Topic: Air gapping (Read 544 times)

If you are under threat of attack, i.e. live in a 100-unit apartment where god knows who is your neighbor or your neighbors' guests, believe me, you can be in trouble. If you live in a single-family home and your neighbors and your area is a very safe area where strangers don't move, then to my mind, software airgap alone can't be an issue. But as o_e_l_e_o pointed, software level airgap will always be less safer than hardware level airgap and I suggest you to stick with his advice.

Answer to your questions:
1. If your computer has never been connected to internet, you won't have software malware unless your manufacturer already gave you an infected computer, i.e. you can't do anything if there exists hardware backdoors in every modern equipment. To be honest, I am afraid, as science and technology develops, the higher the hardware backdoor chances will be. That's why I prefer to use very old device.
2. If there is no wireless signal in your area, just one click can't make your device non-airgapped. If you are absolutely alone in 2km radius and you have an Wi-Fi with password, I don't think your computer is going to hack the password. Absolutely every advice should be suited to individual threats and possibilities. If you are under a serious cyber attack threat, then simply air-gapping your computer is not enough, you need to isolate the room where your computer is located, block all wireless signals and use a Faraday Cage.

I think both are very secure, but software airgap has 2 possible flaws:
1. software malware like the one you mentioned in the answers above.
2. it's just one click away from becoming "non-airgapped". I think this has also been mentioned somewhere above.

In any case, yes, hardware level airgap is not so prone to errors.

Software level airgap - you have turned off your WiFi in your OS.

Hardware level airgap - you have physically removed your WiFi card (or never had one to begin with).

What is considered a software airgap? I don't understand how software could help being airgaped? Like a software that blocks WiFi or one that blocks Bluetooth?

Be aware that there are attacks which can utilize your WiFi without you being connected to a network. Yes, these are far more complex and technical and require an attacker to be in your local vicinity, but they are still possible.

I wouldn't call it dangerous, per se, but just less secure than a hardware airgap. As I've said above, a software airgap is still much more preferable to a standard hot wallet.

I don't argue with you, hardware lever airgap is much safer without a doubt but my point was that software level airgap isn't very dangerous for average computer user who lives in average neighborhood. There are people who don't know how to disassemble Laptop.What if I am that person and live in a village in a big house, in masonry walls and I have password set on my Wi-Fi? So if I don't type Wi-Fi's password in computer, computer won't be able to log in. To be honest, I don't argue with you because your advice is the most correct one, I am just stating, I don't feel like software airgap is dangerous in some cases. Overall, I suggest everyone to follow your advice for better security.

Yes, that's true either. I just noticed that you are back, was it a one day farewell? Anyway, you are welcome.

Man, I totally agree with you and everyone who says that, but unfortunately I don't have an old laptop or pc or any device like that. But as far as the MoneroSigner is concerned, until it is properly released and tested I wouldn't use it either.

Welcome to marketing.

I checked it out. It is absolutely essential to have the respective SeedSigner to Monero, but as far as I can see, it's under development. I wouldn't use it to store important amounts there. Instead, I would rather dedicate a spared laptop (which costs less than a RPi zero), airgap it, and install the officially supported Monero GUI wallet from getmonero.org.

I partially agree, but consider this: comprehending everything a computer executes during operation is an immensely time-consuming task. It involves delving into intricate details, ranging from understanding your computer's architecture and the functions of each hardware component to grasping concepts like elliptic curve cryptography. Disabling the components that enable network connectivity is as straightforward as flipping a coin and ensuring it generates unbiased entropy.

You mean disabling WiFi or other connectivity hardware in the BIOS settings? That is still a software level airgap. It's better than just turning them off in your OS since you can't accidentally turn them back up with a single misclick and need to go back in to your BIOS settings in order to re-enable them, but it is still a software airgap since the hardware is still there, is still functional, and is still connected up. This will never be as secure as a hardware airgap where the necessary hardware doesn't even exist in the device.

My concerns with a software level airgap are not that someone is going to be able to extract data via monitoring my fan speed or electricity usage or one of the other novel techniques which has been described, but rather that a software level airgap is only ever one misclick, one settings change (accidental or malicious), one tiny adjustment, etc., aware from becoming a hot wallet. Additionally, a software level airgap is almost impossible for the user to verify themselves. If you turn on airplane mode on your phone, how can you confirm and verify for yourself that your phone is not transmitting any data at all via cellular, WiFi, Bluetooth, NFC, RFID, and so on?

A hardware level airgap is simply much safer.

Everything with firmware can be infected with a virus. You might like to read about BadUSB. They just reprogrammed microcontroller, emulated a keyboard when connected to computer and initiated a series of keystrokes. Theoretically, CPUs, GPUs, motherboards, RAMs, absolutely every hardware component can be infected but this is something I wouldn't worry about. Probably no hacker is on that level to infect firmware so well that they'll let your computer to generate pre-generated seeds by hacker and if your device isn't connected to internet, who is going to steal any information? And if you think that someone might extract data from your air-gapped computer by recording frequency of your processor's cores or recording fun vibration or frequency of your hard drive, then you probably live in a wrong place

Even if you set laptop to airplane mode, don't remove Wi-Fi receiver and Bluetooth part from your laptop, who is going to get your seeds and bitcoins? Where do you live? I do not promote inattentiveness, no, you should be very careful but don't start thinking about how will someone steal data from your airgapped computer via wireless frequency or like, what if I CPU is infected and so on.
I don't say you are paranoid or something like that but there are so many people who have this illogical fear that someone will hack their computer via recording LED blinking and someone will hack their wallet because BIP wordlist is public and 12 words are too easy to guess

SeedSigner is in fact one of the best projects out there. And unfortunately not a lot of people talk about it. People prefer to use Ledgers... I mean, what the ...

Anyway, o_e_l_e_o recently told me about this: https://monerosigner.com/ which is the essentially a SeedSigner fork for monero. I just mention it because, you never know who could be interested.

That led me to think how about building a desktop with a motherboard that doesn't have an inbuilt wifi adapter, unfortunately, there are not many options available and I can find some basic level motherboards that are ddr4 for about $100 price range and other brands are costing around $400 just for motherboards so better option is to remove the driver from motherboards.

But some claim that config BIOS will also be good enough for an actual airgap, is that true?

In my opinion, nobody should even get in that trouble. Smartphones are the exact opposite of an airgapped device. They are designed to connect to as many networks as possible. You'll have to remove modem, Wi-Fi chip(s), antennas, bluetooth module(s), NFC, GPS I think, and even radio chip? I lost count, maybe there are even more.

Alternatively, if you don't know what you're doing, buy yourself a signing device like SeedSigner. It requires minimum technical knowledge to setup, and is completely airgapped.

I am of the opinion that a properly airgapped old laptop is more secure than the majority of hardware wallets out there, if you know what you are doing. And there is no need to buy a new device just for this. The hardware requirements to run an airgapped wallet are absolutely tiny - any old device will do. You could even build a device from old components you have lying around.

No. Unless you are one of the few people using a modular phone, then the WiFi, Bluetooth, NFC, etc., modules are integrated in to the circuit boards in your phone and nearly impossible to remove without damaging the phone. You can turn all these things off and turn on airplane mode, but as I've said above, a software level airgap is not a true airgap at all.

The whole point of phones is to be able to communicate wirelessly in as many ways as possible. Trying to airgap such a device will never be completely successful. Is it better than a random hot wallet? Yes. Is it as good as a proper airgapped device which has no connectivity hardware? No.

It also depends on the laptop itself. Certain brand or thin laptop usually is more tricky to be modified.


FWIW some old device also can last for really long time with some maintenance.


Removing Wifi/Bluetooth chip or driver from smartphone usually is far harder, so your option usually is limited to always on airplane mode. And aside from AirGap Knox, Electrum Android should have all necessary feature to create wallet on air gapped device.

AirGap Knox claims to be the solution for disabling  "all sorts of connectivity on your smartphone on a system level and create an absolute secure environment for the AirGap Vault." They also claim that AirGap Vault combined with   Airgap Wallet turns Android smartphone into device  the  security of which is  comparable to dedicated hardware wallets:


P.S. Personally I didn't try it  because my stash relies entirely  on security of multisig wallet which has Passport 2  cosigner.

I was thinking is there any ways to make a smartphone air gapped? And obviously do all the things one would do with an air gapped laptop device (Is this even possible? I don't have much knowledge of this). It's a stupid question, isn't it? I understand smartphones are very small and delicate piece of hardwares. It's too much of hassle. Instead buying a old laptop and making it air gapped should be easy.

Not for everyone.

I remember I broke hinges somehow while opening the back panel for switching SSD, so better leave the job to professionals.

---

Using old device for air-gapped wallet is okay but if someone is really going to save few thousands worth of BTC then better spend few hundreds to buy hardware wallet or value for money brand new laptop that can last for atleast 5 years with no issues.

and keep it in popcorn tin  like Jimmy Zhong, the guy known to be an early developer of Bitcoin and the same time who stole 50 000 BTC from the Silk Road.

The guy was himself robbed  despite all measures taken - airgapping, "robust digital home surveillance system", etc. But he was lacking in one important trait - to remain quiet on the matter of bitcoin possessing.



P.S. I come to a conclusion that a  flamethrower becomes a must-have equipment for bitcoiner and is even more important than airgapped device
 

You can certainly buy a SBC for this, but you can also use an old laptop (or any other old computer) you have for this without spending anything. It's fairly easy to open up a laptop and strip out the WiFi card, etc., and turn it in to an airgapped device.