Security / Be Careful What & Where You Backup

hulla

hero member

Activity: 1834

Merit: 566

Quote from: fillippone on July 29, 2019, 04:29:52 AM

Quote from: BitMaxz on June 13, 2019, 06:02:49 PM

Or burn a CD that includes your private keys and seeds as a safe alternative.

I hardly doubt a burned CD can be deemed as "secure".
I had a good number of faulty CD backup after a certain logn time, with all the data written on those immediately lost.
I wouldn't store anything valuable on a home-burned CD.

I supported what you said cause it something I have experienced before and it hard for me to get over all the important document and private information which worth a fortune lost through private CD burned but what I used now is high-quality flash with fireproof case. However, using the burn CD as s safe alternative is not something bad either

pereira4

legendary

Activity: 1610

Merit: 1183

Printers have become way too comboluted with "smart" tech that they are a massive security hole in your setup. You would need an old printer from the 90's with 0 connectivity outside the parallel port.

Ideally you just want a QR code reader, something like this:

And make sure it doesn't have any dumb smarts on it. It would be next to impossible to crack an air-gapped setup using those guns.

fillippone

legendary

Activity: 2268

Merit: 16328

Fully fledged Merit Cycler - Golden Feather 22-23

Quote from: BitMaxz on June 13, 2019, 06:02:49 PM

Or burn a CD that includes your private keys and seeds as a safe alternative.

I hardly doubt a burned CD can be deemed as "secure".
I had a good number of faulty CD backup after a certain logn time, with all the data written on those immediately lost.
I wouldn't store anything valuable on a home-burned CD.

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Quote from: dothebeats on July 27, 2019, 11:52:56 PM

I mean, it could not be that big of a security issue considering that the attacker only forces the printers to print that text and do nothing else, but the mere fact that people can gain access on a printer surrounded by tight systems is pretty much a sczry thought on itself.

If they can force a printer to print a file, it means they are able to send the file to the printer to be printed. In some cases, and with the right file, being able to send a file to a printer is enough to be able to remotely execute malicious code (example: https://nvd.nist.gov/vuln/detail/CVE-2018-5924). Obviously printer malware could steal the details of anything being printed, including paper wallets, but it can also use the printer to propagate malware through the network and infect other machines with anything from clipboard malware to ransomware. Although it is improving, many network capable printers still have little or no in-built security. It's probably not a big concern for the average user, but it can be a serious vector of attack against businesses and corporations. If you are concerned, you can pick up an old school wired printer for ~$20.

Quote from: dothebeats on July 27, 2019, 11:52:56 PM

It's a cheaper solution compared to a hardware wallet and does any other things apart from just being a hardware wallet, too.

You should be careful doing anything else on the device which is storing your crypto. It should be permanently air gapped, and you should also be very careful plugging it in to any external devices or using removable media such as USB drives, as these can be used to transfer malware. Ideally, you should use it for crypto and nothing else.

dothebeats

legendary

Activity: 3542

Merit: 1352

Cashback 15%

Quote from: o_e_l_e_o on June 11, 2019, 10:40:43 AM

Quote from: Chris! on June 05, 2019, 03:23:50 PM

You can't beat printing it out for security.

You can - writing it down. There exists malware which can run on printers and provide 3rd parties with details of what you are printing. If that includes your mnemonic phrase or private key, then you can say goodbye to your coins.

I remember the "Subscribe to Pewdiepie" thingy whenever I see someone mentions printing something useful/important to them on an affected printer. I mean, it could not be that big of a security issue considering that the attacker only forces the printers to print that text and do nothing else, but the mere fact that people can gain access on a printer surrounded by tight systems is pretty much a sczry thought on itself. Since then, I never made any fresh backups of my wallet printed and stuck to my old habits: taking a dusty 2013 laptop which I never use anymore and store everything there. The hardware is still usable and can hold itself together knowing that I replaced some parts, for the sole purpose of keeping my coins in there.

It's a cheaper solution compared to a hardware wallet and does any other things apart from just being a hardware wallet, too.

DaveF

legendary

Activity: 3500

Merit: 6320

Crypto Swap Exchange

Bumping this because it just came up again.
Also, be aware where your preferred wallet app is putting it's data file.
Running electrum as a stand alone app on your PC? It's putting a data folder on your desktop.
Did idrive / crashplan / mozy just backup your desktop to the cloud?

Did you password protect your wallet?

Paranoid is good.

-Dave

ranochigo

legendary

Activity: 3038

Merit: 4418

Crypto Swap Exchange

Quote from: naska21 on June 16, 2019, 03:03:14 AM

One more reason to not rely on cloud backup services is that they may keep outdated wallet.dat . If my memory serves me right, on default, the capacity of keypool for BitcoinCore is equal to 1000. With each transaction you made the change goes to new address that reduce the number of available addresses in keepool. So if your spending are frequent you may find yourself in situation when the initial keypool is depleted and the "old" copy of wallet.dat (backed by cloud) does not include new addresses.

This is changed quite sometime ago with the introduction of HD wallet. While the wallet can still be run in the legacy mode without the HD function, it is even more dangerous with it being HD. Once the seed is compromised, the seed will remain the same for as long as you keep using the same wallet.dat file or your password is changed.

naska21

hero member

Activity: 1358

Merit: 635

One more reason to not rely on cloud backup services is that they may keep outdated wallet.dat . If my memory serves me right, on default, the capacity of keypool for BitcoinCore is equal to 1000. With each transaction you made the change goes to new address that reduce the number of available addresses in keepool. So if your spending are frequent you may find yourself in situation when the initial keypool is depleted and the "old" copy of wallet.dat (backed by cloud) does not include new addresses.

bob123

legendary

Activity: 1624

Merit: 2481

Quote from: Chris! on June 14, 2019, 05:20:06 PM

I've always understood that different wallets could always use different mnemonic seed phrase types so you can't rely on a seed phrase forever. Any idea which is right nowadays, or is it just personal preference at this point?

For that reason there has been a standard created which has been implemented by most wallets already.
BIP39 (https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki) covers the encoding of the seed into the mnemonic code.

It is highly likely that you will always be able to automatically recover your coins from a BIP39 mnemonic code. And if not, the standard can be read by anyone to recover the seed by hand.

Quote from: jackg on June 14, 2019, 05:48:04 PM

Using an air gapped computer or a live os is a good idea (for improved security, pull the hard drive out of your computer before putting the USB stick in - if possible).

Unplugging the hard drive doesn't do anything for the security.

Since the hard drive isn't mounted at boot, there is no direct risk.
Even if you mount the hard drive, if you are using a windows PC and boot a live linux, there is almost no harm which can be done.

Upon boot, a clean OS is being loaded into the CPU / RAM. The harddrive is just some storage.

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Quote from: Chris! on June 14, 2019, 05:20:06 PM

Yikes. I honestly never thought of that. I'll stop looking for a printing solution and continue writing out my private keys.

You could quite easily pick up an old second hand printer on the cheap to only ever use with your air gapped device. If it is never going to connect to a device with internet access, then any malware which may be on it is essentially nullified.

Quote from: Chris! on June 14, 2019, 05:20:06 PM

With that being said, how do people like storing funds long term? For me I roll dice for entropy, use a downloaded version of bitaddress.org to covert that to a private key then convert that to a bech32 address via segwitaddress.org (all offline on a live usb). Then write out the private keys.

Personally, I use a hardware wallet. Connect it as you are already doing to an air-gapped, clean, live USB device, create a new wallet, and it will generate a seed randomly and securely. Write down the mnemonic phrase it gives you as back-up. As long as you have your mnemonic phrase written down, you could even wipe the hardware wallet afterwards if you really wanted.

As long as you generate a phrase which complies with the BIP39 standard (which both Ledger and Trezor do), then there will always be a wallet available to import your phrase to in the future. Worst case scenario, you can manually use your phrase to work out your seed, and then take it from there.

jackg

copper member

Activity: 2856

Merit: 3071

https://bit.ly/387FXHi lightning theory

A lot of security stuff now is down to personal preference as long as you have something secure..

I used a 3 of 3 multisig with 2 seeds on my phone and 2 seeds on my computer which worked quite well (until I reached the 1kb limit electrum had on qr codes so I went and bought a trezor).

Using an air gapped computer or a live os is a good idea (for improved security, pull the hard drive out of your computer before putting the USB stick in - if possible).

Private keys and seeds both use 256 bits so in theory you can use the same key as a seed that you do for a private key (I know there are ways to import them I just can't think of one but there are quite a few pieces of software out there on github).

Chris!

legendary

Activity: 1382

Merit: 1122

Quote from: o_e_l_e_o on June 14, 2019, 09:43:06 AM

Quote from: Chris! on June 13, 2019, 10:50:08 PM

I guess my only question would be if I'm printing something out on an air-gapped system, shut it down then boot up on another system, would malware within the printer be able to send off what I just sent on a live USB?

Likely? No. Possible? Absolutely.

All modern printers have memory which can be utilized by malware. Many mid to high end printers will automatically store copies of the last x number of documents which have been printed or scanned in their memory. If your printer has an option to reprint previous documents, or re-order documents in a print queue, then it is absolutely storing copies. This problem is compounded with printers which accept removable storage like USB drives or SD cards.

It is absolutely possible to write malware which will keep copies of what is being printed and scanned, with instructions to send them off when an internet connection is re-established. Booting your computer from a live USB offers protection from malware on your PC, but if the malware is on the printer, it doesn't really matter what you are doing with your computer.

Yikes. I honestly never thought of that. I'll stop looking for a printing solution and continue writing out my private keys.

With that being said, how do people like storing funds long term? For me I roll dice for entropy, use a downloaded version of bitaddress.org to covert that to a private key then convert that to a bech32 address via segwitaddress.org (all offline on a live usb). Then write out the private keys.

I hear lots of people saying I should use a mnemonic seed phrase instead but I'm not sure how to generate that with my own entropy source. I see why it would make sense to use a mnemonic seed phrase, since it's human readable and less prone to error, but at the same time I've always understood that different wallets could always use different mnemonic seed phrase types so you can't rely on a seed phrase forever. Any idea which is right nowadays, or is it just personal preference at this point?

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Quote from: Chris! on June 13, 2019, 10:50:08 PM

I guess my only question would be if I'm printing something out on an air-gapped system, shut it down then boot up on another system, would malware within the printer be able to send off what I just sent on a live USB?

Likely? No. Possible? Absolutely.

All modern printers have memory which can be utilized by malware. Many mid to high end printers will automatically store copies of the last x number of documents which have been printed or scanned in their memory. If your printer has an option to reprint previous documents, or re-order documents in a print queue, then it is absolutely storing copies. This problem is compounded with printers which accept removable storage like USB drives or SD cards.

It is absolutely possible to write malware which will keep copies of what is being printed and scanned, with instructions to send them off when an internet connection is re-established. Booting your computer from a live USB offers protection from malware on your PC, but if the malware is on the printer, it doesn't really matter what you are doing with your computer.

Chris!

legendary

Activity: 1382

Merit: 1122

Quote from: BitMaxz on June 13, 2019, 06:02:49 PM

Quote from: Chris! on June 13, 2019, 03:49:59 PM

Interesting. I guess not being able to use my new printer on a live USB is even more secure than I initially thought. Thanks!

You can still use the printer but you must disconnect your computer to the internet forever to transfer the generated paper wallet you need a USB drive and transfer it to your offline computer to print.

Or burn a CD that includes your private keys and seeds as a safe alternative.

Yeah no worries there. I only generate paper wallets on a live USB and only use my own entropy source. My only issue is that my printer's drivers don't work properly for me on a Linux Live USB so I've been writing things out instead.

I guess my only question would be if I'm printing something out on an air-gapped system, shut it down then boot up on another system, would malware within the printer be able to send off what I just sent on a live USB? I hope that makes sense.

BitMaxz

legendary

Activity: 3374

Merit: 3095

Playbet.io - Crypto Casino and Sportsbook

Quote from: Chris! on June 13, 2019, 03:49:59 PM

Interesting. I guess not being able to use my new printer on a live USB is even more secure than I initially thought. Thanks!

You can still use the printer but you must disconnect your computer to the internet forever to transfer the generated paper wallet you need a USB drive and transfer it to your offline computer to print.

Or burn a CD that includes your private keys and seeds as a safe alternative.

Chris!

legendary

Activity: 1382

Merit: 1122

Quote from: o_e_l_e_o on June 11, 2019, 10:40:43 AM

Quote from: Chris! on June 05, 2019, 03:23:50 PM

You can't beat printing it out for security.

You can - writing it down. There exists malware which can run on printers and provide 3rd parties with details of what you are printing. If that includes your mnemonic phrase or private key, then you can say goodbye to your coins.

Interesting. I guess not being able to use my new printer on a live USB is even more secure than I initially thought. Thanks!

joniboini

legendary

Activity: 2170

Merit: 1789

Quote from: o_e_l_e_o on June 11, 2019, 02:11:12 PM

I'm all for not trusting third parties, web wallets, exchanges, and the like, but everyone should be able to trust at least one or two close friends or relatives.

For someone who's always alone all their life, this can be quite difficult haha.

I use multiple back-ups with pretty much a strong password. As long as I don't get keylogged or phished, it should be safe. On top of that, I also encrypt it with a password that I never use or write when I'm online. Hopefully that's safe enough. And I don't use Windows to interact with my crypto, so hopefully, I don't lose my money.

jackg

copper member

Activity: 2856

Merit: 3071

https://bit.ly/387FXHi lightning theory

Quote from: o_e_l_e_o on June 11, 2019, 02:11:12 PM

Quote from: jackg on June 11, 2019, 11:00:58 AM

or give it to a friend or relative you trust but most people on here seem to have relatives that will kill for their money.

Haha, this always seems weird to me whenever threads about security are opened. People talk about using dead man's switches or multi-sig wallets shared among relatives or friends so their next of kin will be able to access their funds if they die. My back up is that my wife knows all my wallets and how to access them. I mean, we sleep in the same bed every night. If she really wanted to do damage to me, crypto would be the least of my concerns Cheesy

. I also have a handful of friends I would completely trust with my life, including all my assets, and not doubt for a second I would get them back in full.

I'm all for not trusting third parties, web wallets, exchanges, and the like, but everyone should be able to trust at least one or two close friends or relatives.

I'm similar, I use friends and family to store physical bitcoins.
If my sister gets ahold of one, she's more interested in counterfeiting it than she is in stealing it Grin

.

I have to watch where the relatives place them as the ones I use are probably more likely to forget where they've left them than anything...

Third parties bring it on themselves not to be trusted, no one runs a reliable trustworthy business that grows (there are a few family businesses that surprises but they're few and far between).

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Quote from: jackg on June 11, 2019, 11:00:58 AM

or give it to a friend or relative you trust but most people on here seem to have relatives that will kill for their money.

Haha, this always seems weird to me whenever threads about security are opened. People talk about using dead man's switches or multi-sig wallets shared among relatives or friends so their next of kin will be able to access their funds if they die. My back up is that my wife knows all my wallets and how to access them. I mean, we sleep in the same bed every night. If she really wanted to do damage to me, crypto would be the least of my concerns Cheesy

. I also have a handful of friends I would completely trust with my life, including all my assets, and not doubt for a second I would get them back in full.

I'm all for not trusting third parties, web wallets, exchanges, and the like, but everyone should be able to trust at least one or two close friends or relatives.

jackg

copper member

Activity: 2856

Merit: 3071

https://bit.ly/387FXHi lightning theory

Even though hardbdrives are really cheap (I have quite a few) it's still a good idea to get somewhere external to store everything.

If you're backups are in your one house then there's clearly a problem... What happens if your house goes up in flames, if your seed is in your pocket it can fall out while you try to leave.

If you follow the password recommendations from anywhere reliable and upload to cloud storage (with double or triple) strong passwords, you can secure your seeds and keys quite well. Alternatively you could burry a hard drive - which will also reduce electromagnetic exposure unless energy lines are underground - or give it to a friend or relative you trust but most people on here seem to have relatives that will kill for their money...

I do keep memorising seeds as I have to recover them on the same machine and I don't think that's too secure either due to then $5 wrench problem...

Topic: Security / Be Careful What & Where You Backup (Read 512 times)