Bitcoin Forum
June 22, 2024, 06:35:26 AM *
News: Voting for pizza day contest
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: Importance of clean install on the offline machine?  (Read 1058 times)
CBit (OP)
Newbie
*
Offline Offline

Activity: 14
Merit: 0


View Profile
April 06, 2013, 12:56:27 PM
Last edit: April 06, 2013, 05:06:35 PM by CBit
 #1

Hey!

I've read that you recommend doing a clean install of the OS on the offline machine. Why is that? I understand that a computer once connected to the internet may be infected by malware and that that can fuck up it, including the Armory software, but does it pose threat to the coins if they are backuped on paper?

I have an old computer that I'd like to use as an offline wallet. Windows was reinstalled on it some time ago and it was connected to internet after that only for a short period - in essence, it is highly unlikely that it is infected. I do realize a virus can be there. But with paper backup, will the coins themselves be safe?

Thanks!
etotheipi
Legendary
*
Offline Offline

Activity: 1428
Merit: 1093


Core Armory Developer


View Profile WWW
April 06, 2013, 06:40:17 PM
 #2

Hey!

I've read that you recommend doing a clean install of the OS on the offline machine. Why is that? I understand that a computer once connected to the internet may be infected by malware and that that can fuck up it, including the Armory software, but does it pose threat to the coins if they are backuped on paper?

I have an old computer that I'd like to use as an offline wallet. Windows was reinstalled on it some time ago and it was connected to internet after that only for a short period - in essence, it is highly unlikely that it is infected. I do realize a virus can be there. But with paper backup, will the coins themselves be safe?

Thanks!

In terms of safety of your coins, it's more of how many 9's do you want on your 99.999...% security.  A machine that was not previously used for Bitcoin and then is disonnected and starts being used is far less vulnerable than one that stays online.  But there's no guarantee it didn't pick up some nasty Bitcoin virus that knows how to shuttle data off the system, or compromised your random number generator so an attacker can produce the same wallet your machine does.  These things are tiny for someone holding $500 in BTC, but an unnecessary risk for someone holding $100k.  

The paper backup doesn't add security from people attacking the machine.  It prevents you from losing your coins if your computer is lost, hard-drive crashes, or you forget your passphrase.  If someone compromises the offline computer they can still take your coins, and by the time you notice it, it will be too late, regardless of whether you have the paper backup.

Founder and CEO of Armory Technologies, Inc.
Armory Bitcoin Wallet: Bringing cold storage to the average user!
Only use Armory software signed by the Armory Offline Signing Key (0x98832223)

Please donate to the Armory project by clicking here!    (or donate directly via 1QBDLYTDFHHZAABYSKGKPWKLSXZWCCJQBX -- yes, it's a real address!)
CBit (OP)
Newbie
*
Offline Offline

Activity: 14
Merit: 0


View Profile
April 07, 2013, 12:36:29 PM
 #3

Thanks for the reply, I was hoping you specificly would answer to get the best explanation - which I got Smiley

I understand now. I have another computer that I think has not been in internet in years - meaning, the last time it was online was probably before Bitcoin. I think I'll go with that and see later if reinstall would add some security.

One more question: is there a way to replace the USB-transfer with paper or something like that? Like, print or something the transaction details and then manually add them to the offline machine for signing? I realize this would be quite tedious and I'm definitely not planning on doing it for my small savings, but just wondering in general. That'd be 100% secure against any spyware threat, I suppose.
Dabs
Legendary
*
Offline Offline

Activity: 3416
Merit: 1912


The Concierge of Crypto


View Profile
May 07, 2013, 07:12:00 AM
 #4

Here's what you would do for a complete re-install of whatever OS.

1. Download your OS. (Windows, Linux, whatever). Usually it is an .ISO file that you burn to CD / DVD / USB
2. Get the SHA or MD5 of the ISO file from your trusted source.
3. Verify that your ISO hash is the same. Then burn the CD / DVD.
4. Wipe your computer clean. Use DBAN or some other wiping software. Zero it.
5. Install your OS.

For Linux, most distributions have an ISO ready to use with published SHA or MD5. If you don't know how to use this, just google it. You'll know how in 5 minutes.

For Windows, Microsoft publishes their SHA or MD5 hash on their website too. Helpful if you are MSDN subscriber, or some how got the ISO from somewhere else.

I personally use a non-standard XP installation, but I always verify the hash.

keewee
Legendary
*
Offline Offline

Activity: 1025
Merit: 1000



View Profile
May 07, 2013, 08:14:58 AM
Last edit: May 07, 2013, 08:30:47 AM by keewee
 #5

This is exactly the question I was just considering. Further to the OP I was also wondering how to ensure the security of the offline computer assuming the attacker has physical access to it. There must be occasional updates for any OS to patch vulnerabilities that allow an attacker to compromise the machine at login, at bootup, or perhaps through booting off another live CD.

I have encrypted the filesystem but without going online I don't see there is an easy way to keep the OS up to date. What I have done is to install from a recent distro, then immediately go online to install the latest updates, without performing any other online activity, then disconnecting the network. I would think this would be acceptable to do on an infrequent basis.

How is this normally treated? What do you recommend?


1keewee2vRp63UWvPBynT55ZYw6SUCKDB
Dabs
Legendary
*
Offline Offline

Activity: 3416
Merit: 1912


The Concierge of Crypto


View Profile
May 07, 2013, 08:44:59 AM
 #6

Once offline, you never connect it to the internet. Ever.

If the attacker has physical access to it, your coins can be stolen, unless you use whole drive encryption like TrueCrypt and use a strong and long password (20+ characters).

It's supposed to be offline. Never connected. You don't need updates, since no other person will be using this offline computer except you.

Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!