Topic: Paper wallet on Android phone - page 2. (Read 572 times)

It's not always as simple as that, though, and installing a custom ROM can open you up to a variety of other risks instead: https://www.privacyguides.org/en/os/android-overview/

A fer better option is simply not to use a phone for any serious amounts of money at all. It is very easy to download and flash Tails to a USB drive and use a live OS with your internet disconnected, which will be exponentially more secure than any hot wallet on any phone, stock or custom ROM.

You should obviously keep your OS up to date, but if you are generating keys on an online computer then you should consider those keys as having as low a security as any hot wallet, regardless of your OS. I wouldn't use an old OS since there have been plenty of examples of ones with bugs or vulnerabilities in their random number generators. Better to use Tails (or some other reputable Linux distro) as above.

It's one of the reasons I always suggest installing custom ROM on it, which remove the bloatware, and Google applications if you wish. I personally, have a phone that doesn't have Google installed on it. I use Aurora store or F-Droid to get the applications I absolutely need, which quite honestly isn't many at all. Usually, Firefox, and a few open source applications from F-droid.

At the very least, use adb to remove some of the bloatware if you don't want the instability which sometimes comes with custom ROMS.

It's also a rather dangerous assumption, knowing that manufacturers have installed bloatware in their modified android operating system, which they almost always advertise as stock Android. Here's just a few examples:

https://www.wired.co.uk/article/android-phones-hiding-pre-installed-malware
https://www.cnet.com/tech/mobile/android-malware-that-comes-preinstalled-are-a-massive-threat/
https://www.independent.co.uk/tech/android-malware-phones-infected-samsung-galalaxy-s7-nexus-5x-models-before-sale-a7626726.html

Anyway, that's just a few examples that a quick search yielded.


A few questions;
- Can you be sure that those old devices haven't already been compromised
- Can you be sure that the disks/flash cards are secure
- Are you generating them offline, because I'd be more confident with an updated operating system if it was going online, however again probably better offline in the first place

That's quite an assumption! The thing is: you can never know for sure. And when creating cold storage, being wrong means losing your money.

I think so too. But I prefer to know for sure, which means not taking any risks.

I see no reason to be less careful with 1 Bitcoin than with 100 Bitcoins.

How long is that long-term holding? And why should your friend remove bluetooth or wifi parts? I think that's excessive. I don't think that this process should turn into obsessive compulsive disorder. If you bought smartphone in store, if you have never visited malicious websites and have never downloaded malwares manually, I think that your friend will be fine by resetting it and creating a wallet. I don't think that normal person is a victim advanced espionage.

Btw if I had to create a bitcoin wallet where I would hold a lot of bitcoin for a long time, I would use old PC, with old monitor, reinstall old OS from old disks/flash cards and create an address from that computer.

Maybe I'm wrong but if I had to hold a lot of bitcoins, I mean higher than 100, I wouldn't trust modern PCs or Smartphones in any way. But anyways, if he wants to hold 1-10 bitcoin, I genuinely believe he doesn't have to act so cautiously.

A colleague had similar issue and confiding in me I had to suggest he buys a London used computer which ranges around $50-$80 here my part of Africa, for they are very cheaper compared to a brand new one. He got the computer then completely formatted it to a brand new and used it to create the wallet. Since then I haven't gotten any complained from him relating to it, So i assume it worked out well for him.

OP I assume your friend should be able to afford it too since it's cheaper compared to owning a brand new computer, and it's also an alternative for your friend to avoid losing all his informations and data on his android phone by formatting it. For someone that plans to buy a good amount of bitcoin and hold for a long time then this suggestion isn't a bad one compared to using an android phone.

Ahh yes, I misunderstood. I thought you were saying such apps didn't require camera access, rather than such apps are not open source.

But yes, I agree. Even if you decide you trust the Google apps which are bundled with Android (which is insane given their consistent history of invading your privacy and harvesting your data at every level), the amount of third party bloatware on most new phones is staggering. And as I said above, while the average user can uninstall some of it, much of it cannot be removed without root access.

It's one of the reasons why I dislike using phones for any serious money, and the fact that it is significantly harder, if not impossible, to truly airgap a phone. There is no doubt that OP's friend would achieve better security with an airgapped computer running a live OS, but if a phone is the only option, then it makes sense to cover the cameras.

I went back and re-read my post you quoted and I see that I didn't express myself properly. You seem to have gotten the opinion that I was trying to say that not many phone apps require camera access. I know they do. I have manually removed all kinds of permissions (not just the ones requiring access to the camera). Some have to remain though for the underlying apps to function properly unless you turn permissions on whenever you want to use an app and turn it back off afterwards.

I wanted to say that the Android OS is open-source but the Google bloatware and apps by other services aren't. If the system takes random pictures, those who know how to read code should be able to find that in the codebase. It would make Android look really bad if someone discovered something like that. But looking at the code isn't possible with the standard Google apps where you remain in the dark. 

Once you scan the QR code with your airgapped Android Electrum, it loads the transaction on your screen so you can see the addresses, amounts, fee, and so on, so you can easily double check what you have scanned before you sign it. Similarly, you can do the same thing when you scan the QR code of your now signed transaction to be able to double check what you are about to broadcast. You could even just scan the QR code of the signed transaction and decode it immediately, manually double check the decoded transaction, and then broadcast it via your own node or somewhere like https://mempool.space/tx/push.

QR-codes are more or less black boxes to humans. I wouldn't feel comfortable without at least verifying the QR-code with a different (offline) QR-code reader to confirm actually signed what I wanted.
But at least it's possible, so that gives options

Crypto users, not that I'm aware of. There's probably easier ways than to use the camera specifically, since the camera would likely yield unreliable results. It would likely be easier to just install an app which monitors the screen rather than utilizing the camera or compromising the keyboard, which the majority of users use Gboard. However, when users report that they've lost their Bitcoin on their phone, I don't think any official, actual fair reviews have looked at what caused it.

Yeah, it's pure speculation, and I mainly wanted to highlight it's a possibility, and exactly how. There's been reports here which were pre installed by the manufacturer. Although, they tend to be for serving adverts or gathering data.

However, since we know malware is a problem on devices, whether preinstalled or not; it's only a matter of time before we hear about a crypto related attack.

Either.

You would probably be wrong here. Most phones come with a ton of bloatware, not just from Google, but from the phone manufacturer and bunch of their third party buddies who pay to get their bloatware on to your device. Some of this bloatware can be uninstalled, but much cannot without rooting your phone, which most people don't do. Open your phone settings and go to the permissions section and see just how many apps want access to your camera. I think you'd be surprised. Next time you have your hands on a brand new phone, do the same thing. I would expect at least a dozen pieces of software wanting access to your camera, and those are only the ones the OS is showing you, never mind all the hidden system apps and software.

Easily done with Electrum on Android - import an unsigned transaction via QR code, sign it, then display a QR code for export.

I've had a funded Bitcoin wallet on my phone for years, and never lost anything. Installing the wallet offline, writing down the seed words, funding the address, and wiping the phone again will probably be okay. But you'll never be 100% sure.

Has "your friend" thought about how he wants to proceed in the future, when he wants to use his funds? If that includes using the same phone as a hot wallet, it gets riskier. Offline signing is the safest, but I've never done that on a phone.

Do we have any reports it has happened to crypto users or that they have been targeted by whatever party was interested in obtaining their sensitive data? It's not easy to prove and probably not documented so people can only speculate if it's happening and how.

I would do something extra. After creating the useful paper wallet, writing it down (including address), I would ... create one more wallet (with the same name, if asked).
The point is that there's a chance that if you do this the old wallet file gets already overwritten.
I would also format the phone afterwards, but it's known that phone format is not perfect and may be missing some files (I don't know more details, hence that extra step of mine, which may or may not be useful).

These days, Android lets you know when your camera is being used, however the question is do you trust Google? Also, it's worth mentioning, that a lot of phones are actually not unaltered stock Android, instead the manufacturer will install their own system applications on the phone. For example, I used to have a phone which had certain survivial tools preinstalled on it. That came preinstalled on their phones, so I knew that the operating system they were delivering the phones with was altered by them. So, obviously the next step is uninstall, and install a custom ROM on it.

However, it's quite possible that the manufacturer could actually disable this notification when applications are using your camera. I only know this since, a custom ROM implemented it incorrectly, and it wasn't displaying. So, it isn't out of the possibility that a malicious vendor, or manufacturer could do this. If you aren't buying directly from the manufacturer itself, then the third party could easily install a custom ROM intended for malicious purposes.

In short, yeah I believe a malicious actor could potentially monitor your camera for malicious purposes, and it's probably been done.

It comes down to this; do you trust:
- The Manufacturer
- Whoever you bought the phone from
- Google
- Custom ROM developer

You can verify if your Android is stock through a few ways. A lot of ROMS have issues being a certified Google device, however that can be faked. There's also a lot of ROMs which don't change certain things like the version they used. For example, a lot of custom ROMS are built via AOSP treble, and that leaves behind some custom settings, but also some fingerprinting in terms of version name etc.

The preinstalled applications aren't open source, the operating system is at least open source. Things like the SIM card tool, and a number of other system applications aren't open source. Maps, Play Store etc aren't open source. Technically, any one of these could compromise the isolation that Android typically has, since it's been implemented by Google themselves, and a lot of the are system applications which have a little more capability compared to ordinary user installed applications.

Right, my attitude is anything that you can't verify yourself, shouldn't be entirely trusted. Now, going back to the question of the OP; Would I feel comfortable generating a seed on a phone? It entirely depends on the use, if it's a hot wallet only used for storing small amounts, probably. If it's for a cold storage wallet, I'd probably explore alternatives before resorting to this. I'd feel more comfortable with Google Play removed, and a lot of the Google services, i.e using a custom ROM, mainly due to privacy issues rather than malicious suspicions though. Since, ultimately I'm not a massive target.

Also, worth noting the very camera application on your phone, likely is closed source. I use OpenCamera as an alternative, but you don't get features that come with the preinstalled camera application. You can use adb to potentially remove any unwanted applications that can't be uninstalled from within the operating system.

Ultimately, it depends on how far you want to go down the rabbit hole. We know, keeping a clean slate in terms of privacy, and security from the big companies like Google is almost impossible. Almost all of this implies to your computer hardware as well though. Since, you have to ultimately trust Microsoft, Intel, AMD, and the manufacturer. You can replace the operating system, just like a phone, but you ain't replacing the machine code that the computer runs on.

Not too worry you or your friend too much, most of this is rather into it; it's not exactly something that a normal user will worry about, and honestly most people aren't even thinking about this sort of stuff, and plenty of users here have mobile phone wallets which haven't been compromised.

So, it's probably safe enough, unless you're a very big target to malicious attackers or companies. Even, then it's based on pure speculation. Most of us trust our computers to generate our private keys.

Anyhow, what I would recommend your friend do is; make sure he formats it with random data, and not simply using the format option via the operating system or recovery partition.

I see. Do you believe this could be an accidental recording done by the user or something malicious by the phone system or one of the pre-installed Google bloatware on it? If we go back to the Android being open-source, that's the place to look for those who know how to. I doubt any of the pre-installed Google apps are or anything else you install from Google that requires camera permissions. It's not a secret that Facebook and Google record everything you say and then you see ads of the things you talked about on social media for example. 

No, but it could record his hand written seed phrase. No reason to take the risk when the solution is so trivial.

No, you can't. Ideally the phone is either destroyed or remains permanently airgapped from now on (although I am of the belief that without physically opening the phone and removing the necessary hardware a phone is never truly airgapped). However, that does not appear to be an option here, just as the additional steps proposed by Welsh (such as writing over the SD card with junk data from /dev/urandom or accessing the recovery partition) are also not an option here, since there is no computer involved.

As I said above, if OP's friend has a single phone and nothing else, then "this is probably the best he can realistically achieve".

I have two questions.
 
1. Why put tape over the phone's camera? It can't record your screen or your keyboard, and since the person has already used this phone before, he might have taken numerous pictures of himself and others around him. Is it because Electrum requires camera permissions (for scanning QR codes)? Do you have reasons to believe the camera access can be used for something else? In that case the proof must be in the code.

2. What happens with the phone afterwards? If the person will use it with all its features as a normal smartphone, can we really trust that all sensitive data got wiped with the last format? 

Manuel generation might be worth considering. However, since they're a new user to Bitcoin it might be suspect to errors, which could be problematic. I'm just not sure I'd trust the hardware on a phone. Obviously, tons of people have hot wallets on a phone, and ultimately to trust them.

Under a secure environment. Technically, without a computer formatting the SD card might be difficult, because you've got to trust that the phone is actually wiping that SD card clean. Usually, this is handled through the manufacturers recovery process. Depending on your device, you can access it through holding the power button, and one of the volume buttons at boot up. You can do it via the Android wiping process, however personally I prefer writing via /dev/random whenever possible.

I suppose you also have to trust the computer hardware you're using, and ultimately you have t connect the phone to that trusted computer, which could potentially then become untrusted.

While, taking the above into consideration it also applies to formatting the actual phone. Again, the manufacturers recovery partition is usually responsible for this. When you want to install a custom ROM on a phone, you usually replace this recovery partition with a custom one, especially if you're concerned about security, since even when formatting the phone completely, certain manufacturer partitions remain untouched, as well as the recovery. Some of which, make sense since phones usually have custom functions within their machine code to actually work.

So, you've got to trust the hardware in the first place, since even wiping the operating system doesn't wipe all partitions on the phone, just the system or sometimes refereed to as boot.

I'd probably even potentially recommend a custom ROM for the process, one that doesn't rely on Google Play being installed. Might help with privacy considering that phone has to go online at some point to download Electrum. Something like Aurora Store via F-Droid to download it instead.

It probably is for most people. Plenty of people do it this way, and we don't hear about people losing their Bitcoin on mass. So, it's probably okay. If you really want to dive down the rabbit hole, there's a few security issues which might be raised, but honestly there's no perfect way of doing it, since for most methods you have to trust something or some hardware at some point. Even if you manually generate the private key / seed, which is prone to errors, and there's potential security concerns about the way it's generated, i.e making sure it's random. However, there's also the issue of verification, the only way you can verify it is via importing the seed or private key, into hardware.

Dude, phone can't be a paper... ever. 
He can use his old phone (or cheap laptop) as offline wallet and that will work just fine in most cases, it's enough to reset the phone, and install one Bitcoin wallet app.
Then he should remove sim card, turn of wifi and bluetooth, and enable airplane mode, and use QR codes for communication with other devices.
Some people are going extra measure and they are removing components from phones, but I don't think that is needed.

Better option than old smartphone are hardware wallets, he can make his own DIY signing device that are very cheap (starting from few $) or buy official hardware wallet devices (starting from $50).
There are even hardware wallets in form of credit cards, that are cheap and very secure, they can be used in combination with smatphones for making transactions.