Warning about portable versions

[ThomasV]

Since we now have a subforum for Electrum, I am rewriting here what I already said in other threads. I hope it's more visible in its own thread.

It is not safe to use a portable version of Electrum on an insecure computer!

Don't get me wrong: I am not saying that a portable build is by itself more dangerous than a non-portable version.
However, a portable version does not bring anything more in terms of security. It does not protect you from the computer you are using.
In addition, portable builds encourage dangerous behaviour, because they make it very easy to use your wallet on third party computers, that might be infected with viruses and keyloggers.

I was never enthusiastic about distributing portable versions of Electrum.
I did it because the demand for portable versions was so high that portable builds distributed by third parties were getting popular.
That's the only reason why I accepted to distribute portable builds: I do this in order to avoid an even worse situation.

[1714317105]

1714317105

[1714317105]

1714317105

[1714317105]

1714317105

[1714317105]

1714317105

[1714317105]

1714317105

[coqui33]

Is there a portable 1.7? If so, could you please provide a link?

[ThomasV]

Is there a portable 1.7? If so, could you please provide a link?

not yet, but there should be one soon.

[SebastianJu]

Nice... ill wait for it. Regarding portability... one should be extra cautious when handling values with software. In the end i use portable only on my own pcs, but i prefer software that isnt clawed into one pc and cant be moved to another easily. I mean getting a new pc is a problem then when having some unportable programs. If you have them portable, you simple move the harddisc and you can run your software. Thats why i like portable software and use them if possible somehow.

[SebastianJu]

I now tested the new portable version of electrum 1.7.2 and it works fine. It can run from one directory only. I had to create a shortcut with the -w-tag to specify the electrum.dat that lies in the same directory. The link looks like:

Code:

L:\dirs\Electrum\Electrum-1.7.2-portable.exe -w ".\electrum.dat"

It seems without the -w-tag it will create a new electrum.dat. The -P-Tag doesnt search for electrum.dat in the same dir too. But i didnt test where it would create the electrum.dat. Maybe it only searchs for another filename.
Anyway... i deleted all electrum-files on drive c: and all files in the directory of electrum, except the exe, the link and the electrum.dat. And it works fine when starting with the link. There isnt something created on drive c: anymore.
I only wonder why the oldest transactions are cut and replaced with Pruned transaction outputs. There isnt a setting to change this.

[btcven]

I only wonder why the oldest transactions are cut and replaced with Pruned transaction outputs. There isnt a setting to change this.

When restoring from your seed you need to select a F (full) server to get your entire transaction history.

Also "ThomasV: * Due to an internal format change, your history may be pruned when
  you open your wallet for the first time after upgrading to 1.7.2. If
  this is the case, please visit a full server to restore your full
  history. You will only need to do that once."

https://bitcointalk.org/index.php?topic=50936.msg1667606#msg1667606

[ThomasV]

I only wonder why the oldest transactions are cut and replaced with Pruned transaction outputs. There isnt a setting to change this.

When restoring from your seed you need to select a F (full) server to get your entire transaction history.

please read the release notes for 1.7.2. it is explained there.

[SebastianJu]

Thanks!

[nonsh]

I only use portable versions on own computers. They're easier to backup.

[dabest1]

What is the difference between portable and standalone versions?

[SebastianJu]

What is the difference between portable and standalone versions?

The standalone can be put into a directory and started but the files are stored under c... users... and so on. So its not portably when you take the .exe with you because the wallet lies on the other pc.

[virtualmaster]

Since we now have a subforum for Electrum, I am rewriting here what I already said in other threads. I hope it's more visible in its own thread.

It is not safe to use a portable version of Electrum on an insecure computer!

Don't get me wrong: I am not saying that a portable build is by itself more dangerous than a non-portable version.
However, a portable version does not bring anything more in terms of security. It does not protect you from the computer you are using.
In addition, portable builds encourage dangerous behaviour, because they make it very easy to use your wallet on third party computers, that might be infected with viruses and keyloggers.

I was never enthusiastic about distributing portable versions of Electrum.
I did it because the demand for portable versions was so high that portable builds distributed by third parties were getting popular.
That's the only reason why I accepted to distribute portable builds: I do this in order to avoid an even worse situation.

I like very much Electrum but generally  I  disagree with you.
Surely everything could be used wrong and can create false security feelings.
But generally I consider a portable version more secure and more flexible than an installed one. (if works)
Let us see some concrete examples:
- Skype released a couple of years ago a version which had a reduced functionality than the old one. Once installed the new one it was impossible to put again the old version. It couldn't be found anywhere on the internet. With portable versions you start the new version and if you don't like it then you use again the old one and you can switch as you wish.
- I use Electrum 7.1 portable and it works. Now I downloaded Electrum 8.0 and by starting is giving to me some messages that my wallet doesn't work. Should make a new wallet or repair the old ? I didn't liked any of this options and I started 7.1 again. Otherwise if not backup-ed and installed over who knows what happened with the content of the old wallet.
- I could use Electrum on a computer shared with others. To install it would require administrator priviledges. To ask from the administrator would attract attention on it and could put on risk the coins.
- Electrum is installed on a shared computer. Even in this case I would use my own portable version because on the installed one could be a spyware. Of course a key-logger would be anyway there if installed but that mostly can be fooled with onscreen-keyboard.
- I can have a laptop which is not full-encrypted. A Trucrypt container can be put in the dropbox order(backup is also solved instantly) and there could be not only the wallet but the portable application also. If I have the application outside of the container somebody could boot the laptop from a CD(or access it  from a hacked dropbox account) and install a spyware on the application. So I have more security if the application is also inside of the container.

[novusordo]

It'll be nice when portable hardware wallets like the Trezor become more widespread, then this won't be as much of a concern.

[btcven]

You mean 1.7 and 1.8

.
.
.
- I use Electrum 7.1 portable and it works. Now I downloaded Electrum 8.0 and by starting is giving to me some messages that my wallet doesn't work. Should make a new wallet or repair the old ? I didn't liked any of this options and I started 7.1 again. Otherwise if not backup-ed and installed over who knows what happened with the content of the old wallet.
.
.
.

Running a portable version from an encrypted drive on a infected laptop is dumb. All that security to finally run from a unknown computer that likely has a key logger and a lot of viruses / trojans / spywares... Good luck

[GODLIKE]

Could you add an image based password?
That would make it perfect, probably.

[dabura667]

Could you add an image based password?

What is that?

[SebastianJu]

Could you add an image based password?

What is that?

Using an image file. But i think its risky. The system would know files you often use. If you have a hybrid disc its even easier.

[btcven]

Could you add an image based password?
That would make it perfect, probably.

Be careful with that. The system writes metadata into images (last date opened, last day modified) you will probably lose access to your wallet in a few weeks of use.

[jackjjohnson]

I've been using 1.9.8 (not a portable version) on a Tails USB key. You can funnel it through Tor nodes, but it requires for some kind souls to keep an Electrum server up on a Tor node. Unfortunately the .onion/Electrum servers seem to be infrequent.

If you use the -1 switch, it keeps it from trying other servers.

I consider this to be very secure. You could be on the most infected computer in the world, and it can't touch this. A hardware keylogger would be the only possible way to lose your passwords, and Tails has several virtual keyboards or Keepass that will defeat that.

[SebastianJu]

I've been using 1.9.8 (not a portable version) on a Tails USB key. You can funnel it through Tor nodes, but it requires for some kind souls to keep an Electrum server up on a Tor node. Unfortunately the .onion/Electrum servers seem to be infrequent.

If you use the -1 switch, it keeps it from trying other servers.

I consider this to be very secure. You could be on the most infected computer in the world, and it can't touch this. A hardware keylogger would be the only possible way to lose your passwords, and Tails has several virtual keyboards or Keepass that will defeat that.

Malware could replace the electrum.exe with one that reveals everything. I suggest not to be uncautious.

Why do you need to use onion servers? By using tor you still can use all normal servers. Or do you want to have a server whose location is unknown to authorities?

[jackjjohnson]

Sorry for so long in replying. Tails is a relatively hardened Linux, there is not an electrum.exe on the system. I compiled the executable from source code, and store an MD5sum checksum of the executable in another location in the encrypted storage. It takes 10 seconds to run md5sum  /path/to/electrum so that I can verify it is exactly the same one every time. The Tails USB stick's main use is for bitcoin, no casual browsing, and never any personal email/social networks, etc. I am confident in my ability to use it without getting malware.

My goal was to have a portable USB OS to be as secure as I can make it, to use with Bitcoin. At the same time, I don't want to have a One, Vital, Important Stick That I Cannot Lose.  I image the stick with the dd command (from another running and secure Linux), and can make one big file that I can recreate the USB key from. I have many of them in different locations. If I do lose it, the encrypted parts use a very long password. If it's lost, I have only lost a few euros worth of USB stick, not my information.

My interest in using .onion/Electrum servers is not because I am working with any large amount of BTC at all (to the contrary!) It is just part of this ongoing experiment in making it as secure and private as I can.

[jackjjohnson]

I was incorrect in my description above. I have only been making images from my existing install for some time, had forgotten details until I set up another fresh one recently. Of course I did not compile from source, this is all python. I get the tarred source, and run the executable from that. As long as the MD5sum from Electrum-1.9.8.tar.gz matches the site, and you checksum the executable each time you run it, you are 100% assured you are not running a trojaned version.

I recently set up the Electrum LTC client on Tails as well. Great job, devs, thank you for your work.

[jamesjamison597]

Since we now have a subforum for Electrum, I am rewriting here what I already said in other threads. I hope it's more visible in its own thread.

It is not safe to use a portable version of Electrum on an insecure computer!

Don't get me wrong: I am not saying that a portable build is by itself more dangerous than a non-portable version.
However, a portable version does not bring anything more in terms of security. It does not protect you from the computer you are using.
In addition, portable builds encourage dangerous behaviour, because they make it very easy to use your wallet on third party computers, that might be infected with viruses and keyloggers.

I was never enthusiastic about distributing portable versions of Electrum.
I did it because the demand for portable versions was so high that portable builds distributed by third parties were getting popular.
That's the only reason why I accepted to distribute portable builds: I do this in order to avoid an even worse situation.

using this vertsion is ok..if theres a higher version let me know...BTC

[Elliander]

I think it would be interesting if a single install could create both a portable version that works just by plugging the USB into a computer and also a boot version which works by booting from USB. My reasoning is that, when possible, it would obviously be preferrable to boot into a secure environment, but that might not be practical in all situations.

Personally though, my main concern is using a portable version on a public computer. You can't boot from USB, but you can run it. There won't be a virus to worry about because these computers are instanced so that each day it refreshes and no unauthorized programs can be installed. The problem is two fold: First, if administrative access is required it would never work. Second, these computers are usually monitored.

With college or library computer labs there is usually someone on duty who can actully look at your screen from a remote device at any time and record your behavior. In fact, at my college, it isn't just a chance. They definitely will review what you are doing. In theory, a malicious user could copy down your addresses and funds to associate with an identey which takes away anonymity. This scenario is more likely at Library computers that often give similar access to the FBI.

For this scenario I think portable version should have a default setting of hiding address while leaving address labels visible. That way if you are just checking your balances you will know how much money was sent to which address and when without anyone else being able to see those addresses. Call it a stealth mode. It could even be set up to allow you to copy an address to clip board without showing the address. Of course, once added to clip board and pasted it will obviously be visible, but if the user only does this with one time use addresses it would still provide better security than turning off stealth mode to handle such transactions.

Two other thoughts: Couldn't a proxy program be integrated with a list of safe addresses and then have the program use a random rotating IP address so that when transactions are sent or received there is no connection an IP address to multiple addresses which might later be used to figure out the seed or otherwise compromise privacy? And couldn't the security features of Dark Wallet's Stealth and CoinJoin be applied at some point?

Finally, for portable versions - or all versions really - why not implement some kind of a file checksum? A non writable file could contain the information needed to check the integrity of the executable to make sure that it hasn't been compromised and for added security maybe even a mirror of the executable could run at the same time? Borrowing a trick from virus behavior, if one file is deleted or modified in any way outside of normal user behavior the other one repairs it. In this way a malicious program would need to modify both simultaneously and even then the checksum could be set to run when it opens and right before it exits to alert the user that the file was compromised at the very least.

I think the extra security of all these features together would help protect users who hae a need to use portable modes and would also help protect people who install onto their own machines that later become compromised. Is it feasible though?

[tema]

 Hello! I think it would be a good idea to add TOTP (Time-based One Time Password Algorithm, RFC 6238)

[btcminer021]

I don't think you need to maintain the "Standalone" version. Portable is great. Thanks!

[tema]

I don't think you need to maintain the "Standalone" version. Portable is great. Thanks!

 what is the difference between Standalone Executable and Portable?

[Muhammed Zakir]

I think 'Standalone' will only have 1 .exe file and all the datas(wallets and other datas) will be in AppData. But 'Portable' Electrum put all the files in the folder from which Electrum is running, say USB. So whatever computers you use, all the files will still be in the USB.

   -MZ

[GODLIKE]

Since we now have a subforum for Electrum, I am rewriting here what I already said in other threads. I hope it's more visible in its own thread.

It is not safe to use a portable version of Electrum on an insecure computer!

Don't get me wrong: I am not saying that a portable build is by itself more dangerous than a non-portable version.
However, a portable version does not bring anything more in terms of security. It does not protect you from the computer you are using.
In addition, portable builds encourage dangerous behaviour, because they make it very easy to use your wallet on third party computers, that might be infected with viruses and keyloggers.

I was never enthusiastic about distributing portable versions of Electrum.
I did it because the demand for portable versions was so high that portable builds distributed by third parties were getting popular.
That's the only reason why I accepted to distribute portable builds: I do this in order to avoid an even worse situation.

About keyloggers: why don't you implement a visual (mouse clicking) access check?

[Muhammed Zakir]

About keyloggers: why don't you implement a visual (mouse clicking) access check?

Movements of mouse or clicks can also be recorded. However, you can reduce it by using a scrambled virtual keyboard. But still, most users prefer to use their keyboards.

Note that, ThomasV has explicitly mentioned that portable build is not dangerous by itself. It is just like other builds but it encourages dangerous behaviour.

-snip-

It is not safe to use a portable version of Electrum on an insecure computer!

Don't get me wrong: I am not saying that a portable build is by itself more dangerous than a non-portable version.

 -snip-

In addition, portable builds encourage dangerous behaviour, because they make it very easy to use your wallet on third party computers, that might be infected with viruses and keyloggers.

 -snip-

[chentron]

Please, where is the last portable version for windows ?

[Stn]

I won't be arguing about security. But i have remark about behavior of the portable version. When this version by default creates wallet somewhere deep in the guts of OS where is portability here? I believe that really portable version should handle data file in the same folder where executable is.

I know there is way to assign wallet file from a defined folder. But not create one. Also there are plenty people who able to backup folder with his/her data, but not that many of them able to write shell file to assign wallet file for this binary. Ask them to find where wallet was created and it will be a real challenge.

Portable version should be really portable, otherwise what is the difference with installation?

[3888]

I won't be arguing about security. But i have remark about behavior of the portable version. When this version by default creates wallet somewhere deep in the guts of OS where is portability here? I believe that really portable version should handle data file in the same folder where executable is.

I know there is way to assign wallet file from a defined folder. But not create one. Also there are plenty people who able to backup folder with his/her data, but not that many of them able to write shell file to assign wallet file for this binary. Ask them to find where wallet was created and it will be a real challenge.

Portable version should be really portable, otherwise what is the difference with installation?

The portable version was 'fully' portable up to and including version 2.3.2 meaning that it created all the data folders, files and wallets within the folder from where the exe was started. You could thus copy the electrum portable exe file to a usb drive, start it up and it would create all the folders, files and wallets in the same location on the usb drive which made it 'portable'.

The later versions of Electrum-BTC however no longer functions like this. The latest binaries that were released do not even support Trezor anymore so not to sure what is going on with Electrum but I'm personally not very impressed with the way things are going. The 2.4 binaries have been out almost a month already and still no update to add back in support for hardware wallets.

Electrum_LTC portable on the other hand works as it should. Even the latest version, 2.4.3.1 works just fine, whether portable and or install versions. The portable version creates and or uses the folders, files and wallets within the same directory.

Not sure why Electrum-BTC no longer works that way as Electrum-LTC is essentially a clone of it so not sure why the LTC version can work properly, including with all supported hardware wallets, while the BTC version seems crippled.

[SebastianJu]

Electrum_LTC portable on the other hand works as it should. Even the latest version, 2.4.3.1 works just fine, whether portable and or install versions. The portable version creates and or uses the folders, files and wallets within the same directory.

Hm, i did not know there is an LTC Version and that there already exists a portable version for 2.4.3.1. I'm puzzled why that is so. Is the team coding on both versions different?

I sometimes have the impression that old errors, that already had been fixed once, were reimplemented. For example the missing socks setting looks like such. I think i already have seen that error fixed some months ago.

[3888]

Electrum_LTC portable on the other hand works as it should. Even the latest version, 2.4.3.1 works just fine, whether portable and or install versions. The portable version creates and or uses the folders, files and wallets within the same directory.

Hm, i did not know there is an LTC Version and that there already exists a portable version for 2.4.3.1. I'm puzzled why that is so. Is the team coding on both versions different?

I sometimes have the impression that old errors, that already had been fixed once, were reimplemented. For example the missing socks setting looks like such. I think i already have seen that error fixed some months ago.

Below are the links to the LTC version website and their downloads.

The current BTC version is on 2.4.4. and the latest LTC is on 2.4.3.1.The BTC version, for Windows, have no support hardware wallets and the account labels (used with multiple account like when you have a Trezor) still does not work. The LTC version (which is actually behind) have full hardware wallet support and the account labels works perfectly.

So I'm currently running 2.3.2 for the BTC version as I have a Trezor and 2.3.2 is the last stand alone that works properly and which have hardware wallet support. On LTC I run the latest version (2.4.3.1) without any problems with the stand alone version.

I posted earlier that the current BTC version is now essentially cripple ware in so far as a Windows/Trezor user is concerned.

https://electrum-ltc.org/

https://electrum-ltc.org/download/

[BitcoinNewsMagazine]

Latest Electrum 2.5.1 Portable with Trezor and Ledger support is available for download thanks ThomasV!

[SebastianJu]

Latest Electrum 2.5.1 Portable with Trezor and Ledger support is available for download thanks ThomasV!

Sounds great. Thanks ThomasV. Guess the next big building lot is the server software which had big problems with the spam attacks.

[SebastianJu]

I found some small bugs in the portable version.

I can not change the language. Regardless what i try.

I can not import private keys. There are only sweep and export options. And sweep sounds like a highly dangerous option.

I'm not sure but i believe the satoshi per kb option was set back by upgrading. I first thought it is an automatic calculation depending on net load that raised the fee but it is only satoshi per kb? Not sure yet.

[DuddlyDoRight]

Portable version user here. Cold wallet that uses Electrum live and a FIPS USB drive with isolated crypto for wallet storage. Electrum is signed and jailed.. No NIC on when booting for signing.

Have fun showing me how vulnerable I am..

[RealBitcoin]

calculate the checksum of the electrum file, and put it in a text file next to it, and rename that file to something like blablabla.txt

that way every time you run it, you can check if it has been replaced with a malicious one or not. It works for me, so it should work for you.

And if you rename the file to a random stuff, then the virus wont know whats in the txt file.


Also rename the electrum executable too to something random.

[DuddlyDoRight]

calculate the checksum of the electrum file, and put it in a text file next to it, and rename that file to something like blablabla.txt

that way every time you run it, you can check if it has been replaced with a malicious one or not. It works for me, so it should work for you.

And if you rename the file to a random stuff, then the virus wont know whats in the txt file.


Also rename the electrum executable too to something random.

Just put a MD5 or SHA3 hash in any file anywhere(neither have practical collisions).

Disc image patching isn't where I the attacker am going to attack. I'm going to inline patch UI callbacks post-execution by using debug APIs on Windows, Linux, and OSX. You can't do this on Android or IOS without paring internal "services" to allow trans-sandbox communication and even then you have to give the attacker memory through mailbox buffers..

Jails and memory corruption protection on Linux and OSX and a special user and owning folder and EFS and DEP for Windows 7/8/10. Along with that hash. It'd take a specialized rootkit to get past this which rootkit authors probably won't do unless it become a big trend.

Things will get better when AMD gets something like SkyLake's SGX. This is basically like Truszone in IOS and Anroid by ARM. You'll be able to isolate processes with hardware protection and not even rootkits can interact..

[RealBitcoin]

Just put a MD5 or SHA3 hash in any file anywhere(neither have practical collisions).

Disc image patching isn't where I the attacker am going to attack. I'm going to inline patch UI callbacks post-execution by using debug APIs on Windows, Linux, and OSX. You can't do this on Android or IOS without paring internal "services" to allow trans-sandbox communication and even then you have to give the attacker memory through mailbox buffers..

Jails and memory corruption protection on Linux and OSX and a special user and owning folder and EFS and DEP for Windows 7/8/10. Along with that hash. It'd take a specialized rootkit to get past this which rootkit authors probably won't do unless it become a big trend.

Things will get better when AMD gets something like SkyLake's SGX. This is basically like Truszone in IOS and Anroid by ARM. You'll be able to isolate processes with hardware protection and not even rootkits can interact..

Ok that sounds complicated and i dont really understand, but what i get is that you will attack post execution by corrupting my memory.

Ok but for that you still need some pre-installed malware on the PC, a trojan , that will allow you to do this and remote control my pc like this.

As with any virus, first you need to get your virus on the PC, and then attack like this.


Any electrum user with a quarter brain knows not to download shit or open random links if they have money on their PC.

So how would you get the virus on the PC?

[DuddlyDoRight]

Just put a MD5 or SHA3 hash in any file anywhere(neither have practical collisions).

Disc image patching isn't where I the attacker am going to attack. I'm going to inline patch UI callbacks post-execution by using debug APIs on Windows, Linux, and OSX. You can't do this on Android or IOS without paring internal "services" to allow trans-sandbox communication and even then you have to give the attacker memory through mailbox buffers..

Jails and memory corruption protection on Linux and OSX and a special user and owning folder and EFS and DEP for Windows 7/8/10. Along with that hash. It'd take a specialized rootkit to get past this which rootkit authors probably won't do unless it become a big trend.

Things will get better when AMD gets something like SkyLake's SGX. This is basically like Truszone in IOS and Anroid by ARM. You'll be able to isolate processes with hardware protection and not even rootkits can interact..

Ok that sounds complicated and i dont really understand, but what i get is that you will attack post execution by corrupting my memory.

Ok but for that you still need some pre-installed malware on the PC, a trojan , that will allow you to do this and remote control my pc like this.

As with any virus, first you need to get your virus on the PC, and then attack like this.


Any electrum user with a quarter brain knows not to download shit or open random links if they have money on their PC.

So how would you get the virus on the PC?

"pre-installed" what? My process just has to run and intercept any time you put in the encryption data to unlock the wallet..

How do I get it on your box with the wallet software?

• Ads and zero-day
• zero-day or MITM via DNS hijack
• zero-day or MITM via TOR entry or exit nodes
• Header parsing zero-day in your POP3 or IMAP client
• "spear-phishing"
• infect something on a USB drive and wait for you to use it if you use an air-gap(works with crypto drives too)
• MITM non-TLS non-signed executable over subnet box via AP or infected box
• Brute-force RPC or try SMB zero-day on subnet or AP

A FUD packer or uncommon compiler or compiler-switches so your AV doesn't detect it before I detect and kill your AV or quit before HIPS detects it.

There are others too like Manufacturing backdoors and codec vulnerabilities.

[RealBitcoin]

"pre-installed" what? My process just has to run and intercept any time you put in the encryption data to unlock the wallet..

How do I get it on your box with the wallet software?

• Ads and zero-day
• zero-day or MITM via DNS hijack
• zero-day or MITM via TOR entry or exit nodes
• Header parsing zero-day in your POP3 or IMAP client
• "spear-phishing"
• infect something on a USB drive and wait for you to use it if you use an air-gap(works with crypto drives too)
• MITM non-TLS non-signed executable over subnet box via AP or infected box
• Brute-force RPC or try SMB zero-day on subnet or AP

A FUD packer or uncommon compiler or compiler-switches so your AV doesn't detect it before I detect and kill your AV or quit before HIPS detects it.

There are others too like Manufacturing backdoors and codec vulnerabilities.

Pretty large threats exist there. Do you know any ways to defend against these attacks?

What if electrum needs some king of memory obfuscation system, to hide it's computations in the memory so that viruses can't detect it. And rename the process name of it to a random name as well.

[DuddlyDoRight]

Pretty large threats exist there. Do you know any ways to defend against these attacks?

What if electrum needs some king of memory obfuscation system, to hide it's computations in the memory so that viruses can't detect it. And rename the process name of it to a random name as well.

Stop believing in "secure coding practices" and "secure design" and start believing in OSS hardware isolation with low-complexity.

TREZOR without the dishonest price-tag.. It's open source and the only way you can attack it is through memory corruption and a ARM payload that sends keys back over USB.

I don't have the funding else I could emulate their hardware with any cheap hardware. I've looked at the GIT changes for Electrum it's not hard to do. No way I'm paying $100 for a $10 piece of hardware though..

[RealBitcoin]

Pretty large threats exist there. Do you know any ways to defend against these attacks?

What if electrum needs some king of memory obfuscation system, to hide it's computations in the memory so that viruses can't detect it. And rename the process name of it to a random name as well.

Stop believing in "secure coding practices" and "secure design" and start believing in OSS hardware isolation with low-complexity.

TREZOR without the dishonest price-tag.. It's open source and the only way you can attack it is through memory corruption and a ARM payload that sends keys back over USB.

I don't have the funding else I could emulate their hardware with any cheap hardware. I've looked at the GIT changes for Electrum it's not hard to do. No way I'm paying $100 for a $10 piece of hardware though..

To my understanding Trezor is not that secure because it updates it's firmware from the internet, thats a major attack vector.

Social engineering or the company goes rogue and the signign keys can be compromized, so the entire hardware is worth trash afterthat. That is a major design flaw if you let your "secure" hardware keep contact with the internet.

Best method to store btc is to put it in a cold storage and use QR code to sign the transactions in the offline space. Buy a 2$ cheap webcam, that should do the trick.


Ok but I`m still concerned about online vulnerabilities, if what you say is true, then every online account can be theoretically hacked.

[DuddlyDoRight]

Pretty large threats exist there. Do you know any ways to defend against these attacks?

What if electrum needs some king of memory obfuscation system, to hide it's computations in the memory so that viruses can't detect it. And rename the process name of it to a random name as well.

Stop believing in "secure coding practices" and "secure design" and start believing in OSS hardware isolation with low-complexity.

TREZOR without the dishonest price-tag.. It's open source and the only way you can attack it is through memory corruption and a ARM payload that sends keys back over USB.

I don't have the funding else I could emulate their hardware with any cheap hardware. I've looked at the GIT changes for Electrum it's not hard to do. No way I'm paying $100 for a $10 piece of hardware though..

To my understanding Trezor is not that secure because it updates it's firmware from the internet, thats a major attack vector.

Social engineering or the company goes rogue and the signign keys can be compromized, so the entire hardware is worth trash afterthat. That is a major design flaw if you let your "secure" hardware keep contact with the internet.

Best method to store btc is to put it in a cold storage and use QR code to sign the transactions in the offline space. Buy a 2$ cheap webcam, that should do the trick.


Ok but I`m still concerned about online vulnerabilities, if what you say is true, then every online account can be theoretically hacked.

That's only insecure if they don't internally do a signature check on the image. You have to update firmware from a network.

The only way it can still be vulnerable with an internal signature check is if the transfer or signature code has memory corruption. This code can be done very primitive though where you can give strong attention to crypto implementation and memory handling.

Hardware isolation remedies everything if properly implemented. It's such a small set of function it's not that hard to secure. Even targeted attacks become impossible at some point, because there is only this little query interface to give input to.

[DuddlyDoRight]

That's only insecure if they don't internally do a signature check on the image. You have to update firmware from a network.

The only way it can still be vulnerable with an internal signature check is if the transfer or signature code has memory corruption. This code can be done very primitive though where you can give strong attention to crypto implementation and memory handling.

Hardware isolation remedies everything if properly implemented. It's such a small set of function it's not that hard to secure. Even targeted attacks become impossible at some point, because there is only this little query interface to give input to.

Thats the soft problem. It has a small risk of the signature getting corrupted itself.

What is more likely that the company goes rogue, or gets coerced by the government to hand over the keys and update the device with backdoored updates.

My demands are: complete isolation or junk , there is no other option if you hold millions of $ of bitcoin.

That's a problem with the CPU you're using too. They can get microcode updates with backdoors, and no security product will be able to detect it. Security products also don't check BIOS ROMs. A small isolated device in that environment with crypto is secure though. The NSA would have to find a vulnerability in that small exchange interface or modify the image between repo and signing with a stable backdoor.

[Darra]

Hello.
No matter which version of the portable electrum for Windows I run, I keep on getting:

Microsoft Visual C++ Runtime Library

Runtime Error!
Program A:\electrum-2.7.11-portable.exe

R6034
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.



but after clicking ok, the application seems to run normally..
I am using Windows 10 64-bit..
The installation setup runs fine, but due to privacy (and SAFETY!) reasons, I prefer to use the portable one on a crypted drive..
Any idea why do I keep on getting that runtime error message? (i even tried it on a normal,non-crypted drive.. the same happens..)
Do I need to install something on my win 10,or copy some more files to the portable electrum directory?
Thanks for help, in advance.

edit:
I found the answer myself..
The portable version is built without a manifest...
You need to have "electrum.exe.manifest" from the installer version to be included in the same directory with the portable
version, renamed the same as the portable version.. (eg. electrum-2.6.4-portable.exe.manifest )

(see: https://msdn.microsoft.com/en-us/library/ms235560(v=vs.90).aspx     )

[bitcoin-shark]

just download stand alone version and it s fine for me...

[Thirdspace]

I downloaded electrum portable version 2.9.2
when I tried to run it, I'm getting "Error loading Pyton DLL: C:\DOCUME...  \python27.dll (error code 14001)"
what does it mean? how to solve this problem
If I download the Windows Installer version will I be getting the same problem?
also there's a signature file... how do I use this to verify

[Jiddu]

I downloaded electrum portable version 2.9.2
when I tried to run it, I'm getting "Error loading Pyton DLL: C:\DOCUME...  \python27.dll (error code 14001)"
what does it mean? how to solve this problem
If I download the Windows Installer version will I be getting the same problem?
also there's a signature file... how do I use this to verify

This should help: https://www.reddit.com/r/Bitcoin/comments/1t70ud/electrum_fatal_error_fix_re_python27dll/
(run as admin)

To verify the file, you need GPG. Using a search engine, you should find many tutorials about that.

[kelstasy]

Thanks for the heads up! Don't mind using the portable version because I'll use it on my personal desktop.

[Silviulung]

could we use electrum and electron cash on the same laptop?
cause before 1 august, alot of rumor about don't use both at the same laptop for claiming BCC...
thanks

[zurylostboys]

so far with me nothing happend .. maybe i use diffrent location not the same data cash and btc ...

[Sauaba]

Using both. Standalone and Portable. But I have a question. Is there a way to visualize not just the coins I have but also their value in $?

[HCP]

"Tools -> Preferences -> Fiat"

Set the value and server as you wish. Note that this will only give you a fiat value for your total balance (it doesn't show fiat values in the transaction history or transaction details)... and when you try to create a send it will show a "fiat value" text entry box next to the "btc value" text entry box.

[Sauaba]

Thanks HCP,

Worked fine here.

[bakgwei]

For me, the portable version is the only option I have to use Electrum on my work laptop, where I dont have any admin right (so theisntall-version wot work). Thanks for making this possible - and yes, I do understand the devs concern about being tempted to use it on unsafe PCs.

[jackjjohnson]

Assuming that it is Windows, your work may have keylogging and screencap software. My workplace does, because they deal with customers' money.

Recent versions of Tails https://tails.boum.org/ include a version of Electrum, that works over TOR, for better privacy and safety on your work laptop. You have an option to spoof the MAC address, but on a work network, that could raise red flags as well. Network access could also be tied to an Active Directory user(employee). It has numerous security features: encrypted home directories, disabling scripts, and so forth.

In that case (with Tails), just bring the work laptop home, or use it somewhere other than work. If you are serious about privacy, while using Tails/Tor don't check your real-world email, or Facebook, or Ebay, or anything that ties it to your real existence.

Tails is Linux, so you should be or become somewhat familiar with it before you commit much BTC to Electrum on it. I keep it on a USB key, so I can (mostly) boot up any laptop or PC to it, and have "my stuff". Because it's a USB key, it's easy to clone several/many of them, and keep them in multiple locations. I also scan the contents of my wallet, have copies of important docs, all in the encrypted Tails persistent home directory.

[Alex456789]

Having downloaded the 3.0.0 portable version of Electrum, I found the mistake while installing. My Windows XP Professional SP3 said that the program electrum-3.0.0-portable.exe is not the Win32 application. What must I do with it?

The version electrum-2.9.3-portable.exe works well.

Thank you for your answers beforehand.

[HCP]

You have several options:

1. Upgrade your operating system... it is horribly outdated
2. Downgrade to v2.9.3... v3.0.0 has issues with older versions of windows (it only runs on Windows 10)
3. Try and use the newly released v3.0.1... it had some fixes to try and fix the issues v3.x is having on older windows, but you might need to install some windows updates:

Note: Some old versions of Windows might need to install the KB2999226 Windows update.

EDIT: I've tested v3.0.1 on Windows 7... got the Python35.dll error... then I installed the latest VC++ redist package (I used Visual Studio 2017 package from here: https://support.microsoft.com/en-us/help/2977003/the-latest-supported-visual-c-downloads) and that fixed the error!

[Sauaba]

Hi guys.
I´m using the portable version just on my computer. But I want to know how do I update the portable version? ATM I´m using v2.9.3. Some portable Software I just download a new version, extract and copy it to my current version overwriting the old files. Does it work with Electrum portable too?
Thanks

[HCP]

That is exactly how Electrum Portable works. You can just download the new version of Electrum portable from here (https://electrum.org/#download) and away you go...

NOTE: there are some issues with v3.0.1 on older versions of Windows like Win7/8, (you'll get a Python35.dll error)... If this occurs, you need to install the latest VC++ redist package (I used Visual Studio 2017 package from here: https://support.microsoft.com/en-us/help/2977003/the-latest-supported-visual-c-downloads) which should fix the error.

[Thirdspace]

Having downloaded the 3.0.0 portable version of Electrum, I found the mistake while installing. My Windows XP Professional SP3 said that the program electrum-3.0.0-portable.exe is not the Win32 application. What must I do with it?

The version electrum-2.9.3-portable.exe works well.

Thank you for your answers beforehand.

How did you manage to get it running on your WinXP SP3? I got "python27.dll (error code 14001)"
I checked the reddit discussion electrum_fatal_error_fix_re_python27dll but still couldn't figure out how to solve it

Note: Some old versions of Windows might need to install the KB2999226 Windows update.

I searched on KB2999226 and found it only applies to Win Vista up to 8.1 2999226/update-for-universal-c-runtime-in-windows
any tips on how to get it working on XP (I know I should buy new pc & windows or other OS linux etc) 

[HCP]

The simple answer is that you don't get it working on WinXP... Unfortunately that OS is just way to old and outdated to have any sort of support and the chances of any "modern" working on XP get less and less as time goes by

So, you either need to continue using v2.9.3 or you update your OS... pretty simple really

[Thirdspace]

I was trying with earlier version v2.9.2 when I get python27.dll error
that's why I asked him, Alex456789, on how he gets it running
I never actually get any electrum version running successfully
I'm considering running linux OS live on USB stick for linux electrum
if that is too much hassle or I have trouble, I probably go with easiest way android electrum

[Alex456789]

The KB2999226 Windows update is used for Windows Vista as minimum. As I understand it cannot be used for Windows XP.

I want to ask.

If I continue using the 2.9.3 version of portable Electrum, can I receive coins after hard fork of Bitcoin SegWit2x in this November?

How did you manage to get it running on your WinXP SP3?

The version 2.9.3 runs on WinXP if it is portable only. The full version of Electrum is not running. In order to install it, I have used the following site:
http://hyiphunter.org/bitkoin-koshelek-electrum-otzyvy-kak-polzovatsya/

It is in Russian. If you know this language, you may read the dialogues after the article. If not, you may watch the screenshots in the article which show the way of installing.

Some thoughts from the dialogues after the article:

a) Do not use the spaces in the folder of installing the Electrum. For example, do not install it in C:/Program Files/Electrum, because there is a space between the word "Program" and the word "Files".

b) Do not rename the file which you downloaded from the site electrum.org

c) Install the wallet in the same folder where the installing file is located only. For examle. If you download the 2.9.3 portable file from the site electrum.org into the folder C:/Electrum, you need to install the program in the same folder C:/Electrum.

[HCP]

If I continue using the 2.9.3 version of portable Electrum, can I receive coins after hard fork of Bitcoin SegWit2x in this November?

Well, that's no longer an issue now... the hard fork has been cancelled!

https://medium.com/@OneMorePeter/onwards-all-in-on-segwit-9e7cb3faa73d
https://techcrunch.com/2017/11/08/segwit2x-backers-cancel-plans-for-bitcoin-hard-fork/

Sanity has prevailed.

[forensick]

I don't understand if I can update my portable version simply saving the data folder or I have to enter again the seed?
I have never updated so maybe you can link me a guide.

[HCP]

I don't understand if I can update my portable version simply saving the data folder or I have to enter again the seed?

Personally, I would make a copy of the data folder... It isn't strictly required, but it's always better to have a backup and not need it, than needing a backup and not having one!

Then you just put the new portable .exe in the same folder as the old portable .exe (Note: You don't even need to delete the old portable .exe at this point, it is OK to just leave there). Then double click the new portable .exe to check that it is all OK... that's all there is to it.

Once you have confirmed that everything is running ok with the new portable .exe, you can safely remove the old portable .exe.

[forensick]

I don't understand if I can update my portable version simply saving the data folder or I have to enter again the seed?

Personally, I would make a copy of the data folder... It isn't strictly required, but it's always better to have a backup and not need it, than needing a backup and not having one!

Then you just put the new portable .exe in the same folder as the old portable .exe (Note: You don't even need to delete the old portable .exe at this point, it is OK to just leave there). Then double click the new portable .exe to check that it is all OK... that's all there is to it.

Once you have confirmed that everything is running ok with the new portable .exe, you can safely remove the old portable .exe.

Thank you very much! I updated my portable version with your procedure although I read this thread and I am now worried about dangerous behaviour because it very easy to the wallet on infected computers.

[HCP]

Thank you very much! I updated my portable version with your procedure although I read this thread and I am now worried about dangerous behaviour because it very easy to the wallet on infected computers.

The thing is, the only person in control of the "dangerous behaviour" is YOU.

Portable versions are only dangerous if you engage in risky activity and don't take adequate precautions... it's a bit like sex... if you sleep with random people and don't use condoms/birth control, there can be serious consequences (STDs/STIs... unwanted pregnancy etc)

Likewise with using a portable bitcoin wallet, you put your USB key into random computers without properly assessing the risks and making sure those computers are not infected with viruses/malware/keyloggers, there can be serious consequnces (loss of coins)

[cynical]

I am looking to install and/or create a wallet on an encrypted USB drive so that I can access that wallet on the go,
rather than relying on a 'mobile wallet' on my phone.
From the website i can see the download option is mobile, https://electrum.org/#download
i assume this is the way to go
any thoughts from current users?

[Marcus07]

Since we now have a subforum for Electrum, I am rewriting here what I already said in other threads. I hope it's more visible in its own thread.

It is not safe to use a portable version of Electrum on an insecure computer!

Don't get me wrong: I am not saying that a portable build is by itself more dangerous than a non-portable version.
However, a portable version does not bring anything more in terms of security. It does not protect you from the computer you are using.
In addition, portable builds encourage dangerous behaviour, because they make it very easy to use your wallet on third party computers, that might be infected with viruses and keyloggers.

I was never enthusiastic about distributing portable versions of Electrum.
I did it because the demand for portable versions was so high that portable builds distributed by third parties were getting popular.
That's the only reason why I accepted to distribute portable builds: I do this in order to avoid an even worse situation.

its right

[Casperko]

I will repeat the request in this thread:
The problem with Electrum, version 2.5.2 portable. Essence: included after a couple of weeks, and writes "Synchronization" .. and already 2 days, changed the download server. It does not help, even on the contrary - the red circle glows. In what there can be a problem and how it to correct ??
p.s have Win 7 and recently updated all the drivers, after that Electrum stopped switching on

[HCP]

I will repeat the request in this thread:
The problem with Electrum, version 2.5.2 portable.

2.5.2??!?

That version is far too old... you need to use something like 2.9.3 portable which you can get here: https://download.electrum.org/2.9.3/

Don't try and use v3.x... it doesn't play nicely with Windows 7/8...

[Casperko]

I will repeat the request in this thread:
The problem with Electrum, version 2.5.2 portable.

2.5.2??!?

That version is far too old... you need to use something like 2.9.3 portable which you can get here: https://download.electrum.org/2.9.3/

Don't try and use v3.x... it doesn't play nicely with Windows 7/8...

That is, do you think the problem is this? I should remove the entire electrum 2,5,2 and then just put a new one? And yet, 2,9,3 to put with 2fa or without, will not there be a conflict with the previous version? I have never updated myself and are not sure about the actions.

[HCP]

Most likely, the old version is likely to be your issue. There have been multiple instances recently of people running older versions having troubles syncing.

You don't have to remove 2.5.2... you can just get the 2.9.3 portable and put it in the same location and then run it.

[Casperko]

I understand, I'll try and accomplish my goal!) Thanks for the advice

And the question is, how can I find and download the version 2,9,3 portable on the Electrum website? Thanks for the link ... but it's hard to trust these links in our time

[HCP]

I understand, I'll try and accomplish my goal!) Thanks for the advice

And the question is, how can I find and download the version 2,9,3 portable on the Electrum website? Thanks for the link ... but it's hard to trust these links in our time

The link I gave (https://download.electrum.org/2.9.3/) IS the electrum website... notice the "electrum.org"

Anyway... goto the download page: https://electrum.org/#download and click the "previous releases" link... it'll take you to https://download.electrum.org/ then you just want to look for 2.9.3 folder (https://download.electrum.org/2.9.3/)... and in that will be all the install files for the various OSes... just get the portable.exe (and the portable.exe.asc if you want to check digital signature)

[Casperko]

Yes, 10x, all right, wallet is work now

[altcocollector]

Hi,i'm Milo

 If i protecting my pc either laptop with security code or short a thing.
Wil my electrum data safe ?

Thanks anyway.

I am not sure if anyone understood your question. Could you be a little more clearer. Are you saying that if you protect your PC with an Antivirus, you will be safe? Yes, till the time your computer is safe, you are safe. But the problem with Antiviruses are that they are not so good with keyloggers and malware. So use at your own risk. Thanks!

[JMELATI]

Portable Version for Windows has a virus?
Win32/Spursint detected on Win10.

[HCP]

No, it's most likely a false positive... as long as you use the official site (www.electrum.org) to download an you haven't downloaded from any of the fake sites.

Which antivirus are you using?

[JMELATI]

Ok. Thanks.
Windows Defender (WIN10).

[HCP]

Did you check the digital signature of the file you downloaded using GPG? That is the only guaranteed way to ensure that you have an original install file and not a fake or infected file.

[JMELATI]

Yes, I did it.
All works fine. Thanks!

[rikhartzan]

I've been robbed !!!!,
i was install the latest version 3.0.6 of electrum wallet after downloading the portable version from its official website because windows detect a trojan, 2 days later my funds have disappeared !!!

what can i do??

[HCP]

what can i do??

Pretty much nothing.

If the BTC has been moved, then there is no way to get them back unless the person who controls the address they were sent to sends them back.. which, obviously, is not likely to happen

Did you check the digital signature of the file you downloaded? Do you still have the file you downloaded? If so, we can help you check to see if it is legit..

Have you checked your browser download history and confirmed that you did indeed download from electrum.org and not one of the scam sites?

[DrakonX]

It is not safe to use a portable version of Electrum on an insecure computer!

What does it mean "insecure"? In which manner?

I didn't read the whole thread. If I should do this, please let me know.

[bob123]

It is not safe to use a portable version of Electrum on an insecure computer!

What does it mean "insecure"? In which manner?

I didn't read the whole thread. If I should do this, please let me know.

It is 'insecure' in terms of that it encourages bad habits (using as portable wallet on multiple computers).
The security itself (if used on a secure computer) is the same as with any other wallet (either installed electrum or other wallets).

The security completely depends on the computer it is running on.


I have also replied in your thread regarding armory/electrum.

[NotATether]

Regarding the security of a portable version on a device like a USB flash drive... the main issue I see is the USB getting infected with a virus.  However, I have found a solution we use for work which does not allow the USB to be writable (thus a virus cannot jump onto the drive) unless a bit of code is entered.  This puts the control into the user's hands to determine if the environment is safe before letting the USB stick be read/write.  This is also way easier than trying to write an Operating System to the USB stick... which some say makes the USB more secure (debatable).  Got the Lock License drive from Nexcopy.  https://www.nexcopy.com/usb-secure-flash-drives/lock-license/  You can't forget to make the USB read-only because that is the default state of the drive.  Yank it out of the port and the stick is read-only, no matter what. Cutting power puts it as read-only or write protected

Alternatively, a cheaper old-school solution is to use Electrum on an old computer that has a CD drive, as cold storage for signing transactions, but instead of putting the portable electrum on the disk or USB, you burn it on a CD-R disc and finalize it. That way it becomes impossible to write malware to it since the disc is write-protected.

[NeuroticFish]

Alternatively, a cheaper old-school solution is to use Electrum on an old computer that has a CD drive, as cold storage for signing transactions, but instead of putting the portable electrum on the disk or USB, you burn it on a CD-R disc and finalize it. That way it becomes impossible to write malware to it since the disc is write-protected.

Or, if that's not available, use a live Linux OS on the USB as cold storage.
Although it's less convenient, since you may need multiple reboots to switch between the main OS and the USB, it does the job gracefully.
Just that a second USB (for transfers) is cheaper than a second computer 

[Imranbutt44]

It is not safe to use a portable version of Electrum on an insecure computer!

As i understand this statement, its safe to use Portable Electrum on personal computer.
Am i right ?

[HCP]

It is not safe to use a portable version of Electrum on an insecure computer!

As i understand this statement, its safe to use Portable Electrum on personal computer.
Am i right ?

The portable version is no more "insecure" than the normal windows installer or standalone version.

So, assuming you have taken the proper precautions... ie. confirmed digital signature of Electrum portable download and have taken steps to ensure your "personal" computer is malware and virus free... then it should be perfectly fine.

The dangers associated with the portable version are that it can lead to "dangerous" or "risky" behaviour... ie. putting it all on a USB stick and then using that USB stick on computers that you have no control over. For instance, public computers, internet cafes, other people's machines etc. where you have no idea what is/isn't installed or running on them.