a computer offline how would I send funds back and forth to it though?

https://bitcoinarmory.com/tutorials/armory-advanced-features/offline-wallets/

Quote from: Chris! on December 09, 2015, 06:39:22 PM

Don't you need data to actually do a transaction?

The concept is to have your normal computer online with a "watching only" copy of the wallet. This copy doesn't have any private keys, it only knows the bitcoin addresses.

Since it knows all the bitcoin addresses that you control, it is able to update your balances from the blockchain and let you know when you've received transactions. Since it doesn't have any private keys, malware and hackers won't be able to gain access to your bitcoins from this computer.

Then you have a second computer that is never connected online. This computer stores your private keys. Since it has the private keys, it can sign transactions. It doesn't have access to the blockchain, so it doesn't know what your balances are.

You can create an unsigned transaction with the online computer. Then save that transaction to media that can be carried to the offline computer (such as USB, or SD card). Then you can use the offline computer to sign the transaction, and save the signed transaction to media that can be carried mack to the online computer. Then broadcast the transaction from the online computer.

Quote from: Chris! on December 09, 2015, 06:39:22 PM

I'm a little confused about that.

https://bitcoinarmory.com/tutorials/armory-advanced-features/offline-wallets/

Quote from: Chris! on December 09, 2015, 06:39:22 PM

Could I just somehow use an old computer and I USB?

Yes.

ranochigo

legendary

Activity: 3038

Merit: 4418

Crypto Swap Exchange

Quote from: Chris! on December 09, 2015, 06:39:22 PM

-snip-
If I were to have a computer offline how would I send funds back and forth to it though? Don't you need data to actually do a transaction? I'm a little confused about that. Could I just somehow use an old computer and I USB?

For paper wallets, if possible, I would actually recommend getting a spare and clean phone that has Cyanogenmod rom in it. Cyanogenmod is opensourced and hence it is easy to look through for any possible exploits placed in deliberately.

You can generate a raw TX on the online computer and sign it with the private key on the offline computer then broadcast it on the network. You would require two computer, one offline and one online. This way, your private key is never directly exposed to the internet. The online computer can be used to script a raw transaction to be transferred to the offline computer to be signed with the private key. A raspberry Pi would work fine.

TERA

hero member

Activity: 728

Merit: 500

2.

-generate very long random seed and write it down using pen and paper
-hash the seed with one or more mental passwords to form your private key
-compute wallet address from private key and put it wherever you want
-put away the paper in a safe place
-destroy all evidence of the private key and the computations
-do this all offline in tails. Restart when you are done

-go online and send 0.01btc to the wallet address to make sure it works
-send the rest

-when ready to take coins OUT of cold storage, find the paper and hash it with your mental passwords to form the private key again and import that into a secure wallet, or sign transactions offline.

Chris!

legendary

Activity: 1382

Merit: 1123

The reason I was asking is because I made some paper wallets with a Ubuntu Live USB and not connected to the Internet. I made 3 wallets but now I realised I only made 1 password so all 3 must have the same password. I wouldn't want to punch/scan the private key to spend the funds, put in the password only to end up having a keylogger!

I think it's a very smart idea to have a machine completely offline but for the time being I'll be using paper wallets. Mainly for the price.

If I were to have a computer offline how would I send funds back and forth to it though? Don't you need data to actually do a transaction? I'm a little confused about that. Could I just somehow use an old computer and I USB?

Mickeyb

hero member

Activity: 798

Merit: 1000

Move On !!!!!!

Quote from: ranochigo on December 08, 2015, 10:07:32 AM

Quote from: cellard on December 08, 2015, 09:57:28 AM

Quote from: ?? on ??

- Even your computer in safe condition it'll better if you changed your password periodically or atleast having different password for each

My ultra paranoid method to save my btc :
- using offline wallet
- scanning pc with antivirus every 3 days to prevent being keylogged
- using Anti-keylogger software to prevent being keylogged
- those software that i mentioned above must premium/pro, dont try to use cracked software
- dont install cracked software

What anti keylogger software are you using? I have Malwarebytes Anti Malwaware Premium and Comodo as firewall, what else would I need to be safe? Im considering installing MSI (Microsoft Security Essentials) I heard it was a decent antivirus and it's free. Ideally I would use a Linux machine but a lot of software I need to use is Windows only.

Zemana AntiLogger. Used to have it, don't know how effective it did because I never had any keylogger.

Microsoft Security Essential isn't the best. IMO, Malwarebytes does a very good job. The main thing to keep safe is to just avoid downloading suspicious program. Till now, I haven't got hacked before.

I used Zemana for quite a while and it seemed that it worked fine for me, at least I never caught any keyloggers. Now this doesn't mean anything of course, I might have just been lucky.

All of the above programs don't matter that much for the paper wallets, since the paper wallets if done properly, should be created and printed on a machine that has never been online.

ThunderThomas

full member

Activity: 210

Merit: 100

fastdice.com The Worlds Fastest Bitcoin Dice

I think that paper wallet is secure, but you need to save some where save.
And carefull with water and fire.

Patatas

legendary

Activity: 1750

Merit: 1115

Providing AI/ChatGpt Services - PM!

First off all,the passwords don't really matter as much as the private keys. You could have same passwords for multiple accounts as far as you remember them.Secondly its not advised to use the same password for multiple wallets as if your one wallet is somehow hacked,it opens the doors for every other wallet.

As far as your storing bitcoins is concerned I personally use hardware cases to store my bitcoins as cold storage.Here are a few hardcore wallets you can use.I use trezor.

https://www.bitcointrezor.com/

Case is new and I like it too
https://choosecase.com/

ranochigo

legendary

Activity: 3038

Merit: 4418

Crypto Swap Exchange

Quote from: cellard on December 08, 2015, 09:57:28 AM

Quote from: ?? on ??

- Even your computer in safe condition it'll better if you changed your password periodically or atleast having different password for each

My ultra paranoid method to save my btc :
- using offline wallet
- scanning pc with antivirus every 3 days to prevent being keylogged
- using Anti-keylogger software to prevent being keylogged
- those software that i mentioned above must premium/pro, dont try to use cracked software
- dont install cracked software

What anti keylogger software are you using? I have Malwarebytes Anti Malwaware Premium and Comodo as firewall, what else would I need to be safe? Im considering installing MSI (Microsoft Security Essentials) I heard it was a decent antivirus and it's free. Ideally I would use a Linux machine but a lot of software I need to use is Windows only.

Zemana AntiLogger. Used to have it, don't know how effective it did because I never had any keylogger.

Microsoft Security Essential isn't the best. IMO, Malwarebytes does a very good job. The main thing to keep safe is to just avoid downloading suspicious program. Till now, I haven't got hacked before.

cellard

legendary

Activity: 1372

Merit: 1252

Quote from: ?? on ??

- Even your computer in safe condition it'll better if you changed your password periodically or atleast having different password for each

My ultra paranoid method to save my btc :
- using offline wallet
- scanning pc with antivirus every 3 days to prevent being keylogged
- using Anti-keylogger software to prevent being keylogged
- those software that i mentioned above must premium/pro, dont try to use cracked software
- dont install cracked software

What anti keylogger software are you using? I have Malwarebytes Anti Malwaware Premium and Comodo as firewall, what else would I need to be safe? Im considering installing MSI (Microsoft Security Essentials) I heard it was a decent antivirus and it's free. Ideally I would use a Linux machine but a lot of software I need to use is Windows only.

gkv9

legendary

Activity: 1246

Merit: 1000

!!! RiSe aBovE ThE StoRm !!!

You can have as many paper wallets as you have addresses in one single wallet in any software or online...
So, you can even choose to just cut out your coins into small pieces, distribute them in many paper wallets and save them at a safe place...

calkob

hero member

Activity: 1106

Merit: 521

Quote from: Chris! on December 07, 2015, 08:33:29 PM

Question 1.
Let's say I have paper wallet "X" and paper wallet "Y". I also have a wallet for spending: wallet "Z"

I want to transfer 0.01Bitcoins from "X" to "Z" spend 0.005BTC and from there send the left over 0.005BTC to "Y".
‎
When I took the funds out of "X" I used the password "12345abcde" (which is BIP38 encrypted) and now that the 0.005BTC are in "Y" the password (which is BIP38 encrypted as well) is also "12345abcde. If I had malware and/or a keylogger are my funds at risk because the passwords are the same?

Question 2.

What ultra-paranoid method do you use to store large amounts of BTC? Why do you trust it and how is it 99.999% safe?

I'm just being ultra paranoid because when I started with Bitcoins I got hacked in under 24h. Mind you I was using the Blockchain.info android wallet so that was pretty newbie of me Wink

.

I know some people here: https://bitcointalksearch.org/topic/time-to-bust-a-myth-paper-wallets-are-less-secure-than-normal-encrypted-wallets-1013586 feel that paper wallets aren't actually as secure as they might seem. Just because you use a Ubuntu Live CD/USB doesn't mean if you had malware on your Windows system it won't also be able to infect the Ubuntu Live CD/USB.

This is very top-notch ultra-paranoid stuff and I'd love to hear your expert opinion on the subject!

I would say "yes" to question 1. if an attacker knows about address Y then i'm sure they would try the password that they have captured with there keylogger or screen grab.

in regards to question 2. I created addresses and keys offline and store them on a usb which has never been online and backed up on paper wallets, which i watch only on blockchain.info.

Amph

legendary

Activity: 3248

Merit: 1072

ultra paranoid method would definitely be some online method, but for me i would simply go this route

buying a completely new motherboard and ssd install my safe OS copy, maybe linux if you do not own a secure version of w7(one that you bought...)

and make a backup from there

NorrisK

legendary

Activity: 1946

Merit: 1007

The password only comes into play when a hacker steals your actual wallet.dat file. If they somehow got their hands on your privatekey (which is protected by the password in your wallet.dat file) somehow else, your password does not matter anymore, as they have the private key.

Offline machine, random generation of a string of words, one way usb (hardware wallets), is probably the best way to protect your wallets.

Kprawn

legendary

Activity: 1904

Merit: 1074

If I may ask, why would you want to use the same pass phrase for the BIP38 encrypted paper wallets? I write the pass phrase in a format only I know, on the back of these paper wallets and each of them is

different. The formatting allow me to have the password in plain sight, but still not recognisable.

The whole idea with this, is to make it difficult for other people to guess your pass phrase. Do you use the same password for every site you register on the internet? Not a good practice at all. Roll Eyes

ranochigo

legendary

Activity: 3038

Merit: 4418

Crypto Swap Exchange

Quote from: Chris! on December 07, 2015, 09:17:40 PM

Quote from: EcuaMobi on December 07, 2015, 08:38:17 PM

As long as you created correctly the paper wallet Y then it should be safe. The BIP38 encryption is just an extra security. The main protection is the fact it was generated randomly and it never touched the Internet. If the SW you used to create it was compromised or deficient, or if you exposed the keys to Internet in any way then of course you wouldn't be safe.

My paranoid method to store almost all of my BTC is using a deck of cards: https://bitcointalksearch.org/topic/android-deck-wallet-v10-store-your-bitcoins-in-a-deck-of-cards-811397

100% offline
True physical randomness
Immune to key-loggers

Thanks for your insight! I didn't think it would make sense that I could make 100 different paper wallets with the same password if it's a big security risk. I just wanted to make sure.

That looks like an interesting method. I'll have to read more about that app you've developed!

It can be a security risk if someone have access to your paper wallets physically or if you used them all on the same device for signing and broadcasting the TX. To use the funds in the address, the attacker requires an encrypted version of your private key and your password.

bitbaby

hero member

Activity: 812

Merit: 1000

My ultra paranoid method is that I just use a different machine which stays off-line always for all my bitcoins cold storage, I use encrypted paper wallets and Electrum and keep my funds distributed among different paper wallets and Electrum addresses.

And the most important part is keeping various back-ups of paper wallets and a backup of Electrum seed in a way that only I can decipher it. And also making sure that the Paper wallets are safe from any sort of damage and degradation.

DannyHamilton

legendary

Activity: 3528

Merit: 4945

If you truly want to be paranoid about it, you should probably have a separate computer that is NEVER connected to the internet. Then use that offline computer for signing transactions (with keys from paper wallets or otherwise), and transport the signed transaction to an online computer for broadcast to the bitcoin network.

I think both the Armory and Electrum wallets make this possible. I'm not sure if any other wallets have implemented offline signing.

RealBitcoin

hero member

Activity: 854

Merit: 1009

JAYCE DESIGNS - http://bit.ly/1tmgIwK

Quote from: Chris! on December 07, 2015, 08:33:29 PM

Question 2.

What ultra-paranoid method do you use to store large amounts of BTC? Why do you trust it and how is it 99.999% safe?

I'm just being ultra paranoid because when I started with Bitcoins I got hacked in under 24h. Mind you I was using the Blockchain.info android wallet so that was pretty newbie of me Wink

.

I know some people here: https://bitcointalksearch.org/topic/time-to-bust-a-myth-paper-wallets-are-less-secure-than-normal-encrypted-wallets-1013586 feel that paper wallets aren't actually as secure as they might seem. Just because you use a Ubuntu Live CD/USB doesn't mean if you had malware on your Windows system it won't also be able to infect the Ubuntu Live CD/USB.

This is very top-notch ultra-paranoid stuff and I'd love to hear your expert opinion on the subject!

I wrote a guide about this
https://bitcointalksearch.org/topic/delete-1263429

Probably in a bunker underground. Or throw the offline PC you generated the random number on into a black hole, that should be safe Cheesy

Chris!

legendary

Activity: 1382

Merit: 1123

Quote from: EcuaMobi on December 07, 2015, 08:38:17 PM

As long as you created correctly the paper wallet Y then it should be safe. The BIP38 encryption is just an extra security. The main protection is the fact it was generated randomly and it never touched the Internet. If the SW you used to create it was compromised or deficient, or if you exposed the keys to Internet in any way then of course you wouldn't be safe.

My paranoid method to store almost all of my BTC is using a deck of cards: https://bitcointalksearch.org/topic/android-deck-wallet-v10-store-your-bitcoins-in-a-deck-of-cards-811397

100% offline
True physical randomness
Immune to key-loggers

Thanks for your insight! I didn't think it would make sense that I could make 100 different paper wallets with the same password if it's a big security risk. I just wanted to make sure.

That looks like an interesting method. I'll have to read more about that app you've developed!

EcuaMobi

legendary

Activity: 1876

Merit: 1475

Quote from: Chris! on December 07, 2015, 08:33:29 PM

Question 1.
Let's say I have paper wallet "X" and paper wallet "Y". I also have a wallet for spending: wallet "Z"

I want to transfer 0.01Bitcoins from "X" to "Z" spend 0.005BTC and from there send the left over 0.005BTC to "Y".
‎
When I took the funds out of "X" I used the password "12345abcde" (which is BIP38 encrypted) and now that the 0.005BTC are in "Y" the password (which is BIP38 encrypted as well) is also "12345abcde. If I had malware and/or a keylogger are my funds at risk because the passwords are the same?

As long as you created correctly the paper wallet Y then it should be safe. The BIP38 encryption is just an extra security. The main protection is the fact it was generated randomly and it never touched the Internet. If the SW you used to create it was compromised or deficient, or if you exposed the keys to Internet in any way then of course you wouldn't be safe.

Quote from: Chris! on December 07, 2015, 08:33:29 PM

Question 2.

What ultra-paranoid method do you use to store large amounts of BTC? Why do you trust it and how is it 99.999% safe?

My paranoid method to store almost all of my BTC is using a deck of cards: https://bitcointalksearch.org/topic/android-deck-wallet-v10-store-your-bitcoins-in-a-deck-of-cards-811397

100% offline
True physical randomness
Immune to key-loggers

Topic: 2 paper wallets - same password. Still Secure? Also, how do you secure your BTC? (Read 1117 times)