Pages:
Author

Topic: It is NOT secure to use hardware wallets (and it never was) - page 2. (Read 2228 times)

legendary
Activity: 2926
Merit: 1386
Paper wallet in a safe deposit box ftw lol

And if someone physically gets your paper wallet you lose the coins. Or you could have some technical problem when the day comes to use the coins. Cheesy   

I would suggest, anyone that put a paper wallet in long term storage, see that a decoding program is placed there also. An example would be the bitaddress.org script. Whatever is needed. Toss an entire computer if you like, if you think that script won't run in ten years.

Whatever you put into long term storage, remove the batteries first.
legendary
Activity: 2352
Merit: 6089
bitcoindata.science
Yeah, it's tough to "be your own bank" when your funds are physically in the custody of someone else. But every storage medium has its tradeoffs. It just depends what the biggest threats are.

A friend of a friend had his house burglarized and his safe stolen -- everything gone. Probably a targeted/inside job. Anyway, in hindsight, I guess he'd have been better off with a safe deposit box. I think the moral of that story is don't put all your eggs in one basket. You should never store everything in one place.

Maybe if his privatekeys were inside a drawer, they would not have been stolen. They would look worthless.

Or splitting privatekey/seed in two separate pieces of paper maybe a good idea also.
legendary
Activity: 1666
Merit: 1196
STOP SNITCHIN'
Paper wallet in a safe deposit box ftw lol

The question is wether "Be your own bank" still applies here if you let a bank be your bank instead of being the bank yourself.

Those boxes do not guarantee availability at any given moment.
This may be more secured (from stealing attempts) than storing private keys under your pillow, but is not a reliable (in terms of availability, access, etc.. ) long-term storage.

Those boxes can still be seized by the government.

Yeah, it's tough to "be your own bank" when your funds are physically in the custody of someone else. But every storage medium has its tradeoffs. It just depends what the biggest threats are.

A friend of a friend had his house burglarized and his safe stolen -- everything gone. Probably a targeted/inside job. Anyway, in hindsight, I guess he'd have been better off with a safe deposit box. I think the moral of that story is don't put all your eggs in one basket. You should never store everything in one place.
legendary
Activity: 1624
Merit: 2481
Paper wallet in a safe deposit box ftw lol

The question is wether "Be your own bank" still applies here if you let a bank be your bank instead of being the bank yourself.

Those boxes do not guarantee availability at any given moment.
This may be more secured (from stealing attempts) than storing private keys under your pillow, but is not a reliable (in terms of availability, access, etc.. ) long-term storage.

Those boxes can still be seized by the government.
newbie
Activity: 164
Merit: 0
Paper wallet in a safe deposit box ftw lol
And if someone physically gets your paper wallet you lose the coins. Or you could have some technical problem when the day comes to use the coins. Cheesy   
If someone physically gets your cash/gold/cloths/house/car you will lose your cash/gold/cloths/house/car. Or it could be damaged, burned, broken, etc.
You are never in safe for 100%, that's how our life works.
AGD
legendary
Activity: 2070
Merit: 1164
Keeper of the Private Key
...
Not when the "paper wallet" is made out of stainless steel.

...


Yeah. This is a so called 'steel paper wallet'
Can I also create a 'wooden steel paper wallet'?
sr. member
Activity: 389
Merit: 250
Paper wallet in a safe deposit box ftw lol

And if someone physically gets your paper wallet you lose the coins. Or you could have some technical problem when the day comes to use the coins. Cheesy   
newbie
Activity: 47
Merit: 0
Paper wallet in a safe deposit box ftw lol
sr. member
Activity: 389
Merit: 250
Ledger Hardware Receive Address Attack

Whenever using a hardware wallet  to send or receive. Make sure to check the display of your device to make sure the coins are going to the right address. A virus can change the address.

https://www.youtube.com/watch?v=9Wf1SFTQxAs

https://www.youtube.com/watch?v=sZuxHSM8p-Q
legendary
Activity: 2926
Merit: 1386
The "long term storage problem" is the simplest thing in the world to solve. Consider that a bitcoin address is no more than a 50-some digit long number All you need is a copy of that number in a safe depot box.

An 'address' is a 160 binary number. This, of course, can be encoded in any format.
Just like it is done with the displayed addresses (Base 58 encoding).

But to be able to gain access over the funds sent to the address you need the private key (256 bit binary number), which also can be encoded into *any* format.


The question is wether you want to put it into a depot box.
It matters on how much you trust the phsysical security of this box.

If you want to keep it away from everyones knowledge, such a storage might not be the best idea.

Sort of right. I referred to the private key, which is a 50-some digit long number. How one encodes it does not address the question or affect the answer.

Next, the question was not "if you want to keep it away from everyone's knowledge."

But that really doesn't matter. Please take a moment to think this over.

A private key can of course be password encoded, or encoded using a private scheme. Most of the orientation on this thread is "How to save and THEN RETRIEVE bitcoins." This implies a device capable of the retrieval, a computer or a hardware wallet, whatever.

A paper wallet does not do this, it simply stores the values. Therefore it does not have the complexities of devices with computing capabilities or data storage capabilities.

It's quite reasonable to believe there will in the future be various ways to read these keys into active devices.
newbie
Activity: 78
Merit: 0

Can't we even use those cheap memory cards in which we can store lots and lots of data with any sort of stuff or just private keys only?
Purchasing ~250 Memory Cards with just 2 GB memory will cost much less compared to what we need to pay for that steel thing. Wink
I believe that all of these 250 memory cards are not going to get corrupted at once (few may get corrupted, but not all of them).
Even 25 memory cards can save our Notepad file and have all our data stored without much hassle which we can easily access offline whenever we want to use our private keys to use our funds. Encryption of private keys and then keeping them safer in these memory cards is the best and cheapest way IMO.

Each generation of nand flash is much worse than the previous generation.

If you take a recent high capacity USB key, write it, and put it in a car on a hot day, most of the data will be damaged and the ECC/codecs in the flash controller will have to work their collective asses off to recover your data.

I would not expect the data to be on cheap memory cards in 2 years.  Read the specs from majior SSD manufacturers on data retention unpowered. 


legendary
Activity: 1624
Merit: 2481
The "long term storage problem" is the simplest thing in the world to solve. Consider that a bitcoin address is no more than a 50-some digit long number All you need is a copy of that number in a safe depot box.

An 'address' is a 160 binary number. This, of course, can be encoded in any format.
Just like it is done with the displayed addresses (Base 58 encoding).

But to be able to gain access over the funds sent to the address you need the private key (256 bit binary number), which also can be encoded into *any* format.


The question is wether you want to put it into a depot box.
It matters on how much you trust the phsysical security of this box.

If you want to keep it away from everyones knowledge, such a storage might not be the best idea.
legendary
Activity: 2926
Merit: 1386
Quote
I have been warning people about hardware wallets for years. Bitcoin is the most personal store of value. Don't break it by using untrusted third party soft/hardware:

https://krebsonsecurity.com/wp-content/uploads/2018/03/ledgerattack.pdf

Worth mentioning, that the guy who found this exploit is 15 ys young.


Nothing beats the paper wallet

Fire and water (and time) does.


Not when the "paper wallet" is made out of stainless steel.



Of course a USB could be accessed by an offline air gapped PC. And a hardware wallet could by design have it's records regenerated on a PC if the key word set were known.

A bad actor or government actor could exert influence on a hardware wallet company, say by causing certain items to be included in an update of the hardware wallet. This is at least in my opinion, a long term risk worth mulling over.


What is your solution to that long term problem? I am puzzling myself to find the best possible way to store a few bitcoins long term and, as of today, I have no solution for that. If I look for security, in case I die, nobody will ever be able to recover my coins (until bitcoin cryptographic security is broken). I supposed that leaving a trezor behind could have been that solution but right now I don't think that is a viable option.

The "long term storage problem" is the simplest thing in the world to solve. Consider that a bitcoin address is no more than a 50-some digit long number All you need is a copy of that number in a safe depot box.




legendary
Activity: 3052
Merit: 1273
Nothing beats the paper wallet

Fire and water (and time) does.
What about this "steel" wallet?

https://cryptosteel.com/

Can't we even use those cheap memory cards in which we can store lots and lots of data with any sort of stuff or just private keys only?
Purchasing ~250 Memory Cards with just 2 GB memory will cost much less compared to what we need to pay for that steel thing. Wink
I believe that all of these 250 memory cards are not going to get corrupted at once (few may get corrupted, but not all of them).
Even 25 memory cards can save our Notepad file and have all our data stored without much hassle which we can easily access offline whenever we want to use our private keys to use our funds. Encryption of private keys and then keeping them safer in these memory cards is the best and cheapest way IMO.
legendary
Activity: 2758
Merit: 6830
Nothing beats the paper wallet

Fire and water (and time) does.
What about this "steel" wallet?

https://cryptosteel.com/
AGD
legendary
Activity: 2070
Merit: 1164
Keeper of the Private Key
Quote
I have been warning people about hardware wallets for years. Bitcoin is the most personal store of value. Don't break it by using untrusted third party soft/hardware:

https://krebsonsecurity.com/wp-content/uploads/2018/03/ledgerattack.pdf

Worth mentioning, that the guy who found this exploit is 15 ys young.


Nothing beats the paper wallet

Fire and water (and time) does.
hero member
Activity: 3010
Merit: 794
So if hardware wallets are not safe then it is kinda useless to invest in one right now? If the point of this article is to make people aware of the dangers of using hardware wallets it just made them insecure. If the article is correct any retailer or seller (or even one of their employees) of  a hardware wallet can install a custom firmware before they even put it up to the shelves, yes I know they have stickers and security seals on their boxes but all of it can be easily tampered by a professional.

Maybe hardware wallet makers need to take it on to the next level of security like having a software where it can detect if your hardware wallets are compromised or not. In this way even if they had accessed your wallet you will know if your wallet was touched or not. But in my own personal opinion I would still want a hardware wallet where it is not always connected to the internet or to my desktop, my Bitcoin is more vulnerable out there.
When you are really aware on the risk  of it then you should proceed with caution.We do know issues is already showed up and as a sensible token hodler you will eventually avoid it at all cost. Re-sellers of such wallet can possibly re-packed it and install any software which would compromise or exposed the keys.We have seen such problems thats why i decide to buy in the company itself but still i do have always the doubts that they do have those seeds yet they are the ones who do create and do the packaging.

On the thing being said above, the thing being created by someone can really be possibly be cracked or exploit some flaws by other person anytime.
jr. member
Activity: 84
Merit: 1
Quote
I have been warning people about hardware wallets for years. Bitcoin is the most personal store of value. Don't break it by using untrusted third party soft/hardware:

https://krebsonsecurity.com/wp-content/uploads/2018/03/ledgerattack.pdf

Worth mentioning, that the guy who found this exploit is 15 ys young.


Nothing beats the paper wallet
hero member
Activity: 1680
Merit: 655
So if hardware wallets are not safe then it is kinda useless to invest in one right now? If the point of this article is to make people aware of the dangers of using hardware wallets it just made them insecure. If the article is correct any retailer or seller (or even one of their employees) of  a hardware wallet can install a custom firmware before they even put it up to the shelves, yes I know they have stickers and security seals on their boxes but all of it can be easily tampered by a professional.

Maybe hardware wallet makers need to take it on to the next level of security like having a software where it can detect if your hardware wallets are compromised or not. In this way even if they had accessed your wallet you will know if your wallet was touched or not. But in my own personal opinion I would still want a hardware wallet where it is not always connected to the internet or to my desktop, my Bitcoin is more vulnerable out there.
jr. member
Activity: 308
Merit: 4
its not good i listen about hardware wallets that are more secure and safe and now you are saying its not safe,very big problem and must be resolve this from experts,now only option to save only wallets with password placed at safe place till no other solution.
Pages:
Jump to: