Noob question about e-wallet security

casascius

vip

Activity: 1386

Merit: 1140

The Casascius 1oz 10BTC Silver Round (w/ Gold B)

Quote from: juggernaut76 on July 14, 2012, 06:43:11 PM

Quote

#4 should be qualified to point out that if someone gets a copy of the private keys on the paper wallet, they can steal the coins.

Because the address can be derived via the private key as demo'd on the bitaddress.org website?

Because using the private key, that's how you spend the funds... (and yes, the address can be derived from the private key)

juggernaut76

newbie

Activity: 19

Merit: 0

Quote

#4 should be qualified to point out that if someone gets a copy of the private keys on the paper wallet, they can steal the coins.

Because the address can be derived via the private key as demo'd on the bitaddress.org website?

casascius

vip

Activity: 1386

Merit: 1140

The Casascius 1oz 10BTC Silver Round (w/ Gold B)

Quote from: juggernaut76 on July 14, 2012, 06:09:15 PM

Ok, this has created more questions:
1) Bitcoins exist in reference to a specific address?
2) Wallets are merely a collection of address(es)?
3) A page of addresses printed from bitaddress.org is a paper version of a wallet?
4) This paper wallet exists independently of any other wallet and is hack/theft proof, unless someone steals the paper?
5) Is a casascius coin essentially a physical wallet?

All statements are true. #4 should be qualified to point out that if someone gets a copy of the private keys on the paper wallet, they can steal the coins. Potential vectors for theft include malware on the computer used to print them. There is no malware risk on Casascius Coins as I used a freshly formatted computer to produce all of the keys, and then repeatedly overwrote all sectors on the hard drive, and that computer had no network access at any step of the way.

juggernaut76

newbie

Activity: 19

Merit: 0

Quote from: casascius on July 14, 2012, 05:24:36 PM

Quote from: juggernaut76 on July 14, 2012, 05:16:19 PM

Casascius,
So, you create a new paper wallet every time following a transaction? I've got to read up on this idea.

P.s. your physical Bitcoins are fantastic, I love the idea!

I just print off a ton of them in advance so I don't have to create a new one. For example, I can print 7 unique addresses to a page at Bitaddress.org, and I can just as easily print a dozen pages that'll last me a while.

I simply send bitcoins to the first address and write how many BTC it contains. When I need to spend them, I import them, send off the coins, and make sure the change goes to the next address on the list. I write the new amount in spot 2, and cross out the first one. After all 7 spots are used, throw it away and use a new page.

Result: minimum exposure of online bitcoins.

Ok, this has created more questions:
1) Bitcoins exist in reference to a specific address?
2) Wallets are merely a collection of address(es)?
3) A page of addresses printed from bitaddress.org is a paper version of a wallet?
4) This paper wallet exists independently of any other wallet and is hack/theft proof, unless someone steals the paper?
5) Is a casascius coin essentially a physical wallet?

casascius

vip

Activity: 1386

Merit: 1140

The Casascius 1oz 10BTC Silver Round (w/ Gold B)

Quote from: juggernaut76 on July 14, 2012, 05:16:19 PM

Casascius,
So, you create a new paper wallet every time following a transaction? I've got to read up on this idea.

P.s. your physical Bitcoins are fantastic, I love the idea!

I just print off a ton of them in advance so I don't have to create a new one. For example, I can print 7 unique addresses to a page at Bitaddress.org, and I can just as easily print a dozen pages that'll last me a while.

I simply send bitcoins to the first address and write how many BTC it contains. When I need to spend them, I import them, send off the coins, and make sure the change goes to the next address on the list. I write the new amount in spot 2, and cross out the first one. After all 7 spots are used, throw it away and use a new page.

Result: minimum exposure of online bitcoins.

juggernaut76

newbie

Activity: 19

Merit: 0

Casascius,
So, you create a new paper wallet every time following a transaction? I've got to read up on this idea.

P.s. your physical Bitcoins are fantastic, I love the idea!

casascius

vip

Activity: 1386

Merit: 1140

The Casascius 1oz 10BTC Silver Round (w/ Gold B)

Just as an alternate take - I principally use paper wallets to manage bitcoin. I bought a USB QR code scanner that imitates a keyboard, so for me, moving bitcoins from and to paper wallets is trivial.

Even though it's not what I use for funding Casascius Coins, Blockchain.info is more than satisfactory as a way to move bitcoins to and from paper wallets. When you import a paper wallet, the bitcoins are available for spending instantly, and you can spend some and then move them right back off to a brand new paper wallet. So for Blockchain.info to burn you, they'd have to burn you exactly during the 1 to 5 minutes your coins are on their servers... assuming they are lying about your coins being only in javascript in your browser in the first place.

juggernaut76

newbie

Activity: 19

Merit: 0

Curious, how large are the wallet files when backing them up?

Khanduras

full member

Activity: 168

Merit: 100

Movin' on up.

Again, that's why you should always back up your wallet. I copied mine about seven times across different trusted mediums.

juggernaut76

newbie

Activity: 19

Merit: 0

Well, it's a balance between convenience and trust, as in I don't trust myself to get the whole wallet-security procedure done correctly every time. I'm more afraid I will somehow screw up my own wallet than I am an e-wallet company screwing up my e-wallet.

FreeMoney

legendary

Activity: 1246

Merit: 1016

Strength in numbers

If you want to save an amount that is meaningful to you learn how to safely handle your own wallet. If you convenience for a small amount use an e-wallet. You might want both.

juggernaut76

newbie

Activity: 19

Merit: 0

Excellent. Thanks for the quick replies; this really cleared things up for me.

MoonShadow

legendary

Activity: 1708

Merit: 1010

Quote from: juggernaut76 on July 13, 2012, 06:08:09 PM

So, essentially, backing-up my wallet only protects me from my own mistakes. It serves no protection for me against the mistakes of the e-wallet service?

correct

juggernaut76

newbie

Activity: 19

Merit: 0

So, essentially, backing-up my wallet only protects me from my own mistakes. It serves no protection for me against the mistakes of the e-wallet service?

Khanduras

full member

Activity: 168

Merit: 100

Movin' on up.

Any website, anywhere in the world has to worry about security issues with their servers. It was likely targeted due to the fact that whomever hacked it could get something of monetary value from doing so - but it doesn't mean it happens regularly, or that using e-wallets are insecure.

Whether it was on the internet and stored by someone else or on your own computer it's still something you'd need to worry about. Unfortunately, the internet is not a safe of friendly place.

Backing up your wallet just makes sure you don't lose your wallet. If you lose it, you lose everything that was in it. You should definitely make a backup. If you want to make it more secure, encrypt it.

juggernaut76

newbie

Activity: 19

Merit: 0

Hi,
I've been reading the forum posts about the issues with Bitcoinica today and it is raising some questions for me:

1) I currently do not have any BTC, but I am planning to purchase some and I am interested in keeping it in an e-wallet. Are all e-wallets susceptible to the same problem that Bitcoinica faced today?

2) The e-wallet service I use allows me to back-up my wallet to dropbox or google drive; would doing so save me from an event like Bitcoinica experienced today?

I'm still learning to understand this stuff and I am interested in detailed explanations if anyone is willing to take the time to explain it as it relates to the current Bitcoinica problems.

Thanks,
Jugg

Topic: Noob question about e-wallet security (Read 1282 times)