Topic: HWs and Airgapped PCs: I'm under doubts. What should I do? (Read 415 times)

If doing this you must also make sure you use a new Tor circuit. If a node sees you querying a bunch of addresses from a certain IP, and then later sees a transaction being broadcast from the same IP, it is easy to link all these together, regardless of whether you have used an empty wallet or not.

I'm not sure that would tell you very much. Rather I would restore the seed phrase on multiple different pieces of software (such as Electrum and Ian Coleman) and check they both match. Although even then, that tells you nothing about how securely Electrum is generating seed phrases.

If you want to be ultra paranoid, then flip a coin 256 times and make your own seed phrase from scratch.

Verifying the signature is all you need, because it would mean that this is the version reviewed by the open-source community. If you're paranoid about the developer going rogue, avoid downloading a fresh release, and read discussions about the wallet on multiple places, like this forum, github, reddit, etc. - if there is indeed something malicious in the official releases, someone would notice it and report it.

Your idea with testing for rigged address list is not bad in itself, it won't hurt to do it, but you are just testing against one of many possible attacks, so this alone is not a proof that a wallet is safe. A better way to test a new wallet is just put a small, but not too small, amount of coins into it and wait some time. This way you will cover a lot if not all possible hacking scenarios.

But really, being paranoid about small details isn't really good, it can actually distract you from real security/safety issues, like physical security, that is probably most often overlooked.

That's exactly what I wanted to know but had no idea how to ask more specifically. Thanks for the answer.

Edit: I have one more thing but I don't think it's worth creating a new thread..

Before actually moving my funds into those wallets, I want to make sure (although I did verify the packages with ThomasV's signature, I'd rather be extra-paranoid than be screwed up) that I have installed the legit, non-malicious version of Electrum.

Would creating a new random seed through RNG (using dice and the wordlist) and using that as a test seed on 3 different devices with Electrum installed be enough? I'd use it as a "disposable" seed to check whether all 3 devices show up the same addresses.

If you are only broadcasting a transaction, then simply hiding your IP address through Tor is enough, so there should be no difference between light wallets and full node here. However, light wallets would automatically communicate with servers when they connect to them, requestion information about their addresses, which is where the privacy risk comes, so if you want to use a light wallet, create an empty wallet specifically for pushing transactions.

A little update: I've managed to get multiple devices set up different ways and so far I've played with small amounts of BTC to test out all of the previously mentioned ideas. Got to run Wasabi with Bitcoin Knots and the Core with Full Node as well (wanted to see how both work). I pretty much fell in love with Wasabi, but Electrum seems to give more user control (probably removed from Wasabi for privacy reasons) so I'll actually end up using both separately, depending on my needs.

One particular thing I'm a bit confused about is about broadcasting txs..: strictly from a privacy perspective, which one is better?
 1. Broadcasting from Wasabi (with Knots) through Tor
 2. Broadcasting from Bitcoin Core full node running through Tor
 3. Broadcasting through Whonix (Live Session, Read-Only Virtual Machine running Tor system-wide) from Electrum*

*I'd use the Whonix session strictly for broadcasting the transaction data, after which the session would close

If I'm running a Full Node (or Knots), I feel like it's not a good idea to broadcast my transactions from the same device but to use a dedicated live session to do so.. however, I wanted to hear someone else's opinion about this as well.

Their docs explain about full node, https://docs.wasabiwallet.io/using-wasabi/BitcoinFullNode.html

P.S. if you plan to run Bitcoin Core separately, don't forget to allow incoming connection and check firewall for both devices.


I assume you have both Legacy and Bech32 address. Some people still use legacy address since few service and exchange (usually crap or local exchange) don't support Bech32 address.

Now that makes sense. Thanks a lot for the help. I'll maintain 2 separate devices solely for Bitcoin purposes then.

This is something that I've been contemplating, honestly.. mostly due to the CoinJoin implementation. If Wasabi can download and run a full node, I'll look more into it. Coin mixing is something I'd definitely want to have as a handy feature.

Why would Bech32-only support be a con though? I'm using SegWit only anyway, so that's not an issue for me at all.

Third option, use Wasabi Wallet which uses BIP 158 protocol (basically SPV which have better privacy), where you could :
1. Just run Wasabi Wallet
2. Run Wasabi Wallet and Bitcoin Core separately (either on same or different device)
3. Run Wasabi Wallet and use built-in Bitcoin Core/Knots, which integrated on Wasabi Wallet

But according to their FAQ, the biggest cons are
1. the option to add master public key isn't available through GUI (for now)
2. Wasabi Wallet only support Bech32

Running your own node via Tor will always be better than adding in additional steps. If you did set up your own Electrum server, you would want to point it towards your own node anyway.

If you're running your own node via Tor, then you can use that same Tor session to broadcast your transactions. What you shouldn't do is use that same Tor session to browse the internet, log in anywhere, check your emails, etc.

In your list of devices, I don't think you need device number 3. If you use device number 2 for nothing except running the full node, then device number 3 doesn't really add anything.

Okay so I experimented a bit with these devices and modified a few laptops to make sure there's no more wireless modules on any of them anymore so that I can control the internet access by myself, physically.

I got stuck somewhere though, and it may seem off-topic but I thought it didn't make sense to create yet another thread for this one: I'm not sure how the perfect wallet setup is supposed to look like, honestly.

I'm mostly accomodated to Electrum, but if I understood correctly, Electrum connects to third-party servers which means it broadcasts my addresses and balances. I thought it'd make sense to create my own server then, but I'm not sure whether that's a better option than simply running a full Bitcoin Core node instead.

I have more than 4 devices available to use for my Bitcoin activity, so as long as privacy remains at a maximum level, I'll be using as many as I need. Right now, I have an airgapped PC prepared with the Electrum installed on it. This one will never have any external connection ever again. But I'm a little bit scared of having a "watch-only" wallet on my other Internet-connected Electrum device because I don't want my addresses/balances to be broadcasted to anyone.

I read somewhere that I should be setting up ElectrumX, but I'm not sure whether it's safer/better than the original Electrum or if I should go for the Bitcoin Core instead. Is Bitcoin Core with Tor the safest option privacy-wise, or should I pick Electrum (or something else)?

Also, I'm unsure how I'm supposed to have both unique Tor sessions and a full node Bitcoin Core at the same time. By "unique Tor session", I suppose we're talking about something such as Tails or some other live OS. Is there any way to "renew" the Tor session or my identity through Bitcoin Core?

I thought I'd do everything the following way:
 1. Airgapped PC for signing and cold wallet
 2. Internet-connected PC for running the full node
 3. Tails-running PC for broadcasting txs after connecting to the 2nd device's node

However, I'm honestly completely stuck right now.

If you have the funds available, you could always get a third device which you use solely for running Bitcoin Core and broadcasting your transactions you have signed from your airgapped device, and keep your main device entirely separate from all your bitcoin dealings and activity. That has two benefits - you don't have to worry about compatibility or drivers etc. for all your hardware with your bitcoin-only device, since you are only going to use it for one specific purpose, and it also provides a privacy boost as it reduces the risk of you doing something else on the same device as Bitcoin Core, doing something through the same Tor session, leaking details outside the Tor session, etc. which could impact on your privacy.

Thanks, I'll look into those as well although there are some other options AFAIK such as installing Debian without the non-free packages. The main issue, as I mentioned earlier, is that it's all fun until I get to issues such as a certain device not being recognized. That's where I always give up after hours of research by adding non-free repos and installing non-free stuff.

Yeah, I used to play with Tails until I found out Whonix is supposedly more secure than it. AFAIK, it protects your IP way better than Tails does.

Qubes surely is very secure and feels safe, I have it on my primary disk on my PC and I love it. It's not that hard to use if you get the basic stuff, to be honest. Took probably only an hour or two for me to get the hang of it, and the thought that you can basically have isolated offline and online VMs running simultaneously in the same PC is amazing. While it says it's a very heavy distro, I never had an issue running even 5-6 VMs at the same time. That's kinda weird, considering I have a quite old PC I'm running Qubes on.

ParrotSec is a great distro if you want to run Tor on a system-wide level (or to make use of hacking/security tools). AnonSurf is the main reason I've been using it.

Thanks. Free Linux distros are something I'd definitely go after, but I find myself getting stuck with various errors due to missing hardware kernels/drivers. It's some kind of maze I can't seem to figure out yet, and Tails/Qubes/ParrotSec seems to fix them all although I'm quite sure a lot of the fixes involve non-free packages. I might give it a try this time though. I'm not in a hurry, so I have plenty of time to experiment before actually moving my funds there.

If you're that worried, you might as well as use linux distro that only bundle free (as in open source) software or even hardened linux distro.
FSF have such list if you're curious at https://www.gnu.org/distros/free-distros.html, but i never tried any of the listed distro.


It's impossible not to reveal any fingerprint (see https://en.bitcoin.it/wiki/Protocol_documentation#Message_types), what you could do is make the fingerprint less/not unique (just like what Tor Browser does). But AFAIK it's most private way.

Thanks @o_e_l_e_o for the last reply. Will keep everything you mentioned in mind.

I agree. It's increasingly difficult to preserve your anonymity and keep everything under control nowadays, and while Bitcoin is an amazing tool we can use to improve the financial freedom and control, the fact that it's a public ledger only makes it even worse in some situations.

A few members of this forum made me focus a lot on privacy issues that come with the average person's usage of Bitcoin, especially as I found myself to be among those who were using it the wrong way - and looking at how things change on a daily basis, I get a general negative sentiment about our digital future. Hence, I see protecting our coins in a private way as an essential thing.. although I may seem to be going a bit towards the extremes lately.

I think it is terribly difficult to achieve absolute privacy in today's world where everything is actually analyzed, and if you look at all those companies that deal exclusively with BTC blockchain analysis, just one wrong step is enough to be identified in one way or another. For those to whom BTC is attractive as a payment currency, privacy is a terribly big challenge - I have to admit that so far I have not decided to go in that direction.


Whether it’s Ledger or Trezor (or any other HW) anyone who doesn’t doubt and question their methods constantly actually lives in the false belief that the world is a fair place, when in fact it is quite the opposite. I’ve been using Ledger HW for years, but that doesn’t mean I trust them absolutely, and this latest data leak has definitely shown that anything is possible.

Therefore, it is quite justified to look for some new solutions and to look for every possible flaw in the existing ones.

It's pretty good. The disposable CDs for updates is a nice idea. My airgapped device does not have a CD drive, so I use a USB drive with a hardware write protection switch on the outside, and I format it after each use just to be extra sure. I also transfer transactions back and forth using QR codes and cameras (which I unplug when I am not actively using them).

Provided you aren't leaking information in other ways, such as via your OS or your Tor session. It's best to use a dedicated session to broadcast your transaction and nothing else. Again, unless you are the target of a three letter agency who could potentially monitor your entry and exit nodes, this is probably the best balance of privacy and ease of use.

Now that makes me wonder if there is any workaround to bypass the write protection hardware switch of SD card readers, or if there's any way these hardware switches could be faulty and simply not lock the SD card when I think it physically did so. I don't trust hardware that much, especially as I'm not an expert and I mostly trust what others tell me about it rather than studying the facts by myself - I wish I had the knowledge to personally study those as well, but we can't have everything.

One thing I know is, today's software and components are filled up with backdoors and maliciously-intended codelines. The "old ways" are safer than ever before: dumb phones, CDs, wired connections etc.

I don't mind CDs being unreliable for long-term storage. After all, I would only use them for wallet updates and I don't need those forever. In fact, I'd rather use as many disposable devices and objects as possible the same way I'd rather use Live CDs than install the OS. I feel like it's safer and chances of messing up are lower when you know you just start from point zero every time.

I did read it, and you can make your SD card or even USB un-writable and make it as read-only mode with a lock, and there is also Write-Once-Read Micro SD Cards.
Thanks for explaining.

I feel like you haven't really read my post, but I'll reply anyway. Using writable devices such as USB or SD cards on a PC that is supposed to have no connection to the outside world poses a risk imo to the security of the airgapped device.

I could insert an USB into my Internet-connected PC, download an Electrum update, infect the USB, plug it into my airgapped device and infect it. Now:
 - If I had used a CD instead, after the update is done, even if the airgapped PC is now infected, I would just unplug the CD and cut it into pieces. No information will leave my infected airgapped PC.
 - With the USB, the device is re-writable, so crucial information may now leave from my now-infected, airgapped PC straight onto the USB. Next time I plug it into an Internet-connected device, the "fun" part begins.

AFAIK, Linux systems are way harder to infect than Windows ones. However, I'm taking as much precaution as possible. I want no USB devices to ever be connected to my airgapped device. The safer, the better. USB devices can be wiped, but I would honestly not risk information leaks when a CD is only like $0.20. (sorry for repeating "airgapped" 6 times in this post)