10 ms·

How to protect your cryptocurrency: An in-depth guide

69 points by dcawrey 9y ago

Kardinal 9y ago
I've been trying to get a hold of one of those cold storage thumb drive wallets for a month. Everywhere I look is sold out. I guess people really are catching on to all the advantages you point out in favor of them. Great write up.
- um_ya 9y ago
  Best I know of, is to just make a Tails linux USB drive. It comes with a bitcoin wallet built in.
  - Arubis 9y ago
    That's an excellent tip, thank you!
- Arubis 9y ago
  The shortage of these is so extended that many people (myself included) are trying to profit from it; most hardware wallets are going for 2x-3x retail on AMZN/eBay. I'm arguably part of the problem; I bulk-ordered some Ledger Nano S some time back in hopes of flipping them above retail before they're reliably restocked. Since they're so far backordered, though, I might just end up out my capex (sans the part where I'd have bought one or two for myself anyway).
- StavrosK 9y ago
  There seems to be a shortage of Ledgers, yes. I wouldn't pay 3x the price (which means I'd sell you mine if I didn't have coins on it), but it's easily the best purchase if you have more than a few hundred dollars' worth of coins, or if you're a geek like me. I especially love how it supports multiple cryptocurrencies with the same keys, so I can just store everything in the same place with no hassle.
jordanrobinson 9y ago
Just what I wanted, a modal that blocks the entire page after you've read the first paragraph, asking me to sign up for something vague. Surely the conversion on these can't be good?
- r1ch 9y ago
  It converts pretty quickly into a closed tab...
- thaumaturgy 9y ago
  I browse without cookies enabled most of the time. A very large number of blog-style sites like this one have become nearly unusable because of these damned popups. I'd guess I'm seeing them on 2/3 of these sites now. I'd love to see a uBlock Origin block list for these elements. Hell, I'd pay for it.
  - eco 9y ago
    The Fanboy Annoyances list blocks a lot of these. It should already be in your 3rd Party Filter's list. Just enable it. Edit: Though it didn't block the one on this article...
    - deleted 9y ago
      [deleted]
  - hackermailman 9y ago
    Firefox Focus (Android) blocks all these awful popups/overlays/trackers by default
- StavrosK 9y ago
  Take this: https://alisdair.mcdiarmid.org/kill-sticky-headers/ https://alisdair.mcdiarmid.org/kill-sticky-headers/
- just_one_time_ 9y ago
  I also hate seeing content creators being paid for their work!
joosters 9y ago
A great example of why the whole 'be your own bank' feature of cryptocurrency is not so great a feature after all. These 'how to protect your coins' guides get longer and longer each time another weakness in the system is found. Next month's security guide will have even more steps, and you'd better follow them too...
- fpgaminer 9y ago
  Cryptocurrencies have only been around for 8 years. It's no wonder that we're still figuring out if being your own bank is possible. There's a long road ahead, a lot of innovation to be had. But being your own bank is a worthwhile and potentially achievable goal. Assessing the current state of the system and saying it has failed, at such an early stage, is folly.
  - joosters 9y ago
    How many years should we wait before trusting this technology then?
    - fpgaminer 9y ago
      As many as you need. Cryptocurrencies were easy to use day 1, for people who know what they're doing. The level of technical expertise needed is dropping over time, and will continue to do so. Just as computers were the domain of computer scientists when they first appeared, but nowadays everyone has a smart phone in their pocket. (BTW, let us not forget that everyone thought the idea of a Personal Computer was crazy. It's no wonder that people today think the idea of a Personal Bank is crazy.)
- ilitirit 9y ago
  I agree that it's complex for the layman, but in reality it's really simple for anyone familiar with how crypto works. Even if they didn't, I usually just explain it like this: Your account number is made up of two parts - one part lets you view and deposit, the other lets you withdraw. You can give the first part of your account number to anyone (if you don't mind seeing how much money you have), but you should keep the second part you keep very safe. In fact, once people hear that the second part (the private key) allows you to withdraw, they don't even need to hear the rest. For many people though, they don't like the idea that people who can deposit can also view amounts and transactions. I guess that's why cryptos like Monero are worth looking into.
nirmalkant 9y ago
Excellent piece of work.
dabeeeenster 9y ago
The main issue I have with wallets, which is not really addressed in the article, is that the wallet formats seem to be continually changing. Will the software work with your wallet format in 10 years time when you finally want to cash in your coins? What do you do if it doesn't?
- luismmolina 9y ago
  Changing??
- fpgaminer 9y ago
  You stick with open source wallets; problem "solved". Obviously having to dig up old software and potentially having to make modifications to extract what you need from them is not ideal, but at least it's possible. That said, the lowest common denominator methods of storing coins long term are pretty stable. They're just paper/metal/stone tablets/flesh with a 256-bit key encoded on them. Hard for that encoding to age any worse than, say, floppy disks which you can _still_ buy drives for today.
- nannal 9y ago
  Your private keys will always work.
  - Retric 9y ago
    Assuming no crypto vulnerabilities are discovered.
    - meesterdude 9y ago
      While yes it's prone to various known/unknown attack vectors, and each crypto has a different surface area (like ethereum's smart contracts) The public/private key being one of them is unlikely. Computationally, cracking that takes a monumental amount of computing power that doesn't exist yet.
    - just_one_time_ 9y ago
      Throwaway comment
joosters 9y ago
So protecting your coins relies upon trusting the websites WalletGenerator.net and MyEtherWallet.com ?
- andrem 9y ago
  You can do your own: https://github.com/MyEtherWallet/MyEtherWallet https://github.com/MyEtherWallet/MyEtherWallet or https://github.com/MichaelMure/WalletGenerator.net https://github.com/MichaelMure/WalletGenerator.net Recently there has been an influx of scam attacks using forged myetherwallet URLs in all the altcoin slack channels. Using your own is really the better way to go about this. The article mentions ways to run both solutions offline but going to the source is probably the safest way.
- haburka 9y ago
  You download and unzip files from those websites and then run them with the Internet turned off. You can inspect the source code to make sure it's ok. This article is targeted at non-technical users so a solution that relies on downloaded software is good enough. If you'd like a better solution, then I'm sure some research would serve you well.
  - joosters 9y ago
    Realistically, we both know that hardly anyone will check the source code, let alone be capable of spotting security problems or backdoors. Unplugging your machine from the network doesn't protect you either - who knows if the software leaves some temp files around containing your private keys?
meesterdude 9y ago
I think its fitting that blockgeeks.com has a modal block. To add insult to injury, filling it out and submitting, it took a good 15 seconds for my submit to be processed and their modal to autoclose.
dang 9y ago
This site is banned for using a well-known upvote-selling and comment-selling service. Obviously this is a capital offence on HN. I wish everyone would realize that when they do this, it is obvious in the data and not worth the risk. Perhaps someone could communicate to the upvote- and comment-sellers that they're wasting their time? All: Spam votes and spam comments will get your accounts and sites banned on HN, so please don't.
- paradite 9y ago
  Out of curiosity, how do you establish the identify association between the person who submitted the story, the person who manages the site, and the person who engages with the seller that you mentioned? To me it looks like they could be unrelated different parties or even competitors.

69 points by dcawrey 9y ago

I've been trying to get a hold of one of those cold storage thumb drive wallets for a month. Everywhere I look is sold out. I guess people really are catching on to all the advantages you point out in favor of them. Great write up.

um_ya 9y ago
Best I know of, is to just make a Tails linux USB drive. It comes with a bitcoin wallet built in.
- Arubis 9y ago
  That's an excellent tip, thank you!
Arubis 9y ago
The shortage of these is so extended that many people (myself included) are trying to profit from it; most hardware wallets are going for 2x-3x retail on AMZN/eBay. I'm arguably part of the problem; I bulk-ordered some Ledger Nano S some time back in hopes of flipping them above retail before they're reliably restocked. Since they're so far backordered, though, I might just end up out my capex (sans the part where I'd have bought one or two for myself anyway).
StavrosK 9y ago
There seems to be a shortage of Ledgers, yes. I wouldn't pay 3x the price (which means I'd sell you mine if I didn't have coins on it), but it's easily the best purchase if you have more than a few hundred dollars' worth of coins, or if you're a geek like me. I especially love how it supports multiple cryptocurrencies with the same keys, so I can just store everything in the same place with no hassle.

jordanrobinson 9y ago

Just what I wanted, a modal that blocks the entire page after you've read the first paragraph, asking me to sign up for something vague. Surely the conversion on these can't be good?

r1ch 9y ago
It converts pretty quickly into a closed tab...
thaumaturgy 9y ago
I browse without cookies enabled most of the time. A very large number of blog-style sites like this one have become nearly unusable because of these damned popups. I'd guess I'm seeing them on 2/3 of these sites now. I'd love to see a uBlock Origin block list for these elements. Hell, I'd pay for it.
- eco 9y ago
  The Fanboy Annoyances list blocks a lot of these. It should already be in your 3rd Party Filter's list. Just enable it. Edit: Though it didn't block the one on this article...
  - deleted 9y ago
    [deleted]
- hackermailman 9y ago
  Firefox Focus (Android) blocks all these awful popups/overlays/trackers by default
StavrosK 9y ago
Take this: https://alisdair.mcdiarmid.org/kill-sticky-headers/ https://alisdair.mcdiarmid.org/kill-sticky-headers/
just_one_time_ 9y ago
I also hate seeing content creators being paid for their work!

joosters 9y ago

A great example of why the whole 'be your own bank' feature of cryptocurrency is not so great a feature after all. These 'how to protect your coins' guides get longer and longer each time another weakness in the system is found. Next month's security guide will have even more steps, and you'd better follow them too...

fpgaminer 9y ago
Cryptocurrencies have only been around for 8 years. It's no wonder that we're still figuring out if being your own bank is possible. There's a long road ahead, a lot of innovation to be had. But being your own bank is a worthwhile and potentially achievable goal. Assessing the current state of the system and saying it has failed, at such an early stage, is folly.
- joosters 9y ago
  How many years should we wait before trusting this technology then?
  - fpgaminer 9y ago
    As many as you need. Cryptocurrencies were easy to use day 1, for people who know what they're doing. The level of technical expertise needed is dropping over time, and will continue to do so. Just as computers were the domain of computer scientists when they first appeared, but nowadays everyone has a smart phone in their pocket. (BTW, let us not forget that everyone thought the idea of a Personal Computer was crazy. It's no wonder that people today think the idea of a Personal Bank is crazy.)
ilitirit 9y ago
I agree that it's complex for the layman, but in reality it's really simple for anyone familiar with how crypto works. Even if they didn't, I usually just explain it like this: Your account number is made up of two parts - one part lets you view and deposit, the other lets you withdraw. You can give the first part of your account number to anyone (if you don't mind seeing how much money you have), but you should keep the second part you keep very safe. In fact, once people hear that the second part (the private key) allows you to withdraw, they don't even need to hear the rest. For many people though, they don't like the idea that people who can deposit can also view amounts and transactions. I guess that's why cryptos like Monero are worth looking into.

nirmalkant 9y ago

Excellent piece of work.

dabeeeenster 9y ago

The main issue I have with wallets, which is not really addressed in the article, is that the wallet formats seem to be continually changing. Will the software work with your wallet format in 10 years time when you finally want to cash in your coins? What do you do if it doesn't?

luismmolina 9y ago
Changing??
fpgaminer 9y ago
You stick with open source wallets; problem "solved". Obviously having to dig up old software and potentially having to make modifications to extract what you need from them is not ideal, but at least it's possible. That said, the lowest common denominator methods of storing coins long term are pretty stable. They're just paper/metal/stone tablets/flesh with a 256-bit key encoded on them. Hard for that encoding to age any worse than, say, floppy disks which you can _still_ buy drives for today.
nannal 9y ago
Your private keys will always work.
- Retric 9y ago
  Assuming no crypto vulnerabilities are discovered.
  - meesterdude 9y ago
    While yes it's prone to various known/unknown attack vectors, and each crypto has a different surface area (like ethereum's smart contracts) The public/private key being one of them is unlikely. Computationally, cracking that takes a monumental amount of computing power that doesn't exist yet.
  - just_one_time_ 9y ago
    Throwaway comment

joosters 9y ago

So protecting your coins relies upon trusting the websites WalletGenerator.net and MyEtherWallet.com ?

andrem 9y ago
You can do your own: https://github.com/MyEtherWallet/MyEtherWallet https://github.com/MyEtherWallet/MyEtherWallet or https://github.com/MichaelMure/WalletGenerator.net https://github.com/MichaelMure/WalletGenerator.net Recently there has been an influx of scam attacks using forged myetherwallet URLs in all the altcoin slack channels. Using your own is really the better way to go about this. The article mentions ways to run both solutions offline but going to the source is probably the safest way.
haburka 9y ago
You download and unzip files from those websites and then run them with the Internet turned off. You can inspect the source code to make sure it's ok. This article is targeted at non-technical users so a solution that relies on downloaded software is good enough. If you'd like a better solution, then I'm sure some research would serve you well.
- joosters 9y ago
  Realistically, we both know that hardly anyone will check the source code, let alone be capable of spotting security problems or backdoors. Unplugging your machine from the network doesn't protect you either - who knows if the software leaves some temp files around containing your private keys?

meesterdude 9y ago

I think its fitting that blockgeeks.com has a modal block. To add insult to injury, filling it out and submitting, it took a good 15 seconds for my submit to be processed and their modal to autoclose.

dang 9y ago

This site is banned for using a well-known upvote-selling and comment-selling service. Obviously this is a capital offence on HN. I wish everyone would realize that when they do this, it is obvious in the data and not worth the risk. Perhaps someone could communicate to the upvote- and comment-sellers that they're wasting their time? All: Spam votes and spam comments will get your accounts and sites banned on HN, so please don't.

paradite 9y ago
Out of curiosity, how do you establish the identify association between the person who submitted the story, the person who manages the site, and the person who engages with the seller that you mentioned? To me it looks like they could be unrelated different parties or even competitors.