9 ms·

It’s really scary in Bitcoin land. Either you store your coins online and worry about hackers, or you store them offline and worry about burglars, fires, etc.

by nikanj 9y ago

It’s really scary in Bitcoin land. Either you store your coins online and worry about hackers, or you store them offline and worry about burglars, fires, etc. I’m starting to appreciate the government enforced protections a traditional bank account provides.

Johnny555 9y ago
If you can store it offline, why can't you just store it online in an encrypted file using a strong encryption key?
- codewithcheese 9y ago
  A bitcoin 'wallet' is a strong encrypted key. The question is where do you keep that key.
- cdancette 9y ago
  But where do you store the key?
  - Johnny555 9y ago
    In my head? The same place I store the passphrase to my password manager.
    - brucen 9y ago
      With no backup? What if you suffer a massive head trauma (or an unfortunate death), no way to recover your millions of dollars for friends and relatives? I'm guessing people put this stuff in their wills these days, how secure is a will?
      - Johnny555 9y ago
        I have an encrypted file with online banking passwords, account numbers, etc for my wife. It's on a USB stick in our fire safe, and also in our safe deposit box along with a passphrase hint that my wife or daughter would understand, but is not obvious to an outsider.
- teraflop 9y ago
  The whole point of offline storage is to guard against the risk of whatever internet-connected device you use to store your keys getting compromised. If you make a mistake or fall victim to an attack that lets someone steal the encrypted file containing your key, there's a good chance the attacker will also be able to install a keylogger and get your passphrase.
  - Johnny555 9y ago
    If he can run a keylogger on whatever computer you use to unlock your wallet, then it does it really matter whether you store it offline on USB stick in a safe or not.
    - cloakandswagger 9y ago
      That's where hardware wallets like Trezor or KeepKey come into play. Any transactions are signed on the device and sent back to the computer; your private keys never leave the device.
  - babaganoosh89 9y ago
    The way I do it, is have a bootable usb stick with a clean install of Tails OS that has all my crypto stuff. I also have a gpg encrypted seed file on my google drive as a backup with MFA turned on. I don't think offline storage is necessary as long as you're certain your system is clean, which a clean linux install helps.
tellism 9y ago
There are other options in Bitcoin land to protect against theft. If the online wallet uses multisig then it requires a signature from yourself before they can take the funds. If they're hacked then the hacker can't spend the coins.
watoc 9y ago
And no insurance company (understandably) wants to fully cover Bitcoins. https://seekingalpha.com/article/4099912-coinbase-insurance-problem https://seekingalpha.com/article/4099912-coinbase-insurance-...
beached_whale 9y ago
A safe deposit box with the digital copies of wallet may work
skissane 9y ago
I would like to see banks operate Bitcoin accounts. The bank operates its own wallets, you transfer your Bitcoin to theirs (or just buy it from them.) Keeping the Bitcoin safe is their responsibility. If you want to spend the Bitcoin, you can transfer it back to your own wallet, or directly to the payee. You pay them some fee to do this. Now, it has obvious downsides. Less privacy. Easier for the government to confiscate your Bitcoin. The bank could go bankrupt. But, a person might rationally reason that those possibilities are less likely than them stuffing up a wallet maintained by themselves. Especially if it was a major bank that they might reason is unlikely to go broke. Obviously the Bitcoin account would not be government insured so if the bank goes bankrupt you might lose it all. If criminals break into your account and steal your Bitcoin – if it is due to a problem at your end, e.g. a key-logger on your machine, the bank shouldn't owe you anything. If it is because the bank screwed up, they should be liable to compensate you for the loss.
- GhostVII 9y ago
  If the bank is holding your Bitcoin, what is the point of using Bitcoin at all? It is just an extremely inefficient centralized currency at that point.
  - skissane 9y ago
    As an investment. If a person believes Bitcoin is going to continue to go up in value, they might want to buy a lot of Bitcoin, but have someone else manage the safekeeping of that Bitcoin they bought. I'm one of many people kicking myself that I didn't buy Bitcoin years ago when I first heard about it. And now I'm wondering if I should buy some now, because there is a decent chance it will continue to go up (in the long run). But if I could pay a modest fee for someone I trust (like a very big bank) to look after those Bitcoins for me, I might consider it.
    - joe_the_user 9y ago
      Sure, but to say that is to say that bitcoin's "unique investment opportunity" is akin to that of pieces of irreplaceable artistic value ... or tulips of irreplaceable biological heritage. Once people believed bitcoin could be a currency, a medium of exchange that could be used for the ordinary transactions people used ordinary cash for. Now, it's an "investment vehicle" hurdling down the road that gold, natural gas futures and similar things went gone after 2008 when the Fed began QE in earnest. And sure, "it's different thing time."
s_tec 9y ago
There are three widely-used approaches to managing your own keys: 1. Store the keys on your own device, and also write them down on paper as a backup. 2. Store the keys on a dedicated piece of hardware, and also write them down on paper. 3. Encrypt the keys with a username/password and back that up to the cloud. Option 2 protects against all kinds of malware, including keyloggers. The device has its own screen and buttons, so you can see the backup keys and verify the destination of the funds without trusting you PC. For the paper backups in options 1 and 2, there are fireproof options like cryptosteel. Option 3 gives a really nice UX, since it's feels like a standard username/password login. This is what Lastpass does for passwords, but applied to Bitcoin. Keyloggers are still a threat, and if your password is weak, someone might brute-force it in a database breach situation. Depending on your use-case, this may be worth the tradeoff. The company I work for, Airbitz, implements option 3. In our experience, far more people lose funds accidentally than due to hackers (at least with self-managed keys). Therefore, a familiar UX is crucial to helping users retain control of their funds. Plus, most people aren't willing to invest in specialized hardware, at least at first. If crypto-currencies are ever going to go mainstream, there needs to be a software-only on-ramp.
- scoggs 9y ago
  While I tend to fully agree with everything you are saying wouldn't it be a nice side effect if Bitcoin / crytocurrency dominance forced the average computer user to get serious about password creation and management?
nodesocket 9y ago
We should not be supporting these criminals, most likely based out of Russia or China. It's my biggest gripe with Bitcoin. By buying Bitcoin you are indirectly supporting them. Full disclosure: I am biased; a US citizen.
- midnitewarrior 9y ago
  This makes no sense.
  - cloakandswagger 9y ago
    And is subtly racist.
    - IncRnd 9y ago
      Why do you hold that bias? Are you aware that certain parts of the world have large numbers of people who engage in certain types of cybercrime? "All males are human" doesn't imply that "all humans are male."
dogma1138 9y ago
Multiple copies and store them in a deposit box? Like it’s not as complicated as people pretend heck encrypt it again so the wallet file cannot be profiled and store it on a cloud service.
kbody 9y ago
There's a very simple solution if you care about security. Buy a hardware wallet (e.g. Trezor in my example) note down the 24 words that are basically your privatekey. But enable the passphrase (25th word/phrase) which you type yourself and could keep just in your mind. You have the safety of multiple backups for the 24 words and the extra security from burglars and others with the 25th passphrase. https://blog.trezor.io/hide-your-trezor-wallets-with-multiple-passphrases-f2e0834026eb https://blog.trezor.io/hide-your-trezor-wallets-with-multipl... It also serves as a plausible deniability because when you input your passphrase it will never say it's incorrect, it will merely open a different wallet (generate a different private key). Helps with the $5 wrench attack. You could setup a "fake" wallet with some activity and a low amount of Bitcoins, and have a different passphrase for the real wallet with the big amount. BYOB, freedom comes at a price.
- username223 9y ago
  My "bank account" holds "money" "insured" by the FDIC. Enjoy your "freedom."
  - ganeshkrishnan 9y ago
    There is no right or wrong in this. Dollar and Bitcoin have their strengths and weakness. Neither is going to replace other in the near future.
  - kbody 9y ago
    Your tone showcases your emotions. I can send bitcoins to anyone that wants to accept them, anytime. I can send my USD only if my bank permits me to do so and depending on their schedule. That's one of the core values for me, however I can see that people are used to or just fine with their current bank relationships. Thinking that it's either the one or the other that work for everyone is naive.
    - username223 9y ago
      > Your tone showcases your emotions. I doubt you can define or explain those words, but you're welcome to try.
scotty79 9y ago
You can store your bitcoins online (in multiple places for redundancy) in encrypted file you never decrypt. You can still send new bitcoins to that wallet. When you finally do need to withdraw some bitcoins you just set up clean linux system, download the file, decrypt it, make a transfer, encrypt it again and upload (if you don't withdraw often you can skip that because such offline wallet (at least the one generated by bitcoin core client) can handle few dozens outgoing transfers before you need to update it). Then you don't have to worry about burglars, fires or hackers. You just need to worry about remembering your password. And about the portion of bitcoins you keep elsewhere to pay for things or trade.
- IncRnd 9y ago
  > You can store your bitcoins online (in multiple places for redundancy) in encrypted file you never decrypt. > Then you don't have to worry about burglars, fires or hackers. You just need to worry about remembering your password. And about the portion of bitcoins you keep elsewhere to pay for things or trade. This accounts for confidentiality but does not preserve the integrity or availability of the wallet and for those reasons is far less secure than you believe.
  - Nuzzerino 9y ago
    The availability part is addressed if you use this approach for a larger "vault" wallet that doesn't need to make withdrawals often.
pteredactyl 9y ago
Is that sarcasm?
madshiva 9y ago
It's why we pay them too. For the protection first, not only for the interest. It's has been really nice and secure for people since that they have a technology that protect them for robbing. But Bitcoin fan are totally forgoting this point.

by nikanj 9y ago

Johnny555 9y ago

If you can store it offline, why can't you just store it online in an encrypted file using a strong encryption key?

codewithcheese 9y ago
A bitcoin 'wallet' is a strong encrypted key. The question is where do you keep that key.
cdancette 9y ago
But where do you store the key?
- Johnny555 9y ago
  In my head? The same place I store the passphrase to my password manager.
  - brucen 9y ago
    With no backup? What if you suffer a massive head trauma (or an unfortunate death), no way to recover your millions of dollars for friends and relatives? I'm guessing people put this stuff in their wills these days, how secure is a will?
    - Johnny555 9y ago
      I have an encrypted file with online banking passwords, account numbers, etc for my wife. It's on a USB stick in our fire safe, and also in our safe deposit box along with a passphrase hint that my wife or daughter would understand, but is not obvious to an outsider.
teraflop 9y ago
The whole point of offline storage is to guard against the risk of whatever internet-connected device you use to store your keys getting compromised. If you make a mistake or fall victim to an attack that lets someone steal the encrypted file containing your key, there's a good chance the attacker will also be able to install a keylogger and get your passphrase.
- Johnny555 9y ago
  If he can run a keylogger on whatever computer you use to unlock your wallet, then it does it really matter whether you store it offline on USB stick in a safe or not.
  - cloakandswagger 9y ago
    That's where hardware wallets like Trezor or KeepKey come into play. Any transactions are signed on the device and sent back to the computer; your private keys never leave the device.
- babaganoosh89 9y ago
  The way I do it, is have a bootable usb stick with a clean install of Tails OS that has all my crypto stuff. I also have a gpg encrypted seed file on my google drive as a backup with MFA turned on. I don't think offline storage is necessary as long as you're certain your system is clean, which a clean linux install helps.

tellism 9y ago

There are other options in Bitcoin land to protect against theft. If the online wallet uses multisig then it requires a signature from yourself before they can take the funds. If they're hacked then the hacker can't spend the coins.

watoc 9y ago

And no insurance company (understandably) wants to fully cover Bitcoins. https://seekingalpha.com/article/4099912-coinbase-insurance-problem https://seekingalpha.com/article/4099912-coinbase-insurance-...

beached_whale 9y ago

A safe deposit box with the digital copies of wallet may work

skissane 9y ago

I would like to see banks operate Bitcoin accounts. The bank operates its own wallets, you transfer your Bitcoin to theirs (or just buy it from them.) Keeping the Bitcoin safe is their responsibility. If you want to spend the Bitcoin, you can transfer it back to your own wallet, or directly to the payee. You pay them some fee to do this. Now, it has obvious downsides. Less privacy. Easier for the government to confiscate your Bitcoin. The bank could go bankrupt. But, a person might rationally reason that those possibilities are less likely than them stuffing up a wallet maintained by themselves. Especially if it was a major bank that they might reason is unlikely to go broke. Obviously the Bitcoin account would not be government insured so if the bank goes bankrupt you might lose it all. If criminals break into your account and steal your Bitcoin – if it is due to a problem at your end, e.g. a key-logger on your machine, the bank shouldn't owe you anything. If it is because the bank screwed up, they should be liable to compensate you for the loss.

GhostVII 9y ago
If the bank is holding your Bitcoin, what is the point of using Bitcoin at all? It is just an extremely inefficient centralized currency at that point.
- skissane 9y ago
  As an investment. If a person believes Bitcoin is going to continue to go up in value, they might want to buy a lot of Bitcoin, but have someone else manage the safekeeping of that Bitcoin they bought. I'm one of many people kicking myself that I didn't buy Bitcoin years ago when I first heard about it. And now I'm wondering if I should buy some now, because there is a decent chance it will continue to go up (in the long run). But if I could pay a modest fee for someone I trust (like a very big bank) to look after those Bitcoins for me, I might consider it.
  - joe_the_user 9y ago
    Sure, but to say that is to say that bitcoin's "unique investment opportunity" is akin to that of pieces of irreplaceable artistic value ... or tulips of irreplaceable biological heritage. Once people believed bitcoin could be a currency, a medium of exchange that could be used for the ordinary transactions people used ordinary cash for. Now, it's an "investment vehicle" hurdling down the road that gold, natural gas futures and similar things went gone after 2008 when the Fed began QE in earnest. And sure, "it's different thing time."

s_tec 9y ago

There are three widely-used approaches to managing your own keys: 1. Store the keys on your own device, and also write them down on paper as a backup. 2. Store the keys on a dedicated piece of hardware, and also write them down on paper. 3. Encrypt the keys with a username/password and back that up to the cloud. Option 2 protects against all kinds of malware, including keyloggers. The device has its own screen and buttons, so you can see the backup keys and verify the destination of the funds without trusting you PC. For the paper backups in options 1 and 2, there are fireproof options like cryptosteel. Option 3 gives a really nice UX, since it's feels like a standard username/password login. This is what Lastpass does for passwords, but applied to Bitcoin. Keyloggers are still a threat, and if your password is weak, someone might brute-force it in a database breach situation. Depending on your use-case, this may be worth the tradeoff. The company I work for, Airbitz, implements option 3. In our experience, far more people lose funds accidentally than due to hackers (at least with self-managed keys). Therefore, a familiar UX is crucial to helping users retain control of their funds. Plus, most people aren't willing to invest in specialized hardware, at least at first. If crypto-currencies are ever going to go mainstream, there needs to be a software-only on-ramp.

scoggs 9y ago
While I tend to fully agree with everything you are saying wouldn't it be a nice side effect if Bitcoin / crytocurrency dominance forced the average computer user to get serious about password creation and management?

nodesocket 9y ago

We should not be supporting these criminals, most likely based out of Russia or China. It's my biggest gripe with Bitcoin. By buying Bitcoin you are indirectly supporting them. Full disclosure: I am biased; a US citizen.

midnitewarrior 9y ago
This makes no sense.
- cloakandswagger 9y ago
  And is subtly racist.
  - IncRnd 9y ago
    Why do you hold that bias? Are you aware that certain parts of the world have large numbers of people who engage in certain types of cybercrime? "All males are human" doesn't imply that "all humans are male."

dogma1138 9y ago

Multiple copies and store them in a deposit box? Like it’s not as complicated as people pretend heck encrypt it again so the wallet file cannot be profiled and store it on a cloud service.

kbody 9y ago

There's a very simple solution if you care about security. Buy a hardware wallet (e.g. Trezor in my example) note down the 24 words that are basically your privatekey. But enable the passphrase (25th word/phrase) which you type yourself and could keep just in your mind. You have the safety of multiple backups for the 24 words and the extra security from burglars and others with the 25th passphrase. https://blog.trezor.io/hide-your-trezor-wallets-with-multiple-passphrases-f2e0834026eb https://blog.trezor.io/hide-your-trezor-wallets-with-multipl... It also serves as a plausible deniability because when you input your passphrase it will never say it's incorrect, it will merely open a different wallet (generate a different private key). Helps with the $5 wrench attack. You could setup a "fake" wallet with some activity and a low amount of Bitcoins, and have a different passphrase for the real wallet with the big amount. BYOB, freedom comes at a price.

username223 9y ago
My "bank account" holds "money" "insured" by the FDIC. Enjoy your "freedom."
- ganeshkrishnan 9y ago
  There is no right or wrong in this. Dollar and Bitcoin have their strengths and weakness. Neither is going to replace other in the near future.
- kbody 9y ago
  Your tone showcases your emotions. I can send bitcoins to anyone that wants to accept them, anytime. I can send my USD only if my bank permits me to do so and depending on their schedule. That's one of the core values for me, however I can see that people are used to or just fine with their current bank relationships. Thinking that it's either the one or the other that work for everyone is naive.
  - username223 9y ago
    > Your tone showcases your emotions. I doubt you can define or explain those words, but you're welcome to try.

scotty79 9y ago

You can store your bitcoins online (in multiple places for redundancy) in encrypted file you never decrypt. You can still send new bitcoins to that wallet. When you finally do need to withdraw some bitcoins you just set up clean linux system, download the file, decrypt it, make a transfer, encrypt it again and upload (if you don't withdraw often you can skip that because such offline wallet (at least the one generated by bitcoin core client) can handle few dozens outgoing transfers before you need to update it). Then you don't have to worry about burglars, fires or hackers. You just need to worry about remembering your password. And about the portion of bitcoins you keep elsewhere to pay for things or trade.

IncRnd 9y ago
> You can store your bitcoins online (in multiple places for redundancy) in encrypted file you never decrypt. > Then you don't have to worry about burglars, fires or hackers. You just need to worry about remembering your password. And about the portion of bitcoins you keep elsewhere to pay for things or trade. This accounts for confidentiality but does not preserve the integrity or availability of the wallet and for those reasons is far less secure than you believe.
- Nuzzerino 9y ago
  The availability part is addressed if you use this approach for a larger "vault" wallet that doesn't need to make withdrawals often.

pteredactyl 9y ago

Is that sarcasm?

madshiva 9y ago

It's why we pay them too. For the protection first, not only for the interest. It's has been really nice and secure for people since that they have a technology that protect them for robbing. But Bitcoin fan are totally forgoting this point.