If you'd like to see objections and debunking re: paper wallets I've been having a good time at https://bitcointalk.org/index.php?topic=5161786.msg51734098#msg51734098. In hindsight, maybe dissing hardware wallets in a part of the forum that everyone uses hardware wallets wasn't the best choice, but hey, I'm not here to pat people on the back and tell them what a great job they did buying a $100 glorified USB. I'm here to help educate the next wave of bitcoiners. |
|
|
|
This is insane. I agree. Idk why people still trust these manufacturers when they're clearly incompetent. When using a paper wallet: - You must use a(n) (offline) computer to generate the private key to a paper wallet, and the portions of the private key may remain on the computer long after the fact.
Please tell me what part of the computer these "portions of private keys" remain on. Is it the CPU? The mobo? Oh it's the BIOS isn't it. I'm not turning my wifi off on windows 10 and hoping for the best. I'm using an air-gapped system. You must use a printer to print the private key for a paper wallet, and portions of this image may remain on the printer long after the fact. This is not a risk with HW wallets Really? I haven't used a printer for paper wallets in about a year now. You do know that "paper wallet" is just a loose term people use, right? Imagine anything more durable than paper. Use that instead of paper. - You must transfer the private key of your paper wallet onto a(n) (offline) computer to spend any of your coin, risking the private key remains on your computer long after the fact, and risking that someone will take a picture of your private key/paper wallet. Neither of these are a risk with a HW wallet
Again, sounds like you don't understand what an air-gapped system is. Also, who the hell is generating private keys in a public park where a stranger can take a picture of their screen? Wtf? Go in the corner of your house if you're really paranoid (which of course I am). - An attacker may be able to compromise your paper wallet by being in possession of it temporarily for only a few seconds via taking a picture of your paper wallet. For a HW wallet to be compromised, the attacker must be in continuous possession of your HW wallet for a longer time, and must be in proximity of special electronic equipment. An attacker could stumble across a paper wallet, and compromise it without your knowledge, while a HW wallet being compromised without your knowledge would require a more targeted attack.
How did said attacker guess my BIP38 passphrase so quickly? They must have seen when I typed it out at the public park I generated my keys at I guess.  With a HW wallet, you can use multiple passphrases, including a passphrase that is easy to crack with nominal amounts of coin. You can monitor the coin in the easy to crack passphrase, and if coins are moved from addresses associated with that passphrase, you will know you need to quickly move the coin in addresses associated with a more complex passphrase. An attacker will also not know how much coin you have secured by your HW wallet, so if they find a single passphrase that can be used to generate private keys to spend coin, it may not be a good use of resources to look for additional passphrases that can be used to spend additional coin.
Better yet, set a great passphrase on everything and don't worry about it. Add a watch-only address to whatever wallet you choose and get on with your life knowing you're actually secure. No need to look out for the next vulnerability from your hardware wallet manufacturer.
Guys, I know it sucks that you wasted $100 on a glorified USB but there's no reason to start making up BS and FUD about paper wallets. I'm just trying to teach you how to secure your funds better - without relying on a third party. Again, user error is not a vulnerability. If you shut your wifi off and think you have an air-gapped system you're going to have a bad time.[/list] |
|
|
|
but my paper wallets are substantially more secure than hardware wallets. That's not accurate though. FTFY Sure, but the fact we are even discussing this means your technical knowledge is more advanced than probably 99% of crypto users. Most users would not be able to generate a paper wallet in a secure manner. I consider myself pretty average with tech and I managed to figure it out over time. It's all about the effort you're willing to out into it I guess. There is always trust involved somewhere. Unless you built it yourself, you are trusting the manufacturers of your computer hardware, and the shippers who delivered it to you. Unless you designed it yourself, you are trusting the people who wrote your OS and software. It's probably also worth mentioning that Trezor device is fully open source, and hardware wallets in general are subjected to far more independent auditing and attempted hacking than the vast majority of other hardware or software.
That's not necessarily true. The only thing I really need to trust is the RAM on my laptop or desktop when I boot up a live USB. If I have no Wifi card in the computer and no ethernet cable plugged in then I've removed the internet attack vector entirely. A cold boot attack is probably my biggest concern, unless I'm told otherwise. I've seen many issues come up with hardware wallets over the years True, but the majority of issues are from people using them incorrectly. There have also been plenty of issues with paper (or otherwise self-generated) wallets, again, usually from people using them incorrectly. Any method is only as good as the person using it. I don't agree with that logic at all. Let's test this out in a real world scenerio: The safest car in the world and the least safe car in he world are driven off a 200ft cliff. User error was to blame. Everyone inside both cars dies instantly. Should both cars be considered just as safe now? Paper wallets can be extremely secure if you do it right. I agree with you, but the vast majority of users do not have the ability to do it right. I'm also not claiming hardware wallets are infallible, but they can be just as good as paper wallets if also used correctly. There's a great answer to this question from Andreas Antonopoulos which I think pretty much summarizes my argument: https://www.youtube.com/watch?v=4fsL5XWsTJ4&t=402I watched it. He basically said you have to have some level of trust, meaning I won't bother with one. I just have to trust my RAM manufacturer not to add something onto it that could send off something remotely. One car is safer than the other when both are used properly. I'm tired of people saying paper wallets aren't secure or hardware wallets are just as secure. The only issue with them is user error. That's clearly not a paper wallet issue. It's user error. |
|
|
|
but my paper wallets are substantially more secure than hardware wallets. That's not accurate though. FTFY Your main argument seems to be that it is easier to hide a paper wallet than it is to hide a hardware wallet. A hardware wallet is small enough that I can hide it inside a light fitting, in an electrical socket, under the floorboards, bore a hole in a door/shelf/table/furniture/etc and hide it inside, and so forth. There is a close to zero chance a random attacker would find my hardware wallet without also burning down my house. My main argument is that trusting a hardware wallet with my funds, and paying them $100 for me to trust them is very similar to trusting a bank and paying them for a safety deposit box. I much prefer trusting no one and not having a bill to go along with it. How is this different to having an unsecured paper wallet which is written down?
I'm not trying to be deliberately antagonistic here. This finding regarding the Trezor is important, and it should be discussed, but saying that all hardware wallets are useless is wrong.
Personally, I've seen many issues come up with hardware wallets over the years and I still can't wrap my head around why people use them. I guess it's the same reason people keep funds on an exchange or hot wallet. Ease of use trumps security for the vast majority of users (until they get hacked of course). I'd rather have people learn to store their funds in the most secure manner. I was a newbie before. I know exactly what newbies go through. I wish someone told me how I really shouldn't be using X or Y service because they aren't secure. Hardware wallets are probably 99% secure, although no normal person could actually confirm that. Paper wallets can be extremely secure if you do it right. I suppose I can make a guide so it doesn't look like I'm just bashing hardware wallets. Actually, I think I made one before. I'll have to find and bump that thread. Being blissfully ignorant actually works in the fiat system. You can always get your money back if it's stolen, assuming it wasn't cash. It doesn't in crypto, so take every single precaution possible. Don't. Trust. Anyone. That includes hardware wallet manufactures. |
|
|
|
So you expect that a thief knows what a cryptocurrency hardwallet is, but doesn't know what a paper wallet is? Or that it's easier to "hide" a paper wallet than a "usb stick"?  It's much easier to hide something if the thief doesn't know what to look for. I'm not going to get into it, but taking off a piece of something and etched the inside, then adding it back on is a hell of a lot less obvious than a usb in a safe or in your sock drawer. Hiding a hardware wallet or usb just makes it all that more obvious when the thief finds it. If they stumble across your private key but have no idea they've even found it, that's when you've done things properly. "Countless"? Stop being so dramatic. Sure, there have been some issues identified by several different parties of several hardware wallet devices. To my knowledge, all of the identified issues have either been patched and/or are able to be mitigated. And it's not like there have never been any issues with "paper wallets". I'm sure we're all aware of issues like this: https://blockonomi.com/security-vulnerabilities-walletgenerator/You seem to be taking this very personally. I'm starting to wonder why that is. I'm simply educating users of this forum on a free way to be their own bank. That's why we're all here actually. Is something wrong with that? I don't need a device that i didn't create in my house to hold my cryptocurrency and neither do you. You can create something of your own for free (or I suppose one could argue that it costs time and some paper/ink/materials). Anyway, paper wallets cannot have issues if you use your own entropy and proper security. They're only as good as the person setting them up, which you can say about literally anything. If I owned a hardware wallet and a paper wallet, I would put all of my funds in the paper wallet unless I needed to spend them. I'm not looking into your link because it's just going to be the same bullshit FUD that's on the bitcoin wiki. Some crap about idiots setting up change addresses wrong, other crap about paper burning or water damage blah blah blah.. again, if you aren't going to bother to learn how to properly secure your funds then you will eventually lose them. I'm fully aware of the attacks that could take place on paper wallets. I'm not too worried about my dice being rigged, someone busting in and performing a cold boot attack or certain radio waves that my laptop may or may not give off. It's never going to be a zero chance that your funds are hacked, but paper wallets are substantially more secure than hardware wallets. The way I generate them anyway. If you go and generate a paper wallet online with bitaddress then you're better off just using a hot wallet or hardware wallet. You don't need a 37 character password to make it "secure" per se... the 37 character BIP39 passphrase is suggested to make it as secure as having an "unknown" 12/24 word seed. Which, as we know, is generally measured in terms of "millions of millions of years" for brute-forcing. I can't find any firm numbers on the the time/effort required to bruteforce say an 8 or 16 character BIP39 passphrase. The PDF referenced by Ledger claims a 50% reduction in CPU intensive calculations, so does anyone have any references to calcs on how long a 16 char BIP39 passphrase would take to bruteforce? In any case, saying that a private key written/printed on paper is more secure that a hardware wallet, assuming someone has physical access to both is somewhat disingenuous. I guess the key takeaway is that NOTHING is 100% secure. As long as you know the risks inherent in the system you are using and take steps to mitigate such risks, then hardware wallets are no better or worse overall than paper wallets. Everybody knows that the people setting these passwords will use the tried and true dog name and year of birth or their favourite grandchild or whatever other crap people use now. If you're protecting your hardware wallet with a password that wasn't randomly generated (good luck typing that 37 character randomly generated string of nonsense btw) then you're completely screwing yourself out of the somewhat half decent security that these overpriced USBs offered in the first place. I'll give you a god password to memorize. Don't worry, it's safe because I don't know where you live. Go ahead. It's super easy to memorize. Just read it over 10x and I'm sure you'll have it. Either that or you could... Write it down. Oh or better yet, you could add it to your password manager. But then you're relying on your master password, which again wouldn't make sense to use a randomly generated password and you're back at square one. You have an unsecure hardware wallet with the password writen down. Or you memorized Molly1989AuntieSueLovesToBake (congrats) and it'll be so easy to crack your password. Not brute force. Who needs brute force when there are so many better/easier ways to crack it. (N]Pq?.kHwO/mF@f2V- 7E)Uk0Ih#,}8rE_+g Good luck and be your own bank. Saying that "Hardware wallets still aren't secure, and they never will be." because a physical stolen device can be hacked is a bit sensationalist, isnt it?
What are the chances that a hacker come into my house, search and find my ledger and steal it? This is highly unlikely to happen, especially if you are a discrete person about your btc holdings.
Hardware wallets are still safe enough, especially for newbies.
Well lucky for those thieves they know what to look for when they break in now don't they? Binance was also safe for newbies. So was blockchain.info/com. Being idiot proof is the opposite of safe. If I wanted your version of safe I'd use my debit card through PayPal because that way if I'm watching an infomercial and buy some $99 knives that can cut through a tin roof at least I can get my money back. LOL
Paper wallet are much more complex to be really safe. Not everyone is able to properly airgap a computer , and the risks involved in case of a mistake are very high.
Complex = not safe. Got it. I bet I can teach even you how to properly air-gap a computer. It'll take 10 mins out of your day and you'll have a very useful tool for lots of other things in life. The risks of making a mistake are the same (don't lose your private keys). What is higher risk with paper wallets? I'm not hashing out my pubkey by hand here. It's the exact same process anyone would use to generate a private key but it's air gapped. Okay, that and I use my own entropy source, but again, super easy to learn. Only true if you specifically mention the usage of encrypted private key (see BIP 38) with strong passphrase. 100% agree. |
|
|
|
If you don't have a hardware wallet, use an offline generated private key/seed (aka "paper wallet"). I might be misunderstanding you here, but how is this safer? If your concern is regarding a physical attack on your hardware wallet, then surely with a physical attack on a paper wallet it is completely trivial to steal your coins? It's a hell of a lot easier to hide something that an attacker is unaware of, than a laptop, a phone or a hardware wallet. A physical attack can only happen if you A. Know what you're looking for or B. Happen to stumble across something over smarter of hours or days tearing someone's house apart. It's also free rather than $100 and you don't need to worry about all of the other countless vulnerabilities that constantly pop up with hardware wallets. I agree that a 37 character password suggestion is not going to be taken up by the vast majority of users, meaning hardware wallets just aren't as secure as truly offline generated private keys (not that they ever were). |
|
|
|
An attacker with a stolen device can extract the seed from the device. It takes less than 5 minutes and the necessary materials cost around 100$. This vulnerability affects Trezor One, Trezor T, Keepkey and all other Trezor clones. Unfortunately, this vulnerability cannot be patched and, for this reason, we decided not to give technical details about the attack to mitigate a possible exploitation in the field. However SatoshiLabs and Keepkey suggested users to either exclude physical attacks from their threat model, or to use a passphrase. https://ledger-donjon.github.io/Unfixable-Key-Extraction-Attack-on-TrezorYet another hardware wallet issue folks, this time though, it's unpatchable. If you're using a hardware wallet, encrypt it. If you don't have a hardware wallet, use an offline generated private key/seed (aka "paper wallet"). Be your own bank. Stop trusting hardware wallet manufactures to protect your money. |
|
|
|
|
I've recommended wasabi to so many people at this point but never thought to look for posts on bitcointalk. It came at just the right time with all centralized mixers getting pwned in one swipe. I'll be following along to see what else comes up down the road!
|
|
|
|
Isn't that wiki article just horrible? I've always used a "paper" wallet, stored it properly and never had any issues. I do agree that the name should be retired. It's just an offline backup or air-gap generated private key. You never have to worry about some kid hacking your device with offline private keys. The only risk is physical access or your house burning down. There are many materials out there that won't burn in a house fire. Get creative. I wonder why a company selling hardware wallets wouldn't want people storing their funds more securely, and for free  . Strange /s |
|
|
|
You are able to reverse a family&friends transaction if you used a VPN / Proxy while sending. After that, you just need to contact the Paypal customer support and claim your account to be hacked. Paypal will then return the money.
If that works once you're just scamming PayPal. That means you're as much a degenerate as the person that scammed you. Good luck pulling that scam off twice.
If you are a legit buyer of bitcoin using PayPal F&F it's going to be very hard to have your funds reversed. If you're a seller of bitcoin accepting PayPal, you have no idea if you're dealing with a hacked PayPal account or stolen credit card. If their tx is flagged as fraudulent, it'll be reversed. |
|
|
|
|
I only have 500 BTC for sale. Would you do a trade for such a small amount?
Hahahahahahahahahahahahahahahahaha. Get the hell outta here.
|
|
|
|
That also excludes the plan to weld two pieces together to require one to break the piece in order to redeem the keys for the same reason.
Maybe a spinner ring? That or a spinner ring with a small decorative hole so it never shows the whole private key. You could easily access the private key by spinning it around and writing down the private key 1 letter at a time? |
|
|
|
Again pointing on others is like kindergarden  I couldn't agree more. Any news pointing out fabricated CO2 emissions (of an extremely useful network) is distracting newbs front the fact that this is a once in a lifetime opportunity. If they don't believe it yet, that's not really my problem. |
|
|
|
|
IMO the b.s. needs to be debunked once and for all. How much power does the USD consume? I need to order a roll of nickles, a roll of dimes and a roll of quarters. How much does that cost to mint, circulate and actually get into my hand? With such an outdated concept of moving metal around a country, it's obvious without looking into it that fiat takes a hell of alot more energy than anyone realizes. Does anyone care though? Of course not! Because it serves a very important purpose. Bitcoin has an even greater purpose and will be using power to do so.
Also, these estimates are all over the place because it's impossible to calculate. Even if you assume everyone has the same ASIC, how can you tell where they all are and what type of power they're using? What percentage is solar, hydro, wind? You'll never hear that. It's all burning coal to make electricity to mine bitcoins. It's a mirage to sway the general public into thinking that bitcoins are for criminals, it's bad for the environment or whatever other FUD.
Does anyone remember when the internet was going to use the entire world's power? I think we turned out okay, and the internet is pretty useful IMO.
|
|
|
|
Great stuff OP. But I think that you need to change your thread title because it's a bit confusing. You can't sell Used gift cards. I think it should be Unused gift cards Thank you for useful guide. Lol I got clickbaited! I was very disappointed to learn that my empty gift cards are still worthless. Maybe next time. |
|
|
|
Can we please just have posts/accounts like this instantly nuked? They're so pointless. If your "friend" (that totally exists ) wants to do some large deals WITH KYC, have them send me a DM and I'll hook them up with an OTC desk. If they're looking for an anonymous deal maybe try much much smaller trades on Craigslist lol. |
|
|
|
|
First off, I can't make any promises on how much I'll be posting. You could end up with 5 or 10 posts in a month. You could also end up with 50+. If you can't deal with the uncertainty I'd suggest paying per post. If you're willing to take some "risk" you can always make me an offer for the month.
FAQ
What rates do you charge? Do you accept shitcoins? Make me an offer I can't refuse! I accept Bitcoin, GRIN and Ravencoin. Anything else, probably not.
Does this include your avatar? Probably not. My avatar is very recognizable IMO and I'd like to keep it that way.
Are you willing to post X amount of posts in Y section of the forum? I won't be changing my posting habits for your advertisement. If you'd like to see where your signature would be posted check out my previous posts.
When do you expect payment? I'd rather be paid upfront, but if you're paying per post that might get a little tricky. Escrow is welcome. Everyone seems to be at each other's throats these days do idk who people trust. If Lauda, OgNasty, Blazed or Minerjones still escrow I'm happy to use any of them.
Terms and Conditions
I reserve the right to refuse advertising any service I deem unacceptable. I won't advertise a scammy website or shitcoin. I won't use my signature for personal attacks. If your project appears to be legit but I don't believe in it I'm fine with advertising, but again, I won't be changing the way I post. For example: I'm fine with advertising for a bitcoin mixer or gambling website, but wouldn't go around suggesting people use them. If you need proof that I'm still me, I should be able to sign a message from any old address on my profile (assuming I still have access to it).
If you're interested in advertising please post your rate here. We'll figure out the details (payment, escrow etc) afterwards. If you've got questions please ask!
|
|
|
|
Well, I've got a good understanding of how engraving keys that the end user gives to me securely, but I still can't figure out if there is a way to BIP38 encrypt Minikeys. It seems to me like the format isn't recognized as a private key and can't be encrypted. I'm not sure if thats a defined limitation or just a personal problem.
I ran into one other issue with upper/lowercase letters. I had planned on just using a smaller font size for lowercase letters, but that is confusing for things like R vs r . My engraver is a jig with a carbide engraver bit that follows hand made movements. I use a template to keep the font and size consistent, but I do not have a lowercase letter template and I'm having a bad time finding one. I'll probably just mill one myself, but thats a pain. Anyway, I'll keep you updated!
I always meant to do something similar, although I just bought jewelery stamps. I had the exact same problem where I couldn't find lower case letters. I did eventually find some, but in a weird font & 3x as expensive. I thought that would be funny to share. Why the hell are lower case letters so hard to find!? Anyway, this is an awesome idea. Many kudos from someone who meant to do this but never went through with it. |
|
|
|
Quoting so others can see the picture. What are the dimensions? Could you also give a brief description of it, such as what it's made of etc.? |
|
|
|
|
This was happening when I was trying to make a post just a minute or so ago.
Just an FYI in case it gets out of control and is affecting lots of users.
|
|
|
|
|
Show Posts
