Topic: My questions regarding wallet (Read 381 times)

Coinbase wallet isn't a good choice either. It is closed source, meaning you have absolutely no idea what it is doing in the background or how good or otherwise its security is. It connects via Coinbase's servers, so you have absolutely zero privacy and Coinbase are well known for harvesting every shred of data they can about you and selling that to third parties, so if you use Coinbase wallet then your addresses and transactions are almost certainly being fed to blockchain analysis companies, government agencies, and anyone else who is interested. It lacks many features such as coin control.
If you are not going to use a hardware wallet, then you should at least use a reputable and open source software wallet such as Electrum.

Blockchain can be easily accessible by hackers and it's very dangerous for people who store their tokens their in other for long term purposes. Blockchain don't have the kind of security other wallets have like the top one presently is Trezor model T. It's means of security is definitely a strong one as hardware Wallet and have two factor authentication for security purposes. Although there are still several wallet good enough for storage of coins like the underrate coinbase.

Blockchain.com is still a poor choice for a wallet, I'm afraid. First off, it is a web wallet, which is the least secure type of wallet available. The wallet is permanently online, which opens it to the possibility of constant attacks. It is run through a browser, which for most people are very insecure. It is protected only by a simple password, which can be brute forced, reset, socially engineered, phished, and so on. Since it is a third party website, you have no idea what is happening on the back end, and must take everything on trust. You have no idea whether the seed phrase they give you is actually securely generated and you have no way to be sure that they do not have access to your private keys. Further, they have suffered from some serious vulnerabilities in the past, including very basic things like reusing k values which resulted in thousands of bitcoin being stolen.

I would move any coins from blockchain.com to a hardware wallet as soon as realistically possible.

Thanks for your answer.
I am sorry, not bitcoin.com it's blockchain.com

Honestly... it should be. Regardless of how good you think your antivirus is, there will always be malware that it won't/can't trap.


Online wallets and security are two very different things... and in almost all situations are mutually exclusive.

You would be wise to heed the advice of o_e_l_e_o and the others.

First of all, bitcoin.com is a known scam site designed to promote a bitcoin fork known as Bcash. You should avoid it. Secondly, as I said above Trust wallet is closed source, so you should avoid that too.

To answer your general question, any closed source wallet could have access to your private keys and coins. Since it is closed source, you have no way of knowing what it is doing. It could only give you pre-generated seed phrases from a list known to the developer, or it could send your seed phrase off to some server somewhere where someone else could access it (like Coinomi did when they sent seed phrases to Google servers).

You should stick to open source software wallets like Electrum, or go one step further and get a good hardware wallet.

You are right. As PawGo has explained, coins are not stored on your hardware wallet. The only thing which is stored on your hardware wallet is your private keys, and these give you permission to move certain outputs around the blockchain.

So called “coins” are never “stored” on your computer or mobile. “Coins” are in fact abstraction.
All the information are stored and managed by computers with full nodes. These computers exchange information between themselves. Information about transaction tells who has access (possibilities) to spend a given “coin”. And, to be able to spend some coins, you must gain access to private keys which allows you to do some actions. Now we come to the most important part - where the information about private keys stored. If you ask me if you generate keys on mobile phone connected to internet, using application you downloaded- the answer is “I do not know”, theoretically if application source code is known, you may trust it.
Some use hardware wallets, because private keys “never leave the device”. Some use computer disconnected from internet.

Thanks all for reply.

Security is not my main concern because I always keep my pc and phone protected with anti virus and as a tech guy i am aware of it.

1) My main concern is , I like online wallet like bitcoin.com, trustwallet  etc.. where they provide private keys and 12 words secret phases. Can they have still have custody of my coins anyhow? Is coins stored on their server?

2) In hardware wallet, does coins are stored in hardware? or only private is stored in a hardware wallet? Eg. suppose if there is 0.1 BTC in our wallet it is stored in address and can be seen in blockchain ledger so actually coins are stored in wallet address on blockchain server and not on hadware or software wallet. Am i right? or not?

Many still think that having a hardware wallet means their coins are secure. But this is not the case. It's the seed that guarantee you the security. A hardware wallet can be stolen, broken, replaced many times but if you lose the seed or the seed is compromised then your coins are at risk.

I understand you are concern about your security. Please watch this video.

The goal is to absolutely minimize the possibility of it becoming infected or compromised. If you have any suspicion that your airgapped computer has been compromised, your should be formatting it and starting from scratch.

You can and should use an open source OS (most likely a minimalist Linux distro) so you can be as sure as possible it is not doing anything funky. The hardware angle I will grant you, but keeping it permanently airgapped again minimizes the possibility of any potential vulnerability being exploited.

It's OK to import very limited data in to an airgapped device - ideally only a verified copy of your wallet software of choice and nothing else. Every additional thing you import makes it less secure.

The goal of an air gapped computer/device is to be usable even if infected/compromised. You will never be 100% sure your computer is safe because nobody can guarantee that your operating system and the chips of your computer are free from any backdoor. It's ok to import datas into an air gapped computer, what is wrong is to export outside uncontrolled datas.

Even without a SIM card and on flight mode, phones ping for cell towers, search for WiFi networks, can send and receive Bluetooth/NFC/RFID data, and more. The NSA have said they can still track phones even when they are in flight mode: https://threatpost.com/nsa-warns-smartphones-leak-location-data/. The average person also cannot verify a single thing that flight mode does. Simply turning it on and believing that your phone is now airgapped is a fallacy.

If you are no longer using the device as a cold wallet and have emptied all the wallets it was storing, then sure, you could put the WiFi card back in and connect it up to the internet again. You would have to start from scratch again in terms of airgapping and formatting the device if you wanted to use it as a cold wallet again though. You can't just reconnect and disconnect on a whim and think your device is still safe.

Which ones are you thinking about precisely please? If the sim card is out of order/removed and if there is no connectable wifi network where you are I don't understand how a smartphone could leak a seed outside neither any data.

If there is not anymore funds in the seed they store and if you don't plan to use this seed again (like anybody should do) I don't understand what risk there is in using them again. You can use devices as cold wallet without having to sacrifice them, that was my point.

Not really. A cold wallet should be permanently airgapped and never connected to another device, network, or the internet. Most hardware wallets on the other hand are designed to be safe even when connected to an device with internet access.

Private keys sign transactions, not seed phrases.

I don't think it is possible to turn a mobile phone in to a true cold wallet. Even on flight mode it still receives and transmits data via a number of channels.

Cold storage should never connect to the internet, even for a moment. If it does, then it is no longer cold storage.

A hardware wallet is safer than a software connected wallet because it works in the same way as a cold wallet. That is to say, it internally signs transactions with its seed and only sends those signed transactions to the computer without exposing the seed.
If you want to safely store your funds in a mobile phone, it's better to use an old one as a cold wallet. That is to say, you should never use it as a phone till your funds belong to the seed in it, you should remove the sim card and only use it in airplane mode (no wifi and even bluetooth connection). It's even better to physically turn off/remove antennas if you can. You can also do the opposite : using an old laptop or tablet that you won't connect till their seed is in use and broadcasting signed transactions with your smartphone.

It doesn't matter if you are working  in IT or not, I wouldn't use Trust wallet for storing any coins, or I would use it only for pocket change money.
This is closed source wallet and you can find better open source alternatives that probably work even better.

I don't really care what most youtubers have to say, they are paid shillers and they are probably recommending one more close source crap like ledger.

And what if you lose you mobile phone with trust wallet?
It's much more likely to lose or damage something you carry with you everywhere all the time.
You should keep backup seed phrase offline on paper or metal, and you should have strong password and passphrase for your account, so it' doesn't really matter if you damage hardware wallet.
You can always restore all your coins to any BIOP39 supported wallets, hardware and software.  

What kind of question is this... you buy new one if you want, or you don't, same like with anything else that gets damaged or broken.  

Trust wallet is closed source and a hot wallet. It is one of the least safe choices to store large amounts of coin. I would definitely invest in a hardware wallet if I were you.

The Trezor web shop does not seem to include India as a shipping option. The Ledger web shop does. However, Ledger and Trezor both list www.etherbit.in as their official Indian reseller, as you can see on the following pages:
https://www.ledger.com/reseller
https://trezor.io/resellers

Looks like etherbit is a bit more expensive than either of their own web shops, but I don't know how much extra in shipping or how long you would have to wait for delivery by ordering direct.

Let a signing device cost you ~$200. That's less than 1% of the price your coins are currently worth. For me that would be a no-brainer.

If your coins are Bitcoin only I would suggest you also buy a signing device that just supports Bitcoin. First it minimizes possible attack surfaces by eliminating code intended to support the other coins and second - at least for me - it is an ethical thing as I despise most of the crypto casino which one would indirectly help flourish. That would rule out the Trezor and Ledger mentioned above. The latter also had a serious leak of customer information which led to some threatening and blackmailing of customers. I even heard stories of people getting a visit from not so friendly people who wanted their coins. Maybe just rumors idk...

Considering the above I would advice you to buy a Foundation device or a Coldcard. Coldcard also deletes your customer information after some time (at least it says it does).

Best thing would be to pay with bitcoin, provide a false identity and let the shipment come to a place somewhere you have access to, but which is not exclusively identified with you. This way you mitigate some risks, since ordering a signing device directly to your home provides plenty of evidence about your financial business to outside people...

But don't let the hassle be a non-starter for NOT buying one.

I'm not sure about availability in India, but it probably makes sense to first check which hardware wallets support the altcoins you want to store and then go from there.

Trezor:
https://trezor.io/coins/

Ledger:
https://www.ledger.com/supported-crypto-assets

That's just two of many available hardware wallets these days, but those are the ones I personally am familiar with. Maybe someone else can chime in with other hardware wallets.

Either way it is recommended to purchase hardware wallets directly from the vendors or at least from an official reseller (I believe those should be listed on the websites of the respective hardware wallet). Avoid market places like Amazon or Ebay as on those sites you may never know whether you got a legit wallet or one that's been tempered with.

Thanks, Which is the best-recommended hardware wallet. Easy to operate. Stores BTC + Altcoins and reasonable rate available in India?