Bitcoin Forum

Bitcoin => Wallet software => Topic started by: t3xoff on September 11, 2021, 04:29:47 AM



Title: BITCOIN WALLET
Post by: t3xoff on September 11, 2021, 04:29:47 AM
Can you guys tell which wallet is safest according to your experience.


Title: Re: BITCOIN WALLET
Post by: pooya87 on September 11, 2021, 05:46:44 AM
Any wallet software that is 100% open source, old (meaning wasn't created a week ago!), is reviewed, preferably has reproducible builds (for those who can't or don't want to compile the source) and is created by competent developers.
I can only recommend two even though there are more: bitcoin core and Electrum.


Title: Re: BITCOIN WALLET
Post by: Pmalek on September 11, 2021, 06:55:58 AM
You didn't specify what device or operating system you use. There are desktop and mobile wallets. Mobile wallets are further divided into those created for Android or iOS devices. Unfortunately, you will sometimes see that a software wallet works for Android, but doesn't work on iOS phones. You have to take such things into account as well.

The below source hasn't been updated for a year, but it will still give you plenty of information about what is available:
[General] Bitcoin Wallets - Which, what, why? (https://bitcointalk.org/index.php?topic=1631151.0)


Title: Re: BITCOIN WALLET
Post by: Lucius on September 11, 2021, 10:28:54 AM
Can you guys tell which wallet is safest according to your experience.

This question is asked by a person who found  "a critical security flaw in bitcoin protocol that would give me infinity private keys and all that private keys work." (https://bitcointalk.org/index.php?topic=5359011.msg57893259#msg57893259) If you are already so skilled that you managed to dismantle the bitcoin protocol, I guess you should answer your own question.

Given that you’ve found a way to hack the entire network, does it make sense to ask which is the safest Bitcoin wallet?


Title: Re: BITCOIN WALLET
Post by: n0nce on September 12, 2021, 10:56:13 AM
I would argue the safest wallet would be a paper wallet created by hand, by tossing a coin 256 times.

That's going to be the binary encoding of your very secure private key. The issue will then just be how to calculate an address from it, where you can receive funds.

A solution to this is presented by the https://seedsigner.com/ device, which is fully open source hardware and software, and totally air gapped. You can enter the private key and it calculates a public key for you and it can even sign a transaction to spend those funds.
After it's powered off, the key is lost since it's just stored in RAM and you will have to import it again the next time.


Title: Re: BITCOIN WALLET
Post by: BlackHatCoiner on September 12, 2021, 11:10:50 AM
I would argue the safest wallet would be a paper wallet created by hand, by tossing a coin 256 times.
You don't have to do it 256 times, unless you really need one private key. Tossing it 128 times is enough (https://bitcointalk.org/index.php?topic=5324797.0).

The safest wallet option, hmm. I mean, you ensure that there's nothing malicious in your RNG, but you aren't fully ensuring the randomness. For example, you should toss it firstly x times and see if on average x/2 times it was heads. Otherwise, your generation may not be random and hence, guessing your entropy may be far easier.

There's a lot of discussion about this topic in the link above.


Title: Re: BITCOIN WALLET
Post by: o_e_l_e_o on September 12, 2021, 07:44:10 PM
A solution to this is presented by the https://seedsigner.com/ device, which is fully open source hardware and software, and totally air gapped. You can enter the private key and it calculates a public key for you and it can even sign a transaction to spend those funds.
That's one option, sure. An easier option without having to buy a specific device will to be use a permanently airgapped computer running a clean install of an open source reputable Linux distro of your choice with full disk encryption. Lots of people would recommend Tails for such a purpose, with handily comes bundled with Electrum. If you only want to store your wallet on paper after you have generated an address on Tails, then you can just shut it down once you've backed up your seed phrase on paper. If you want to continue to access your wallet on Tails to use as a cold wallet, then you'll need to enable persistent storage.



Title: Re: BITCOIN WALLET
Post by: n0nce on September 12, 2021, 07:47:24 PM
A solution to this is presented by the https://seedsigner.com/ device, which is fully open source hardware and software, and totally air gapped. You can enter the private key and it calculates a public key for you and it can even sign a transaction to spend those funds.
That's one option, sure. An easier option without having to buy a specific device will to be use a permanently airgapped computer running a clean install of an open source reputable Linux distro of your choice with full disk encryption. Lots of people would recommend Tails for such a purpose, with handily comes bundled with Electrum. If you only want to store your wallet on paper after you have generated an address on Tails, then you can just shut it down once you've backed up your seed phrase on paper. If you want to continue to access your wallet on Tails to use as a cold wallet, then you'll need to enable persistent storage.
Well, it's basically the same thing. This is just an airgapped Raspberry Pi (regular Linux machine, as you recommend) with a screen and some buttons. I'd argue many people don't have a spare computer to use in an airgapped fashion, but if you have one, you can save the around 50 bucks that a SeedSigner costs.


Title: Re: BITCOIN WALLET
Post by: NeuroticFish on September 13, 2021, 06:40:07 AM
according to your experience.

My experience may be way different than yours. For me, a Tails USB (or other Linux live USB) with Electrum on it already does the job.
So the question is wrong and incomplete, since the relevant part is your experience: the experience with crypto and the experience with computers.
For newbies I always recommend to look for one of the established hardware wallets that work with Electrum (and learn how to safely install Electrum too); and yes, basically use with Electrum.


Title: Re: BITCOIN WALLET
Post by: mocacinno on September 13, 2021, 06:46:07 AM
Nobody will be able to give you a complete answer, because everybody has their own background, their own OPSEC, their own hardware requirements, their own preference... Even between longtime members, there is some discussion as to which method, which brand, which procedure is the best. This being said, i'd basically say that if you stick to one of these three, you should be ok in the "safest" department:

  • A properly airgapped setup with either electrum or bitcoin core
  • A paper wallet generated in a secure way
  • A well-known hardware wallet purchased directly from the source, i'd recommend either ledger or trezor brands

Do realise that either of these options have their own OPSEC requirements... If you buy a hardware wallet from an untrusted source, you're probably worse off than if you'd use a desktop wallet... If you generate a paper wallet the wrong way, you're unsecure... Even airgapped setups can be setup in the wrong way if you really try.

My personal preference would be a completely offline hardened CentOS (with an encrypted partition containing the folder that holds my wallet.dat) with the latest version of core producing an encrypted non-HD wallet that has been backupped on an USB stick that is clearly marked in a way that makes is perfectly clear it should never be inserted into any other (online) PC and that's kept in a bankvault. Truth be told, such a setup is to much work for me, so i just bought a couple of hardware wallets instead  ;D


Title: Re: BITCOIN WALLET
Post by: Husires on September 14, 2021, 06:39:12 AM
Can you guys tell which wallet is safest according to your experience.

"safest" is a relative term, according to your definition, extent of your experience in programming, how to protect your devices physically/software.


I can make the following suggestions:

  • Zero programming experience and willing to spend a little money: Hardware wallets are the right choice as they provide a safe environment for those who do not have programming experience with their support for many currencies.
  • Some software experience and you don't want to buy hardware wallets: choose an open source wallet, well reviewed with the purchase of a new device that is airgapped.
  • Good software experience: You can secure your currencies with your options, and it will not cost you any extra money.


Therefore, the first and second options are ideal.


Title: Re: BITCOIN WALLET
Post by: Pmalek on September 14, 2021, 12:20:32 PM
Some software experience and you don't want to buy hardware wallets: choose an open source wallet, well reviewed with the purchase of a new device that is airgapped.
Considering how much information is available on the topic of creating an airgapped setup, both on Bitcointalk and outside of it, you really don't need any particular knowledge to be able to follow a step-by-step guide. Just read the recommendations and apply them. The biggest problem isn't in creating an airgapped system. The biggest problem is that most people don't have spare computers or laptops laying around and not being used that they can use exclusively for their cold storage. Or they are not willing to invest in one only for that purpose.   


Title: Re: BITCOIN WALLET
Post by: mocacinno on September 14, 2021, 12:36:38 PM
--snip--
The biggest problem is that most people don't have spare computers or laptops laying around and not being used that they can use exclusively for their cold storage. Or they are not willing to invest in one only for that purpose.  

This is indeed an excuse i've heared numerous times from newer members: a hardware wallet is expensive (eventough it costs less than $100), or an old pc to setup an airgapped setup is expensive (eventough it costs less than $300)... But 3 months later they come in to complain about the fact they've lost the equivalent of $100.000 they had in their exchange "wallet" due to a hack or phishing or an exit scam.

It ridiculous to see how people don't want to spend $100 to keep $100.000 safe... But it is indeed a very, very, very common excuse i've read many, many times from many, many people....


Title: Re: BITCOIN WALLET
Post by: o_e_l_e_o on September 14, 2021, 12:46:24 PM
you really don't need any particular knowledge to be able to follow a step-by-step guide.
I think you do, or at least, you do if you want to do it properly.

Most people would know how to turn off their WiFi or put their laptop in to airplane mode. However, WiFi cards can still leak some data even when turned off by the OS, and there is always the chance that you (or something in your OS) turns it back on by mistake. So to be sure, you should remove your WiFi card. How many people would be able to open their laptop and even identify the WiFi card, let alone safely remove it, especially if it is built in to the motherboard? Having a guide which says "Remove your WiFi card" is fine, but if someone has never before opened up a computer to look inside (which is the majority of the population) then that isn't really helpful for them. The same goes for other steps, such as installing Linux. A lot of people have never heard of Linux or even really know what an operating system is.

Step by step instructions are rarely detailed enough for the complete newbie, and if there is the slightest error or issue, then they are completely stuck. You don't need any programming knowledge as suggested above, but you do need a certain level of familiarity with computers and hardware.


Title: Re: BITCOIN WALLET
Post by: Pmalek on September 14, 2021, 01:15:28 PM
But 3 months later they come in to complain about the fact they've lost the equivalent of $100.000 they had in their exchange "wallet" due to a hack or phishing or an exit scam.
I understand what you are saying and I agree. I am just saying how it is. People start thinking about their security only after they were the victims of a hack/scam. We start to think and cheat like that from early age. I am not going to do my homework because there are 30 other pupils in my class. What are the chances the teacher will check if I did mine? And if you get a bad grade, you are angry at yourself for spending 30 minutes and doing the homework in the first place. You can apply the same excuses to matters of health, your own safety, etc.

<Snip>
Fair points, but if you don't know how a WIFI card looks like, Google it or watch a YouTube video of how to disconnect it. You can find YouTube videos on how to dismantle almost any model of popular laptops, clean them, and put them back together.

Working with Linux is a different kind of problem. That's not something a quick guide can teach you. But if you absolutely don't want to do that, you can stick with Windows because your system will be offline anyways. Linux is recommended, but it's not a must. 


Title: Re: BITCOIN WALLET
Post by: o_e_l_e_o on September 14, 2021, 01:31:56 PM
Linux is recommended, but it's not a must. 
Sure, but then we start getting in to gray areas. Linux is recommended, but Windows will do. Removing connectivity hardware is recommended, but turning it off will do. Formatting the hard drive first is recommended, but not doing it will be OK since you will be offline anyway. Encrypting your wallet is recommended, but no one will have access to it anyway so it's not necessary. And so on. Soon enough, we are left with someone just turning off their WiFi and thinking they have a safe airgapped wallet.

The problem with airgapped wallets is exactly this - you can seriously mess up if you cut corners or don't really understand what you are doing. This is much harder to do with a hardware wallet. I would say if you can't commit (or don't have the knowledge) to set up an airgapped wallet properly, then you would be safer using a hardware wallet instead of settling for a sub-optimal airgapped set up.


Title: Re: BITCOIN WALLET
Post by: Lucius on September 14, 2021, 02:56:27 PM
It ridiculous to see how people don't want to spend $100 to keep $100.000 safe... But it is indeed a very, very, very common excuse i've read many, many times from many, many people....

It has always been strange to me, especially considering that these same people are willing to pay much higher amounts when it comes to other devices such as smartphones, laptops or, say, the increasingly popular electric scooters that cost an average of around EUR 300. Someone might say that the biggest problem is that there are free solutions (desktop&mobile wallets), and I agree that people won't invest even $50 if they can get something for free - but ignorance also plays a big role here, because they don't understand the basic differences and potential risks arising from free solutions.

I made a decision a long time ago, I will not help anyone to invest in crypto if that person does not understand some basic things before, and if they will keep their coins online or in a mobile/desktop wallet on devices they use every day for various activities. Then it's just a question of when something bad will happen, and then it's usually someone else's fault that it happened.


Title: Re: BITCOIN WALLET
Post by: Pmalek on September 14, 2021, 06:16:33 PM
Sure, but then we start getting in to gray areas...
I would still argue that from everything you mentioned, using Windows is the only acceptable thing if someone has no knowledge of Linux distros. And in most cases, the average Joe won't have any. Everything else you said, is not recommended. 

I would say if you can't commit (or don't have the knowledge) to set up an airgapped wallet properly, then you would be safer using a hardware wallet instead of settling for a sub-optimal airgapped set up.
That's why the most common answer to the question what type of wallet should I use is buy a hardware wallet.

I made a decision a long time ago, I will not help anyone to invest in crypto if that person does not understand some basic things before, and if they will keep their coins online or in a mobile/desktop wallet on devices they use every day for various activities. Then it's just a question of when something bad will happen, and then it's usually someone else's fault that it happened.
When and if something happens is not a concern of yours. The only problem is if it's a close friend or relative and you wouldn't want them to get hurt or scammed. Even then, I would seriously advice them to reconsider what they are doing and explain what can happen to hot wallets.   


Title: Re: BITCOIN WALLET
Post by: o_e_l_e_o on September 14, 2021, 07:13:34 PM
I would still argue that from everything you mentioned, using Windows is the only acceptable thing if someone has no knowledge of Linux distros. And in most cases, the average Joe won't have any. Everything else you said, is not recommended.
But I, on the other hand, would argue that using Windows is absolutely not acceptable, that Windows is insecure, that Windows is spyware, that Windows has enormous amounts of unnecessary and non-removable bloatware filled with God-knows-what code, and so on. To me, none of the things I mentioned are acceptable. To you, using Windows is acceptable. To someone else, turning off rather than removing connectivity hardware might be acceptable. And so enters the gray area of what constitutes an airgapped wallet. Either commit to doing it all and doing it properly, or opt for a hardware wallet.

It's like the old saying - Good, Cheap, Fast, pick two. In this case we would replace fast with easy. Hardware wallets are good and easy, but not cheap. Airgapped cold storage (provided you have a spare device you can use) are good and cheap, but not easy. Mobile wallets, web wallets, etc. are cheap and easy, but are not good.


Title: Re: BITCOIN WALLET
Post by: Lucius on September 15, 2021, 08:32:54 AM
When and if something happens is not a concern of yours.    

I’m talking from personal experience where someone was very irresponsible and lost a significant amount of coins, and then I was the one who was most responsible for it - because I made someone deal with it at all - it’s that classic accusation “that you didn’t mention Bitcoin, I wouldn't lose money". I paid a loss out of my own pocket for someone not to blame me for something my whole life, but this is the last time I will allow myself something like that.

I will not exaggerate if I say that from my personal experience at least 90% of people are not ready to be their own bank, and anyway they are only interested in how to profit, preferably in a very short time.


Title: Re: BITCOIN WALLET
Post by: NeuroticFish on September 15, 2021, 08:55:19 AM
I’m talking from personal experience where someone was very irresponsible and lost a significant amount of coins, and then I was the one who was most responsible for it - because I made someone deal with it at all - it’s that classic accusation “that you didn’t mention Bitcoin, I wouldn't lose money". I paid a loss out of my own pocket for someone not to blame me for something my whole life, but this is the last time I will allow myself something like that.

Sad story. The lesson should be to tell people clearly (and emphasize too!) that it's completely their decision for what they do with their money, whether you do this online or in real life.


I will not exaggerate if I say that from my personal experience at least 90% of people are not ready to be their own bank, and anyway they are only interested in how to profit, preferably in a very short time.

100% correct. And most people prefer to blame anybody else than themselves when something goes wrong.


I made a decision a long time ago, I will not help anyone to invest in crypto if that person does not understand some basic things before, and if they will keep their coins online or in a mobile/desktop wallet on devices they use every day for various activities. Then it's just a question of when something bad will happen, and then it's usually someone else's fault that it happened.

For newbies I lately recommend HW exactly because of this. Then the chance that the blame is on me decreases greatly.


Title: Re: BITCOIN WALLET
Post by: DaveF on September 15, 2021, 04:13:05 PM
A while ago I posted this: https://bitcointalk.org/index.php?topic=5205304

And it's still valid today. It's not just what wallet but what you want to do with it, and how much is it holding, etc.
Also, as I keep saying, having a hardware wallet for a hot wallet that at most is going to have $50 is just time consuming and not worth it.

It's not a one size fits all.

-Dave



Title: Re: BITCOIN WALLET
Post by: Pmalek on September 18, 2021, 06:57:50 AM
Also, as I keep saying, having a hardware wallet for a hot wallet that at most is going to have $50 is just time consuming and not worth it.
I would never purchase a hardware wallet to store $50 in it if that amount is the first and last time I own Bitcoin. But if that's not the case, and you are planning to periodically increase that stash to say $100, $200, etc., it's well worth the money and the trouble. I think that if someone's first experience with Bitcoin is a positive one, that person would likely want more. Let's not forget that if Bitcoin reaches a valuation we all hope for, those initial $50 would be worth a lot more. 


Title: Re: BITCOIN WALLET
Post by: DaveF on September 18, 2021, 01:11:41 PM
Also, as I keep saying, having a hardware wallet for a hot wallet that at most is going to have $50 is just time consuming and not worth it.
I would never purchase a hardware wallet to store $50 in it if that amount is the first and last time I own Bitcoin. But if that's not the case, and you are planning to periodically increase that stash to say $100, $200, etc., it's well worth the money and the trouble. I think that if someone's first experience with Bitcoin is a positive one, that person would likely want more. Let's not forget that if Bitcoin reaches a valuation we all hope for, those initial $50 would be worth a lot more. 

Agree 100%, part of the issue with forums and my typing is I can put out a point and type it knowing what I am thinking but you don't. So the background is kind of missing.

So yes, if you are going to keep adding to the wallet to have it grow from $50 then $90 then $175 etc, that is one thing.

In MY view, that is NOT a hot wallet, that is a cold storage wallet. Or a 'warm' wallet.

The 'hot wallet' say the one on my phone that my signature campaign pays into, even someone as paranoid as I am has no security on it beyond a password / fingerprint.

The BTC comes in, 75% of BTC goes out just as quickly. That is what I think of as a hot wallet.

If someone is just getting into BTC and wants to get some and spend it and then get some more and spend it, IMO going hardware is just going to frustrate them.
I explain to them that it is just like cash in a regular wallet and if you do something stupid or careless with it, it's gone.
I then can tell them there are MUCH better ways to do it for long term and even 'middle term' storage. THEN I can get into the hardware, multisig, and other options and determine what works best for them.

-Dave


Title: Re: BITCOIN WALLET
Post by: Lucius on September 18, 2021, 02:33:32 PM
Sad story. The lesson should be to tell people clearly (and emphasize too!) that it's completely their decision for what they do with their money, whether you do this online or in real life.

I understood this as a very important lesson, and it is important that it happened at a time when the price of BTC was around $200, and I could afford to go in the direction of compensating someone for the damage caused by insufficient knowledge and insufficient awareness of how important security is when it comes to crypto. Back then, HWs weren't as popular as they are today, and a hot wallet on a computer used for everything was an ideal target for some malware that came into possession of seed stored on PC.


Title: Re: BITCOIN WALLET
Post by: suzanne5223 on September 19, 2021, 02:58:13 PM
Can you guys tell which wallet is safest according to your experience.
The wallet that the crypto community believes to be safest because they are not exposed to danger is a hardware wallet (ledger) or non-custodial open source wallet (electrum) which has already been evaluated but avoiding human error is needed to be your top priority for the safety of your wallet from online theft still lies in your hand.


Title: Re: BITCOIN WALLET
Post by: Pmalek on September 21, 2021, 08:10:31 AM
The wallet that the crypto community believes to be safest because they are not exposed to danger is a hardware wallet (ledger)
Danger is too broad of a term. If we are only talking about the safety of your private keys and ultimately your crypto, sure, Ledger manages to achieve that. But Ledger hasn't handled themselves properly during the database leak, so they failed to protect the privacy of their customers. They are currently failing at the production of Nano X's because too many of them have battery issues. Ledger isn't great, neither is Trezor or Electrum. Electrum is a software wallet. Although it's one of the best in its class, it's still a hot wallet (unless you are using it as a cold storage) and can't be compared to a hardware wallet or a properly airgapped device.   


Title: Re: BITCOIN WALLET
Post by: suzanne5223 on September 21, 2021, 01:18:34 PM
The wallet that the crypto community believes to be safest because they are not exposed to danger is a hardware wallet (ledger)
Danger is too broad of a term. If we are only talking about the safety of your private keys and ultimately your crypto, sure, Ledger manages to achieve that. But Ledger hasn't handled themselves properly during the database leak, so they failed to protect the privacy of their customers. They are currently failing at the production of Nano X's because too many of them have battery issues. Ledger isn't great, neither is Trezor or Electrum. Electrum is a software wallet. Although it's one of the best in its class, it's still a hot wallet (unless you are using it as a cold storage) and can't be compared to a hardware wallet or a properly airgapped device.   
Thank you for pointing this issue out cause I'm aware of the NanO x problem but the ledger database leak that happened then will only expose those that purchased the ledger before the data leak to a possible physical attack.
If we talked about things that have to do with internet activities there will always be a danger involve due to inexperienced or human error and pcmag (https://www.pcmag.com/news/black-hat-researcher-shows-why-air-gaps-wont-protect-your-data) once claim that air-gapped devices are also not secure as we believe it was.

This is what I have thought about several times and what we can do now is to use one of the best wallets in there class until a total solution arrive.


Title: Re: BITCOIN WALLET
Post by: n0nce on September 22, 2021, 02:15:32 AM
Can you guys tell which wallet is safest according to your experience.
The wallet that the crypto community believes to be safest because they are not exposed to danger is a hardware wallet (ledger) or non-custodial open source wallet (electrum) which has already been evaluated but avoiding human error is needed to be your top priority for the safety of your wallet from online theft still lies in your hand.

Please check these threads and rethink your recommendations (I myself wouldn't recommend a single brand at all, just give resources for an interested person to form their own opinion - there is no perfect hardware or software wallet):

Ledger Nano X Battery Pandemic (https://bitcointalk.org/index.php?topic=5358741.0)
[BIG LIST] Hardware wallets (80+) (https://bitcointalk.org/index.php?topic=5282364.0)
[ list ] Open Source Hardware Wallets (https://bitcointalk.org/index.php?topic=5288971.0)
Secure Element in Hardware Wallets (https://bitcointalk.org/index.php?topic=5304483.0)

Quote
I'm aware of the NanO x problem but the ledger database leak that happened then will only expose those that purchased the ledger before the data leak
Oh, so you're aware of all these BIG issues, yet still recommend Ledger? ::)


Title: Re: BITCOIN WALLET
Post by: Charles-Tim on September 22, 2021, 06:33:39 AM
Oh, so you're aware of all these BIG issues, yet still recommend Ledger? ::)
That does not mean any other hardware wallet database is perfect, anyone of the can be hacked at any time. The best is to find a way you can purchase hardware wallet in a way information you provide hardware wallet company can not be linked to your real identity. Do not be surprised if you heard the database of another hardware company is leaked, try to protect you identity yourself is the best.

Only what I do not like about Ledger Nano is because it is not completely open source, its secure element which generates and store the seed phrase is close source, while many reputed members are still recommending the wallet. That is the fact that makes me prefer Trezor which is completely open source but which should be used with passphrase to make the possible physical attack not to be able to reveal your keys if possible the hardware wallet was stolen.

But, you are not wrong, more hardware wallet are recommendable but people do recommended Trezor and Ledger Nano because they are the most used and most tested for vulnerabilities.


Title: Re: BITCOIN WALLET
Post by: o_e_l_e_o on September 22, 2021, 12:33:18 PM
and pcmag (https://www.pcmag.com/news/black-hat-researcher-shows-why-air-gaps-wont-protect-your-data) once claim that air-gapped devices are also not secure as we believe it was.
There is no system in the world which is 100% safe and secure and completely impervious to all attacks. However, this article makes it sound like stealing data from an air gapped machine is almost trivial, which it obviously is not. For any of these attacks to work, someone must first gain access to your airgapped computer, install malware on it, place some kind of microphone, radio receiver, or similar in the same room you would be using it, and do all this without it being noticeable. For most people who keep their airgapped device inside their locked house (as long as you are not silly enough to plug in a random USB drive someone gave you to your airgapped device), then that is next to impossible. Airgapped wallets set up properly remain very secure.


Title: Re: BITCOIN WALLET
Post by: Lucius on September 22, 2021, 01:05:46 PM
But, you are not wrong, more hardware wallet are recommendable but people do recommended Trezor and Ledger Nano because they are the most used and most tested for vulnerabilities.

Unfortunately, there is no other manufacturer that has managed to impose itself as an adequate alternative to Ledger or Trezor if we take into account everything that happened to Ledger, but also the irreparable vulnerability that was discovered on Trezor. This shows us that there are no serious players in the market, but only some who obviously do not have enough money or ideas to become somewhat relevant.

All this together benefits those who live from the old glory, and instead of achieving the highest possible quality and safety, they constantly run into new problems. I am of the opinion that people should be advised to consider buying hardware wallets, but they should not be explicitly suggested what exactly to buy.


Title: Re: BITCOIN WALLET
Post by: n0nce on September 22, 2021, 03:17:32 PM
But, you are not wrong, more hardware wallet are recommendable but people do recommended Trezor and Ledger Nano because they are the most used and most tested for vulnerabilities.

Unfortunately, there is no other manufacturer that has managed to impose itself as an adequate alternative to Ledger or Trezor if we take into account everything that happened to Ledger, but also the irreparable vulnerability that was discovered on Trezor. This shows us that there are no serious players in the market, but only some who obviously do not have enough money or ideas to become somewhat relevant.

All this together benefits those who live from the old glory, and instead of achieving the highest possible quality and safety, they constantly run into new problems. I am of the opinion that people should be advised to consider buying hardware wallets, but they should not be explicitly suggested what exactly to buy.
There are certainly tons of tried and trusted alternatives today, just a few that come to mind are BitBox and ColdCard.
Check out this great list: [ LIST ] Open Source Hardware Wallets (https://bitcointalk.org/index.php?topic=5288971.0)

I agree, I prefer to give the resources and let the person decide on their own; no wallet is perfect and it comes down to personal preference what drawbacks are okay for you and what is unacceptable for you.


Title: Re: BITCOIN WALLET
Post by: Lucius on September 23, 2021, 12:41:20 PM
There are certainly tons of tried and trusted alternatives today, just a few that come to mind are BitBox and ColdCard.

Then answer the question why these alternatives are not sold in larger quantities after the competition has proven that it is not capable of being up to the task when it comes to the safety of their customers, or vulnerabilities that cannot be fixed? I'll tell you why, because they're not powerful enough to deserve that trust at all - nothing sells on its own, no matter how good it is.


Title: Re: BITCOIN WALLET
Post by: n0nce on September 24, 2021, 02:23:46 AM
There are certainly tons of tried and trusted alternatives today, just a few that come to mind are BitBox and ColdCard.

Then answer the question why these alternatives are not sold in larger quantities after the competition has proven that it is not capable of being up to the task when it comes to the safety of their customers, or vulnerabilities that cannot be fixed? I'll tell you why, because they're not powerful enough to deserve that trust at all - nothing sells on its own, no matter how good it is.
They do sell in large quantities.


Title: Re: BITCOIN WALLET
Post by: Pmalek on September 24, 2021, 08:56:10 AM
There is no system in the world which is 100% safe and secure and completely impervious to all attacks. However, this article makes it sound like stealing data from an air gapped machine is almost trivial, which it obviously is not.
it's one thing to want to stay protected from a thief who targets you and wants to steal from you. It's a whole other level if you get on the radar of a serious government agency who decides to take you down (darknet markets, Silk Road, etc.). Your primary concern should be to to remain protected from the first type of adversary. Your secondary concern should be not to do illegal things that would result in you becoming a target for the latter. Because if you do, you are gonna have more important things to worry about than how safe your bitcoin wallet is. This is not a response to you personally, just some of my thoughts. No one is untouchable.    


Title: Re: BITCOIN WALLET
Post by: Lucius on September 25, 2021, 09:06:31 AM
They do sell in large quantities.

Is that something you can back up with a fact or just your personal opinion? I did not find data on how many of these HWs were sold, but Ledger announced a few months ago that it had sold over 3 million devices, while some estimate that the number of Trezors is slightly less than that, but still in the millions.


Title: Re: BITCOIN WALLET
Post by: o_e_l_e_o on September 25, 2021, 03:20:39 PM
it's one thing to want to stay protected from a thief who targets you and wants to steal from you. It's a whole other level if you get on the radar of a serious government agency who decides to take you down (darknet markets, Silk Road, etc.).
If you are a target of a major government or one of their agencies such as the FBI, then the security of your wallets is almost inconsequential. They'll put you in jail regardless.

Laws specifying whether you can be required to provide your decryption key or password for data files to law enforcement or other agencies vary depending on the country you live in. US courts seem to (so far) be saying that doing so would violate an individual's Fifth Amendment rights. I'm not aware of any rulings in the US relating to handing over your bitcoin wallet passwords, seed phrases, private keys, etc., though. There was a case in Germany of someone who spent two years in jail (he's since been released) for installing mining software on other people's computers, but refused to hand over the password to a wallet containing around 1,700 BTC. I can't find out whether he has since been able to recover or spend any of those 1,700 BTC without the police coming knocking, though.

But yes, I agree. When thinking about wallet security you should be focusing on the most likely attack vectors, which for most people will be the opportunistic attacker or maybe a targeted attack by one or two individuals. If you think that your most likely attack vector is that of a nation state, then you've got far bigger problems to deal with.


Title: Re: BITCOIN WALLET
Post by: n0nce on September 25, 2021, 05:18:05 PM
They do sell in large quantities.

Is that something you can back up with a fact or just your personal opinion? I did not find data on how many of these HWs were sold, but Ledger announced a few months ago that it had sold over 3 million devices, while some estimate that the number of Trezors is slightly less than that, but still in the millions.
I don't work at a hardware wallet company, so I have no numbers, but if you look outside the Trezor-Ledger-bubble, you'll find big communities of each of the other wallet brands (chat groups, Twitter followings, etc. - I know any one of those metrics can be faked, but look at the bigger picture).

Even though they may not sell millions, they still sell many. And I'd encourage that, instead of continuing to shill Ledger, 'it must be good because they sell many', because this shilling may be the exact reason why the others sell less than a million devices each.

I know, I know, hen and egg problem and all, but I think you get the idea.

Actually, I don't even understand your point or opinion, starting here:
Quote
Unfortunately, there is no other manufacturer that has managed to impose itself as an adequate alternative to Ledger or Trezor if we take into account everything that happened to Ledger, but also the irreparable vulnerability that was discovered on Trezor
You are trying to say that there are no good alternatives to Trezor and Ledger, because they have security bugs and bad customer data handling? How does this make sense? Exactly because these wallets have flaws, we should look at the alternatives..


Title: Re: BITCOIN WALLET
Post by: Pmalek on September 25, 2021, 06:11:26 PM
Laws specifying whether you can be required to provide your decryption key or password for data files to law enforcement or other agencies vary depending on the country you live in. US courts seem to (so far) be saying that doing so would violate an individual's Fifth Amendment rights.
The United States is a legal and logistical nightmare in such matters. They have Supreme Courts and Federal Courts.

This source that I found (https://www.vox.com/recode/2020/2/24/21133600/police-fbi-phone-search-protests-password-rights) says that in 2019, the Massachusetts Supreme Court forced a defendant to reveal the unlocking code for this phone. During the same year, Pennsylvania’s Supreme Court ruled that an accused individual does not have to disclose the password for his computer. Those are just some cases with courts of the highest level.
When it comes to Federal Courts, the Third Circuit Court of Appeals ruled that a defendant had to unlock multiple computers and devices. But, the 11th Circuit Court of Appeals ruled in favor of the defendant in a similar case. 

Then we have the issue of biometrics. The source says:
Quote
Law enforcement is allowed to use people’s bodies as evidence against them, for instance by compelling them to participate in suspect lineups or provide their DNA. So if the police can take your fingerprints, can’t they use them to unlock your phone?
...
Quote
courts have been more likely to rule that the Fifth Amendment does not apply to biometrics than they are that it applies to passcodes.
...
Quote
Yet another factor to consider here is that, while it’s impossible for police to read your mind and get your passcode, they can hold a phone up to your face or press your finger on it to bypass the biometric lock. And while your lawyer can (and should) argue that any evidence found this way was illegally obtained and should be suppressed, there’s no guarantee they’ll win.
 

The conclusion is that it's safer to use a password/pin code than biometrics when it comes to password-protecting your personal devices.
Quote
So, all things considered, if you’re worried about law enforcement getting access to your phone, your safest bet is to just use a passcode.
*All quotes are from the source mentioned above.


Title: Re: BITCOIN WALLET
Post by: o_e_l_e_o on September 25, 2021, 07:48:24 PM
When it comes to Federal Courts, the Third Circuit Court of Appeals ruled that a defendant had to unlock multiple computers and devices.
So, this case is a little more nuanced than that.

If you read the court documents, you'll find that they specifically mention that the Eleventh Circuit found that the defendant should have their Fifth Amendment right against self-incrimination applied in such scenarios. The difference here is that the courts already knew what was on the encrypted hard drives (partly from testimony from another person and partly from records from the associated computer they were attached to), and they already had enough evidence from other sources to convict the individual in question. For those reasons, the court said that forcing the individual to decrypt the hard drives would not amount to self-incrimination since it would not change the outcome of the court case or their final ruling.

This scenario could potentially apply to bitcoin if law enforcement knew you had a bitcoin wallet and also knew the addresses in it, as unlocking it does not incriminate you any more. If you had a bitcoin wallet and they did not know which addresses were in it, could you argue for your Fifth Amendment rights? I don't know the answer to that.


Title: Re: BITCOIN WALLET
Post by: Pmalek on September 26, 2021, 07:30:49 AM
For those reasons, the court said that forcing the individual to decrypt the hard drives would not amount to self-incrimination since it would not change the outcome of the court case or their final ruling.
It's certainly interesting to think about. Imagine that the defendant was accused of embezzling 1000 BTC, but the actual number is much higher, 5000, for example. The court only knows and has evidence for the 1000 BTC. Providing them with access to the computer would be self-incriminating if they can obtain evidence for the remaining 4000 bitcoin. I wonder what would happen then.   


Title: Re: BITCOIN WALLET
Post by: o_e_l_e_o on September 26, 2021, 08:09:43 AM
I wonder what would happen then.
Yeah, who knows? The courts themselves don't know until if and when such a case actually occurs, and even then I'm sure it would get bounced up through the chain of courts and appeals. In such a case where the defendant will be going to jail for embezzling $40 million anyway, would it make much difference if that number was actually found to be $200 million? Or would it make much difference if the defendant stuck to a story that they do not know the seed phrase/wallet password and so cannot reveal the true amount of bitcoin contained?

Anyway, to get somewhat back on topic, the safest wallet for you is going to be the one which protects best against the attack vectors which you deem most likely for you. If you honestly believe those attack vectors are from a three letter agency, then although a hardware wallet or encrypted airgapped wallet might prevent them from accessing your funds, you'll need to go to much greater lengths if you want to hide the existence of those funds altogether.


Title: Re: BITCOIN WALLET
Post by: Lucius on September 26, 2021, 10:59:17 AM
Even though they may not sell millions, they still sell many. And I'd encourage that, instead of continuing to shill Ledger, 'it must be good because they sell many', because this shilling may be the exact reason why the others sell less than a million devices each.

I don’t shill Ledger so don’t make such accusations if you don’t have concrete evidence for it. I’m just talking about specific data that can be found online, and you’re guessing something based on your feelings. The fact that we are discussing something does not mean that we advise someone to buy it, on the contrary - we warn of all the bad features or omissions that these companies have made over the years.

Actually, I don't even understand your point or opinion, starting here:
Quote
Unfortunately, there is no other manufacturer that has managed to impose itself as an adequate alternative to Ledger or Trezor if we take into account everything that happened to Ledger, but also the irreparable vulnerability that was discovered on Trezor
You are trying to say that there are no good alternatives to Trezor and Ledger, because they have security bugs and bad customer data handling? How does this make sense? Exactly because these wallets have flaws, we should look at the alternatives..

You completely misunderstood what I meant - I'm just saying that despite all the bad things surrounding the two most famous HW manufacturers, no other company has emerged to offer a product that would become the killer of Ledger&Trezor. This does not mean that there are no alternatives, as I have already written, let everyone decide which device is best for him - and after all hardware wallets are an alternative in themselves - there are many other ways to store cryptocurrencies, and some may be safer than any HW.


Title: Re: BITCOIN WALLET
Post by: n0nce on September 26, 2021, 03:01:31 PM
Anyway, to get somewhat back on topic, the safest wallet for you is going to be the one which protects best against the attack vectors which you deem most likely for you. If you honestly believe those attack vectors are from a three letter agency, then although a hardware wallet or encrypted airgapped wallet might prevent them from accessing your funds, you'll need to go to much greater lengths if you want to hide the existence of those funds altogether.
Only issue with super well hidden and anonymous funds, especially if there is no three-letter agency behind your ass: there will be a point in time where you'll want to spend those millions and then it may be hard to argue where that money came from. This is why I have this bookmarked:

You should never delete a wallet.

By keeping the private keys, you can always prove you just bought the BTC in a point in time when you were able to afford them.
However, you'll have evaded wealth tax for years in case you lived in a country collecting such a tax. This might put you into jail.
So it's tricky to hold funds completely secretly, without landing in jail! Everyone should make sure to consider this.


Title: Re: BITCOIN WALLET
Post by: o_e_l_e_o on September 26, 2021, 03:51:12 PM
However, you'll have evaded wealth tax for years in case you lived in a country collecting such a tax.
If it's several million dollars worth you are talking about, then that is more than enough money to easily migrate to a country with more friendly bitcoin laws if you are concerned about a wealth tax.

I wonder what has happened in scenarios where people have lost access to their wallets or keys for a number of years (and therefore not paid wealth tax since they don't technically own that money) before managing to recover them, find an old back up, brute force them with newer technology, etc. Have tax authorities gone after them for historical wealth taxes?


Title: Re: BITCOIN WALLET
Post by: n0nce on September 26, 2021, 04:42:09 PM
However, you'll have evaded wealth tax for years in case you lived in a country collecting such a tax.
If it's several million dollars worth you are talking about, then that is more than enough money to easily migrate to a country with more friendly bitcoin laws if you are concerned about a wealth tax.
Yup, for sure, but they should keep this in mind before mindlessly cashing out in their current country is what I'm saying.. :)

I wonder what has happened in scenarios where people have lost access to their wallets or keys for a number of years (and therefore not paid wealth tax since they don't technically own that money) before managing to recover them, find an old back up, brute force them with newer technology, etc. Have tax authorities gone after them for historical wealth taxes?
That's an interesting scenario. If we try to translate it to a pre-crypto scenario, it would be something like losing a bag of gold coins, then finding another equal sized one in your garden years later for example. It should be handled the same way with lost wallet / wallet password. It's hard to prove that you don't have a backup somewhere, though. I would argue it's impossible to prove there is no backup in some drawer. So in the end it would depend on your law: if it's your burden to prove you don't own something or if it's the authorities' burden to prove you do. I'm not a lawyer and have no idea how this is handled in any country, but it would be interesting to know.


Title: Re: BITCOIN WALLET
Post by: o_e_l_e_o on September 26, 2021, 07:17:48 PM
-snip-
It is of course impossible to prove the non-existence of anything. I can't prove that dragons aren't real, and I can't prove that I lost the only copy of all my private keys and seed phrases in a tragic boating accident. No reasonable court would say "Prove you have forgotten the password" or "Prove you don't have the seed phrase backed up somewhere", because it is impossible to do so.

In the US, loss of property (which is what bitcoin is classed as) can only be deducted from your taxes when it is caused by a federally declared disaster. So forgetting your wallet password or failure of your hard drive absolutely would not count. Now, the US doesn't have a wealth tax (at least, not yet!), but for the sake of capital gains taxes, losing your bitcoin wallet means nothing for the taxes you owe. It would seem particularly cruel to continually charge someone a wealth tax on money they can't access however, perhaps without which they would be well below the threshold and making them pay out from their regular income.

I did also find this document from the OECD:
The possibility of losses or theft of a virtual currency gives rise to a number of questions from a tax perspective. Should a loss or theft be treated as a disposal (and capital loss) for the taxpayer? Are lost tokens able to be deducted from the value of an inheritance? There is very little guidance available on how these events should be treated for tax purposes and approaches differ in the few countries providing guidance. For example, in the case of loss or theft of a crypto-asset in Australia, the owner may claim a capital loss, provided they are able to present the evidence of their ownership. In the United Kingdom, theft is not considered to be a disposal and Her Majesty’s Revenue and Customs (HMRC) considers that the individual continues to own the asset. Similarly, the loss of a private key is not considered a disposal, but a taxpayer can apply to have the loss recognised.


Title: Re: BITCOIN WALLET
Post by: Pmalek on September 27, 2021, 06:45:16 AM
I did also find this document from the OECD:
For example, in the case of loss or theft of a crypto-asset in Australia, the owner may claim a capital loss, provided they are able to present the evidence of their ownership.
So I am an Australian. I have Bitcoin in a wallet that I can prove belongs to me. For example, I purchased the coins on a centralized exchange where I performed KYC. I withdrew them from there to my wallet and that should be enough to prove they are mine. To avoid paying taxes, I "lose" my coins. I send them out over TOR to another Bitcoin wallet. From their, they get mixed, coin-joined, converted to Monero, gambled with, etc. Omg, I am so unlucky, someone stole my coins, but thankfully, I can claim capital losses.

I wonder what the Australian authorities would say to a claim like that. 


Title: Re: BITCOIN WALLET
Post by: DaveF on September 27, 2021, 12:24:03 PM
I did also find this document from the OECD:
For example, in the case of loss or theft of a crypto-asset in Australia, the owner may claim a capital loss, provided they are able to present the evidence of their ownership.
So I am an Australian. I have Bitcoin in a wallet that I can prove belongs to me. For example, I purchased the coins on a centralized exchange where I performed KYC. I withdrew them from there to my wallet and that should be enough to prove they are mine. To avoid paying taxes, I "lose" my coins. I send them out over TOR to another Bitcoin wallet. From their, they get mixed, coin-joined, converted to Monero, gambled with, etc. Omg, I am so unlucky, someone stole my coins, but thankfully, I can claim capital losses.

I wonder what the Australian authorities would say to a claim like that. 

US here, but I am going to guess the same thing that happens here when anything is stolen that cannot be traced. The government accepts you at your word. And, if it ever comes out or can be proven that you lied you get arrested and charged with fraud.
It also is probably one of those things you can only do once. If it happens again, although they might let you claim it, they are going to look through all your finances very closely and see if they can find anything that is "not correct".

Kind of like a lot of stolen art fraud. Buy expense art, sell it under the table, claim theft, collect insurance.

-Dave


Title: Re: BITCOIN WALLET
Post by: n0nce on September 27, 2021, 03:26:44 PM
In the US, loss of property (which is what bitcoin is classed as) can only be deducted from your taxes when it is caused by a federally declared disaster. So forgetting your wallet password or failure of your hard drive absolutely would not count.
Damn, paying wealth tax on something you don't own anymore, forever? This would be cruel :o

US here, but I am going to guess the same thing that happens here when anything is stolen that cannot be traced. The government accepts you at your word. And, if it ever comes out or can be proven that you lied you get arrested and charged with fraud.
This makes sense; so just make sure to not lose wallet files twice in a country with wealth tax, I guess?! I'm being honest; this is a thing that can and does happen to people.