Topic: How do you guys secure your bitcoins ? (Read 1129 times)

You guys are doing a great job with armory, thank you!

The application has some very nice feature, e.g. signing transactions completely offline - each time I boot my cold-storage PC and syncing, then am I exposing the PC to the internet.
I would definitely advice user who have large funds to look into this solution.

I have only little experience with Armory, maybe I will switch from Bitcoin-core to Armory if my level of paranoia increase.

Seriously.  This is Armory's bread and butter.  You can keep the coins as secure as you want (hot or cold wallet), one-time only backups, still distribute unique addresses for every transaction, still be able to monitor the coins and incoming payments on the online computer, and no need to sync blockchain data between online and offline computers to spend.

Basically, Armory has already solved all the complexities of putting private keys offline, keeping public keys online, and shuttling the minimum amount of data needed for the offline computer to securely verify and sign the transactions.

https://bitcoinarmory.com/about/using-our-wallet/#offlinewallet

I believe that softron means the blockchain-wallet, it has a pretty nice function to sweep private keys, you can even use your webcam to read a QR code for the private key.

You could make 100 x paper wallets and load them with 0.01 BTC each.
Then use them as "5 dollar bills", each time you need bitcoins you redeem a bunch of your 0.01 BTC paper wallets.

Well, no advanced techniques used:

1. I do not use Windows for running bitcoin-qt.
2. Wallet is encrypted with strong password.
3. The whole datadir is placed on a TrueCrypt volume mounted manually when needed.
4. A few backups of wallet.dat in different physical locations.

Sure, not a cyber Fort Knox, but IMHO enough considering I'm still below 1 BTC :-).

How do you use blockchain when you need them online and how do you get to cold safely?

Simple i dont keep the keys on a machine i use on d net. So its all offline and i use blockchain when i need them online.

Remember to always spread out the risk:
Keep 1/4 at inputs.io, 1/4 at BIPS, 1/4 at Mt.Gox and 1/4 at Vircurex?  lulz

Just keep them on gox.  lulz

I have done a lot of research on this topic; my solutions uses two Bitcoin-core clients and one paperwallet.
1. Bitcoin-core client running on my desktop-pc, this is my hotwallet, where I do all my in/out transactions to the "world". I never keep too many bitcoins here. Password is of cause strong.
2. Bitcoin-core client running on dedicated pc, this is my cold-storage, only use this PC if I have to move funds to my hot-wallet.
3. Paperwallet, printed out, stored away. Never touches this one. Only uses it for long time storage of funds I am certain that I don't need in the near future.

I have backup of all the wallets, located at two different locations.  

I know that there is more secure ways to do this, but the more security you add the higher is the chance that you will not be able to access the funds your self.
The important thing for me, is that it reasonable safe and I trust the setup.

I also thing it is important not to "put all the eggs in one basket", thing it is important to divide your funds into different system/types. E.g. if my cold-storge is compromised it is unlikely that my paper wallet is compromised at the same time.

I have backups

If you are talking about securing a cold storage for 10 years, at least have a physical backup of your private key (and keep the key like it literally worth $100,000).

You'll get pissed off more if your laptop hdd has any problems 10 years later.

It's not really complicated once it's all setup. just a bit annoying that you have to type two passwords on boot. One to unlock your boot partition. One thing I didn't mention my laptop closes the encrypted boot partition once booted. I'm also protecting all my personal data using this setup.

I'm also protecting myself this way from physical theft of my wallet.dat while the bitcoin client is not running. I don't want a super hard password on my wallet just in case I the worst happens and for some reason I forget it. But that means the password can be brute forced.

With my script the wallet.dat file will only be accessible when the client is open and in use. Once I close the client the script closes the encrypted partition and my wallet.dat is not accessible.

I know the wallet encryption is hard to break NOW but you also have the future to think about. Something that sounds ludicrous now could be achievable in the near future. Bitcoin is still a very early growing currency. The thing with bitcoin is that it's not just a national currency it's a GLOBAL currency. If bitcoin keeps growing and maybe become the dominant internet currency (I'm predicting it will) each one of your coins could be worth around $100,000 easy in the next 5 to 10 years. If you have a few coins that's a lot of wealth. If someone has a copy of your encrypted wallet and has motive nothing is impossible. I'd hate to wake up 10 years down the road thinking I was stinking rich, check blockexplorer and realize some fucker actually managed to break the encryption on my wallet and steal my coins.

That's why I'm super cautious about my wallet.dat

 

Sounds pretty complicated.

I just have my coins stored in as a default wallet.dat file which is encrypted using the default Bitcoin-qt software.

Its backed up to a few separate physical locations on USB flash drives.

If you use a strong passphrase, your coins are still secure even if someone nabs your wallet file.

If you dont encrypt your wallet.dat, or you dont back it up, you are asking for trouble.

Just thought I'd start a discussion (if anyone wants to discuss) how you lot are securing your bitcoin wallet, machines ? Here's how I have mine setup.

Bitcoins are stored on my laptop.
Laptop boots from UEFI grub (more secure than bios)
grub handles luks encryption now yey so grub prompts for password and mounts /boot fs (protects against initrd and vmlinuz tampering)
system has two drives one ssd (encrypted lvm) and one HDD (/var,virtual machines,wine).
init contains script to check hashsum of grub after boot and warns after boot (warns of changes to your bootloader)
after unlocking other drives the system boots into desktop.
My bitcoin wallet is stored inside yet another encrypted lv and symlinked back into my .bitcoin directory. I also have a custom startup script to handle loading the bitcoin-qt client. Here it is it's nt pretty but it works


What does this do ? Here's a brief explanation.

prompts for crypt password.
unlocks the encrypted filesystem and mounts to the appropriate folder.
checks to see if the encrypted folder is mounted with a simple file test.
checks and cleans up any old symlinks or now wallets created due to premature bitcoin-qt loading.
loads the bitcoin client with my wallet.
unmounts and locks the encrypted filesystem when bitcoin-qt is closed.

Script includes some zenity to give me nice gtk windows with information etc. I suppose I could get hit by a hardware sniffer, or exploited while the client is running but if I keep the client use to a minimum. Also I encrypt my wallet using the bitcoin client.

Also I have an init to wipe memory on shutdown via secure-delete, I also have a patched kernel with tresor included. My laptop has been bios locked and nothing else is allowed to boot except internal dd.

Is this over the top ? Or could I do anything else to keep people out ? How do you protect yours ? I suppose I'm trying to protect from theft of my laptop and theft of my wallet from my laptop while it's unattended (providing I've remembered to close the bitcoin client).