Topic: SEED storage on digital media. (Read 795 times)

Yeah, my commitment to developed scheme remains strong. Following your advice I have acquired very useful stuff - FNB58 USB tester which ^{as I think}  will help to avoid damage ^{resulted from the faulty  port} for both my HW dongles and encrypted media:


I also took into account the potential bit-flips ^{resulted from cosmic rays},  events  which happen sometimes and to mitigate this I have extended my armor by two  Samsung Pro Endurance microSD cards and spread my digital storage over the world  to my friends and relatives. I intend to buy at least one-two card/flash-drive each coming year and spread them also. ^{Such doing is affordable for me.}

I had a local Spectrum clone back in the nineties, it was the machine for my first "computer" games and my first lines of code. But I've sold it at some point. I am not sure I'd know where from could I buy one now if I'd want to - I mean in my country.

While indeed, you may find old hardware at enthusiasts one may need to be inclined toward such "circles" in order to know about them. The heirs may not know if their struggle will pay off and may give up early.
And back to ZX Spectrum: I know for sure that my kids would have quite a hard time to figure out they can feed the computer with programs from audio cassettes 

So I stick to the advice of also keeping it physical, no matter how one wants to play and test.


OP is an enthusiast, and while he does like to play with stuff, he already took my advice to think properly on an inheritance plan (at least he wrote that).

---

Actually for signing a Tails stick is just fine. Or a SeedSigner is not that difficult to build.
..Just this topic is about long term storage of a seed, and some insist on digital storage, and more than just for test/fun.

Aside from what other member have said, there are few others uncommon reason such as.
1. The HW company or official seller can't ship to your country or region.
2. Don't want to leave any trace or history that they buy or own hardware wallet.

ebay has a shit ton of obsolete gear.

I sometimes list old clean hdds at a high price with an offer option.

I say that these can be used to recover old hdds if you are in the business.

Ie dissasemble my working old drive and the indentical dead old drive.

lift the disk from the old dead drive and put it in my working old drive.

I have sold about 20 old hdds this way to different hdd recovery people.

No matter how digitalized the world is, there is no escape from the physical world and at least 1 backup should always be physical.

If you look a little into the past (in time), then before CD/DVD, magnetic tapes were used, which, if you really want to, can still be found, as well as playback devices. Retro devices even 40 years old are now not a problem to find and use. Take, for example, the same ZX Spectrum. Of course, buying technically obsolete devices will be a little more difficult than a regular purchase in an electronics store, but still, it is possible. Therefore, even if USB ports change in 10 years (or more) (Type-C already differs from USB 2.0-3.0), then you can still find retro devices on the market, which will become modern technology. And regarding the fact that children will not know how to use USB, the Internet will increasingly accumulate knowledge and this information will certainly be stored on the network. Knowing that a parent \ relatives in the distant past had a bitcoins, these children will find a way to use USB.

Thanks for your  appraisal, you will not waste your time in the course of diving into this technique.

BTW, I have refill my Tails ammo ^{(which keeps my SEED and other sensitive info)} with two  Samsung Pro Endurance microSD cards with  enterprise grade NAND cells that  "stands up against magnets, X-rays, water, drop and  wearout"

That's something I completely agree with.
My concerns are on the fact the digital backup is indeed safely made and stored and that a complicated approach may become "too complicated" even for yourself in case something unexpectedly bad happens.
But yes, creativity is nice.


Well said.

I like the idea of ​​creating encrypted digital backups, I like seeing people's creativity. I have developed my own method that offers good plausible deniability and resistance against brute force attacks.

Simple works, but it depends on the person's point of view, whether they feel comfortable with "simple" or want something more complex. The important thing is to sleep with peace of mind.

OP I visited this topic in the past, but I didn't get it in detail, just in general. One day I want to understand everything, but from what I saw it seems cool and ingenious.

Because we have the skills.  



I'm the owner of Passport2 and shared bunch of tips on this device here on forum. Just look at my history.




The primitive media like "fire, water and impact resistant metal plates" doesn't allow to share it  with SEED among geographically distant relatives ^{(as they can easily peep up my SEED)}. My sophisticated media can be distributed with no worry  about SEED safety ^{(as a matter of fact I shared it with my distant) relatives)}.



I'm sharp enough, don't worry  

I seriously don't understand one thing, why do you guys try to make things harder? Just buy a ColdCard or The Passport Foundation wallet, both of them are air-gapped, then write down seeds on fire, water and impact resistant metal plates or just shop on Trezor's website and you'll find other safe creative storages. And that's all, your wallet is generated and stored safely. Why should you make process harder and have a headache when you can super simplify everything without losing protectability?

That's a very good warning but in the first case, he shouldn't make things hard when there isn't necessity of it, especially when the pros don't outweigh the cons, i.e. the risk/safety ratio is worse in this case.

I didn't try any other alternatives, thus I can not take the responsibility for the consequences of the use of other software.  However to generate your security key you may use ^{(as I did)} the following commands  instead of using Kleopatra (^{which in fact the interface for GnuPG)} for this purpose:


Take care of the secret key you have exported.^{(I have encrypted mine with HW pgp and keep it in Tails persistent volume)}

What alternative software do you think could be used instead of Kleopatra and KeyPassXC?

I use YubiKey 5 series dongles which among other protocols support OpenPGP 3 ^{(however I can assume that there are other dongles whch sopprt openPGR, just DYOR).} Regarding on how to use them, please see my opening post which described step-by-step procedure on how to  set the security key  to your YubiKey. Should you have any further questions, feel free to ask me.

Can I ask you to elaborate on the "hardware pgp keys", please? How do you suggest making them? How to use and update them step-by-step?

Well, this is highly, highly unbelievable scenario to happen,  nevertheless I have took it seriously and to prevent it I will buy in the nearest future  USB tester to control voltage on D+ and D- lines. Have seen this stuff recently  on Amazon, the price around $50 is not to worry about. Thanks.

P.S. In this scenario applied to my setup, USB pens with Tails would get damage   first, rather than HW pgp keys.




Should USB be replaced by new interface my private pgp key can be easily ported. HW is just a holder of that key.

BTW, two of my HW keys have NFC interface alongside with USB.  

Let's say a very bad case of bad luck and every time and every laptop you try to use to read any of those USB key it breaks them. What then? How confident would you feel when the second one is already broken and you still didn't manage to make more backups? Yes, I know, it's extreme... Still, I recommend some physical means too as backup.

We are in 2024. USB is still widely used, but various flavors tend to change the trend. I would not be surprised if in 10 years already the USB port will not look like now. I expect USBC, for example for the port. Plus: 25 years ago CD/DVD was a thing, now it's no more; are you sure your kids or nephews will know - when the time comes - what to do with an USB stick? Will you be sharp enough in 20-30 years to change the storage (from USB stick) to something that will be then "in trends"?

I will only add this Star Trek classic: https://www.youtube.com/watch?v=hShY6xZWVGE

Really intrigued because those keys are crucial for my guarding system.  What may be wrong with HW  keys that hold my pgp secret? Don't say about physical damage. Should this happens with any  key it can be easily replaced. In fact their quantity can be increased at any time but I don't see the need for keeping more than three keys  at the moment.



You can guess yourself  

While I don't fully agree with your trust in the USB keys (even if they're 3 of them), I do think that this "inheritance model" is better than the lock time approach.

Are we indeed talking about a significant amount that deserves the hassle of paid legal service, or are you talking about a hypothetical future scenario? (Clearly, you don't have to answer me on this, it's something you have to think/answer to yourself, you know..)

Lock-time transactions for inheritance is awkward stuff in my view as they required a constant renewal while you alive. Besides, any legitimate inheritance plan must contain the legal  strand.

In my case, the relevant flash drives, PIN to HW pgp keys and detailed instruction will be handed over to heir by me in person,  while he will get the envelope with those physical pgp keys  from representatives of the legal service I have contracted with.

I know you are very technical man, more than me, and I believe you knew about these risk very well. There are public cases like CEO of an exchange years ago suddenly died and he is the only one who control treasury of that exchange. Maybe more cases like this, I could not remember them all, from business level to family or individual level.

With individuals, they can learn from Hal Finney who has a chronic disease and prepare for his wife to inherit his Bitcoin private keys and bitcoins. You can do the same for ones you love, wife/ husbands, children, ...

[1] Crypto CEO dies holding the only passwords that can unlock millions in customer coins
[2] Quadriga CEO's widow speaks out over his death and the missing crypto millions
[3] Bitcoin and me (Hal Finney)
[4] Using Locktime for inheritance planning, backups or gifts

Yeah, I know that they can may break down. That is why I'm testing each of my cloned flash drive regularly on the month bases. It's highly unlikely that all three will fail simultaneously  because of poor workmanship, thus if  any of them  were noticed as corrupted it  could be replaced by other clone.



Agreed, this is the weakness of human being whose  memory is vulnerable to deceases, hard accidents and senility.

Thus, I'm in the process of development of the inheritance plan, just for above reason.

It's an interesting setup and I kinda like it. And 3 copies sounds good.

Still... flash drives can get corrupted a bit too easy for my liking. I mean I had to reformat or throw away at least 10 USB disks in the last 20 years... and we're talking about very long time here, right?
This is the issue with electronic devices. They can get broken easier than more physical stuff.


I will add that age or an accident or stroke can make you forget the passwords/PINs you've used there.


These are the weak spots I've seen.

For those who have the courage  to try my method I  share a trick on how to unite in friendship Kleopatra and hardware pgp keys that hold the same secret but have different ID.

The problem is that each HW pgp key has its own unique ID and by  keeping the last used ID in the cache  Kleopatra refuses to work with other clones of HW key.

The work around is the following.

• 1.  Before importing public pgp HW key into Kleopatra remove default keys which come with Tails distribution ( they are developers keys and    become not necessary for your purpose)
• 2.  Insert any HW key from your cloned set
• 3.  Import relevant public key
• 4.  When  being asked about certification choose Cancel
• 5.  Right click imported public key and select Change Trust
• 6.  Choose "It's my certificate"
• 7.  Proceed with your tasks involving inserted HW key: decryption, encryption, signing, verifying what ever you want.
• 8.  After completing your tasks remove you HW pgp key.
• 9.  Right click public key and select Remove
• 10.Close Kleopatra
• 11 .Next time when you open Tails you will have the   pure untouched Kleopatra that doesn't remember HW keys ID. So you can proceed with any key from your cloned set referring to 2 - 10 in this list.

Recently, i made a thread suggesting creating/importing seeds in wallets like Electrum or Sparrow, as they allow you to export encrypted digital backups.

Security tips for making encrypted backups of your seedphrase.

I completely support your idea!  Seed storage on digital media is a crucial topic, we definitely need more threads like this on the forum.

Mantra.

Never recommended by whom, by you?

 Then, don't use it.


Wise people use for this airgaped Tails which doesn't contain any malware including  keylogers , wooden headed folk utilize devices  and OS that have keyloggers.
Regarding,  IronKey Vault, all typing must be done on airgaped machine, it goes without saying, beside IronKey Vault has the build-in virtual keyboard.
Do you have any experience of working with Tails and/or airgapped machine?


Empty words in fact that tell nothing. Tell better how they can leak from my system.


Yeah, yeah , and better on the other planet, let's say on Mars for instance.
 
In fact digital form of storage should be a companion for primitive one, which in my case is a binary code hold on  titan washers .

---

Further on, any referring to primitive forms of SEED storage in this thread will be considered as offtopic. Tread is solely  for the discussion of best methods to store SEED on digital media.

I have shared my SEED protected by described way to close relatives (geographically distant by hundreds miles)  and don't afraid that they or any other folk can get my phrase. They have only flash drives with Tails but all  set of HW pgp  clones  is in my hand.

SEED phrases stored by primitive way can not be shared with other people without revealing them.

It is never recommended to store your seed phrases in any form of digital media, not even using PGP encryption. You never know, you may lost the secret key file and if you lose then you lose the pass phrase. You also is going to type the seed in the digital media, you will never know if there is a keylogger installed in your device. For any form of digital storage, you always have chance to leak your private key.

It's always better and recommended to store you seed in digital form and it needs to be a fireproof solution.

For not tech savvy people, like you, who wanna use digital media for storing sensitive info like SEED phrases, passwords, etc   I would advocate off-the-shelf products like those produced by Kingston.

I have their flash drive from IronKey Vault Privacy 50 Series and must confess that having AES 256 encryption as well as protections from both bad USB and brute force  it may be considered  as a good digital media stuff for storage  SEED phrases . The only drawback I see is that it is not friendly with Linux and works solely on either Windows or Mac OS machines.

My approach is a bit complicated as in fact it has three layers of protection which might  be looked as overkill.

I saw this notification on the bitcointalk supernotifier and it caught my attention because I have done a DIY Seed Storage on a soda can Inspired by Pmalek's Guide. I would have really loved to try this but I am not a tech savvy person. The only software I recognize there in the write up is Kleopatra which I used one time when I learning to sign a message courtesy of bitcoingirl.

With this contribution I'd like to share my latest "innovation": a method I've implemented  for storing my SEED phrases on digital media.

For this purpose, I use the bootable flash drive holding  Tails OS with  all communications drivers locked. Persistent volume of this OS is  secured with a compound password i.e part of this password is  stored in a hardware security key and enters unlocking field via its OTP interface , while other part is entered manually at unlocking volume. HW security key is aimed also for storage  my private ed25519 PGP key.

The persistent volume keeps   KeePassXC database, locked with a composite password that includes a segment stored in HW key. This password differs from that one safeguarding the Tails persistent volume.

The KeyPassXC database houses encrypted GPG messages corresponding to my SEED phrases. These messages are encrypted using my PGP hardware key (smart card in terms of Kleopatra), which is protected by a PIN code. Notably, only two incorrect PIN attempts are permitted; a third incorrect attempt will result in the blocking of access to the PGP key.

For anyone interested , I  provide ppg code for setting up hardware keys.



The corresponding public key is imported into Kleopatra key manager with database situated within the persistent Tails volume.



Consequently, by utilizing Kleopatra and a hardware key, one can decrypt/encrypt SEED phrases  and securely add  encrypted messages  to KeePassXC database.

In practice, I maintain three cloned Tails flash drives and three hardware keys, each serving as a backup for the others.

I welcome any constructive criticism regarding potential points of failure or unknown vulnerabilities in my system.

---

Picture shows my Tails flash drive (in the form of debit card, metal frame)  and pgp HW key