How safe is an Encrypted Bitcoin core wallet with a strong password?

shorena

copper member

Activity: 1498

Merit: 1528

No I dont escrow anymore.

Quote from: cuddaloreappu on July 23, 2014, 11:48:45 AM

-snip-

If the NSA spends all its resources for a whole week to crack our wallet, nobody can save us..

So please try to discuss what is common, how can a mainstream man protect his wallet?
i am sure these sophisticated trojans wont bother this common man

If the NSA spend all their resources for a whole week to crack your wallet, theyd still be cracking. A properly secured wallet can not be bruteforced, not even by the NSA. They have slightly different ways however:

from: https://xkcd.com/538/ ofc

Zeus is what is (or was, there is better stuff now) after you and your bank accounts. 95% of the worlds mail came from botnets for a while. IIRC its less now, but that should give you an estimate what you are up against. The rest that your anti virus scanner detects is just the crap from last year or something a borred teen put together.

RedDiamond

sr. member

Activity: 294

Merit: 250

Quote from: cuddaloreappu on July 23, 2014, 11:48:45 AM

i am sure these sophisticated trojans wont bother this common man

How can you be so sure?

For example even if I do not use twitter much I got some time ago this tweet claiming "US government trying to shutdown the bitcoin network.": http://www.thewhir.com/web-hosting-news/tweet-claims-us-government-wants-ban-bitcoin-actually-spreading-malware

Did not open the “video” however

cuddaloreappu

hero member

Activity: 756

Merit: 502

Quote from: shorena on July 23, 2014, 10:23:16 AM

Quote from: RedDiamond on July 22, 2014, 11:45:07 PM

Quote from: shorena on July 22, 2014, 03:14:29 PM

Nope, to be safe from keyloggers use something like keepas [1] which is designed to protect against keyloggers.

If malware hits even KeePass can not protetect you. Quoted from KeePass webpage: "For example, consider the following very simple spyware specialized for KeePass: an application that waits for KeePass to be started, then hides the started application and imitates KeePass itself. All interactions (like entering a password for decrypting the configuration, etc.) can be simulated. "

Ah yes, didnt think of that. So only a secure OS can.

Quote from: RedDiamond on July 22, 2014, 11:45:07 PM

Quote

"use a portable browser" might be usefull, however what is preventing the malicious internet cafe operator to make a copy of all of your data? There might be more interesting stuff. Public computers are not safe.

Again, if the computer is infected, the portable browser offers no protection.
-snip-

Yep that was what I wrote, the 3 tipps behind the link where pretty much useless.

Quote from: RedDiamond on July 23, 2014, 02:49:07 AM

It is also posssible that malware infects your machine’s BIOS. If it happpens then you are in big, big trouble.

Hardware trojans and not even your secure OS can help you. BadBIOS is the one that comes to mind.

If the NSA spends all its resources for a whole week to crack our wallet, nobody can save us..

So please try to discuss what is common, how can a mainstream man protect his wallet?
i am sure these sophisticated trojans wont bother this common man

shorena

copper member

Activity: 1498

Merit: 1528

No I dont escrow anymore.

Quote from: RedDiamond on July 22, 2014, 11:45:07 PM

Quote from: shorena on July 22, 2014, 03:14:29 PM

Nope, to be safe from keyloggers use something like keepas [1] which is designed to protect against keyloggers.

If malware hits even KeePass can not protetect you. Quoted from KeePass webpage: "For example, consider the following very simple spyware specialized for KeePass: an application that waits for KeePass to be started, then hides the started application and imitates KeePass itself. All interactions (like entering a password for decrypting the configuration, etc.) can be simulated. "

Ah yes, didnt think of that. So only a secure OS can.

Quote from: RedDiamond on July 22, 2014, 11:45:07 PM

Quote

"use a portable browser" might be usefull, however what is preventing the malicious internet cafe operator to make a copy of all of your data? There might be more interesting stuff. Public computers are not safe.

Again, if the computer is infected, the portable browser offers no protection.
-snip-

Yep that was what I wrote, the 3 tipps behind the link where pretty much useless.

Quote from: RedDiamond on July 23, 2014, 02:49:07 AM

It is also posssible that malware infects your machine’s BIOS. If it happpens then you are in big, big trouble.

Hardware trojans and not even your secure OS can help you. BadBIOS is the one that comes to mind.

RedDiamond

sr. member

Activity: 294

Merit: 250

It is also posssible that malware infects your machine’s BIOS. If it happpens then you are in big, big trouble.

RedDiamond

sr. member

Activity: 294

Merit: 250

Quote from: shorena on July 22, 2014, 03:14:29 PM

Nope, to be safe from keyloggers use something like keepas [1] which is designed to protect against keyloggers.

If malware hits even KeePass can not protetect you. Quoted from KeePass webpage: "For example, consider the following very simple spyware specialized for KeePass: an application that waits for KeePass to be started, then hides the started application and imitates KeePass itself. All interactions (like entering a password for decrypting the configuration, etc.) can be simulated. "

Quote

"use a portable browser" might be usefull, however what is preventing the malicious internet cafe operator to make a copy of all of your data? There might be more interesting stuff. Public computers are not safe.

Again, if the computer is infected, the portable browser offers no protection.

One possible solution is boot computer from live linux cd when sensitive data need to be accessed.

shorena

copper member

Activity: 1498

Merit: 1528

No I dont escrow anymore.

Quote from: Justin00 on July 21, 2014, 10:59:02 PM

I would partially disagree.
They have the password (to something) as you said, but they did not get the wallet.dat
So you have essentially protected the wallet.dat, Have you not ?

Quote from: shorena on July 20, 2014, 12:28:32 PM

Quote from: Bernard Lerring on July 20, 2014, 09:05:07 AM

Why not install VirtualBox on the Windows PC. Then use a virtualized Ubuntu installation when you need to access your wallet?

Because it gives you complexity not security. If the host system is infected any virtualisation as protection is useless. While you might be able to fool very simple malware that just searches for the wallet.dat with this, it will not help you against a keylogger. If you type in a password in the VM ware it is still piped through the host OS.

Yes, I would argue against that however that simple malware is not something you need to be concerned about. Most malware today is no longer written by borred, talented teens, but by professionals. Modern malware C&C Servers even have support build in [4]. Thus a search for running VM Ware is routine

Quote from: ranochigo on July 22, 2014, 04:49:27 AM

You can easily rename the file type to something else like .wkshw and rename it back to .dat when you needs it. They most probably won't spend time to search for a file type like this.

Which -again- only protects you against simple malware. It is not much more difficult to seach the fileheaders instead of the file ending.

Quote from: cuddaloreappu on July 22, 2014, 05:52:56 AM

I think always using on screen keyboard will make it very safe from keyloggers

Nope, to be safe from keyloggers use something like keepas [1] which is designed to protect against keyloggers. A screenkeyboard is easily detected and taking a screenshot for each click is something e.g. Zeus [2] does if you want. AFAIK Zeus isnt even the latest shit [3] out there.

Quote from: Muhammed Zakir on July 22, 2014, 10:23:35 AM

Find a simple guide but useful : http://www.vistatalks.net/2009/11/3-simple-tricks-to-prevent-keylogger-from-stealing-your-password/

edit : Search 'prevent keyloggers from grabbing your passwords' in google to get many tips and tricks.

Kindly,
MZ

"use a portable browser" might be usefull, however what is preventing the malicious internet cafe operator to make a copy of all of your data? There might be more interesting stuff. Public computers are not safe.

Quote from: tsoPANos on July 22, 2014, 07:34:54 AM

-snip-
But, when talking about bitcoin, smart hacking tools DON'T EVEN NEED YOUR PASSWORD!
They just need your private keys to steal your money.

Yep.

Quote from: tsoPANos on July 22, 2014, 07:34:54 AM

-snip-
The best way to protect your coins is to NOT GET INFECTED
Just don't install crapware!

"Common sense" is probably the best (sometimes the only) line of defense against malware. Well a secure OS is helping as well.

[1] http://keepass.info/help/base/security.html#secdesktop
[2] https://en.wikipedia.org/wiki/Zeus_%28Trojan_horse%29
[3] https://en.wikipedia.org/wiki/Operation_Tovar
[4] AFAIK it was mentioned here https://www.youtube.com/watch?v=GA7S0JK8o_k - didnt check, its been a while since I lasted watched that talk. Watch it. It will make you think different about todays malware.

Muhammed Zakir

hero member

Activity: 560

Merit: 509

I prefer Zakir over Muhammed when mentioning me!

Find a simple guide but useful : http://www.vistatalks.net/2009/11/3-simple-tricks-to-prevent-keylogger-from-stealing-your-password/

edit : Search 'prevent keyloggers from grabbing your passwords' in google to get many tips and tricks.

Kindly,
MZ

tsoPANos

hero member

Activity: 602

Merit: 500

In math we trust.

There is no way to be safe from keyloggers.
Of course you can take some measures to limit the possibility of lousing your coins.

Use on-screen keyboard, to type your password, or even use a key scrambling software.
That makes it impossible for most keyloggers to record your keystrokes.
Sadly, more sophisticated hacking tools allows to get past the key scrambling and even record
your screen and send screenshots the the hacker.
But, when talking about bitcoin, smart hacking tools DON'T EVEN NEED YOUR PASSWORD!
They just need your private keys to steal your money.
When your wallet program prompts you to enter password, it does because it needs to decrypt your wallet
to do something.(Like spend some coins)
When you do this, the wallet gets unencrypted for a very small period of time
which is enough for hackers to dump your private keys.
They can also read them from memory.
The best way to protect your coins is to NOT GET INFECTED
Just don't install crapware!

Using strong passwords only protects from brute-forcing.

End of story.

RedDiamond

sr. member

Activity: 294

Merit: 250

Quote from: cuddaloreappu on July 22, 2014, 05:52:56 AM

I think always using on screen keyboard will make it very safe from keyloggers

Screen keyboard gives you protection against physical keyloggers like this: http://www.amazon.com/Keyllama-4MB-USB-Value-Keylogger/dp/B004ZGXU48. However there exist also keylogger software which can capture also screen keyboard.

Muhammed Zakir

hero member

Activity: 560

Merit: 509

I prefer Zakir over Muhammed when mentioning me!

Quote from: cuddaloreappu on July 22, 2014, 05:52:56 AM

I think always using on screen keyboard will make it very safe from keyloggers

I only use on screen keyboard for simple purposes. How can you type everything in on screen keyboard? or Are you telling that you type passwords and other sensitive datas with on screen keyboard? Roll Eyes

Kindly,
MZ

cuddaloreappu

hero member

Activity: 756

Merit: 502

I think always using on screen keyboard will make it very safe from keyloggers

zetaray

hero member

Activity: 658

Merit: 500

If you have a keylogger, no password is strong enough. Best to use a dedicated machine for bitcoin, and install nothing but your wallet software and no altcoin wallets either.

Muhammed Zakir

hero member

Activity: 560

Merit: 509

I prefer Zakir over Muhammed when mentioning me!

Quote from: ranochigo on July 22, 2014, 04:49:27 AM

Quote from: hibr3d on July 22, 2014, 12:00:54 AM

Quote from: Justin00 on July 18, 2014, 12:05:14 PM

Not very if you have a key logger and hacker can some how retrieve your wallet.dat

It is safer than having an easy to guess password and obviously having no password would be like handing it on a platter.

I would do this (after you have finished with the client each time) Rename wallet.dat to something else, move it out of the normal directory (preferably off the PC). You would still be vulnerable to key logger and 1000 other scenarios, but if someone got access to your PC they might search/scan for wallet.dat and hopefully moves on when they can not find it.

And what to do if the keylogger searches for ".wat" in the start bar?

You can easily rename the file type to something else like .wkshw and rename it back to .dat when you needs it. They most probably won't spend time to search for a file type like this.

All most all of the key loggers upload the inputs. I couldn't see any other types of key loggers.
Kindly,
MZ

ranochigo

legendary

Activity: 3038

Merit: 4418

Crypto Swap Exchange

Quote from: hibr3d on July 22, 2014, 12:00:54 AM

Quote from: Justin00 on July 18, 2014, 12:05:14 PM

Not very if you have a key logger and hacker can some how retrieve your wallet.dat

It is safer than having an easy to guess password and obviously having no password would be like handing it on a platter.

I would do this (after you have finished with the client each time) Rename wallet.dat to something else, move it out of the normal directory (preferably off the PC). You would still be vulnerable to key logger and 1000 other scenarios, but if someone got access to your PC they might search/scan for wallet.dat and hopefully moves on when they can not find it.

And what to do if the keylogger searches for ".wat" in the start bar?

You can easily rename the file type to something else like .wkshw and rename it back to .dat when you needs it. They most probably won't spend time to search for a file type like this.

hibr3d

full member

Activity: 271

Merit: 100

Quote from: Justin00 on July 18, 2014, 12:05:14 PM

Not very if you have a key logger and hacker can some how retrieve your wallet.dat

It is safer than having an easy to guess password and obviously having no password would be like handing it on a platter.

I would do this (after you have finished with the client each time) Rename wallet.dat to something else, move it out of the normal directory (preferably off the PC). You would still be vulnerable to key logger and 1000 other scenarios, but if someone got access to your PC they might search/scan for wallet.dat and hopefully moves on when they can not find it.

And what to do if the keylogger searches for ".wat" in the start bar?

Justin00

legendary

Activity: 910

Merit: 1000

★YoBit.Net★ 350+ Coins Exchange & Dice

I would partially disagree.
They have the password (to something) as you said, but they did not get the wallet.dat
So you have essentially protected the wallet.dat, Have you not ?

Quote from: shorena on July 20, 2014, 12:28:32 PM

Quote from: Bernard Lerring on July 20, 2014, 09:05:07 AM

Why not install VirtualBox on the Windows PC. Then use a virtualized Ubuntu installation when you need to access your wallet?

Because it gives you complexity not security. If the host system is infected any virtualisation as protection is useless. While you might be able to fool very simple malware that just searches for the wallet.dat with this, it will not help you against a keylogger. If you type in a password in the VM ware it is still piped through the host OS.

Muhammed Zakir

hero member

Activity: 560

Merit: 509

I prefer Zakir over Muhammed when mentioning me!

Quote from: shorena on July 20, 2014, 12:28:32 PM

Quote from: Bernard Lerring on July 20, 2014, 09:05:07 AM

Why not install VirtualBox on the Windows PC. Then use a virtualized Ubuntu installation when you need to access your wallet?

Because it gives you complexity not security. If the host system is infected any virtualisation as protection is useless. While you might be able to fool very simple malware that just searches for the wallet.dat with this, it will not help you against a keylogger. If you type in a password in the VM ware it is still piped through the host OS.

As it is said earlier, Brute-force attack will be hard. It isn't highly secure but it is good and try to install original OS and search for a way to detect and remove keyloggers from your computer for the preferred OS.
Kindly,
MZ

shorena

copper member

Activity: 1498

Merit: 1528

No I dont escrow anymore.

Quote from: Bernard Lerring on July 20, 2014, 09:05:07 AM

Why not install VirtualBox on the Windows PC. Then use a virtualized Ubuntu installation when you need to access your wallet?

Because it gives you complexity not security. If the host system is infected any virtualisation as protection is useless. While you might be able to fool very simple malware that just searches for the wallet.dat with this, it will not help you against a keylogger. If you type in a password in the VM ware it is still piped through the host OS.

Bernard Lerring

sr. member

Activity: 294

Merit: 250

Why not install VirtualBox on the Windows PC. Then use a virtualized Ubuntu installation when you need to access your wallet?

ANTIcentralized

full member

Activity: 210

Merit: 100

Quote from: cuddaloreappu on July 18, 2014, 12:38:09 PM

i mean encrypting wallet with a very strong password and doing this in a freshly installed windows pc.

That will take care of keyloggers right!

Now tell me how safe is such an encrypted wallet

This would take care of keyloggers when you create your password, but would not necessarily take care of keyloggers when you later need to input your password as your computer could potentially become compromised in the future.

grue

legendary

Activity: 2058

Merit: 1452

Quote from: ranochigo on July 18, 2014, 09:46:28 PM

Not much, Windows is known to have a lot of vulnerabilities, since you are exposed to the internet, you might get a malware. Installing Linux on an offline computer would be significantly safer.

windows does have vulnerabilities, but they're not so bad to the point that connecting a reasonably up-to-date windows machine to the internet will get you infected.

Golph