Bitcoin Forum

I just installed a bitcoin client on my PC , a was thinking before i download my wallet from blockchain.info, If someone has access to my PC or if i am infected by a virus will this compromise allow my bitcoin to be stolen?

Yes, the file containing you wallet can be stolen that way, but put a very hard to break password on it and you'll be fine for a while. The time and effort wouldnt be worth the thief's time for stealing whats in your account.

Cold storage is a good way to be safe, a good anti-virus is always need for any stuff you do on a PC.

^^

Even if u are doing Cold Storage, be wary about your private key. Try to have a real random source for your private key generation. If that's cracked, then no cold storage or hardware wallet can save u from being robbed.

Any computer connected to the internet can be attacked. If you have enough to worry about get a laptop and never connect it to the internet.

bitcoins can be stolen if someone has infected your pc, or someone breaks into your house and takes your pc with him/her.

If your computer is hacked than you will lost your bitcoin. So there is always a chance of loosing your bitcoin.

No, if I have a cold offline wallet then no.

Of course, they can be stolen, you have to be careful.

make a backup of your private key (on your offline computer) and HIDE IT using this: http://embeddedsw.net/OpenPuff_Steganography_Home.html

then you can transfer the carrier to your online computer with usb stick

For a techy style website that is a horrible looking website you linked there.

All this also depends on what you want to do with your wallet, constant hot wallet or just a store?

who cares how it looks...the software is straight up kick-ass.  try it.
it is very high security. (and its free)

Well there is no chance of getting your bitcoin stolen from a pc wallet until you distribute your private key in the public, or get scammed. also dont store your btc in third party wallets for long.

Yes, there are lots of viruses/malware now that target bitcoin wallets. Of course hackers want it now that the value has risen so much!! So take care to learn about cold storage, and about keeping your online computer secure, if you hold any BTC on it.

I'm not sure but I recall that someone once told me it's not impossible to hack the wallet with another computer, like mining for the public wallet's private key or something.. but it would take millions or years... something like that ::)

You're referring to brute-forcing someone's private key.  Yes it would take millions of years.
That's something entirely different.

You can still have your keys simply STOLEN by virus/malware.

If you have your private keys stored in one wallet, then if you mislay that wallet or it gets corrupted, then you will lose your keys. Backing up your wallet makes a copy of your private keys, but it’s important to back up your whole wallet. Some addresses are used to store change from transactions, and may not be shown to you by default. Back the whole thing up in several different places, and keep them safe from prying eyes.

When you get your wallet up, be sure to password it. While any virus that can detect key strokes could still read this (when you type it in), you are much safer having it passworded/encrypted than not. Then even if they steal the wallet, they'd need the password to do anything with it.

Generate a paper wallet from a offline linux computer that has never and will never touch the internet. and never use an offchain/third-party wallet, always have full access to your coins.
-ranochigo

Can you please explain how "has never and will never" is better than just "will never" touch the net

I guess what you said is right, but couldn't the one that have touched the internet and infected with virus affect the outcome of the address calculation?
-ranochigo

you're right. 

yes, there are more and more ways everyday people are trying to steal bitcoins. step 1: encrypt your wallet (set up a very strong password and don't store your password openly on a text file or anything)

be wary of unreputable traders and get-rich-quick btc-denominated investment schemes, too...... ;)

There are two major threats for Bitcoin storage.

1. Theft: Hackers might use phishing sites or keyloggers to steal your coins. Use advanced anti-Virus to prevent such attacks.
2. Loss of Private Key: Sometimes, the offline backup or the private key might be lost for ever (by mistake). There is no way to regenerate it, and if you lose the private key, then all of your coins will be gone.

I do this.  

I boot up Ubuntu via a USB key using "try it now" instead of a full installation.

I have a local copy of bitaddress.org saved.  

Then I generate some addresses and save to a USB key.  Copy public addresses then stash away the USB key.

This way, the private addresses never gets online.

If your wallet has been encrypted with a strong password, it is still safe.


Both your wallet file and your password could be captured, and your bitcoin will be gone very soon.  ;)

+1 for cold storage (creating and maintaining your wallet in a device with no internet connection).
BTW, it is so ironic to see this advice from TF lol. :P

means that we can not keep all important files on our computer because it will be very detrimental when it all happened

That works quite well, the whole process doesn't let the computer touch the internet.
At least he didn't say to put it at third party wallet service.. ;)

Yes Of course, the data will be included in your device memory and therefore are available for the taking "by spywares or curious people" and even having a password doesn't provide absolute protection.

HOWEVER, if you do not take sufficient security measure when creating a cold wallet, it is possible to get hacked.

Of course, it can be stolen. This is one of the main problems of digital currency

No, it is not a problem if you know how to take security seriously.


Correct. If your computer hasn't been 100% offline, then it's still vulnerable.

Someone brought up BIOS-based viruses, though. Would it be possible for someone to have the key snagged and stored in the BIOS somehow, then when you load up the computer normally and go online, it would send in the information? I've been pretty amazed at the tricks people have come up with in the past...

I did. The BIOS has no memory, but however, it does not need to have so. It can just transmit the data from the USB stick to the hard drive, and then upload it to the hacker whenever the PC is online.

Bitcoin can be stolen, sure. Lots of malware these days. Also, be careful with 3rd party wallets, exchanges etc -- basically, any other entity that controls your coins. If they have your private keys, it means you don't have control over your bitcoins. And then.....poof! :-\

I advise setting up paper wallets or other cold storage mediums so that the majority of your bitcoins are not kept on a computer that can be accessed online. Because yes, there are many hackers and the like that want to get their dirty hands on your coins! Take precautions!

Is this a legitimate fear, though, or just something that may or may not actually be possible? I'm not familiar enough with the BIOS to know how this all works.

And you can short it out to reset it prior to running any wallet generator on the system, right?

Having my coins stolen is one of my biggest fears. Seems people lose them to thieves everyday.

To be on the safe side, you can download the stock BIOS and flash it before turning it into a cold wallet.
As far as I know, the malware can be flashed into the BIOS, and it will execute commands made by a hacker. It probably will keylog everything and save that into your hard drive, and it will upload it once it has an internet connection, so the OS doesn't make a difference.
It's a fear, but it's highly unlikely to happen, to be honest. I'm just suggesting 100% protection here.

i had the bitcoins in my QT wallet stolen. here is how it happened: it was during the November bubble and some guy posted an altcoin miner (i think YAC) but it was really a virus and it drained my BTC wallet. that was a huge bummer!

Meh. Have antimalware and antivirus, and be careful when downloading random stuff.

I figure if it's possible, and it would lead to stealthily being able to steal wallets, mass adoption would increase the chances of people doing it. The rewards are just too great not to.

Thats why I dont download any alt coin wallets. ?

Same here. It actually sort of sucks, I need to get a spare crap computer that I can mess around with for things like that. For example, CPU mining MRO could be really profitable when it came out, but I was too scared of downloading anything. So I missed out. Did buy some and made a bit of BTC profit out of it, though.

I believe free anti virus would take care of that problem, so you won't miss the Alt coin mining :)

AV's only catch certain things. When someone comes up with a new virus, it can go undetected for weeks or months. Relying on this as the sole way to protect yourself is going to result in disaster.

I have no fear because my coins are in cold storage! 

Anti virus cannot cover all of the viruses, some are FUD so they cannot be detected. Free anti virus means that it will cover even less, not such a good idea.
-ramochigo

Cold storage ... TradeFortress should definitely have a good education on that by now.

TF has always been 100% behind cold storage. He always put down web wallets because then you don't control your keys. Even when he ran Inputs.io he was against web wallets, :p.

What is the best flavor of linux to use?

Then saying you are sorry and giving out free hugs fixes everything. Got it.

You realize this isn't the real TF, right? This has been established time after time by those who have dealt with him extensively.

yes i had my bitcoins stolen once from my QT wallet. i believe it was from an altcoin wallet that was actually malware. :-\

1 Set up a Wuala account, or other cloud backup service of your choice.

2 Create a strong and unique password offline (manually). This password should be at least 20 characters long; it should contain numbers, upper and lower case letters, and symbols. It should be as random as possible, ie it should look something like this: Zr%8qL03&cvwS9@05AatdP71. Never use this password elsewhere.

3 Do not forget this password. Recite it several times a day. It is easy to overestimate your ability to remember a password several months in the future. To be on the safe side, write it down and store the piece of paper in a safety deposit box.

4 Download Bitcoin Linux binary and save it on a USB drive.

5 Shut down your computer, and boot Ubuntu (or Linux distribution of you choice) from a liveCD. This will not affect your current operating system.

6 Disconnect machine from the internet. Unplug any network cables and disable wireless. Verify that wireless is disabled in the icon on the upper right corner (Ubuntu). Double check that machine is disconnected by opening the web browser.

7 Run bitcoin while disconnected to the internet. The client will show 0 connections and 0 blocks, but it will still generate a wallet.dat file and a bitcoin address.

8 Encrypt your wallet using the strong and unique password from step 2 above. (Bitcoin Client > Settings > Encrypt wallet)

9 Copy wallet.dat (found in hidden folder .bitcoin in your home directory) to USB drive.

10 Save bitcoin address to a text file and copy it to USB drive.

11 Shut down system and turn off computer. Before switching your computer on again, remove all power sources for about 1 minute. Physically remove battery from laptop.

12 Backup encrypted wallet.dat file in several places:
Send it to your 5 best friends by email attachment and ask them to save it for you.
Save it on your Wuala account created in step 1.
Save it on several USB drives and CDs and store them in different geographic locations.

13 Send bitcoins to the address saved on the USB drive. Double check in the block explorer that they have been sent.

yes it surely can. i wasnt careful and was downloading all sorts of malicious stuff and something drained my desktop wallet about a year ago  :-[

I would be especially careful with the free IPO coins because those are pretty risky and they're usually launched by new users. Always verify the source.

I bought a cheap tablet solely for the purpose of generating addresses & making paper wallets. I did this offline & that tablet will never again be connected to the internet. I think that's about as safe as you can get.

[/quote]

Yes, the file containing you wallet can be stolen that way, but put a very hard to break password on it and you'll be fine for a while. The time and effort wouldnt be worth the thief's time for stealing whats in your account.
[/quote]

How do you know what's in his account? He could have 10s of thousands of BTC in there.

I would think twice before doing this. There was some problem in the RNG on android, it allowed attackers to brute force the private key easily. It might be possible for another problem to surface, use an offline computer which will and have not connected to the internet.
-ranochigo

I didn't use a RNG. I rolled dice & then put the resulting number in as a brainwallet passphrase. Does that mean my paper wallets are safe or are they still at risk due to this RNG problem on Android?

I don't know the specifics of this situation, but I took that to mean the "dice roll" is based on a faulty random number generator (RNG). So it can be cracked much more easily than if it were truly random.

The answer is yes. Be very careful of Malware and software that claims to increase your bitcoin. Eventually the hackers will Crack the algorithm for wallets. Just a matter of time.

If this ever became a real threat (people have already considered quantum computing and still say it isn't possible) the encryption would just be changed I'd think. I wouldn't really worry about it being cracked. As long as you use a decent password obviously.

Keylogger could log your password when you enter it (say, when you create a tx to send out bitcoin), and your bitcoin would be gone even if you used an extremely long random password. ;)

I was responding to the cracking wallet passwords part. Keylogging isn't cracking; it's keylogging. Very different things.

I see. My bad, I thought you were referring to the "Be very careful of Malware" part. :P

That is worst, brainwallet isn't the most secure, attackers can bruteforce the result of your dice number. If sucessful, everything will be stolen.
-ranochigo

Do not download a huge amounts or porn :D And you will probably stay away from most of the PC viruses. Be careful always for scammers not only on this forum, but anywhere.
BR

Have there been known instances of attackers successfully bruteforcing keys made using a dice roll?

Do you mean dice roll by the result of (1-9)? If that is so, there is a lot of cases which the wallet was compromised.
-ranochigo

You can fell for paranoia about security of your machine.
Hackers are clever beasts, brace yourselfs.

I did a LOT of research before making my wallets. I often read that those paper wallet generators could be rigged (can't remember what the correct term is but you know what I mean :) ) and was lead to believe that the way I did it was the most secure way.
[/quote]
That isn't 100% true. Yes its true that paper wallet generators can be rigged, you can use them on a offline computer by downloading the codes and run it on the offline computer. To prevent the possibility of it being rigged, the best way is to manually review the codes. Try not to use those online wallet generators.
-ranochigo

I have now come to the conclusion that there is nothing that I can do to make a secure paper wallet. Surely any combination of numbers/letters/words etc will be guessed by some supercomputer sometime?

Not at all. Combinations grow exponentially large, much too big for supercomputers.

Flip a coin 128 times, you have 2^128.

That's about 340 trillion trillion trillion combinations,
Each of which would have to be checked by doing a complete
Sha256 hash.

No computer could do it in any mortal time frame.

Roughly a billion seconds ago, Jesus walked the earth.

So do you think my 64 dice rolls followed by a few words is sufficient?

IMO, a person could bruteforce your 64 dice rolls and a few words in a few months or even days. And are you sure you can spend the time to type those 64 letters and a few words? You can easily forget it.
-ranochigo

So you really think it would be safer to generate keys by using 'the moving dots' on bitaddress.org etc? In your opinion, is that the safest way?

I would also love to hear someone else's opinion on this.

Unless you can manipulate someone's mouse strokes perfectly for 200 times, then you can hack it. This is theoretically impossible on a computer which will never access the internet. Even if the mouse strokes are recorded, the attacker will not be able to access the mouse stroke recorded.
-ranochigo

Why 200 times?

64 dice rolls is 6^64.  that's on the order of 2^160.  You can't brute force it even if you had a million billion years.
It has nothing to do with opinions!  

That's this many combinations: 1461501637330902918203684832716300000000000000000

Anyone who says you can brute-force that doesn't realize how BIG that really is.

That's what I had been told originally by people who seemed to know what they were talking about, but recent posters made me doubt it. Not sure now whether to go ahead & generate new addresses just in case, or leave it as it is.

Do the math for yourself.

2^128 = (roughly) 3.4 x 10^38

1 trillion = 10^12
A trillion trillion = 10^24
A trillion trillion trillion = 10^36

The fastest supercomputer is the Tianhe-2, which
has over 3 million cores, takes 720 square meters
of space, and was developed by a team of 1300
scientists and engineers.

It theoretically can do 50 petaflops, which is
50 quadrillion calculations per second. You need about
1000 operations to do a SHA-256 hash, so, with this
computer, you could 50 trillion hashes a second.

If you had 20 billion of these computers, you could do
a trillion trillion hashes per second.

You'd still need to run all that computing power for
340 trillion seconds to reach 2^128, nevermind 2^160.

There's 31,536,000 seconds in a year, so that comes
out to: 10.78 million years.

:)

* i dont know if floating point operations are comparable
to integer operations, but its irrelevant.

Wouldn't mind hearing the opinion of others as regards this matter??? My BTC are probably small fry to most people but to me they're a lot & I want them stored as safely as possible.

Generate your keys offline. Do not online computer.

You can also hide a copy of your keys using the open puff software.

They were generated offline but I got worried that the keys could be bruteforced.

Perhaps someone here can confirm my "opinion" on the feasibility of brute forcing a properly generated random key.

especially keys generated using dice rolls (64 times in my case) with an additional word or 2 added after the 64 numbers.

Just curious, do you not trust/understand the math, or do you not believe dice rolls are random enough?

Although I followed the advice given on another forum & rolled dice, I'd have preferred 64 characters chosen from anywhere on the keyboard, even if they weren't as 'random'. Surely they'd have been harder to bruteforce?

Here's the advice I followed:

http://www.reddit.com/r/BitcoinWallet/comments/1p6y5c/secure_paper_wallet_tutorial/

What you should understand is that there are "only" 2^160 bitcoin addresses.

So while 58^64 is bigger than 6^64 , you can't make use of the extra security.
(Nor do you need to)

That said, you should do whatever makes you feel most secure :-)

But would you agree with my point - that keys generated using only the numbers 1-6 are not as secure as if they had been generated using the numbers 0-9, never mind the other characters on the keyboard? Would it really take a supercomputer many years to bruteforce 64 numbers in the range 1-6?

So in a nutshell, if you were in my position, you'd be happy enough with the security of the keys I have generated using the dice rolls?

I would only agree if the exponent was the same.
10^x > 6^x  (10 to the power of x is greater than 6 to the power of x).

Apparently you don't quite understand the power of exponentiation
or you don't understand how basic probabilities work with combinations.

If you roll a die, there's a 1 in 6 chance to roll, say a one.
to roll 2 ones in a row, is 1/36  (6^2)
to roll 3 ones in a row, is 1/216 (6^3)
...and up it goes.

when we look at 6^64, the exponent 64 is much more important than the 6.
in the end its still a huge number of combinations.

You could flip a coin 160 times and get about the same number of combinations.
Its not any less secure because there's "only two" numbers (heads or tails).

To get the same combinations using digits 0-9, you'd have to use 49 digits.
To get the same number of combos using all uppercase letters, all lowercase
letters, plus 10 digits, (62 characters), you only need about 28...

so whether you use 2^160, 6^64 , 10^49 or 62^28, its all the same number
of combinations.  And a supercomputer cannot try that many combinations
as I spelled out in one of my previous posts in this thread.

If your PC was stolen, I think they can right?

But then again, thats if they have your pw. Not sure how they would, but you have to be a hacker.. :-\

Always run a virus scan to be sure there is no type of virus that would risk your coins.

It's internet money. Of course it can be stolen when it's just sitting on your PC connected to the internet. Silly rabbit.

Imagine, you are really urgent for a few BTC, do you take your time to type the 64 characters and few words? Wouldn't it be better if you scan your paper wallet and put in a few letters and get your BTC instantly? Even if it is that secure, you are sure to get a few letters wrong in the 64letters and a few words, you might not even be able to remember it.
-ranochigo

That works too, I guess it is also as secure. But I think your mouse strokes are even more random, just in case.

They always can be stolen, unless you use some smart cold storage

In general, this is safe advice.

Cold storage for large amounts of bitcoin, password on your wallet if you're not storing a large amount.

definetly good advice about setting the password. so many people who get hacked seem to never have a password. I think its not mandatory passworded by default as to many newbies might forget passwords. silly reason if you ask me... but noone did :( lol

It couldn't be 'mandatory' as there are many different clients, I assume you're talking about QT though.

Im always so "lucky" that im sure some shit will happen. The security issue worries me the most and deters me from getting bitcoin. :(

Is there a newbie version way to setup the paper wallet.

Like a youtube tutorial, or the blockchain one.

Yes, it is always possible that your BTC can be stolen. This is true no matter what precautions you take, although certain precautions will make it be less likely that your coins will be stolen.

If you use a sufficiently strong password if using Bitcoin-QT or multibit then your chances of BTC theft will be reduced.

The safest way to protect your coins in a "hot wallet" form would probably be blockchain.info with 2fa enabled, blocking tor exit nodes and having a strong password and a strong sending password.

The safest way to store your coins via "cold storage" is probably a paper wallet that is encrypted (that is that gives you what is essentially a private key, but you need a password to make it usable). You should store your paper wallet both in paper form and in a USB stick/drive (to prevent issues with the ink faking on the paper) and store it in a safety deposit box (it may be advisable to use two boxes at different banks in the event of a robbery/fire at the bank.

The 10 steps in the coindesk article (http://www.coindesk.com/information/paper-wallet-tutorial/) should be pretty easy to follow.

Put a really long password on it, it would be almost impossible to hack then...

What is the most safe way to store coin? I hear people say cold storage.. I dont want to use paper printouts. Can I put the wallet on an external hard drive and remove it + the original wallet from my computer so its now only stored on a drive that cant be accessed unless I plug it in? If so what files do I put on the wallet to ABSOLUTELY guarantee i can bring them back up on my PC any time? I was using multibit but on advice from a friend I got bitcoin core which took like 3 days to sync. Can I back it all up so I don't have to sync every time?

If you don't like downloading the whole block chain you can use electrum cold storage, doesn't require a paper printout, in fact you can restore your wallet from a secret 12 word seed.

No matter what you BTC can be stolen.

The question is, do the precautions lower the chances of your coins from being stolen enough?

i think yes.it is because if any one use your pc or your computer hacked then may be they stole your bitcoin and one thing that i have read about wallet id.if your install new windows and forget to backup then you will lost all your money from the wallet.may be i am wrong but in my knowledge this is true..

Well, that is indeed true.

Even for a paper wallet, your wife or your son could stole it from your safe (if they know your safe's password).
And for offline wallet, they could stole your whole HDD (if they know your wallet's password) :P

You could make multiple cold storage wallets with different passwords and store them in different geographical locations.

Obviously they can be stolen but it's only cause you would've done something wrong if that were to happen.