|
1. Do not use the same password in more than one place.
2. If you can remember your password, it is probably weak.
3. If your password is less than 12 character long it is probably weak.
4. If your password does not contain numbers, upper-case letters and some weird symbols, it is probably weak.
5. Use password management software to store and generate passwords, such as firefox's password manager, keepass etc...
6. Use long mnemonic pass phrases as master passwords for password managers and and other accounts which you need to be able to access without using password management software (like gmail account and truecrypt containers, for example)
7. Consider writing some important passwords down on paper and storing it in secure location.
Your mileage may vary.
|
|
|
|
|
If you had a non ecrypted wallet.dat on the compromised computer, transfer all the money you had there to a new secure wallet ASAP.
It wallet.dat was encrypted, first transfer it (and only it) to a secure computer. Than as skull88 said.
Using secure system change all your passwords, when changing every password repeat "I will not open email attachments, I will not open email attachments, I will not open email attachments..."
|
|
|
|
As far as whether this is unprecedented or not, some on these forums say it's common for exchanges to cancel trades, but I am not familiar with the matter. Regardless, MtGox's terms of use presumably allow it, or if the terms are not explicit, then nothing forbids it.
i challenge anyone to cite one example from a reputable currency (or even commodities) exchange. and the absence of a restriction in a contract does not give the party who happens to have power freedom to do anything in a contractual relationship. that's not the contract law of the united states, the united kingdom, or japan, at least. instead, terms are implied based typically on trade usage, and implied terms are just as binding as express ones. Yep. Implied terms are in force in absence of formal contract and this does not help mtgox one bit. They said that they are talking to lawyers and the same time they have not even published any terms and conditions or company registration details or contact details. I am not familiar with prevailing legislation in Japan but in UK and EU only failure to disclose contact and registration details would get them in serious legal troubles even if they were just selling dog turds. But they are playing into a financial institution and taking deposits. This is all freaking unbelievable. The first lawyer they would talk to would raise hell about this as the first matter of business. This is extremely amateurish... |
|
|
|
|
I am basically proposing here to run freebsd in CLI mode i.e. no X anything. As such hardware-wise all you need is support for wired network adapter, keyboard and display (text). There might be a few exceptions but I really doubt that for these devices FreeBSD's hardware support is any worse than that of Linux.
|
|
|
|
|
"self-extracting archive" should scare the bejisus out of you kids.
It means untrusted code! An now... why would mtgox send you anything like this!
|
|
|
|
Another option: FreeBSD, minimal install + /usr/ports/*/bitcoin . Takes 5 minutes to install and rock solid security wise and can have uptime of years. My FreeBSD servers which run many jails(VPS) inside typically have years of uptime (only reboot when I need to upgrade to the next major version). Just to give you idea of it's reliability. |
|
|
|
|
well... my mtgox password was ªç!¼:Üý\†€BZ*Š”TbŠòê unique for this site, moreover I never sent them a single penny, bit or fiat.
Learn from the pros, kids.
I am still pissed off by finding my email in that damn list.
This mtgox biz and many other things which we are witnessing with bitcoin will be in history books.
|
|
|
|
i mean, thanks - but i can juggle my own balls...
lol, nice one |
|
|
|
|
That would one step from security thru obscurity.
Want your data secure, get a new wallet on a separate and dedicated for wallet keeping hardware device with secure and very securely configured OS (i/e/ no GUI/X/Windows etc) no bloat, maybe ssh access at most, encrypted partitions and swap, keep it offline as much as possible, keep it's existence secret, no wireless networks. Keep encrypted backups of the wallet in the cloud etc... This would be a nice set of controls mitigating many common and significant risks.
Anything less, when talking about decent amounts of BTC is not enough.
|
|
|
|
|
That's why I did not even bother to start mining namecoins . It was obvious that arbitragers will even thing out quickly and it is so much simpler to just continue mining bitcoins than mess with all the namecoin thing (unless you really want those namecoins).
|
|
|
|
|
If anyone needs a test case for 'limbo transactions' simply send some money when your client is not up to date completely with the block chain. You will get a limbo transaction which at the moment basically the same as money lost and it is also unclear what happens with all the "change" involved which can be rather significant.
Seems like a serious bug to me.
A friend of mine has a a few such limbo transactions and no idea how to fix this. I also simply do not know how to help here.
Any suggestions?
|
|
|
|
|
windows vs. unix debate all over again
or a swiss army knife versus a professional tool set.
bloating bitcoin client with all kinds of stuff as poor innocent naive users demand versus doing one thing very well and using other tools that are doing well other things, like securing wallets.
|
|
|
|
|
Counterparty risk is too high without any reasonable control available to mitigate it. This would be true even, if, say Satoshi himself offered such service.
|
|
|
|
MikesMechanix, all the laughable suggestions were made to get offline 4 digit BTC wallets which effectively contain 5 soon to be 6 digit of USD equivalent. In other words, more than annual income of most people and more than 10-20 years or even lifetime saving of most people. All the suggestions of having an extra computer not routed to the internet, or booting from a thumbdrive, just to make the occasional online payment are laughable.
Ask the former owner of 25k bitcoin if he is in laughing mood... Fell free to laugh at recommendations of Information Security professional (in retirement), who've done proper risk assessment, at your own peril. BTW I am not advocating 'not implementing' wallet encryption, I am just saying that this is not really a solution for fat wallets and there may be more useful things to do for developers. If your wallet has 10 BTC (at present valuation), I would not even bother encrypting anything... just keeping OS reasonably secure would be enough. If there is 10k BTC it would be completely different thing. |
|
|
|
If your computer is compromised, you are screwed, the moment you enter your password to decrypt the wallet.
That's always the case >if< your pc is compromised. an encrypted wallet.dat would protect from simply copying the file to usb, if someone has physical access to your pc. also if your pc is compromised doesn't automatically mean it's running a keylogger in the background. every idiot can copy&paste a file but not every idiot knows how to set up keylogger. making the wallet more secure doesn't harm anyone, so why not do it? there will never be 100% security, but it would at least be a bit safer than it is now. In environment when almost weaponized viruses are created specifically to harvest bitcoins this might do more harm than good. Many people will rely on this encryption instead of taking their bitcoin wallets offline or use specialised devices or services to secure wallets. There is lots of merit in original bitcoin stance that bitcoin deals with money and it is up to the users to take care of their wallets security. At the same time, as you correctly noted, wallet encryption functionality would protect from some attacks. This is not a black and white thing. It looks like bitcoin devs will bow to popular demand for false sense of security and bitcoin encryption will be in the next version of bitcoin client. I would prefer to have instead of encryption, possibility to chose which exact coins are being spend and to have more than one wallet. My view is that doing encryption in official bitcoin client is like hanging this thing on your regular wallet (with cash and credit cards)  |
|
|
|
Bitcoin developers, please, please, please do create encrypted wallet functionality, so that I can run bitcoin on my malware infested windows computer while enjoying false sense of security.
Are you inferring that the average person's computer will never be safe enough to use the bitcoin client? You inferred it. I implied what you said in the post #18.  If your computer is compromised, you are screwed, the moment you enter your password to decrypt the wallet. Banks get around this (still not completely) with second factor auth and I do not see how bitcoin can do second factor auth without losing decentralisation. (unless Satoshi comes out of the woods with invention of proofofwork/blockhain for second factor auth) |
|
|
|
|
Show Posts
) training should make it fairly secure.
