Bitcoin Forum

I have come up with a simple way to keep your BTC safe from all kinds of threats.  It's impossible to delete, or to get hacked, and requires no skills or training to set up.  Meet my

Paper Bitcoin Wallet

For sale at http://casascius.com

Sample Here: http://166.70.147.8/btc/PaperWalletSample.pdf

Instructions:

1. Buy my Paper Bitcoin Wallet via PayPal, including your mailing address in the order.  It's $5, my PayPal is mcaldwell at mc2cs.com.  (Each sheet is unique, of course).
2. When you receive it, have your Bitcoins sent to any of the addresses printed on the page.
3. When ready to spend your Bitcoins, redeem exactly the same way you would a BitBill.

Q. How many addresses do I get?

A. The sheet for $5 has 9 Bitcoin addresses and their corresponding keys.  For $10, you can get four sheets (36 addresses).  Worldwide letter-mail postage is included.

Q. How does it work?

A. Generating addresses requires no contact with the network.  An address is a public and private key.  In this case, I am merely providing you both keys on a piece of paper.

Q. Do you keep a copy of my keys?

A. No.  I am not keeping a copy of anything - neither the public nor private keys.  Once I mail it, it's gone.

Q. Don't I have to trust you?

A. Yes, because anyone who knows the private key can spend the coins sent to the matching bitcoin address. However, anytime you send bitcoins to a website, you're trusting the owner of that website.  You are also trusting them not to get hacked.  I have a good reputation on the forums and on OTC, and my paper wallet is unhackable.  And I am willing to hand-sign and include an actual physical fingerprint on each page I send out, as well as on the envelope.  (That protects me too, in case someone else were to make paper wallets just like me).  I am providing this service because I believe many people would rather trust me than trust that the Bitcoins on their computer won't get lost, hacked, stolen, corrupted, or otherwise destroyed.  I promise I am not out to scam you.  I am not keeping a copy of your keys.

Q. How can you be so sure they are hackproof?

A. I have followed a very specific safe procedure to produce these.  I have generated these addresses into a brand new wallet using Bitcoin on a computer booted from a Linux Live CD with no internet connection, saved the export to a flash drive using Sipa's import/export patch, formatted them into a report with Microsoft Access, and printed them on a directly-connected printer following a fresh install of Windows and Access.  After production, I used Linux to overwrite the entire Windows hard drive, and then destroyed the USB flash drive with a hammer.  At no point did any of this equipment ever connect to the Internet, and I keep the remaining sheets locked in a safe.  Each address is sequentially numbered so I can be sure there are no duplicate pages, etc.  Only one person can possibly screw it up - ME - and I promise I'm doing this right.

Q. Couldn't I just do this myself?

A. Of course.  The easiest way is to install Sipa's patched version, generate a fresh wallet, use the "walletdump" RPC command to spit all the keys to a text file, and then print it.  Do this with the network unplugged, and delete it when you're done, to keep the possibility of a hacker getting at it as close to zero as possible.  By buying my sheet, I am saving you the hassle.

Q. Why are you taking PayPal and not BTC?  We hate PayPal!

A. This is to help newcomers get up to speed.  Sure, I'll take BTC, just e-mail me, but I expect many people interested in a paper wallet may not yet have BTC and are looking for a safe place to keep it.

Q. Why would anybody want a paper wallet?

A. With all the hacking lately, as well as scares and losses due to computer crashes or malfunctions, a paper wallet is a very effective way to limit one's exposure.  They already exist - a BitBill is an example of a paper wallet which just happens to be designed in a way that requires you to tear apart the card to see the private key.  I expect that offline paper wallets will become more common for average users as these threats become stronger, and that Bitcoin clients to come will make it easy both to import them and to easily print new ones.

Q. How do I know the balance of funds on each address?

A. Look it up on BlockExplorer.com.

Q. How do I redeem them?

A. The procedure is exactly the same for redeeming BitBills (except that you don't have to scan anything with your cell phone).  Presently, you need to run a patched version of Bitcoin to import the private key.  I am anticipating that at least one major exchange site will soon offer the ability to make BTC deposits by providing a private key.  Be aware that until then, re-importing Bitcoins into a digital wallet is not easy enough for Grandma, so this is a better "savings" wallet than a "checking" wallet.

Q. How many times can I use each address?

A. You can use it for receiving as many times as you want, but once you divulge the private key, you can no longer be certain that you are the only person who knows it.  Once you type the private key into a computer, use a new address.

EDIT: added link to info page at casascius.com, changed addresses per sheet to 9

interesting concept. a bank of sorts. i wish you the best of luck in this complex business.

I'm not storing any balances or handling any funds - I am printing randomly generated numbers on paper, mailing them out, and forgetting about them, promising not to keep a copy.  Once I send out a sheet, it's completely out of my hands.

This is interesting, but still too complicated and messy for the average Joe.

We're to trust you not to keep them? Nope, not going to happen. No one in their right mind would trust an unknown 3rd party with full access. No offense, but this seems like a clear money-grab since the keys are a one-time use. Furthermore, this concept is not simple-for-grandma. A grandma isn't going to know what a private key is, how to use BlockExplorer, or know how to spend the money.

Or the modified bitcoin client.
Just seems like a half baked idea stolen from bitbills.

I take it you don't use any trading websites, and are part of the unbanked population.  And you probably have no interest in BitBills for the same reason.  Sure, if you know nothing about me and have no reason to trust me, that's a fair assessment, but others do know enough about me and consider knowing my real identity a positive factor in favor of trusting me, and...


...please avoid calling me a thief based on this sloppy non-sequitur.  What does one-time-use have to do with your assumption that this is an attempt to steal?  How many people in this community have I done business with, and how many have I stolen from?


Ahh, the notion that I'm stealing something.  What, exactly?  By the way, Bitbills are a great product, if you are willing to wait 3 months to order some.  And Bitbills are a legit product too - I have bought some, and redeemed most of them, and can attest that every Bitbill I redeemed contains exactly the balance it said it did.  I trust Bitbills enough that I am holding a significant balance on one and not my computer (1QEk8SCapWttMxSjes5gWm3MtL3MSZcSAN).  Now how exactly am I stealing from Bitbills?  Doug (@bitbills)?  Am I stealing from you?

The only other noteworthy difference is that your cost per address is lower with my offering than on a Bitbill, which probably is related to the fact that Bitbills - given that they're meant to be durable and protect the private key from snooping - take much more to produce.

interesting idea
just want to point out, there is a discrepancy in OP, at one time you said you'll destroy all tracks of private keys on the other hand you said you're keeping copy of private keys in a safe.    

Silly idea :) You expect grandmas not just to type in 160 bit random case hashes but also private keys (and patch a client). Does the client even validate these against eachother? And what if grandma makes a typo just using an address (before any validation)? Poof, balance gone.

You also replaced a) security of one system by a) security of another, b) the postal network the sheets are sent over and c) trust in a third party. Doesn't sound like an improvement to me.

He said he's keeping the "remaining sheets" in his safe - i.e. the ones that haven't been sold yet.

No, as previously noted, I expect one of the major exchanges to offer a place to type these in, so Grandma doesn't have to.  Inevitably the bitcoin client will offer the same thing.  Same thing is needed for BitBills.


There is validation built in.  Just like Bitcoin addresses, 32 of the bits are a SHA256-based check code.  The odds of the client accepting a typo are 4-billion-to-one, and that's assuming the address is still well-formed after the typo.

The client doesn't have to validate the public key against the private one.  Only the private key actually needs to be entered, the bitcoin client automatically calculates the public address from the private key.


If you think that the likelihood of a letter carrier knowing your envelope contained Bitcoin keys, reading your keys through a security envelope, importing them into his bitcoin wallet, and spending them, is greater than the likelihood of you encountering malware on your system anytime soon that emails your wallet.dat, keylogs any encryption passwords you use, and provides remote control of your computer to a hacker, then you have a well-founded concern.

It seems to me that the average person is not going to use Bitcoins until some large publicly-trusted entity, like Amazon or Apple, starts offering accounts.  We all have to realize how different our perspective, experience, and skills are from the average person, who can barely do email, Skype, and online shopping.  And encryption?  Fuggedaboutit.

Fire !!!!!!

It will be easier for grandma if the key import/export feature would finally be pushed to the main client :)
Then everybody can do this in a second.

I haven't seen a mention of that, but you only add another party to trust to the mix with it. Grandma is better off going to a (Bitcoin) bank and having nothing to do with any of the underlying technology whatsoever. If she needs to pay for something in Bitcoin, banks offer APIs to merchants for integration of the bank's own payment environment with which customers are already familiar (customer only selects bank she uses on the merchant's site). This system has been in use for half a decade, that I know of.


Good, I didn't know that. I presume that means the regular client rejects randomly typed (but well formed) addresses.


Ok, so the customer does the validation by visual comparison of the resulting address and the client rejects the private key with a confidence of 4 billion to 1. That's sufficient. My gripe for this point shrinks to it being too much hassle, still a major point for grandma I think (those with elderly family determined to learn the difference between left and right mouse button know what I'm talking about :)).


The likelihood of actually having a compromised system (50%) compared to the possibility of having a compromised system ('100%') is also lower, but it doesn't mean it doesn't exist. Why 100%? The private key relies on security by obscurity, which can by definition never be fully guaranteed. If you're unlucky, some corrupt postal worker might happen upon one of your letters and scan all of your outgoing mail afterwards. This risk is not mitigated by a simple security envelope. Adding any links to the chain means lowering the chain's security.

... and if it printed QR codes as well, with the ability to load them into a wallet in an automated fashion.

Trusting someone else to print you out wallet private keys is just insane - even if the OP of this thread is trustworthy, it sets a dangerous precedent allowing any asshole scammer to come along and repeat the trick.

I have added a means to verify that my sheets are genuine, I'm stamping them with my own fingerprint.  See http://casascius.com for a reference fingerprint.

By doing so, at least I have raised the bar upon any asshole scammer.  I at least have a real life identity to put on the line!... something scammers are rarely willing to offer.

I can't even begin to understand how you could think that this would be a viable business.

but now, anyone else can include your fingerprint on their own sheets.

since trust isn't needed for a product in this niche, it's unfortunate to require it. for example, you might just package and sell an open-source version of grondilu's script (or write your own simple front-end to openssl) connected to some small additional code that generates a pdf from the output. on a system with the right tools, it's a ten-line shell script. of course, your customers might copy it to their friends without a license from you, but that risk seems easier to price than the risk that you'd retain clients' keys forever and, some time far from now, simply steal bitcoins untraceably.

alternatively, given the nature of ecdsa keys, you could let customers construct something printable on a website while provably not having access to their private keys. see gavin's 'split private keys' discussion in the development forum, from which you can extrapolate what you need. (being out of practice with the mathematical rather than the systems-related features of cryptosystems, i did not initially realise myself how easy it was to do this, but it's quite straightforward.)

5 BTC bounty to the maker of a convincing spoof.

I actually smudge ink on the paper to do this.  It's not as though I'm printing "fingerprint.jpg" on the document.  The print is real.


I could, but that raises the bar well above the target audience.  Lots of people without technical interest want bitcoins.  Running scripts sounds easy for me, but many people interested in Bitcoins can't be bothered to have to deal with installing the client, and are scared to swim in deep waters after hearing that hackers and viruses are after their wallet.dat's.  But most people can manage "buy now with paypal", as well as deal with a credible and provable assertion that the one guy who made their hacker proof wallet isn't going to stiff them.

the problem is that it's an unprovable assertion. nobody can tell whether you've kept the private keys. all a thief would have to do in your place is keep all the data, inspect the block chain periodically for a very large balance, and strike once many years from now in an entirely untraceable way.

i actually trust you, and i doubt i could name five other members of this forum i would say that about. but sadly i would not be able to recommend a service like this.

it wouldn't be much harder to set up a website that uses the right sort of handshake to prevent you from ever knowing the private keys, and then outputs a pdf that the customer can print. why would anyone prefer the physical post here, unless they don't know how to print a document? (the post adds an additional problem, which is that the document might be inspected by a post officer or any other 'man in the middle'.)

Why not?

Of course.  YOu are 100% right.  But what is different here is my ass is on the line.  Thief should plan on his ass being kicked if he is giving out his real name and address like I am.  MtGox and MyBitcoin could stiff you any second, and your bitcoins could disappear if they get hacked  (as has already happened to some).  I also have enough personal assets that one could sue me for losses and actually recover them.  If you suffer a substantial loss at the hands of MtGox or MB, you're lucky to get the time of day.


Just curious, would you also say the same for MyBitcoin.com?


The closest practical thing I can think of would be something in Javascript that generates the private keys client-side, so the server side never sees them.  That would be trivial to do.  But that doesn't really solve the problem - one must then trust that the website is being honest about the behavior of the script and that one's own machine isn't compromised by malware.  The typical person interested in a paper bitcoin wallet lacks the expertise to independently determine what such a website really does.

I guess we'll see what the market decides. Let us know how it goes.

You run this for several weeks, months, years, and keep tabs on how much money is in the paper. You get bored and decide to take it all and move to another country. We have your thumbprint, woopty-fucking-doo.

The market is already speaking, which is why I decided to take this from a forum posting to an actual website.

if you waited five years and stole from just one particularly wealthy address, your deniability would be quite plausible and even, very likely, convincing in context to many people. who could say it was you who stole anything, rather than someone who illicitly gained access to the customer's sheet of paper in the intervening five years?


absolutely. indeed, given recent events, i trust them far less than i trust you. there's no good way for them to prove that the thefts that recently occurred at their site weren't at their own instigation or for their own benefit, just as you wouldn't be able to prove something similar the first time anyone anonymously stole money from one of your customers' addresses.

for similar reasons, the business isn't robust against that sort of bad publicity. if i were a competitor, all i'd have to do is buy one of your sheets, transfer 1000 btc to it, transfer that sum away, and then claim you did it. who's to know? getting rid of trust solves that problem too.

What would I do with the 25-employee software business I happen to be running in South Jordan, Utah?  Pack it up?  All so I can steal somebody's bitcoins?  This would make sense if I were a transient, but a little bit of Google and you'll see I'm not.

The payoff could be (much) larger than whatever the business is worth. Maybe you'd do it for the thrill. Maybe you would need a large/quick anonymous sum, which liquidating the business would not fulfill. Maybe you got into an accident that changed your personality. Maybe someone took your family hostage and made you do it. Whatever, there are a ton of reasons why this isn't something I'd bet my life on. And fingerprints can be lifted incredibly easily if you are as easy to find as you say.

That and it's not incredibly hard to create a fake online persona. The whole point of Bitcoin is to keep it peer-to-peer. Why would I put all my trust in a single source that isn't backed by anything?

Yeah thanks for the effort but there is no way I would trust this.  I would however happily pay a donation to someone who shares with the community a detailed method for creating and later using paper wallets ourselves.  I know there has been other discussions on the very topic but haven't had a chance to go see if maybe a semi-easy to use solution has already been contributed.

See my original post where I say "Q. Can't I just do this myself?"

Fair enough, and thank you.  Donation address?

You guys are not being nice. This is really no different than bitcoin4cash or cash2bitcoin where people send envelopes stuffed with cash to complete strangers!

I would never consider doing that either.

Or MtGox or MyBitcoin or anywhere else for that matter.

I concede they don't necessarily have to be nice - they are correctly pointing out that if they use my sheet, that I could be dishonest and stiff them.  And when they say they can do fine without my sheet, nine times out of ten they're right.

The other 1/10 who gets stiffed, or who will get stiffed in the future, and see their bitcoins vanish, will have absolutely no clue who took them.  The most they'll be able to say is "F*CK".  Same with funds disappearing from bitcoin4cash or mybitcoin or in transit via the postal service.  At least if someone gets stiffed with my sheet, they know exactly who to blame.

Neat idea.

Have you ever heard of a bank?

People will trust this, eventually.

It may take 100 years to become fully accepted. But it is a sound business model.

I don't think anyone has anything against casascius, this is a theoretical/practical discussion of the merits of his proposal.


Not quite, they receive/send you Bitcoin, which is a final transaction and should immediately be obvious whether it worked or not. The proposed scheme here could retain or lose in transit the private key, which can be used to control future balance in the associated account. It's like introducing the possibility of chargebacks, except on all of the balance as long as the account is in use :)

check what Joric made: https://github.com/joric/pywallet
It makes exporting/importing keys easy without recompiling Bitcoin. It does it right to the wallet using a python script! Still new but pretty cool and easy!

I'd definitely do it if I could generate my own. But I don't trust you that much and never will

You can generate your own address: https://bitcointalk.org/index.php?topic=37997.0
You randomly chose yourself the priv key (if you fear not being random enough, you can generate the priv key from a passphrase (https://bitcointalk.org/index.php?topic=34378.0) or from one of your file (https://bitcointalk.org/index.php?topic=36445.0)) and use the coresponding Bitcoin address

Looking for this Casascius paper wallet. Please PM me if you have one available.

I am a collector of anything that is Physical Bitcoin or crypto

My website or you can say my online  Bitcoin Museum lists all of my collectables at www.cryptocoinscollection.com


Thankyou