3 ms·

I think it is a lot easier than reliably storing say, gold, and yet it is considered not unusual for people to keep some gold or other physical assets of value

by lrvick 5y ago

I think it is a lot easier than reliably storing say, gold, and yet it is considered not unusual for people to keep some gold or other physical assets of value in personal home vaults. Unlike physical assets, you can make redundant copies of digital assets giving anyone not lazy a huge durability advantage. For readily accessible warm wallets not storing kidnapping-worthy amounts, this airgapped pattern can work well for the modestly technical https://github.com/hashbang/airgap/blob/master/docs/HD-Cryptocurrency-Wallet.md https://github.com/hashbang/airgap/blob/master/docs/HD-Crypt... Anyone that wants to learn reliable self custody hit me up. My job is teaching self custody to major fintech companies but anyone asking questions for personal use in public in places like #!:matrix.org I will help for free as I have time.

raesene9 5y ago
The difference between storing gold and crypto, is the range of people that can attack it. With Gold someone has to physically come to the location I've stored it in, that necessarily limits my attacker set. With crypto, if I use a hot wallet the whole world can attack me. And I know you can use a cold wallets and air-gapping, but now you need to get into managing those well. This is possible but inherently not easy for the average lay-person. And yep you can duplicate them, and again I look at how many relatively savvy people have DR incidents where they don't test their backups and restores regulaly and get a nasty surprise when they try a restore and realise they got corruption. All to say, it's possible sure, but I'm not sure for non-specialists I'd say it's a lot easier than gold.
- lrvick 5y ago
  Any non technical person can learn to use a cold hardware wallet like a Trezor or Ledger these days. Anyone that can put a combination into a home vault can use one. I am not aware of anyone who has tried a modern hardware wallet that still argues that crypto self custody is above the abilities of anyone technical enough to use traditional online banking. Once they use a pen to write down the 24 word backup then they can simply write it down a second time, or a third. Store a copy in a safety deposit box or anywhere resistant to theft or fire. Easy. Anyone that can store paper stock certificates can do this only with these the copies are valid.
  - raesene9 5y ago
    So once I've got my 24 word backup, how is that any safer than storing gold? Anyone who could come steal my gold can come take my hardware wallet, could they not? Also the problem with duplicate hard wallet backups is, if I'm understanding it correctly, a thief can take any one of them to access the crypto? If so it's a tradeoff, redundancy against increased risk of loss...
    - lrvick 5y ago
      They can come take your hardware wallet but they can't use it without your passphase/pin and most have a built in self-destruct if you get the pin wrong too many times. Now if someone has an electron microscope and can read the raw memory cells, that is another matter, but not your typical adversary trying to steal for a quick buck at a pawn shop. It is also more durable because gold you can only store in a single location, whereas with a hardware wallet you could put you 24 word backup somewhere hard to access, maybe spread across one or more safety deposit boxes. Then if your funds ever feel at risk, you can simply erase your hardware wallet and go on vacation with confidence knowing you can trivially restore it when you get back with a trip to the bank.
- titoCA321 5y ago
  People don't want to store gold and valuable at home without insurance. There are businesses that will store your gold for you. And yes home robberies do occur along with disasters from flood, quakes, and weather.
  - raesene9 5y ago
    I wasn't suggesting people did want to store gold, I was suggesting that storing crypto isn't necessarily easier or safer than doing so :) That said, as the post I was responding to mentioned there are definitely people who absolutely do store gold. Home robberies and floods do also occur... and those things can take out offline hard-wallets just like they can take out gold.
grumple 5y ago
Just in that list of commands, there are a dozen different pieces of software that a user has to trust not to steal their keys or make some sort of error. I have more faith in the legal system than software I haven't personally audited. So now I have to audit whatever btchip_setup is, ndeftool, and a bunch of other software if I really want technical security. Oh, and if I really want to do it right, I've got to audit the chip designs and inspect the chips to make sure they are to spec and don't have secret cred-stealing hardware. Then you have to trust the hardware storing the data not to fail. But every physical storage medium will fail eventually, so now you need a system by which you create backups and test your backups. And now you have to secure your backups separate in case of fire or technical theft too. It starts to become a part time job very quickly...
- lrvick 5y ago
  The end result is storing 24 english words. You can store them on paper, on a CD, an NFC tag, a stone tablet. Storing words long term is a well understood problem. Do not trust any or this software to generate those words truly randomly? No problem. Use bip39 diceware to literally generate your words with dice. When it comes to not trusting software to convert those words to a keypair deterministically, use NASA dual path tactics. Use two unrelated software suites to convert those words to keypairs and sign a transaction and ensure the final signed payload output from both unrelated toolchains is identical. Bip39 has been implemented in many programming languages. Now you can form strong confidence in your entire supply chain from key generation entropy to a final transaction with perhaps a couple hours of effort. If you are moving millions in value and worried about supply chain attacks the extra effort may be worth it. For most a Trezor or a Ledger used as the instructions that come with it advise will be in fine shape.
  - grumple 5y ago
    How many people on earth would even understand what you just said? It's limited to a (probably small) subset of software experts. For the vast majority of people it's basically "trust the shady nerds and the VCs backing them".

by lrvick 5y ago

raesene9 5y ago

The difference between storing gold and crypto, is the range of people that can attack it. With Gold someone has to physically come to the location I've stored it in, that necessarily limits my attacker set. With crypto, if I use a hot wallet the whole world can attack me. And I know you can use a cold wallets and air-gapping, but now you need to get into managing those well. This is possible but inherently not easy for the average lay-person. And yep you can duplicate them, and again I look at how many relatively savvy people have DR incidents where they don't test their backups and restores regulaly and get a nasty surprise when they try a restore and realise they got corruption. All to say, it's possible sure, but I'm not sure for non-specialists I'd say it's a lot easier than gold.

lrvick 5y ago
Any non technical person can learn to use a cold hardware wallet like a Trezor or Ledger these days. Anyone that can put a combination into a home vault can use one. I am not aware of anyone who has tried a modern hardware wallet that still argues that crypto self custody is above the abilities of anyone technical enough to use traditional online banking. Once they use a pen to write down the 24 word backup then they can simply write it down a second time, or a third. Store a copy in a safety deposit box or anywhere resistant to theft or fire. Easy. Anyone that can store paper stock certificates can do this only with these the copies are valid.
- raesene9 5y ago
  So once I've got my 24 word backup, how is that any safer than storing gold? Anyone who could come steal my gold can come take my hardware wallet, could they not? Also the problem with duplicate hard wallet backups is, if I'm understanding it correctly, a thief can take any one of them to access the crypto? If so it's a tradeoff, redundancy against increased risk of loss...
  - lrvick 5y ago
    They can come take your hardware wallet but they can't use it without your passphase/pin and most have a built in self-destruct if you get the pin wrong too many times. Now if someone has an electron microscope and can read the raw memory cells, that is another matter, but not your typical adversary trying to steal for a quick buck at a pawn shop. It is also more durable because gold you can only store in a single location, whereas with a hardware wallet you could put you 24 word backup somewhere hard to access, maybe spread across one or more safety deposit boxes. Then if your funds ever feel at risk, you can simply erase your hardware wallet and go on vacation with confidence knowing you can trivially restore it when you get back with a trip to the bank.
titoCA321 5y ago
People don't want to store gold and valuable at home without insurance. There are businesses that will store your gold for you. And yes home robberies do occur along with disasters from flood, quakes, and weather.
- raesene9 5y ago
  I wasn't suggesting people did want to store gold, I was suggesting that storing crypto isn't necessarily easier or safer than doing so :) That said, as the post I was responding to mentioned there are definitely people who absolutely do store gold. Home robberies and floods do also occur... and those things can take out offline hard-wallets just like they can take out gold.

grumple 5y ago

Just in that list of commands, there are a dozen different pieces of software that a user has to trust not to steal their keys or make some sort of error. I have more faith in the legal system than software I haven't personally audited. So now I have to audit whatever btchip_setup is, ndeftool, and a bunch of other software if I really want technical security. Oh, and if I really want to do it right, I've got to audit the chip designs and inspect the chips to make sure they are to spec and don't have secret cred-stealing hardware. Then you have to trust the hardware storing the data not to fail. But every physical storage medium will fail eventually, so now you need a system by which you create backups and test your backups. And now you have to secure your backups separate in case of fire or technical theft too. It starts to become a part time job very quickly...

lrvick 5y ago
The end result is storing 24 english words. You can store them on paper, on a CD, an NFC tag, a stone tablet. Storing words long term is a well understood problem. Do not trust any or this software to generate those words truly randomly? No problem. Use bip39 diceware to literally generate your words with dice. When it comes to not trusting software to convert those words to a keypair deterministically, use NASA dual path tactics. Use two unrelated software suites to convert those words to keypairs and sign a transaction and ensure the final signed payload output from both unrelated toolchains is identical. Bip39 has been implemented in many programming languages. Now you can form strong confidence in your entire supply chain from key generation entropy to a final transaction with perhaps a couple hours of effort. If you are moving millions in value and worried about supply chain attacks the extra effort may be worth it. For most a Trezor or a Ledger used as the instructions that come with it advise will be in fine shape.
- grumple 5y ago
  How many people on earth would even understand what you just said? It's limited to a (probably small) subset of software experts. For the vast majority of people it's basically "trust the shady nerds and the VCs backing them".