I was enthralled by one of the recognized bitcoin books, Mastering Bitcoin by Andreas M. Antonopoulos,
[1] so I decided to go through some of his youtube bitcoin playlists and a particular one interested me, The use of the paper wallet, their benefits and how to use them securely.
[2] I was thinking there was going to be an updated video about some dangers of using paper wallet but I didn't find any on the channel until I came across about heist of Bitcoinpaperwallet
[3] that accounted for 124.85 BTC that was swept from private keys generated from the website last year.
How did that happen? Some years back, one of the forum member, Canton
[4], developed a bitcoin paper wallet and a thread
[5] in 2013 as a bitcoin cold storage but eventually sold it in 2018 for undisclosed reasons. Would anyone expect the current admin to keep them safe? Even when Canton advised users to run generator from the Github source code, many users were unaware that there had been a change of ownership. The new owner managed to create a backup saver on the server that stored every private keys created from the website and no one noticed the backend structure even when it was open-source.
Did users think they are safe with the new management? Many were not even aware that there was a change of ownership even when he reminded people to specifically run generator from the Github source code.
There were warnings that were reported here and would have prevented some of the stolen funds, LoyceV created a thread
[6] and alerted the original thread to let others know about the ongoing scam but I presume many who used the wallets are not on Bitcointalk.
What is the point of this thread, exactly? Bitcoin developers have never slept, rather seizing and using each opportunity to improve bitcoin and its network for simplicity and effectiveness. Paper wallets have progressed from a sort of cold storage to a hardware wallet, but they are still widely used. They used to be a good and trustworthy technique of generating private keys, but they have now become literally bad, and also too risky. There are other similar paper wallets websites that are still widely used, what will happen if there is going to be a similar shift of ownership with the remaining ones? Are they presently sweeping Bitcoin from users?
Let's put aside the risk part, practically, using it now as a one of the traditional way of storing BTC poor in the sense that they are not good for security and privacy, they are totally so different from the working principles of Deterministic wallets that are used today. These cool features that concflict paper wallet include:
Privacy and security have a cost, they weren't created for no reason, therefore you should cherish yours. Your transactions are distributed as a file across the every connected nodes, your wallet address always changes any time you spend, and this helps you limit the public from knowing who owns the balance, especially if you are holding a large sum. It also protects you from hackers trying to figure out who is behind a large sum of Bitcoin. This is something you won't find with a paper wallet: if you spend from a single key, your balance becomes public and exposed.
Most wallets are now have a human readable code and are easily to generate as many as possible private keys. Very easy to spend from any addresses because your private keys are secure in a single 12 seeded words ( can also be 15, 18, 21, 24 depending on the entropy). This feature isn't accessible in paper wallets, so you'll have to deal with a slew of keys every time you want to perform a transaction or backup, and switching wallet software will be a pain.
There is still an ongoing debate as to which why javascript random number generator is still not the best option. I checked one of the popular paper wallet git repository
[7] and the last time it was updated was 2016, there is high chance your are likely using a Math.random() and they are not too good random number generators.
[8]Another reason why you should never rely on javascript random number generators that use math functions.
Some of the most common random wallet generators take random numbers from the operating system, such as
/dev/urandom in Linux and
CryptoGenRandom() in Windows and how other popular cold wallet generate good entropies include:
How are Hardware Wallets doing entropy?Trezor is mixing external entropy from computer with internal entropy from built-in hardware random number generator
RFC 6979, and this can be verified on their github page.
Ledger wallet is using Random Number Generator from their closed source Secure Element to generate mnemonic seed with AIS 31* certification.
ColdCard have the option for using internal true random number generator from their secure element or to use D6 Dice Rolls that can be verified. Verifiable Seed Generation.
Keystone (ex Cobo) is using Random Number Generator from their open source Secure Element and it can generate seed with casino-grade dices. Verifiable Seed Generation.
Passport wallet is using Avalanche noise source, an open source true random number generator. Verifiable Seed Generation.
Bitbox is using five different entropy sources from factory setup, secure element, regular chip, computer and device password, everything is open source and with latest update you can roll dices for verifiable seed generation.
Safepal is using closed source secure element for random number generation with AIS 31* and FIPS PUB 140–2** certification
BC Vault uses built-in hardware gyro sensor and various timings with human shaking the device for random number generation.
Jade wallet is mixing internal entropy from built-in hardware random number generator and various other things with companion app entropy.
Onekey mini uses internal random number generator that satisfies NIST SP 800-90A/B/C; CSPRNG is used to guarante the quality of randomness, which is equivalent to DIEDARD TEST, FIPS 140-2, TEST U01 test criteria.
This is cool feature are available in almost popular cold and hot wallets such as Bitcoin core
[9], Electrum
[10] and other hot wallets especially ledger.
[11] An advanced features that enable you to spend from a particular address, you dont have to aggregate all over addereses just to spend a UTXO, a single address or more is adequate to spend depending on quantity your are willing to sign and lock on receiver address.
Source:
https://nopara73.medium.com/coin-control-is-must-learn-if-you-care-about-your-privacy-in-bitcoin-33b9a5f224a2Soure:
https://support.ledger.com/hc/en-us/articles/360015996580-Using-Coin-control?- You may have to deal with additional issues when using paper wallets as storage, such as avoiding fire, theft, and deciding where to store them. When dealing with paper wallets, there is a high level of security in your hands.
Hot wallets might not be the best alternative for paper wallet but you have less headache to worry about. Better still, get a hardware wallet, they are affordable and outstanding cold storage for those who want their btc to be offline.
Avoid paper, cheap things may cause you big sometimes.
[1]
https://oiipdf.com/mastering-bitcoin-programming-the-open-blockchain-oreilly-2nd-edition-2017[2]
https://www.youtube.com/watch?v=cKehFazo8Pw[3]
https://www.coindesk.com/tech/2021/02/24/bitcoinpaperwallet-back-door-responsible-for-millions-in-missing-funds-research-suggests/[4]
https://bitcointalksearch.org/user/canton-39021[5]
https://bitcointalksearch.org/topic/the-official-bitcoinpaperwalletcom-thread-updates-and-news-169836[6]
https://bitcointalksearch.org/topic/m.54525886l7]
https://github.com/pointbiz/bitaddress.org[8]
https://hackernoon.com/how-does-javascripts-math-random-generate-random-numbers-ef0de6a20131[9]
https://bitcoinelectrum.com/how-to-spend-specific-utxos-in-electrum/[10]
https://bitcoinelectrum.com/how-to-spend-specific-utxos-in-electrum/[11]
https://support.ledger.com/hc/en-us/articles/360015996580-Using-Coin-control?