Topic: Time to bust a myth. Paper wallets are less secure than normal encrypted wallets - page 6. (Read 12337 times)

Can someone please verify the security of bitcoins I have stored with this method:

0. I copied bitaddress.org source code onto a formatted flash drive.
1. Turned off my computer. I unplugged my computer from the Internet.
2. I booted from a Ubutnu Live DVD.
3. I opened the bitaddress website from the flash drive (not from the Internet, because the computer was not connected to the Internet during this boot up with Ubuntu Live).
4. I printed a bunch of private keys onto paper with my laser printer.
5. I turned off the computer and removed the Ubuntu Live DVD.

(have since printed hundreds of non-bitcoin-related documents from the laser printer, clearing its memory)

Also: I only use they private keys once. If I ever send funds from them, I destroy the private key and never use it again.

Thank you, I am taking this very seriously. I would welcome any information or guidance how to avoid such scenario. Reading your answer I see another problem in Not following basic rule to spend whole amount of BTC stored in Paper Wallet. When you once use your Private key is not "private" any more. I will follow your thread for sure. Thanks.

It's not that difficult to backup your wallet. To do it with electrum, simply create a wallet, write down the seed on paper with a pen (no printers), then do file>save copy and save it in cloud storage. Now you have 3 copies, 2 different mediums and 1 offsite. Electrum backups are forever (except for the labels, you can use the label sync feature if you want to back those up). The seed is at risk of physical theft however, and I wouldn't recommend encrypting it in case you forget your password.


Paper wallets do get hacked a lot but this is usually due to people using crappy software to make them.

However I had a friend who had his paper wallet hacked recently, which is why I decided to make this thread. He typed the private key into his computer to send some bitcoins out of it and a few hours later the rest of the funds on the paper wallet were stolen. We're still looking into what exactly what happened but we found a RAT on his computer so my guess is that the hacker found out he had a paper wallet (he had a copy of bitaddress.org saved on his desktop) and keylogged him entering in the private key and stole the rest of the funds later. There are many other way the hacker could've done this, and I suspect we will see more sophisticated attacks on paper wallets soon.

I found this information very interesting and valuable. I understand it as information what can possibly happen if someone did not follow basic and fundamental steps of security on computer he is using. I would like to understand what is good practice to avoid security break which can allow to steal and send away a private information (private keys).
What I would be intersted as well if there is someone who can confirm he lost Bitcoins from Paper wallet he created as safe Cold storage.

I tend to agree with you. Im more paranoid that the printed paper gets lost/deteriorated than a usb+hd backups.

right. I think it is somewhat of an unrealistic expectation for everyone to backup their wallets in multiple locations and mediums as this level of security is foreign to most people, especially with the advent of cloud storage that allows their documents to be automatically backed up to their cloud service. I am not saying that I engage in this lack of security environment or that it is a valid excuse however it is unfortunately a reality for a lot of people.

I'm not necessarily endorsing review from the foundation. But maybe an open review platform. such as [1]Codereview?

[1] http://codereview.stackexchange.com/

Not really. You still need to trust the people doing the review, which is the same situation we have now. And the Bitcoin foundation is broke and nobody trusts them.

That's a damn good idea

Yeah I wrote that guide mainly for those kinds of hacks because they are the most common. I probably should write more about the issue you describe. You should follow the 3,2,1 procedure when backing up an encrypted wallet, 3 copies, 2 mediums, 1 offsite. You could use a paper wallet as a backup medium, or a CD. You can use this copy of your wallet to restore it if your pc is infected and not risk tracking the malware across.

Paper wallets are useful for certain scenarios such as backups but they are not very useful as a security tool.

It looks to be useful for someone who is trying to secure their coinbase account (for example) or their bitcointalk account, but not so much for a wallet that does not use any kind of central location to keep track of your passwords. For example you could simply enter your email/password on coinbase from a secure computer and change your password to secure that account. However when dealing with an encrypted file (wallet) then you would somehow need to transfer that file from a malware infected computer onto a "clean" computer and potentially risk that you infect the "clean" computer in the process.

Right. Thats why I mentioned atleast an 80bit password. If you are going to use poor passwords despite all the warnings DO NOT have anything to do with Bitcoin as all of your exchange accounts and wallets will be hacked.


I posted a guide before on what to do if you've been hacked, follow that guide and this won't happen:
https://bitcointalksearch.org/topic/edu-what-to-do-if-youve-been-hacked-929882
(I need to still fix that up, I hate that guide).

A paper wallet is physically much smaller, and as a result is easier to hide. Also in the event that you are physically robbed (potentially unrelated to bitcoin) then the attacker is more likely to go after your airgaped computer then a paper wallet. Also by human nature, a computer that is air gaped, is more likely to have a weak password securing it's encryption if any at all. So someone may steal your computer hoping to have something to sell for drug money to fuel their addiction and may end up stumbling upon your massive amounts of bitcoin while never coming across your paper wallet (or even seeing it and ignoring it).

One avenue that a paper wallet is probably more secure is when you are needing to spend your bitcoin and know in advance that your computer has malware. With an encrypted wallet, it is going to be more difficult to get your encrypted wallet to a non-malware infected computer without also potentially bringing the malware with you. With a paper wallet on the other hand, all you need to do is simply find a computer that is secure and not infected with malware.

Another point that you might want to add is the fact that when someone is told they should encrypt their private key with a strong password, they are much more likely to use a weak password when using a paper wallet because they will think that the chances of someone ever getting access to the paper wallet to even try the password are slim

The horrible scenario is: One day you wake up and find out that your coins are gone  

Then you will panic and start to check the security of each step of your operation

It basically falls into two categories:
1. The key generation was not secure
2. The key was stolen

The generation part is most difficult to defend, since there is no easy way to guarantee the true randomness of the key. Even if you have a true random key generated by dice casting, you could still become the victim if the conversion software intentionally provide you a key that software author makes

This concern even applies to hardware wallet, which is even less transparent than those webpages

So, in order to make sure every step is secure, either you rely on some authority (which against the "trust nobody" spirit of bitcoin), or you must be able to review the code that does the actual key generation and conversion. That's why many people dare not to put serious money in bitcoin unless they are good at code review

Maybe bitcoin foundation can act as an authorized code reviewer and publish the certified software and hardware

Simply create a normal encrypted wallet with Bitcoin Core, Electrum or Armory and don't go messing around with private keys or paper wallets. Back it up and use a strong unique password.

I'm going to post a guide that will explain how to set up a very secure and very simple hot/cold storage system. It's not hard at all.

When reading all this I ask myself how can the average non-technical user ever store bitcoin safely ?
You would almost crawl to the necessity of a trusted party to store your keys.

You still need to trust entropy, and due to it being an actual device it is much easier to hide a backdoor in Entropy than electrum. There are added risks of my computer hardware being hacked, but IMO it's more likely that someone will try to insert Bitcoin-stealing backdoors into Entropy then they will try to insert Bitcoin-stealing backdoors into some random-brand laptop. It is also easier to make a backdoor for Entropy because Entropy is a much simpler device and there are thousands of types of BIOS, they would need to write one for my exact type of BIOS, they only need to write one that will work on all Entropy devices.


https://en.wikipedia.org/?title=/dev/random


Live OS's have poor entropy.

Yes, but I don't have to import my whole life savings. Additionally, If I'm especially paranoid I can import it into a live boot OS that has been verified where the practical only risk is an infected bios(highly unlikely).

Yes it can. Read the OP. It can be logged once you type it into your computer to spend it.

a paper wallet made by dice rolls can't be hacked unless someone rolls the dice and gets the exact same results