Bitcoin Forum

I found a thorough software wallet analysis from veriphi.io, https://www.veriphi.io/en/software-wallet-analysis

Here's a link to the table presenting all known wallets, https://docs.google.com/spreadsheets/d/1aZ1zbaUEzCo9NCctN8-eL2VLIiSdY009tTJvRXDUWEw/edit?usp=sharing

Post mistakes and disagreements, if there are any.

For Electrum:
Line 12: "Wallet is API, SPV or a Node?" : AFAIK everyone describe Electrum as an SPV wallet.
Line 22: "Can you add extra entropy?" : Yes, Electrum supports SEED extension.
Line 36: "Can you have many accounts?" : If it's about multiple wallet files, it should be yes.
Line 39: "Can the user broadcast any TX?" : Yes by using the console command broadcast(tx)

For clarification, some of these fields should be specific, not yes or no.

How come hardware wallets like Trezor and Ledger are not recommended? they are making some desktop/mobile wallets look like a better option.

Also not sure what do they mean when they say that Trezor has bad privacy? as it's always possible to run Blockbook  (https://github.com/trezor/blockbook)and connect the wallet to your own node.

Couldn't agree more... I just read the table and was about to post the exact same thing when i saw you beat me to the punch.

I guess they're missing some factors when they're determining whether or not to recommend a wallet. If they'd take the fact that private keys never touch your computer into account and give these factors a high score, the table would look a tad bit different. But offcourse, if you create a scoring system that's focussed on a less secure wallet, and ignore the features of hardware wallets but still try to use the same scoring system for them, you'll end up "proving" desktop wallets are more secure (for newbies reading this: this statement is untrue... Hardware wallets like trezor or ledger are far more secure than any desktop wallet)

I think they should have included a summarized part who has the best feature, like what they do in comparing cars. Like of the most recommended feature highlighted, instead of having the 6 columns highlighted in Green, 5 in yellow, 9 in red, and 5 in black. It just seems biased.

So for example:
Open Source: Yes is highlighted in Green
Open Source: No is highlighted in Red

It's quite hard to understand what they are trying to say in that spreadsheet.

One other thing just popped to mind when i read the spreadsheet for a second time... A new remark for both ledger and trezor: Both can be used together with electrum. If you use electrum together with a ledger or trezor, many of the "negative" features become "positive".

For example:

• No shit coins (whatever that might mean)
• no web app
• open source backend
• user can connect to his own node (he'll need an electrum node tough)
• Python instead of javascript
• multisig
• 2FA
• probably even coinjoin trough an electrum plugin???
• most of the extra features supported by electrum
• Tor enabled possible
• complete fee selection
• many price api's
• RBF enabled
• Coin control enabled
• user can broacast any tx
• message signing
• batch spending
• testnet
• ...

So... apparently choice is a bad thing now? ??? Especially given that the "shitcoins" that BRD wallet supports are BCH, ETH and ERC20 tokens... 2 of which are Top 4 on CoinMarketCap... hardly what you would call a "shitcoin" ::)

The metrics used in this "analysis" are very subjective. :-\

They're describing Trezor Wallet which isn't great, not the Trezor hardware wallet itself which can be used with other wallets.

I believe they were grading the wallet app on Trezor's website, not the Trezor hardware itself? But I'll try to talk to them and show the questions in the topic. It shouldn't be hard for them to reply, if they have the time.

Eventough this is a valid assumption, it doesn't take away the fact that newbies reading this list will most likely jump to the wrong conclusion that it's better to create a wallet with an online wallet provider than to invest $100 for a ledger or a trezor. If you're a legit company and you publish a spreadsheet like this, newbies can suffer the consequences of your actions.

You're nitpicking, but I can see your point. I already pointed Verihpi about said criticism, and this topic. I believe a simple clarification near the top of the spreadsheet would do.

Hi Everybody, This is Maciej from Veriphi, my twitter handle is @CepnikMaciej.

Thank you for starting this thread, we're happy this got so much traction. You were right about your presumption when we mention Trezor and Ledger, we are talking about their online platforms. This is specified in the related article when we point out this is a software analysis only. Indeed, in a perfect situation someone using a ledger or trezor with the electrum wallet has really strong security.

We agree this might not be clear enough, especially for people that fall upon the table without the associate article. We will be adding a comment specifying the difference. Thank you all for pointing this out.

My only criticism for your review is some wallets were "not recommended" because the reason was "shitcoins"? You would do that to GreenWallet, or Electrum if you can HODL shitcoins in them?

I bet it's because of the inclusion criteria (written above the spreadsheet), which seemed like also used as the criteria for rating:

That said, those that aren't specifically made for Bitcoins with minimal features/security fell to non-recommended.

the list seems to become emotional thing rather than fact based when it comes to the black part at the end. i am talking about the S2X part! for example for Coinbase it says ""S2X, Custodial, Shitcoins"! what the hell does that even mean? Coinbase is a custodial bitcoin wallet, has nothing to do with shitcoins, it is not a good option to store bitcoins but it is an excellent option for beginners to buy bitcoin and get started with a familiar interface then move to a real wallet!

the row saying "P2SH" is misleading because P2SH is simply "pay to script hash" and it has nothing to do with SegWit but based on the Yes/No it seems like they mean a nested SegWit!

"Coin control" and "Batch spending?" rows should not even exist in custodial wallets because it doesn't make sense.

"Can the user broadcast any TX?" some of the columns also have an API that lets you push a TX like blockchain.com but it says "NO"

"Message Signing / Verification?" i believe you can sign a message from both blockchain.com and coinbase through their interface. and for blockchain.com since you already have your private keys you can do it elsewhere too.

"Shitcoin Exchange" shows yet another emotional row!

"Other BTC Features?" for bitcoin core says YES whereas it really doesn't support a lot of features. for example mnemonics (BIP39 and its family), coinjoin, lots of other BIPs.

ps. i am curious whether hardware wallets are actually "fully" open source?

---

for Electrum (some may have been mentioned):
Why? +user friendly and feature rich
Connects to a Backend Server? it is not a server that Electrum connects to, it is a node
both "Can you add extra entropy?" and "Can you add a passphrase?" should be YES
"Can you have many accounts?" if they mean actual accounts like on a site then it shouldn't be available for all collums only for web wallets, if they mean accounts as in different wallets then it is true for a lot of them including Electrum, bitcoin core,...
"Can the user broadcast any TX?" YES!
"Customizable UI (User Interface)" there isn't much customization option available! you can change units, show/hide some tabs to see "advanced" tabs but i wouldn't call it customization, but it is just my opinion.

---

all in all i think it was a good table but had some mistakes here and there. i also think it is better if they add some tool tips on each cell on first row explaining what they mean and also they should remove unrelated ones and instead of YES/NO it should place something like a dash indicating not-applicable.

As far as software goes, Trezor One and Trezor T are fully open source. You can also build one yourself from scratch. The microcontrollers' hardware is another matter.

But I agree though. Anyone who owns a service or an app that supported S2X should NOT be recommended, especially to newbies. Hahaha. 8)

Veriphi updated their wallet analysis, and added 8 more wallets,

Bisq Wallet
Rise Wallet
HODL Wallet
Jaxx Liberty Wallet
ZenGo
BTCPay
Casa Node 2
Bitpie

With only BTCPay added to the most recommended choices.

Plus Veriphi also added more new important features that shows the,

Latest Version
Latest Release Date
Latest Github Commit
Responsible Disclosure Program
Latest Known Vulnerability
and if Patched.

https://docs.google.com/spreadsheets/d/1aZ1zbaUEzCo9NCctN8-eL2VLIiSdY009tTJvRXDUWEw/edit?usp=sharing

Bump.

I saw three topics asking the same question, about the same wallet, "Is Exodus safe for long term storage" Newbies, read the wallets suggested by Veriphi, and use the safest wallets.

I'm wondering why cold wallets aren't recommended. And there isn't Atomic wallet in this list.

Read the all the information posted in the spreadsheet. It's not the hardware wallet that isn't recommended.

Plus, AVOID Exodus, and all other wallets that doesn't let you control the fees. They aren't good to the network.

https://support.exodus.io/article/69-how-does-exodus-calculate-fees

Looking at the table.. a lot seems to be wrong and/or weird.

Some things picked:

• Wallet is API, SPV or a Node?
  What the hell is an "API" wallet? Additionally, every wallet is a Node. What this should say is "full node".
  
  
• Is the Backend Open-Source?
  No one can verify whether the open-source code actually is used. So that is quite pointless IMO when talking about the reputation of a wallet/backend.
  
  
• Other BTC Features: Electrum "No"
  Since CPFP is mentioned in other wallets, electrum does offer CPFP. Same goes for Wasabi. Also, you have added "Payjoin" to BTCPay, but no CoinJoin to Wasabi. This table is extremely inconsistent.
  
  
• Fee Selection
  Why does BTPay have "full" and everything just "Yes" ?
  
  
• "Bitcoin Unit of Account"
  Really?
  
  
• Replace by Fee
  Wasabi's entry is wrong. It should be "yes" instead of "no".
  
  

My conclusion would be that the table is so inconsistent and full of wrong information that it would be easier to delete it and start again with more useful information and a proper formatting.
It really is not worth showing a newbie.

No, SPV/light-wallets are not actually part of the network, and are therefore, NOT nodes. They merely connect to a node. You're nit-picking, but I will ask Veriphi to change it, and avoid further confusion.


Then you believe Exodus is as bad as Electrum in this list?


I will show Veriphi.


Why not, it's minor.


I'll show Veriphi.


It's not that very inconsistent, it did enough to guide newbies, which wallets are the open source/most secure/safest.

if we want to nitpick then we should split these things into different layers. wallet layer is not categorized like this. wallet is only responsible for creating and holding private key, generating addresses from these keys and signing transactions.
how the transaction outputs are verified and are send to the wallet layer depends on another layer which defines whether it is a "full node" or not. and we also have a very strict definition there too. for example none of the old bitcoin core versions can be considered full node anymore because they no longer verify "everything" (can't see or understand witnesses).

in other words there is no difference in nature of the "wallet" layer between electrum and bitcoin core, the difference is only in details and the other layers.[/list]

Depending on what we are talking about.
Regarding security, no. Exodus is a horrible wallet.

Regarding privacy, yes. They are both shit regarding privacy. Both send all addresses, transactions and balances to a server who can link all your BTC transactions to your IP and your geo location.




There are no "accounts" in bitcoin.
This is a huge flaw in your mindset.

If this is intended for newbies, you are already teaching them a horrible behavior.




It is extremely inconsistent.
I just picked a few wrong things i saw. There are way more there which i did not mention.

This table shouldn't be used to guide newbies at all. IMO it is worthless.

It's merely Veriphi's comparison between different wallets, and you have the freedom to object.


I'm confused, what? I believe Veriphi said "BTC as unit of account", not actual accounts. A unit of account is "one of the functions of money" for wallets merely to measure value.

In some wallets in the list, "Bitcoin used as Unit of Account" is a "yes".


You disagree with the recommended wallets in the list?

Link to a post I made back in November 2019: https://bitcointalk.org/index.php?topic=5205304

Basically saying that it's nice and all to recommend certain wallets to people but without really knowing what they need to do or have the ability to do advising them to use certain ones might actually be a disservice.

And, I know I have said the below in other threads before but I'll say it again.
Phones and PCs (Mac's too) are not secure, any wallet that is 100% reliant on them with no hardware / 2fa / multisig is also not secure.
The rest is just fluff.
And if you have auto update turned on which is the default then unless you know how the updates are pushed to the Play Store or iTunes Store then you are also at risk.
Is their github account secure? How about the workstation that they use to push updates up? etc.

-Dave

A popular quote says that "Nobody is more dangerous to himself than an ignorant individual."Therefore, recommending a specific wallet to newbies is not enough to guarantee their protection when they still lack the fundamental steps to avoid human mistakes and how to put wallet secure features to work.
The question about the computer we used which are not open source have been raised before on this forum but there should be a possible solution to secure wallet in case computers are tab.
Meanwhile, auto update and download of wallet is not an advisable idea which the newbies need to be aware.

i'd argue that someone who has made the effort of looking around and does the research to find a good wallet will also research about other things including how to increase their own security while using that wallet. it is those who don't make any effort who are in the most danger.

as for computers, the drama of some parts not being open source is just about privacy not security even though they try to include security in it too.

And I would say that a complete newbie to bitcoin probably wants to get a wallet in a hurry, since that's the first thing you need if you want to own bitcoin.  And assuming they are in a hurry and are presented with a choice of a huge number of wallets, they might not know which ones are good and which are complete crap.

Yes, newbies should absolutely do their research before choosing a wallet, but the reality is that a lot probably don't.  I know I wasn't very choosy when I picked my first wallet and I sure as hell didn't know about all of the important features that I do now that I have some experience. 

Lists like this to help noobs are not a bad thing.  There might be some disagreement about certain things, but overall I think they're helpful to someone who's just getting started.

All of that is important, of course, but I don't think any of these things negates the importance of wallet recommendations.

Which goes back to the post that made that I linked.

IMO a wallet recommendation, without knowing more then just "I need a BTC wallet" is difficult if not impossible to know what to recommend. The chart is good, but it's just a start.

If you are US based and all you want to do is trade BTC to USD and USD back to BTC in hopes of making a profit in a controlled regulated way then Coinbase wallet might be the way to go.

If you are talking trivial amounts (and the value will vary person to person) would an easier to use wallet be better?
Even if it's not as secure as we would like, if it's difficult for that person to use, it might actually be more secure for them. Because, a wallet that is more secure / better but more difficult to use (once again for them) might cause frustration / mistakes.

And sometimes it's just the "quality" of the wallet itself. I used to love mycelium. But because TWICE I could not connect to they server it delayed a trade / cost me a lot of time & effort to get it done I stopped using them. That comes into play also.

Also, there are other factors. Although I might not agree with them such as this about Samurai : https://bitcointalk.org/index.php?topic=5213333.msg54578860#msg54578860
Different view then I or the OP have but it's still there.

-Dave

it makes sense, specially the huge number of options made me thinking. studies show that when people are presented with a lot of choices they always have a much harder time making a choice compared to when they only have a handful of options to choose from.

Hahaha. I used Blockchain.info for my primary storage when I bought my first batch of Bitcoins. I believe most newbies did during 2015 - 2016.


Encrypted hot-wallets, stored in encrypted USBs, and plugged in in a computer exclusive for Bitcoin transactions, only if needed could be safe enough for most newbies' needs in my opinion.

I believe it would take a few days for newbies to learn, and a few more weeks to be comfortable with it. We learned, didn't we? 8)

It's also better to learn, than to lose your coins.

If there is already a dedicated PC only for BTC transactions, it might as well be used as a cold wallet.

This is way too overkill for a hot wallet. You might as well just use a single USB with a bootable linux distro and the wallet file saved on some persistent storage on it (maybe even encrypted inside a veracrypt container or encrypted via LUKS).
That's just as secure as your approach, but doesn't need a dedicated PC (which could be used as cold storage anyway).

But to be my own bank, and to put a large part of my savings in Bitcoin, give me overkill security with a hardware wallet AND a dedicated Bitcoin computer, than something I might regret.

It's better to overshoot security than undershoot it.

True.
But an encrypted USB stick is not comparable to a hardware wallet.

Using a dedicated (online) PC with an USB stick containing the sensitive information -> overkill for a hot wallet.
Using the dedicated PC offline as a cold wallet -> more secure and doesn't require more hardware/devices.

An encrypted USB storage device does not have any hardware security. The private keys are being unencrypted and accessible when a transaction is being signed.
This does not apply to a hardware wallet, where the private keys are inside of a secure element which does not leak any data while signing transactions.

Good, sound advice for newbies, and it applies to hardware-wallets too. Don't be the first users of a new product, because you will be the first actual public beta testers of a real-world release. Always wait for reviews, and fixes. 8)

https://twitter.com/matt_odell/status/1301130083588071430

For users/newbies who want to try Lightning payments, Veriphi wrote a blog comparing different wallets for the LN. I believe it cover all features extensively for all levels of users.

https://veriphi.io/en/blog/lightning-wallet-analysis

https://docs.google.com/spreadsheets/d/1jzJ2Vut6q-cbr7bg3tshqJszJFLXpvi194os7GxQQ30/edit?usp=sharing

Do you have any recommendations for where to get help with 3rd party wallet issues, such as when Bitcoinwallet.com holds your bitcoin hostage and refuses to approve the KYC (Know Your Customer) verification process after providing accurate information and high resolution images of ID? I would like to file a complaint if they do not approve me this fourth time. I am really starting to think they are just holding my bitcoin hostage because they know I am trying to transfer it out of their possession.

Custodial wallets like Bitcoinwallet.com that even ask for KYC from you are the worst type of wallets you can ever use. They will hold you money hostage and there's nothing you can do about it.
Look at the ugly reviews about them on Trustpilot. Not sure why you were still using the wallet among other much better wallets - https://www.trustpilot.com/review/bitcoinwallet.com

There is nowhere else you can file a complaint except your local authorities and that will also come at a cost if ti gets to involve lawyers

Thanks Arena, you basically confirmed what I suspected...

I am in the process of switching everything to a hardware wallet, so hopefully I can get it released...It has been so long, at the time they were recommended.

I doubt they were recommended at all.
I never heard of that "wallet". Where was it recommended?

I can't imagine anyone actually recommending it  ???

Post on reddit, twitter and related channels hoping they notice but it's the first time I'm hearing of this custodial wallet so it might be a scam.

I can't understand one thing only. How could hardware wallets be compared to mobile ones?

We always consider certain characteristics for each wallet, being open source versus closed source, custodial or not, cold/semi cold/hot wallet,...
A hardware wallet could be considered a semi cold storage and most of their software is open source and the keys are both generated and kept in your device.
A mobile wallet depending on the software you are using can be anything so lets be specific and use Electrum. It is 100% open source, keys are both generated and kept locally but it is hot storage since a mobile device can not be cut off from the different types of networks ever. Also you always carry your phone around with you so you shouldn't store all your bitcoins in it ever.

Security-wise a hardware wallet can be safer than a mobile wallet.

Was hoping Coinomi in there.

Edit: stupid me, again

Coinomi is included, even tho it is spelled "CoiNomi".

Scroll to the right. It is included in the "Not recommended" section, which is correct.
I probably would have put it into the "Not at all recommended" category, but that's based on a personal aversion against incompetent developers claiming severe vulnerabilities in their application aren't severe at all.

Probably because not everyone can afford a hardware wallet? I can afford one myself but I'm not using laptop to connect the hardware wallet with to make some transactions or is there any hardware wallet that can make transactions without connecting to the internet? I don't think there is one right now.

There isn't. It won't be the selling point of HW wallets either. They are supposed to be able to protect the private keys and the funds in the most demanding conditions (being infected with malware etc).

What you're looking for it probably an airgapped offline wallet. You can easily do it with Electrum[1] and you can set up a watchonly wallet on the online computer to gather the data needed.


[1] https://electrum.readthedocs.io/en/latest/coldstorage.html

He stated that the article is not about the hardwallet, just software but we see quite a few mentioned there. He mentioned the weakness with software wallet but not the hardwallet, we all know hardware wallet is not absolutely secure offline, can be destroyed with water, forces, fire etc nothing anonymity and sovereignty. Another difference between last year and now is the improved availability of hardware wallet and we also have cheaper brands.

For those people who can’t make their Trezor hardware wallet work with Electrum, there’s a downloadable desktop application for Trezor. This is especially for those users who don’t feel safe in using their web application, like me.

https://suite.trezor.io/