Wallet misunderstanding.

[steelboy]

Hi

I am assuming that this has probably been answered many times over in various threads but after looking have not found exactly what i am looking for and am hoping to get a few answers to my specific questions. (This is the Newbie section after all)

I have a few bitcoins that at present are kept in online wallets. After reading a little more recently i have found that these arent as secure as i previously thought.

Can anyone recommend a more secure alternative. I have a Mac and am running OSX. I don't mind some tech difficulty but I am by no means an expert.

Ideally, I would want it to be something easy like an online wallet but then encrypted with a very long password.

Thanks in advance for the advise.

SB

[cobra-kai]

Here are some excellent wiki pages that I used as a starting point for setting up a secure solution:

https://en.bitcoin.it/wiki/How_to_set_up_a_secure_offline_savings_wallet
https://en.bitcoin.it/wiki/Securing_your_wallet

If you really want an online wallet that is reasonably secure, you can generate a paper wallet (bitaddress.org) as a savings account, which you can monitor by adding it at as a watching account on blockchain.info. When you need to withdraw from the account, blockchain.info will ask you for the private key, which you can conveniently scan (QR code) with the webcam.

[b!z]

Hi

I am assuming that this has probably been answered many times over in various threads but after looking have not found exactly what i am looking for and am hoping to get a few answers to my specific questions. (This is the Newbie section after all)

I have a few bitcoins that at present are kept in online wallets. After reading a little more recently i have found that these arent as secure as i previously thought.

Can anyone recommend a more secure alternative. I have a Mac and am running OSX. I don't mind some tech difficulty but I am by no means an expert.

Ideally, I would want it to be something easy like an online wallet but then encrypted with a very long password.

Thanks in advance for the advise.

SB

http://blockchain.info/wallet

Online wallets don't get any more secure than this. Encryption is done in browser, so they never touch your wallet.

[FarmerGreene]

I second the advice of having a paper wallet.  I have redundant copies of mine, and I trust it implicitly.

If you want something electronic, then Electrum should work for you.  Remember to encrypt your wallet and keep several backups including at least one not in your immediate geographic area.

I don't trust online wallets.  They are a high value target for Johnny Hacker.  I am a significantly less valuable target.

Cheers,
Greene

[steelboy]

Thanks for the replies, heres what i came away with.

Online wallets might no be the best idea. Blockchain.info (MyWallet) is  a form of online wallet though. (I was actually looking at this but if it's online i might use it for a more day to day wallet instead of the current service i am using). Does it have a facility for password protection as well?

Paper wallets (is that the same as cold storage then?) seem like the way to go. I looked at Cobra-Kai's suggestion and although the instruction steps looked complicated they didn't look unfathomable. The main issue i had with them was they seemed more geared at Linux, Ubuntu users and didnt seem suitable for Mac. (If i'm wrong please let me know)

Anymore help or ideas would be great

[cobra-kai]

There was a lot of information in the links I sent, but that is only because there are many different strategies you can use for securing your funds. The solution I suggested is very simple, yet reasonably secure. 1) generate and print a paper wallet by using the bitaddress.org web page (preferably on an offline computer). 2) Import the public key into your blockchain.info wallet to be able to monitor the address 3) When you need to withdraw funds, use blockchain.info to make the transfer, for which you will need the private key.

Try this with small sums first, until you feel confident enough to use it with larger amounts.

[steelboy]

There was a lot of information in the links I sent, but that is only because there are many different strategies you can use for securing your funds. The solution I suggested is very simple, yet reasonably secure. 1) generate and print a paper wallet by using the bitaddress.org web page (preferably on an offline computer). 2) Import the public key into your blockchain.info wallet to be able to monitor the address 3) When you need to withdraw funds, use blockchain.info to make the transfer, for which you will need the private key.

Try this with small sums first, until you feel confident enough to use it with larger amounts.

I looked at the bit address.org and there are a number of articles from worried people regarding the fact the key is generated by them and not yourself. Any thoughts on that?

Also, how do you use the website and services offline?

[cobra-kai]

I personally think that those people are worried because they don't understand how bitaddress.org works. The web page is self contained Java Script, so the code that generates the wallet is executed on your machine, not on a server. If you save the web page to disk, you can read the source code yourself. You can take that saved copy and open it on an offline computer, and it will happily generate new keys. In fact, that is what many people (including myself) do to be on the safe side when generating paper wallets.

[steelboy]

Nice one. I will be looking into it ASAP.

[DannyHamilton]

You have to start by deciding how much risk you are willing to accept and how much convenience you need.

Paper wallets are great (and extremely secure if done properly) for long term storage, but they are very inconvenient.

Online wallets such as InstaWallet are extremely convenient for momentary use, and frequent transactions, but are not very secure.

The wallets I'm familiar with listed in order of security (highest to lowest) are:

Paper Wallet
Armory
Bitcoin-Qt
Electrum & MultiBit
https://blockchain.info/wallet
Most other online wallets (MtGox, CoinBase, Bitfloor, InstaWallet, etc.)

There is very little difference in security between Electrum, MultiBit, and Blockchain.info.  However, in my opinion, there is a slightly increased chance that a person using blockchain could fall victim to a phishing attempt (or other social engineering).

EDIT: As of 2013-04-17 BitFloor has ceased all operations.

[steelboy]

You have to start by deciding how much risk you are willing to accept and how much convenience you need.

Paper wallets are great (and extremely secure if done properly) for long term storage, but they are very inconvenient.

Online wallets such as InstaWallet are extremely convenient for momentary use, and frequent transactions, but are not very secure.

The wallets I'm familiar with listed in order of security (highest to lowest) are:

Paper Wallet
Armory
Bitcoin-Qt
Electrum & MultiBit
https://blockchain.info/wallet
Most other online wallets (MtGox, CoinBase, Bitfloor, InstaWallet, etc.)

There is very little difference in security between Electrum, MultiBit, and Blockchain.info.  However, in my opinion, there is a slightly increased chance that a person using blockchain could fall victim to a phishing attempt (or other social engineering).

Nice one, that's pretty much what I've worked out now too.

So is a casascius coin a kind of paper wallet?

[mokahless]

You should probably treat this like you treat money right now. How secure is the wallet in your back pocket?

So my suggestions are to have the following and to move money around depending on your need for access:
offline computer: the computer catches up with the blockchain. The computer's OS (preferably linux) is newly installed and you do not use the internet for anything except bitcoin. After it catches up with the blockchain, you copy the wallet.dat file to a thumb drive and place it in a fireproof safe lock box. Write down or email yourself the address and never turn the computer on unless you want to withdraw funds. This is like your bank account.

create an android wallet. This is like your real wallet. Most people have a limit because they are afraid of being mugged.

create a normal wallet on your computer. This is moderately safe if you take precautions. Others can suggest secure software but I have had no issues with the satoshi client and an encrypted wallet.dat

Create an online wallet and treat it like you would money you pre-pay to any online services.

Put money in these accounts based on the security/ convenience you are willing to risk. This is just an overview and my ideas. I'm sure others can come up with more ideas, etc. Personally, I have an online computer that is dedicated for my Bitcoins. I will likely plan in the future to have more secure storage locations like listed above as my value of BTC grows. I also have an android wallet that I have 0.64USD in right now in bitcoins

[cobra-kai]

I second mokahless opinion to have different wallets with different security/convienience. I would like to add that his "offline" computer solution can be made even more secure by using Armory and following the procedure here

https://bitcoinarmory.com/using-offline-wallets-in-armory/

for signing transactions offline. Then the offline computer can be truly offline, instead of the semi-offline approach that mokahless describes.

This is in fact the solution that I have used for my most secure account, with some extra features. The offline computer runs Debian with whole disk encryption. The wallet stored on the computer is a brain wallet generated by bitaddress.org (on the offline computer), and I backed up the bitaddress.org code in various places, so that the tool to generate the brain wallet is secured. So if the computer crashes, I can always recover my funds, without having to have a paper copy in a vault. That's a pretty neat solution, imho.

That said, the question was for an online wallet solution that would be decently secure, and in that respect, I think that the combination of a blockchain.info wallet and a paper wallet is a good compromise. The blockchain.info page is open source and does not send a private key that you enter to sign a transaction from a watching only account to its server, and the private key of the paper wallet can be easily scanned with the webcam when you need to transfer funds.

[steelboy]

Thanks for all the help guys. I will be looking into the Armory today. I have 2 more questions if you dont mind.

1. As i have a mac is it worth buying a cheap laptop to keep offline to run the armory/bitcoinaddress from.

2. How does the blockchain keep up with the transactions if they are done offline. (I dont quite get this)

Thanks

[cobra-kai]

Thanks for all the help guys. I will be looking into the Armory today. I have 2 more questions if you dont mind.

1. As i have a mac is it worth buying a cheap laptop to keep offline to run the armory/bitcoinaddress from.

2. How does the blockchain keep up with the transactions if they are done offline. (I dont quite get this)

Thanks

1. If you want to be really secure, then yes. You can get a used eee pc or similar netbook for next to nothing.

2. You use Armory on the online computer to generate unsigned transactions. Then you transfer the unsigned transaction manually (e.g. on a USB disk) to the offline computer, where you sign it (with Armory). You then transfer the signed transaction manually to the online computer, where you broadcast the transaction (again with Armory). On the online computer, you will also need bitcoin-qt, to communicate with the bitcoin network, but on the offline computer, you only need Armory. It takes some effort to wrap your head around the procedure, but once you've done it a few times, you'll quickly get the hang of it.

[FarmerGreene]

>> So is a casascius coin a kind of paper wallet?

It's more metallic really. 

Yes, the public key of the rev1 Casascius coins were printed on the outside of the coin.  You could verify the coin's balance from blockchain.info.  You could also send money to the coin, making it worth more than its face value.  When you wanted to transfer the coin electronically, you'd rip off the sticker and find the private key inside it.

I bought one of these these when btc was under $10 <giggle>.  Now I can't find it.  <shat>