Bitcoin Forum

I don't know this will help other user in here or not.but this tips is usefull to newbie like me.

1. Keep bookmark trusted website
There are many fake website like a fake MyEtherWallet spread on social media, email and any grub chat.
2. Use secure password while creating new wallet
Use capital letter and number to secure your password. If you want more secure add Symbol in your password
3. Add authenticator
if you using website wallet, add Authenticator to your account
4. Install Anti Virus in your device
Anti virus is very useful to secure your wallet in your computer
5. Don't using google extension that not official
Fake extension can steal your wallet. Like a MyEtherWallet CX

1. This has been popular and many already knew it but it's still a good refresher mostly to the newbies. Don't click a link that you are not very familiar with like MEW but they aren't the only website/wallet that has been targeted by phishing sites. Bookmark all the sites that you have been using regularly.

2. You can also add some numbers.

3. Yes, google authenticator or authy

4. It will help to make your usage protected but there's some virus that can penetrate even you have anti-virus. My say on this is to become a very responsible and vigilant user.

5. Use the trusted ones and don't input your wallet details to unfamiliar sites.

Never send your private keys over email, google drives or enter them in a form. Fake airdrops sometimes ask for the users private key and this is a sure sign of a scam.

If your serious about security your private keys should never be connected to the internet at all.  You should sign all your transactions offline.  You should of mentioned that instead of giving these terrible suggestions.

His uggestions were not terrible. All of them are correct. And they are newbie focused, as you are in a beginners and help board.

On the other hand, your suggestion is useless for a newbie, as you didn't said how to sign the transaction offline. This means nothing for a beginner.

Maybe you are talking about hardware wallet, but you didn't even mentioned it..

So , to sum up, do as op says and use a hardware Wallet. Or Google for air gapped computer ;)

Airgapping a computer's indeed the best way to proceed if you're not willing to buy a hardware wallet. There's a decent article at the bitcoin.it forum (https://en.bitcoin.it/wiki/How_to_set_up_a_secure_offline_savings_wallet) explaining the basics of this process if you're not sure how to go about airgapping a computer as well, though I'm sure there's other guides out there on the Internet as well.

Hardware wallets have been dropping in price quite a bit recently; I can find a Trezor or Ledger for less than $40 on a site like eBay now, though there's always a security risk with those devices even if they appear to be new. If you do choose to buy a hardware wallet, make sure you're making a new seed upon using the hardware wallet for the first time and you're not using anything already written down as the seed- there's still a scam going around where some wallets come with pre-filled seed recovery codes controlled by a scammer with Ledger wallets. Also make sure to reset the device's settings completely upon receipt.

It's definitely a good practice to bookmark authentic websites like exchanges or web wallets, but this won't save you in a DNS spoofing attack. Since sites like MyEtherWallet depend on the centralized Domain Name System, their registries can be hijacked and users served with a phishing site -- even on the official, correct domain. This happened to MEW not long ago (https://www.reddit.com/r/MyEtherWallet/comments/8eloo9/official_statement_regarding_dns_spoofing_of/).

The best solution is to avoid web wallets entirely.

And if you want to be safer, you can simply download MyEtherWallet's source code from their GitHub repository[1] and use that instead.

If we're talking about preventing your password(s) from being bruteforced, then having a password with more characters would benefit you a lot more than just adding symbols here and there on a short password. As much as possible, keep your passwords at 40 characters minimum. Yes, it might be too much to memorize, but here's where password managers comes in. Take a look at KeePass[2].

---

[1] https://github.com/MyEtherWallet/MyEtherWallet
[2] https://keepass.info/

I choose to use GNU/Linux instead of Windows, so this might be an additional option. GNU/Linux is easy to use and it's great for work/productivity unless you want to use your computer for gaming. I've been using Linux for years now and don't plan on going back to Windows (I might buy a new laptop with Windows just for the sake of playing PES).

Antivirus is great but it's also important to learn how to verify file signature. In case of DNS attack, an attacker could redirect you to their site to download a malicious file (which is created with the same look as the original), just like what happens with Electrum (not exactly the same but I hope people got the idea). There's a lot of tutorial on the internet about this, so maybe it's quite easy to learn too.

Hey these are good advices for newbies, recently many users fell for the Electrum wallet scam, where the PC version asked them to update it, many didn’t even realise they were being scammed. I feel if you need to update only visit the official site, and update it from there. It seems you missed one important tip, never do any transactions on a public and unsecured network, 99% chances are your data will be hacked.

i am still not using MYEtherWallet but i think all those tips are good for protect wallet . As like as me newbies are should follow those tips to secure wallet and keep protect from hacker .

I would never consider buying hardware wallet from anywhere, except directly from the manufacturer. It's very sensitive device in terms of security, and I think that saving a few dollars is not worth the risk. Even if user reset device there is always possibility that hackers modify hardware in some way, so you can get completely fake device.

Regarding OP advices, they are good, but in addition to good antivirus every device should have firewall and extra antimalware protection. Such software should be regularly updated with new versions and with daily anitivirus/malware definitions. Also every browser need adblock, it will prevent to user see bad ads when using search engines, and most of them are related to phishing sites and fake crypto wallets.

#1 Should be getting a hardware wallet.

Regarding the MEW attack that happened a few months ago where the DNS was hijacked and many users who logged in lost their tokens. Those who had hardware wallets like a Nano S didn't. Because you need physical access to a hardware wallet in order to send funds from it. So a hacker can't do it without having your wallet in his hands + knowing your pin code.

Or the computer in which funds/ private keys stored should not be used to for unnecessary stuffs.
For me, I dedicate one computers to use for trading, only for trading on well-known exchanges, nothing more than that.

Indeed, hardware wallet users don't reveal their private keys at any point in the process -- only signed transactions --  so they're usually safe from these kinds of phishing attacks.

You can achieve the same thing by using MEW offline with cold storage (https://kb.myetherwallet.com/offline/ethereum-cold-storage-with-myetherwallet.html) instead of using the web wallet.

Useful advices for the noobs. But I always recommend hardware wallets. I prefer them

Helpful tips from newbie to newbie. But scammer is very smart. They can send any malware in groupchat to steall your wallet in device

They are bunch of wallets that needs email too and those are target of scammers and hackers. They are sending fake emails, phishing websites be careful to always check where the email is coming from some looks like really identical. That's a common mistakes to click directly on those emails without checking it.

First Of all Don't use Private Key to Login and Keystore File. Its better to use Metamask along with Brave Browser which has shields to many ads and offers protection.

Very clear information about secure wallet.  I think the safest wallet is hardware wallet. There is always a risk as long as you connect to internet. If you have good amount BTC, it is safer to store in a cold wallet or hardware wallet.

I have done it all of the step but sometimes people are not consistent for what they are doing it.
From that point, it lead into disaster where they are blaming the subject on himself !

Over 4 years, I keep my wallet safe and luckily scammer never come at once

installing of anti virus is not necessary sometimes there have anti virus can access your personal data. your history even your password in your account... saving private key is enough and google authenticator is the strong security to your wallet..

These are helpful but let me add some options.

..for number 1,
If you don't have your personal pc, "https://www.protectedtext.com/" could help you save the links of your trusted website.
Facebook messenger would also do it and all you need to do is search your name on the messenger search bar then click the chat bar of yourself right there.

..for number 2,
To create a secure password, you may use special characters and it is limitless.
For example, password: vampire1<*.*>

..for number 3,
it is not that necessary to have an authenticator since there are also some consequences of having one too. But some of the wallets gives you the option for authenticating your wallet too.

..for number 4,
You can actually download internet security like "kaspersky.com" to avoid being hacked with software and sites from your browser.

These are the things I would like to add for this. I hope I could help you all and have fun!

If you handle wallet on PC I would recommend secure it not only with anti-virus.

Simple security guide ;D:

• Don't open, click or run suspicious files, links, and programs. Rule of thumb: if you are not expecting it, it is suspicious.
• Don't open suspicious files, email attachments, or archived documents, if you do not completely trust the source they are originating from. Send unwanted emails to spam folder before reading – files or links from people you don't know should be treated as malicious by default. Verify file origin by the means other than media used to receive it. For example, if you have received a Word document via email, contact the sender by an Instant Messenger or by phone and verify the reason for sending it. The most risky file types are: Any executable files: exe, com, bat, ps1, swf, jar etc. MS Office documents, especially with macros: doc/docx/docm, xls/xslx/xslm etc. PDF documents: pdf. Vector graphics with embedded code: svg. Archives of these files, especially password-protected.
• Sometimes it's hard to tell malicious files from legitimate ones under time pressure. Use Virustotal to verify any file by scanning it by more than 50 antiviruses at the same time. While it is much more efficient than scanning files offline, consider the fact that you need to disclose the file to a third party. https://virustotal.com
• Don't open suspicious URL links, especially those pointing to web-sites you don't normally visit. 
• Be careful with pop-ups in your browser, applications and operating system. Always read pop-up messages and don't 'accept' anything in a hurry. 
• Do not insert flash drives, CD/DVD, external HDDs etc. into your computer unless you explicitly trust their origin. There are techniques of hacking into your computer before you open files on a flash drive and way before your antivirus scans them. If you found it outside or inside the office, if you received it by mail or delivery, if a stranger gives it to you asking to print out a document or just open attach it to a PC – it is likely to be malicious. Only trust your own devices and proceed with caution when dealing with devices received from people you work with or otherwise collaborate.
• Don't use pirated software. Don't run or install software downloaded from untrusted sources. This includes torrents and other peer-to-peer networks. This especially includes keygen and cracking tools that require administrator privileges to run. Morals or ethics have nothing to do with it: it is just totally insecure. First, trojaning the distribution and putting it online 'for free' is a known way of hacking into systems and it happens much more often than we'd like. Second, pirated software can rarely be kept up to date with security patches that just don't arrive to your system. Messing with 'activations' and re-activations just isn't worth it and the risks of not updating software are unacceptable.
• Turn on Auto-Update in your Windows OS. For more details refer to the official FAQ: https://support.microsoft.com/en-us/help/12373/windows-update-faq
• Make sure your Windows Update is configured to check for updates for all Microsoft products, including MS Office. https://www.winhelp.us/configure-automatic-updates-in-windows.html
• Update third party software regularly or automatically. For that, use Flexera (formerly Secunia) PSI or an equivalent tool that checks your third party applications for updates and allows you to update them automatically. http[Suspicious link removed]rasoftware.com/enterprise/products/software-vulnerability-management/personal-software-inspector/
• Turn on AppStore auto-updates as recommended by Apple: https://support.apple.com/kb/PH25371
• Turn on your MS Office Auto-Update in macOS as recommended by Microsoft: https://support.office.com/en-us/article/Check-for-Office-for-Mac-updates-automatically-bfd1e497-c24d-4754-92ab-910a4074d7c1
• Use Homebrew to keep your third party apps up to date. You can easily find many tools you already use in Homebrew: $ brew search vlc $ brew search wireshark $ brew search gpgtools etc. To install Homebrew, follow the official guide: http://brew.sh
• You can use Full Disk Encryption feature of your OS to protect the data at your laptop or PC from theft or loss. FDE is a free feature on Linux, macOS, and Windows Pro.
• Use trusted end-to-end encrypted communications for private/confidential data. End-to-end encryption ensures that no one other than you and your recipient can access the conversation. The means of encrypting email end-to-end are PGP or GPG, or S/MIME. End-to-end encrypted Instant Messengers are Signal, WhatsApp, iMessage, Viber, Threema. Facebook Messenger, Google Allo, and Telegram have 'secret chats' that may be seen as more secure than default mode.
• To protect your traffic data and metadata from network sniffing, use VPN. You can choose from many VPN services providers, such as proXPN or OpenVPN AS. You can install and maintain your own VPN server as well. Always use corporate VPN when working with business data remotely. proXPN https://secure.proxpn.com OpenVPN https://openvpn.net How to setup your own VPN server: https://www.digitalocean.com/community/tutorials/openvpn-access-server-centos

These are all useful tips, but I would add that the easiest way to protect your cryptos if you have even a small capital is to buy a hardware wallet like the ledger nano. Then you can rest easy!

I am a great fan of hard wallets, but please buy direct from the manufacturer. Forget Ebay and Amazon.

It’s great to see people taking out time to help us others. It’s important to appreciate these stuff. As per rest, I feel that the BEST thing you could do in terms of safety/security is to get yourself with Hardware Wallets (https://cryptolinks.com/hardware-wallet), which are not expensive at all, at least not IF you have sufficient Cryptos.

I would definitely recommend it especially Trezor, as it can give you the type of comfort you want and like I said, it’s not that costly either, so not wrong to use.

I encourage your efforts and seeing that you are a newbie you are on the right track.
It's always important to keep safety at its maximum in the cryptocurrency space and I always encourage the double layer protection 2fa

Use another PC for crypto) or at least create new user on your PC. and NEVER click on links from emails/messages.

Finally, i found a person who do this and his wallet safe over 4 years