Stay safe.

[coreli]

Stay safe. Just a reminder.

Your thread should be stickied in the newbies section.

[marcotheminer]

Awesome thread, Im going through it now and im gonna do some of it!
Thanks

[pekv2]

I've added something to the OP that might save someone much trouble if practiced.

Added to the OP:

Avoid Link-Scammers

Avoid Link-Scammers

[nipponese]

Is there not a way to require 2-factor Google Authenticator keys for login?

[reaxion]

great advice thanks

[420smokz]

This is great! Thanks!

[pekv2]

np, guys.

Is there not a way to require 2-factor Google Authenticator keys for login?

For? I do not fully understand your question.

[SirBitsalot]

Wow GREAT article especially for a new guy! Thanks

[AlliumPorrum]

If using Windows, would it be a good idea from security point of view to handle all wallets by running a virtualized Linux on top of Windows? This way I wouldn't need to start the computer to Linux with CD everytime I need to handle wallets, but are the any risks from security point of view?

They are still on the same computer and using the same memory, but I would think that if the Windows is affected by some malware, it shouldn't be possible to address Linux applications anyhow.

[cerulean]

Interesting. I have tried all before I read this thread though but it's a good one for newbies, especially for those who just can't stay "safe".

[AlliumPorrum]

By "not staying safe", are you referring to using Windows over all..?   

My wife uses this PC also, so unfortunately there really isn't any option for Windows.

Thinking more about this Linux virtualization; theoretically if there where some key tracking malware on Windows, it could read all keys pressed when using the Linux wallet. But I'm not sure if this could cause any problems or not?

How about the wallet file; is it safe when using virtualized Linux? Where exactly would it be stored, and could it be possile that some Windows malware could access it?

[pekv2]

Block bad stuff with Hosts file by MVPS < Has been edited.

MVPS is now supplying their hosts file with 0.0.0.0 rather 127.0.0.1.

Good move on mvps's part. Saves them space as well.

Edit:
I suppose if you want to be hardcore secure, linux is the route. No windows>linux virtual stuff. No windows period.

[Taint]

This is a good safety guide, I'd like to throw in a vote for Password Safe.

I'd also like to suggest you check out TrueCrypt, an Open Source solution for encrypted file storage. It's portable and works under Linux, Windows and Mac.

Finally, I have to wish more sites were willing to use Google's OTP 'Authenticator'. It's one of the reasons I like Slush's pool.

-Edited for spelling

[stbot]

keepass has addons which allow sftp of the database file to a selected server. This is a good option to back up you password database.

http://keepass.info/plugins.html#ioprotocolext for sftp addon KeePass 2.x

[xbtitman]

Great site.  Thanks for the info.

Do you recommend getting the Xmarks bundle package with LastPass premium?

Cheers,
James

[pekv2]

Edited and added

Additional Notes:
With the latest LastPass as of the moment 3.1.0, and you have a system strong computer system you may up the PW iterations. Raise in increments of 100 or 1000. Anything high might be bad for mobile devices or slow computers. I set mine at 200000 Not recommended if you do not know what you're doing..
https://helpdesk.lastpass.com/security-options/password-iterations-pbkdf2/

Block unencrypted content on encrypted sites with Firefox or a browser equivalent to Firefox.

With the latest Firefox ESR or latest release of firefox, you may block mixed content at about:config. I don't know about earlier versions of FF.

Code:

security.mixed_content.block_display_content : true
security.mixed_content.block_active_content : true

Also two addons add two buttons to easily disable or enable these settings.
https://addons.mozilla.org/en-US/firefox/addon/toggle-mixed-active-content/
https://addons.mozilla.org/en-US/firefox/addon/toggle-mixed-display-content/

An option too up your google account security.

The security question for google, allows you to change it to a custom question.
I took with my lastpass addon and generated a character password with Show advance options ticked, everything ticked to make your password the strongest. Copy generated password, paste as security question.

Go back to generate a new password and generate a new password with highest strength possible, copy and paste for the answer.
Save/update google settings.

Open a secure note for lastpass and keep these two generated password stored under its title question/answer, which is protected by your masterpassword for lastpass.

It's just a blockade against a security question attack on your google account or any other account that has this security question feature.

[bitGun]

great information, thanks!
about the software, what about PASSWORD SAFE?
it's open source and it's  free!

[apsvinet]

Me gusta this thread.
Thanks for the advice op, bookmarked this thread.

[khalilhimura]

Thanks OP for the great info. Was looking for tips on security. PGP was on my to do list

[LuckyBtc]

Thanks for sharing this usefull info