As far as i am concerned, malicious actor were able to obtain API keys, 2FA codes, etc.. from the victims, correct ?

Why does binance even cover those losses which obviously happened due to people who have no idea how to secure sensitive information ?

There was no security breach at all (correct me if i'm wrong). What has binance to do with this ? Why reimbursing the customer for something which is not their fault ?


It is not like the developer of core now reimburse anyone who gets his funds stolen because he publicly posts his private keys.
Or shall ThomasV now reimburse everyone who publicly posts his seed which results in funds getting stolen ? I don't think so.


So.. i see 3 possibilities:
1) Binance indeed head a security breach and feels responsible
2) This is some sort of 'hackers stole money' - tax fraud from binance
3) Binance is just plain stupid for covering the losses caused by the victims

Does this mean.. your only backup is a file on your usb flash drive ?
That's not recommendable. Flash memory chips can break, bits can flip (corrupting your data) or they can simply die due to environmental influences.

You shouldn't rely on electronic devices only.




And how can you guarantee that?

'Hacking' into the nano s is indeed not possible without some high level 0-day exploits.

What i can think of, is that law enforcement agencies had a warrant, and were able to seize all necessary things (e.g. nano s + pin somewhere written o paper or mnemonic code).
I can't imagine them technically hacking into the nano s to gain access to the BTC.

In this case, btcrecover should find the correct passphrase in a very short amount of time.

For x letter in your password, it needs to check 2^x variations.
With 10 letter, there are 1024 possibilities (which is a really low number for bruteforcing). This would probably run through in less than 5 seconds.

You just need to properly configure the token file.
If you need further help in configuring it, feel free to ask for assistance.


Also.. please do not talk to 'helpful newbies'. Most of them (if not all) are scammer:

It depends on the point of view.

There were no hacks. There was a (low severity) vulnerability which allowed malicious server to show a message. Nothing more.

Multiple people have fallen for this (very bad) phishing attempt and downloaded malware. This happens quite often (less often through a message from the electrum server, more often from some phishing sites).


The devs have nothing to do with it. If you visit any phishing site which has electrum in its name and download malware.. shall they compensate you for this mistake too ?

It is the users responsibility to use their common sense and to not fall for phishing attempts.




I'd always try to stay up-to-date.

While a specific version might be safe today, there could be some dangerous vulnerabilities or bugs found tomorrow.

You should always aim for an up-to-date system. You just need to make sure to download electrum from the original site (https://electrum.org/#home) and from nowhere else. Then you are safe.

This applies to using the wallet, not to updating the wallet.

If the firmware updates aren't signed (which i think they aren't, because people already have been able to flash their own firmware onto the nano s), his friend could (if he wanted to be malicious) have a malicious version of ledger live installed on his computer and a malicious firmware update prepared.
OP would then 'update' his nano s with a malicious firmware.

Of course, the next time OP would access the nano s with a non-malicious version of ledger live, he would get a message stating that the firmware is not genuine.
But at the computer of his friend, all would look normal.


I know, that's quite a stretch. And one shouldn't have such friends. But updating a hardware wallet is not always secure. You need a clean / trustworthy computer to do so.


Edit:
It seems, the nano s does indeed check whether the firmware (to be installed) is signed by ledger.
Somehow weird, i thought people were able to flash own firmware onto the nano s...

Oh well.. hence, my theoretical attack is not possible. And currently i can't think of why updating the nano s on an compromised computer could pose a risk.

There was no security issue or whatsoever in firefox.

Mozilla just didn't update their SSL certificate properly in time. Therefore the warning appeared that the add-ons couldn't be verified (because certificate invalid).
But there hasn't been any vulnerabilities or anything else security-related.

That's insane. Microsoft is slowly on their way being a bigger data kraken than google.. And to achieve that, you really have work for it..




+1 for this.
The only reliable way.

No.
He send BCH to a BTC address (owned by coinbase).

Coinbase is able to gain access to these BCH, but doesn't want to recover them for OP (which is understandable).




Even if the coins would have been sent to a different valid address no one has the keys of, the chances of generating a private-/public key pair which results in given address is close to zero.

Well, this depends on how safe you want to be.

Since the firmware will be checked once you access your nano s via ledger live, the only option which could pose a risk would be tampering with the hardware.

Do you trust the person who gifted you the nano s ? Was it a friend / relative ? Or some stranger ?
Does the case of the nano s look untouched ?

It requires quite some technical know-how to get and set up the required hardware and build it into the nano s to compromise the device.

Usually (if you got it from a friend / relative), are not paranoid and don't want to store a massive amount of BTC on it, it should be fine without checking the hardware (my personal opinion).
But if you want to be 100% sure or got it gifted from an unknown / not that trustworthy person, i'd check it.

Unfortunately this is not a matter of opinion.

Windows 7 is missing quite a few security features, which are present in windows 10.

While it might be true that windows 10 has some 'features' which collect data for 'enhancing user experience', all of them can be turned off.
Turning off the data collection in windows 10 is way easier than getting win7 to be as secure as win10 is.

?

Every node verifies the transaction it receives. There is no remote control going on 




Opening a port itself does not necessarily create a security risk.
If you have remote access on your computer, it is infected with malware. This has nothing to do with core.

I'd also love to see the proof.




Are you talking about incoming connections from the bitcoin network ?
That's how the network works. Noone has access to any files or similar on your computer.

You are just exchanging block data. That's all.

It is possible.

It is correct that you need a rooted device to access all information on your mobile or to access information from a different context.


But.. as i have mentioned, IF the application allows to be run in debug mode, you can enter the user context of this specific application via adb.
Then, you can access all data from its context (meaning all data stored by this particular application).
This can be done with the adb command: run-as


Application developer can disable the option to be run in debug-mode.
And in fact, security orientated applications should do that, but a lot of those still allow to be run in debug mode.

No, imported keys are also encrypted.
There is no unencrypted (sensitive) information anywhere on your harddrive left after encrypting your wallet file.

Just make sure to backup your wallet file after encrypting / importing keys.

Sensitive information is just accessible unencrypted when your wallet is unlocked (master key stored in RAM).

If you know how it should look like, but just don't know the exact variation, bruteforcing should be doable in a reasonable amount of time.

What exactly are you missing in your variation ?
Do you know the amount of character ? Are you just missing a few one ?
Is it about upper / lower case letters ? Are you looking for a permutation of your characters ?

I fixed that for you.

Honestly, windows 7 is far away from being a secure OS.
If you compare it to windows 10, it is basically an open barn door screaming 'i am vulnerable'.

Windows 10 has a superior concept with less flaws and more security tools / features (e.g. EMET). Almost every windows 7 computer which is connected to the internet can be compromised with a quite low amount of effort.

No attack is targeting 'signed transactions' in any way.

That's not a surface for an attack. You either target the key storage or the signing process. But not the transaction itself.
If the transaction is signed, there is nothing which can be changed anymore.

The transaction has to be manipulated before signing, which can happen either on an online computer or offline computer (e.g. through compromised USB).




A hardware wallet contains a hardened microcontroller with less interfaces than a normal microcontroller and a smaller attack surface.
The private keys are stored inside of (and never leave) the secure element.

Upon booting, it verifies the firmware (whether it has been tampered with) and only proceeds if the software running on the nano s is genuine.

The private keys can not be extracted out of the nano s, the only way to 'access' the private keys is to give it a transaction to be signed (which requires a verification on the device itself).
Extracting the private keys itself, is not possible.




Kali itself is not unsafe. Upon installation it doesn't create a normal user account, but this can be done with an one-liner.

The reason kali is not suitable for everyday-use is because it requires quite some configuration if you want to use it as your daily OS.




It does, but it is outdated.
You won't be able to connect to an electrum server with the outdated version.

So, you'll need to download it anyway, which lets you also choose any other distro.

I know that quite a lot of malware stays undetected.. but where do you got the 63% from ?
Do you have any source for this ?

This seems to be a very precise number.




Holy moly.. that's a lot of encryption here  Almost encryptception.




You mentioned yourself, that malware can hide itself (i.a. polymorphic, encryption, ..).
Therefore relying on AV's too much, won't help (not saying that it's not good to have one!).
And since checking all applications accessing some online services is not really an option on windows (for a not that techy user), the best weapon against malware is common sense IMO.

You should definitely include common sense in your small guide.

Compromise a transaction ? 


Your whole thinking is wrong.

If you are using the same machine for signing offline and online stuff, it is not air-gapped.

You seem to not understand the scenario at all.

I will briefly explain it to you (once. if you don't understand it afterwards.. your problem):

• You have your computer which is used to be connected to the internet which you 'air-gap' for signing transactions offline (according to you)
• This computer is infected with a rootkit
• You boot from your live USB, because you want to sign a transaction
• The rootkit gains access to all of your seed / private keys (because there are not protected by a secure element, they are just on your USB and if your live OS can access it, the rootkit can too)
• You sign your transaction
• You shut your PC down completely
• You boot your main OS and go online to broadcast the transaction
• The rootkit already has your private keys, and now with internet access, has the ability to send the private keys to the attacker
• -> You know lose all coins associated with the seed / private keys which are stored on your USB
• -> Your so-called 'mimiced hardware wallet' is proven to be not as secure as a real hardware wallet because it lacks the components which define a hardware wallet.

I hope you do understand this. Maybe read that carefully a few times, if you don't 
So, instead of posting wrong information.. try to understand the things you are talking about.

For the future: If you want to post something, log off, research for 1 or 2 hours, if still necessary to post -> post.
Your misinformation are not needed here. And if you get disabused from a misconception, accept it.




Yes.. thats 'all you can tell me'.. simply because you don't know what you are talking about.

Unfortunately i don't know whether it works with 1.3.1.
But you could simply try it out. Open the ledger manager and browse the available Apps, search for 'recovery check'.

If it doesn't work (e.g. because the app is not available for your firmware version), you could download the site https://iancoleman.io/bip39/, then burn a live linux ISO on a bootable USB, boot from the USB and enter your seed into the downloaded site.
Then check whether the address produced matches with yours from ledger live.


The first option (recovery check app) is obviously easier. But definitely make sure you have the correct backup of your seed before proceeding with updating the firmware.