HOWTO: create a 100% secure wallet

[Crystal Excursion]

I am a PhD scientist and have spent several years translating applied science into protocols for people with minimal training to follow (in pharmaceutical industry). Trust me, it is not easy! One must very specifically define each variable and downstream relationships.

We are at the point where MASSIVE amounts of money WANT to roll in but are afraid of security related issues.

From my interactions, I have concluded that lifetime investors (40-70yrs) old with successful history in the global markets are the key demographic. Guess what, most of them barely know how to send email, but very much realize the growth potential of this thing.

We need a WELL WRITTEN STEP BY STEP MANUAL endorsed by votes!!! and we need it NOW!!!

https://en.bitcoin.it/wiki/Securing_your_wallet

[bitcoindude]

Thanks!

[GooberGoo]

I am a PhD scientist and have spent several years translating applied science into protocols for people with minimal training to follow (in pharmaceutical industry). Trust me, it is not easy! One must very specifically define each variable and downstream relationships.

We are at the point where MASSIVE amounts of money WANT to roll in but are afraid of security related issues.

From my interactions, I have concluded that lifetime investors (40-70yrs) old with successful history in the global markets are the key demographic. Guess what, most of them barely know how to send email, but very much realize the growth potential of this thing.

We need a WELL WRITTEN STEP BY STEP MANUAL endorsed by votes!!! and we need it NOW!!!

While I agree with you that the 40-70 year old demographics are sitting on a huge chunk of $$ AND the fact that they are mostly computer illiterate and have NEVER touched a command line interface before, I doubt you'll see this "dummy-proof manual" written and--more important--widely adopted by this group of folks any time soon. It's simply asking too much for the average folks.

My feeling is that this so-called "theft" (which we have to take at face value since there really is no proof other than one person's claim) may actually be a good thing for bitcoin. After all, necessity is the mother of all invention. This is what I predict will happen:

1) A spawn of third-party brokers/bankers willing to hold your bitcoin deposits for safety. Of course this means sacrificing some level of anonymity but that's the price you pay for security. In addition, there will be a service charge added.

Think of it like this...what if a trusted brick&mortar bank or entity or institution that complied within legal banking laws offered you the ability to deposit your bitcoins? And the only way to withdraw them would be the standard banking authentications of legal ID and PIN number.

In some ways, bitcoins are very similar to an entity like E*Trade where I sign over my actual stock certificate and deposit the shares into my account for trading & safekeeping.

This is a win-win for some, but not for those who want to stay anonymous. Nevertheless, there will be a market for it that fulfills that demographic you mentioned.

2) Third party security consultants who specialize in illustrating that hypothethical "MANUAL" you wish for and possibly taking even further steps & safeguards as well.

3) Other jobs & services & products will be created to get around the high technological barrier of safeguarding your bitcoins....e.g., a book published "Safeguarding bitcons for Dummies" (if it hasn't already been written) and dummyproof it by possibly using non-command line linux or phone apps.

As bitcoins grow in popularity and demand, it will only create more ways to fulfill the needs of the 90% technophobes out there. And in the end, this will be a good thing.

Just my .00000002 BTC worth!
 

[GooberGoo]

We need a WELL WRITTEN STEP BY STEP MANUAL endorsed by votes!!! and we need it NOW!!!

https://en.bitcoin.it/wiki/Securing_your_wallet

While I agree in the content, the point *I think* bitcoindude was making is this:
any time they see command lines, people simply freak out and their brains immediately fallback into MEGO mode (My eyes glaze over). 

Reverse quoting Jerry Maguire:
 "You lost me at command line." 

[cypherdoc]

this thread should resonate with you:

http://forum.bitcoin.org/index.php?topic=15052

i too use VMWare Fusion Win7 guest on a Macbook pro host.  i may have more questions than answers for you but this is what i do:

i have my multiple copies of wallet.dat files on several encrypted Ironkeys spread around geographically.  i use Win7 with the client installed to keep block chain updated for speed.  when i want to update my wallet, i plop the file into the app folder for a short time to update and then immediately move it back to Ironkey.  then i use Eraser to wipe/delete the file in Win7.  i don't browse or email in the VM.  i try to minimize programs i use within the VM.

questions for u:

1.  how do i password access to VMWare Fusion?  looked around but don't see that option.
2.  for the Bitcoin client internet connection i use NAT as i believe this is the most secure vs. bridged or host.  is this true?
3.  is it true if a trojan, virus, or malware gets onto my host Mac side that it would most likely NOT find its way into the VM?
4. i also disabled the Share Folder option to close off a perceived portal.  reasonable?

[abenderlong]

How often should one back up their wallet?

[cypherdoc]

before the completion of 100 transactions.

[bitcoindude]

The "Secure you wallet" wiki is written for someone with 'moderate' (at the very least) understanding of software/hardware. It must be expanded! That document is absolutely critical!!!

[abenderlong]

This isn't exactly relevant, but I'd enjoy someone to explain this to me. I'm on a mac (if that matters) and I'm connected to a mining ip. However, on the site its saying that I'm not connected. I did connect to it with the correct miner and password, and my mining program is displaying my khashes. What's the problem?

[Intertreuton]

Thanks for pointing that out.

[Saint Cad]

There's also another possibility, an off-site whitelist.

Everytime a BTC is spent, it looks off-site at the white-list (encrypted of course) associated with that wallet (default is any transaction is good).  The security is that I must log into the white-list account to change it (so password protected) with confirmation sent to my email (validation).  So now I have 4 wallets used for mining or whatever and one for saving.  On my white-list for the miners the only valid address is my saving account.  My saving account uses the default but only has money in it when it is transferred in to spend.

[bitcoindude]

From the wiki on Securing Your wallet:

"Backup all data (500MB)
Follow these instructions to backup all the bitcoin data (wallet and block chains) to an encrypted disk image.
1.Open Disk Utility
2.Click New Image and choose 500MB, 128-bit or 256-bit (faster or more secure) encryption and single partition.
3. Save it somewhere you won't lose it (like your Dropbox, Strongspace or whatever)
4. Choose a safe and strong password
5. Move everything from ~/Library/Application Support/Bitcoin/ to the image
6. Symlink it back so the app would be able to use it
      ln -s /Volumes/Bitcoin ~/Library/Application Support/Bitcoin
Don't forget to mount your image before using Bitcoin and unmount after quitting it.

Backup just wallet.dat (40MB)
Follow these instructions to backup just the wallet.dat file. This results in a smaller disk image, but it's more complicated to do.
1. Open Disk Utility
2. Click New Image and choose 40MB, 128-bit or 256-bit (faster or more secure) encryption and single partition.
3. Save it somewhere you won't lose it (like your Dropbox, Strongspace or whatever)
4. Choose a safe and strong password
5. Move your wallet.dat file to the image
    Symlink it back so the app would be able to use it
     ln -s /Volumes/Bitcoin/wallet.dat ~/Library/Application Support/Bitcoin/wallet.dat


Can someone elaborate even a little bit on these steps. What is "symlink"?

[osborn_20]

From the wiki on Securing Your wallet:

"Backup all data (500MB)
Follow these instructions to backup all the bitcoin data (wallet and block chains) to an encrypted disk image.
1.Open Disk Utility
2.Click New Image and choose 500MB, 128-bit or 256-bit (faster or more secure) encryption and single partition.
3. Save it somewhere you won't lose it (like your Dropbox, Strongspace or whatever)
4. Choose a safe and strong password
5. Move everything from ~/Library/Application Support/Bitcoin/ to the image
6. Symlink it back so the app would be able to use it
      ln -s /Volumes/Bitcoin ~/Library/Application Support/Bitcoin
Don't forget to mount your image before using Bitcoin and unmount after quitting it.

Backup just wallet.dat (40MB)
Follow these instructions to backup just the wallet.dat file. This results in a smaller disk image, but it's more complicated to do.
1. Open Disk Utility
2. Click New Image and choose 40MB, 128-bit or 256-bit (faster or more secure) encryption and single partition.
3. Save it somewhere you won't lose it (like your Dropbox, Strongspace or whatever)
4. Choose a safe and strong password
5. Move your wallet.dat file to the image
    Symlink it back so the app would be able to use it
     ln -s /Volumes/Bitcoin/wallet.dat ~/Library/Application Support/Bitcoin/wallet.dat


Can someone elaborate even a little bit on these steps. What is "symlink"?

I think is just a reference to another file, almost like a file shortcut in windows. One difference being that symbolic link let you reference directories.

For those of you who know more about bitcoins(am newbie here lol) wouldn't that kind of defeat the purpose of securing the file?. I mean if you are using the bitcoin application the wallet would still have to be loaded into ram, creating another security problem.

If you want to secure your files just encrypt the wallet file with your savings and use another account to use normal transactions.

[linkingnodes]

FIRST OF ALL< SORRY FOR MY ENGLIGH AND THE DISORGANIZED WAY I MAKE THIS POST. LET ME TELL YOU THAT ALL OF YOU ARE REALLY GREAT PEOPLE AND THE SECURITY GUIDE IS REALLY HELPFULL AND ALSO MAKE ME LAUGH A LOT!!!!

I have a question, when you download the bitcoin client within the bootable ubuntu. you only have one address, the one that the client is showing, where do you look for the other 9 addresses? you need to create them with the new button (clcik the new button 9 times) correct? then you need to copy and send them to your email address. then you copy only the wallet.dat file to a cd or usb and secure it .   thats it to create the saving wallet. right?

so the wallet .dat has 10 private keys for your 10 public adresses(keys). there are no more keys. Correct? i mean there is no an overall wallet.dat key, the wallet is only i file where the private keys for each public public adrees (key) is stored. right?

why do you create the other 9 adreeses why not leave only the first adreess the one that appear once you open the bitcoin client and use only that one for the saving wallet? is better to have more adresses?? for security??? for me will be easier only one i prefer not to have to much info.

Also i wanted to mention that i tried the dsl linux but in order to open the bitcoin client you need to download some other packajes ..so even thought is small.. i think is better ubuntu fro newbies like me. as you said before hope someone make a distro for only manage the savings wallet in a bootable setup, will be great.

Finally i would like to know if some of you could advice me about the following config i have been thinking for allowing me to manage bitcion and also allowing me to use online banking in a safe way.  I was thinking about two options or even combine these ptions.


but before giving you the options let me describe my setup. I have a laptop with windows xp, regarding security for windows i really dont care about security on windows i dont have antivirus (i think is a waste of time and cpu spped ) so you could imagine my windows as a really diverse ecosystem. Also the cd drive is not working and the bios doesnt allow me to boot from a usb, only from the network  naaa too much work for a network boot.. so basically i can only boot from the HD. yes i know its a piece of crap but i dont have money to buy a new one!!

so taking into account the above info, i have the following options as i tell you before:

1. make ubuntu accesable from a Virtual machine and install it in my usb, and store within this ubuntu my dayly wallet and also manage my online banking. i could open it from my windows.also allowing this to be a portable wallet.

2. the other choice is to install ubuntu along windows, a dual boot

3. or i could combine this two options and create a 3 wallet system, the savings wallet made with the live cd ubuntu,  an intermediary wallet which will be located in the ubuntu folder within windows (to install ubuntu i have no other choice but to use ubuntu windows installer WUBI, below i will explain more) , and 3 the portable ubuntu- wallet which i can acces form the usb within windows or any other pc. i expend most of the time in windows, so sometimes i would like to use my wallet from windows.

so which of these otions do you recomend? i would like to do the last one but if you think is fine just to install ubuntu on the usb (http://www.pendrivelinux.com/). let me know.

regarding the dual boot (as i told you before i cannot make a partition i can only boot from the HD, and i wont change to ubuntu cause i use protools) the ubuntu windows installation WUBI creates an ubuntu folder in windows, in C:. Within this folder you have a root.disk file which i thing is the important file where the data from ubuntu will be store (https://wiki.ubuntu.com/WubiGuide). So how do i secure this file or better the entire ubuntu folder? i thought about truecrypt, but maybe that will not work cause when i restart the pc and acces ubuntu maybe the files will not be available for running ubuntu since they are encrypted. I was trying to do so.. but i got bored in the middle of the procces i had some alerts and bahh i didnt tried....

also it will be ok if i encrypt the bitcoin folder within ubuntu?? with rgular ubuntu encryption?

regarding the portable ubuntu in the usb... how can i secure the hole system? do i need to encrypt the usb files???

encription only works when you are not using the things encrypted am i ringht?

 so if i use ubuntu from the usb in my computer or other pc, the wallet could be stolen from the windows system while i am running the VM am i right?

how can i use the pendrive ubuntu in any pc without compromising the files i am using in ubuntu?


THANKS I HOPE HAVENT ASKed a lot of stupid STUPID QUESTIONS. if you read all the post i really thank you.




 

[jpp]

here is how I made a safe for my bitcoin and be sure it is readable for several years :
I run live ubuntu
I run bitcoin, note down the bitcoin adress aand the close bitcoin.
I 7z with password the wallet.dat -> the archive is 700Bytes long
I uuencode it ->800byte long
I generate a qrcode of it with qrencode
I print it several time on paper and store it at diferent place
I power off the pc

The password can be told to family member or stored in a safe in a bank (not needed for me, I do not have so much bitoin)

uuencode is needed because qrcode can not store full binary data (in fact it can not store the \0 char)

so I am sure it will be ever readable, qrcode and 7z are well known, uuencode is from the 70's and simple.

[bitcoindude]

I run Mac OS X

I created an encrypted .dmg and copied my entire BAY1/users/me/library/application support/bitcoin folder to the .dmg (mounted of course. Then I deleated the original folder. Next, I copied the bitcoin launch button to the same dmg and clicked. No coins and restart of block connections???

Next, I copied the entire folder back to the original location and clicked the original app launch button. Same effect???

What do I do?

[bitcoindude]

Also, the application was running at the time I did all this???

[osborn_20]

I run Mac OS X

I created an encrypted .dmg and copied my entire BAY1/users/me/library/application support/bitcoin folder to the .dmg (mounted of course. Then I deleated the original folder. Next, I copied the bitcoin launch button to the same dmg and clicked. No coins and restart of block connections???

Next, I copied the entire folder back to the original location and clicked the original app launch button. Same effect???

What do I do?

If your wallet.dat file is encrypted, then i think is safe but maybe the application cant access it, as long as is encrypted.
Decrypt it in a secure system and transfer the amount you want to use to another account, maybe in like a linux based system, then move it to an encrypted volume.

Also you want to be extra paranoid delete your files with a software like active eraser for windows, which makes deleted files unrecoverable from disk. But maybe thats just me who does that .

[cypherdoc]

can u tell me the pathway to the wallet.dat in Ubuntu?

[bitcoindude]

THis all happend while the disk was mounted...