Do you REALLY trust hardware wallets?

[bob123]

MEW is not secured as you think every time you open your MEW wallet you need to copy paste your private key from time to time to open your wallet online. So if your computer is infected with malware and viruses any time soon thief can get your copy pasted private key history and stole all of your altcoins and ERC20 token.

MEW is just as secured as any other online wallet is (wether it is blockchain.info, coinbase, etc..  doesnt matter).
With an compromised PC the only (relatively) secure way of accessing coins is to use a hardware wallet.
I would never consider to use a web- or desktop wallet on an infected PC.

[1715165215]

1715165215

[1715165215]

1715165215

[1715165215]

1715165215

[1715165215]

1715165215

[1715165215]

1715165215

[Commie]

Can't see it posted here before, so read and think - https://krebsonsecurity.com/wp-content/uploads/2018/03/ledgerattack.pdf

There was a whole thread devoted to it here: https://bitcointalk.org/index.php?topic=3167854.0 (including a link to the original blog post by the original author Saleem Rashid)

In any case, the vulnerability has been patched according to Ledger as of the latest firmware. Again, it just highlights the fact that NO solution is 100% secure...

Thanks for pointing out the right thread to me. Time to do more reading on the subject

[carlfebz2]

MEW is not secured as you think every time you open your MEW wallet you need to copy paste your private key from time to time to open your wallet online. So if your computer is infected with malware and viruses any time soon thief can get your copy pasted private key history and stole all of your altcoins and ERC20 token.

MEW is just as secured as any other online wallet is (wether it is blockchain.info, coinbase, etc..  doesnt matter).
With an compromised PC the only (relatively) secure way of accessing coins is to use a hardware wallet.
I would never consider to use a web- or desktop wallet on an infected PC.

This is why having a clean PC will always be the main priority.Even I is really careful when it comes to security and cleanliness/malware-free of my own computer yet informations is store mostly in here.Files and other documentations. To avoid such malware risk,Install anti virus, don't download random things on the net, active updates both OS and AV itself then just sit and relax.You would be confident on making any transactions if you do know that you are not prone on such risk.

[Spendulus]

.....To avoid such malware risk,Install anti virus, don't download random things on the net, active updates both OS and AV itself then just sit and relax.You would be confident on making any transactions if you do know that you are not prone on such risk.

Much easier is to simply take the PC and delete email and web browsers.

That will leave the machine capable of operating system and AV updates, but will eliminate most routes of infection.

[bob123]

Much easier is to simply take the PC and delete email and web browsers.
That will leave the machine capable of operating system and AV updates, but will eliminate most routes of infection.

Or (to get back to topic): Just use a hardware wallet.
This does not require to remove the most used (and probably most needed) software on a pc.

A pc without browser/email/etc..  is a neither a cold storage nor an online pc someone wants to use.

[Spendulus]

Much easier is to simply take the PC and delete email and web browsers.
That will leave the machine capable of operating system and AV updates, but will eliminate most routes of infection.

Or (to get back to topic): Just use a hardware wallet.
This does not require to remove the most used (and probably most needed) software on a pc.

A pc without browser/email/etc..  is a neither a cold storage nor an online pc someone wants to use.

Wrong.

A pc without browser or email could have private keys stored in 500 locations in a variety of ways. On internal HD, internal SSD, etc.

Clearly it is cold storage.

An "online pc someone wants to use" is exactly what you don't want it to be.

[gentlemand]

Wrong.

A pc without browser or email could have private keys stored in 500 locations in a variety of ways. On internal HD, internal SSD, etc.

Clearly it is cold storage.

An "online pc someone wants to use" is exactly what you don't want it to be.

If there's the tiniest hint of online accessibility then surely it's not cold.

Ccleaner was recently compromised. As far as I know they couldn't do much, but even with email and browser removed, there are still hundreds to thousands of programs and processes talking via the internet that someone may find a back door into.

We never find out until after the act.

[Aura]

I don't really trust hardware wallets, that's why I don't own one. My main reason is the lack of open-source for example, Ledger wallet is only partial open-source. That means that there is still some code running on the hardware that you can't verify. Besides that, they are quite expensive compared to air-gapped machines that only require an old PC. I have more fate in a computer, without internet capability running a wallet compiled from source (Armory) than pre-configured hardware. Armory allows you to sign transactions on your air-gapped machine and managing your wallet on an online PC without sign access (watching-only).

They certainly add a level of convenience, especially for all of the coins the support.

That's is certainly a benefit for people who store altcoins. But for my personal situation not, as I only store Bitcoin and some Litecoin.

Also, a ledger nano s for example is much cheaper than any laptop/very cheap desktop you'd find, I don't think it's fair to assume that everybody would have an old computer lying around.

Even the old computers that schools have, will run an offline version of Armory. I bet you can get these for less than 10 bucks on a flea market or elsewhere. Also Armory has support for single board computers like the Raspberry Pi, that can be bought for $25. It's a hardware wallet with even better security and validity, but at a fraction of the cost.
.....

Support for Armory has been weak for the OS X for some time, and future support for the MS version is not certain.

However, note that Armory supports regeneration using a keyword sequence. And that page you print out can have an encryption key.
So there is really no reason for the old PC, right?

Yesterday's computers likely will not work on tomorrow's database.

Armory requires a full copy of the CORE database, so the "old PC" will need something > 200 GB available. Since the CORE database is growing, any reasonable projection for the storage needs after say 5 years is what, maybe 500-800 GB?

I was talking about the offline version.
Windows and OSX still have full support for Armory, so I don't get what you're talking about.
Storage for the full blockchain is not that expensive, one terabyte harddrives go for less than $40.

[Spendulus]

I don't really trust hardware wallets, that's why I don't own one. My main reason is the lack of open-source for example, Ledger wallet is only partial open-source. That means that there is still some code running on the hardware that you can't verify. Besides that, they are quite expensive compared to air-gapped machines that only require an old PC. I have more fate in a computer, without internet capability running a wallet compiled from source (Armory) than pre-configured hardware. Armory allows you to sign transactions on your air-gapped machine and managing your wallet on an online PC without sign access (watching-only).

They certainly add a level of convenience, especially for all of the coins the support.

That's is certainly a benefit for people who store altcoins. But for my personal situation not, as I only store Bitcoin and some Litecoin.

Also, a ledger nano s for example is much cheaper than any laptop/very cheap desktop you'd find, I don't think it's fair to assume that everybody would have an old computer lying around.

Even the old computers that schools have, will run an offline version of Armory. I bet you can get these for less than 10 bucks on a flea market or elsewhere. Also Armory has support for single board computers like the Raspberry Pi, that can be bought for $25. It's a hardware wallet with even better security and validity, but at a fraction of the cost.
.....

Support for Armory has been weak for the OS X for some time, and future support for the MS version is not certain.

However, note that Armory supports regeneration using a keyword sequence. And that page you print out can have an encryption key.
So there is really no reason for the old PC, right?

Yesterday's computers likely will not work on tomorrow's database.

Armory requires a full copy of the CORE database, so the "old PC" will need something > 200 GB available. Since the CORE database is growing, any reasonable projection for the storage needs after say 5 years is what, maybe 500-800 GB?

I was talking about the offline version.
Windows and OSX still have full support for Armory, so I don't get what you're talking about.
Storage for the full blockchain is not that expensive, one terabyte harddrives go for less than $40.

Last I heard Goatpig had a buddy who now and then would answer questions or do tech support for OS X ,and he did not have a test machine on which the OS X version of Armory could even be compiled. So as a long time Armory user I can't share your optimism on this eg. "full support."

Now if we can buy 1tb drives for <$40 what does this mean? That the $10 PC no longer does the job....which is what I said...

Regardless, you are still doing it wrong "According to Armory." You print out a paper wallet with their word list and store that.

In five or ten years time there may be expected many changes in wallets and PC operating systems.

[Pattberry]

MEW is just as secured as any other online wallet is (wether it is blockchain.info, coinbase, etc..  doesnt matter).
With an compromised PC the only (relatively) secure way of accessing coins is to use a hardware wallet.
I would never consider to use a web- or desktop wallet on an infected PC.

You cannot anything to an infected PC, even if you connect through hardware wallet and if the system you are using is infected, you will loose your coins, first and foremost learning how to secure your connection is the first job before handling crypto currencies, i do trust hardware wallets than any other form of storage and make sure you connect only to secure system.

[gentlemand]

You cannot anything to an infected PC, even if you connect through hardware wallet and if the system you are using is infected, you will loose your coins, first and foremost learning how to secure your connection is the first job before handling crypto currencies, i do trust hardware wallets than any other form of storage and make sure you connect only to secure system.

Incorrect. That's the whole point of a hardware wallet. Private keys are never exposed to the internet no matter how rancid the machine you connect it to is.

But while connected anything you do on the computer could be compromised. You have to use the hardware wallet's screen to confirm addresses as the computer's wallet app could be showing you false addresses.

[Aura]

I don't really trust hardware wallets, that's why I don't own one. My main reason is the lack of open-source for example, Ledger wallet is only partial open-source. That means that there is still some code running on the hardware that you can't verify. Besides that, they are quite expensive compared to air-gapped machines that only require an old PC. I have more fate in a computer, without internet capability running a wallet compiled from source (Armory) than pre-configured hardware. Armory allows you to sign transactions on your air-gapped machine and managing your wallet on an online PC without sign access (watching-only).

They certainly add a level of convenience, especially for all of the coins the support.

That's is certainly a benefit for people who store altcoins. But for my personal situation not, as I only store Bitcoin and some Litecoin.

Also, a ledger nano s for example is much cheaper than any laptop/very cheap desktop you'd find, I don't think it's fair to assume that everybody would have an old computer lying around.

Even the old computers that schools have, will run an offline version of Armory. I bet you can get these for less than 10 bucks on a flea market or elsewhere. Also Armory has support for single board computers like the Raspberry Pi, that can be bought for $25. It's a hardware wallet with even better security and validity, but at a fraction of the cost.
.....

Support for Armory has been weak for the OS X for some time, and future support for the MS version is not certain.

However, note that Armory supports regeneration using a keyword sequence. And that page you print out can have an encryption key.
So there is really no reason for the old PC, right?

Yesterday's computers likely will not work on tomorrow's database.

Armory requires a full copy of the CORE database, so the "old PC" will need something > 200 GB available. Since the CORE database is growing, any reasonable projection for the storage needs after say 5 years is what, maybe 500-800 GB?

I was talking about the offline version.
Windows and OSX still have full support for Armory, so I don't get what you're talking about.
Storage for the full blockchain is not that expensive, one terabyte harddrives go for less than $40.

Last I heard Goatpig had a buddy who now and then would answer questions or do tech support for OS X ,and he did not have a test machine on which the OS X version of Armory could even be compiled. So as a long time Armory user I can't share your optimism on this eg. "full support."

Now if we can buy 1tb drives for <$40 what does this mean? That the $10 PC no longer does the job....which is what I said...

Regardless, you are still doing it wrong "According to Armory." You print out a paper wallet with their word list and store that.

In five or ten years time there may be expected many changes in wallets and PC operating systems.

There is full support as long as there is someone in the community that can test it, which I'm sure of. You don't have to own a machine with the target OS to compile an executable.

That's right, to have Armory fully up and running you also will need an online machine with quite some disk space. Meaning that the total costs won't be $10, however I was not talking about the full set-up for Armory but just the offline machine only.

I like Armory for it's offline signing feature, which is easy and fast to use and that does not apply for a paper with the word list on it.

[Spendulus]

I don't really trust hardware wallets, that's why I don't own one. My main reason is the lack of open-source for example, Ledger wallet is only partial open-source. That means that there is still some code running on the hardware that you can't verify. Besides that, they are quite expensive compared to air-gapped machines that only require an old PC. I have more fate in a computer, without internet capability running a wallet compiled from source (Armory) than pre-configured hardware. Armory allows you to sign transactions on your air-gapped machine and managing your wallet on an online PC without sign access (watching-only).

They certainly add a level of convenience, especially for all of the coins the support.

That's is certainly a benefit for people who store altcoins. But for my personal situation not, as I only store Bitcoin and some Litecoin.

Also, a ledger nano s for example is much cheaper than any laptop/very cheap desktop you'd find, I don't think it's fair to assume that everybody would have an old computer lying around.

Even the old computers that schools have, will run an offline version of Armory. I bet you can get these for less than 10 bucks on a flea market or elsewhere. Also Armory has support for single board computers like the Raspberry Pi, that can be bought for $25. It's a hardware wallet with even better security and validity, but at a fraction of the cost.
.....

Support for Armory has been weak for the OS X for some time, and future support for the MS version is not certain.

However, note that Armory supports regeneration using a keyword sequence. And that page you print out can have an encryption key.
So there is really no reason for the old PC, right?

Yesterday's computers likely will not work on tomorrow's database.

Armory requires a full copy of the CORE database, so the "old PC" will need something > 200 GB available. Since the CORE database is growing, any reasonable projection for the storage needs after say 5 years is what, maybe 500-800 GB?

I was talking about the offline version.
Windows and OSX still have full support for Armory, so I don't get what you're talking about.
Storage for the full blockchain is not that expensive, one terabyte harddrives go for less than $40.

Last I heard Goatpig had a buddy who now and then would answer questions or do tech support for OS X ,and he did not have a test machine on which the OS X version of Armory could even be compiled. So as a long time Armory user I can't share your optimism on this eg. "full support."

Now if we can buy 1tb drives for <$40 what does this mean? That the $10 PC no longer does the job....which is what I said...

Regardless, you are still doing it wrong "According to Armory." You print out a paper wallet with their word list and store that.

In five or ten years time there may be expected many changes in wallets and PC operating systems.

There is full support as long as there is someone in the community that can test it, which I'm sure of. You don't have to own a machine with the target OS to compile an executable.

That's right, to have Armory fully up and running you also will need an online machine with quite some disk space. Meaning that the total costs won't be $10, however I was not talking about the full set-up for Armory but just the offline machine only.

I like Armory for it's offline signing feature, which is easy and fast to use and that does not apply for a paper with the word list on it.

I'm not here to argue. See bolded above those are easily verified facts.

[Fatunad]

You cannot anything to an infected PC, even if you connect through hardware wallet and if the system you are using is infected, you will loose your coins, first and foremost learning how to secure your connection is the first job before handling crypto currencies, i do trust hardware wallets than any other form of storage and make sure you connect only to secure system.

Incorrect. That's the whole point of a hardware wallet. Private keys are never exposed to the internet no matter how rancid the machine you connect it to is.

But while connected anything you do on the computer could be compromised. You have to use the hardware wallet's screen to confirm addresses as the computer's wallet app could be showing you false addresses.

You are correct.If the address being shown isnt the one which is on hardware wallet then better not to proceed.Its always been good to make any transfer with a clean pc than on risking making any transaction with an infected one.Since the key isnt exposed on the hardware wallet itself but im not really too confident because risk will always be there.

[Aura]

I don't really trust hardware wallets, that's why I don't own one. My main reason is the lack of open-source for example, Ledger wallet is only partial open-source. That means that there is still some code running on the hardware that you can't verify. Besides that, they are quite expensive compared to air-gapped machines that only require an old PC. I have more fate in a computer, without internet capability running a wallet compiled from source (Armory) than pre-configured hardware. Armory allows you to sign transactions on your air-gapped machine and managing your wallet on an online PC without sign access (watching-only).

They certainly add a level of convenience, especially for all of the coins the support.

That's is certainly a benefit for people who store altcoins. But for my personal situation not, as I only store Bitcoin and some Litecoin.

Also, a ledger nano s for example is much cheaper than any laptop/very cheap desktop you'd find, I don't think it's fair to assume that everybody would have an old computer lying around.

Even the old computers that schools have, will run an offline version of Armory. I bet you can get these for less than 10 bucks on a flea market or elsewhere. Also Armory has support for single board computers like the Raspberry Pi, that can be bought for $25. It's a hardware wallet with even better security and validity, but at a fraction of the cost.
.....

Support for Armory has been weak for the OS X for some time, and future support for the MS version is not certain.

However, note that Armory supports regeneration using a keyword sequence. And that page you print out can have an encryption key.
So there is really no reason for the old PC, right?

Yesterday's computers likely will not work on tomorrow's database.

Armory requires a full copy of the CORE database, so the "old PC" will need something > 200 GB available. Since the CORE database is growing, any reasonable projection for the storage needs after say 5 years is what, maybe 500-800 GB?

I was talking about the offline version.
Windows and OSX still have full support for Armory, so I don't get what you're talking about.
Storage for the full blockchain is not that expensive, one terabyte harddrives go for less than $40.

Last I heard Goatpig had a buddy who now and then would answer questions or do tech support for OS X ,and he did not have a test machine on which the OS X version of Armory could even be compiled. So as a long time Armory user I can't share your optimism on this eg. "full support."

Now if we can buy 1tb drives for <$40 what does this mean? That the $10 PC no longer does the job....which is what I said...

Regardless, you are still doing it wrong "According to Armory." You print out a paper wallet with their word list and store that.

In five or ten years time there may be expected many changes in wallets and PC operating systems.

There is full support as long as there is someone in the community that can test it, which I'm sure of. You don't have to own a machine with the target OS to compile an executable.

That's right, to have Armory fully up and running you also will need an online machine with quite some disk space. Meaning that the total costs won't be $10, however I was not talking about the full set-up for Armory but just the offline machine only.

I like Armory for it's offline signing feature, which is easy and fast to use and that does not apply for a paper with the word list on it.

I'm not here to argue. See bolded above those are easily verified facts.

Right.
Armory is in my circumstances the best software wallet available, because I only use Windows and Unix distributions. 

[cashberycoin.com]

So Ledger are releasing a soon to be mandatory update for the Nano S.

The reason is hinted at here - https://twitter.com/spudowiar/status/970977060134023168

I've read elsewhere that physical access is required for any issues so everyone should be fine.

However I can only imagine the amount of problems that pop up will increase as the amount of money lurking on hardware wallets accelerates. The incentives are just too enormous.

I'm nowhere near savvy enough to know whether something is coded well but I have faith in the creators and coders to do their best to stay on top of things, however there's no shortage of dodgy people with matching skills who'll go all out to beat them and it could a finely balanced race.

Will you choose to keep the faith no matter what happens or regress to things like paper wallets if more weirdness emerges?

I am not trust in it, maybe i must create my own wallet, and going to ICO after that ))

[Spazzer]

Times are changing and I think trust in third party programs and software is at an all time low. I would like to see more open sourced projects and Samourai Bitcoin Wallet expand into other areas.

[gentlemand]

Times are changing and I think trust in third party programs and software is at an all time low. I would like to see more open sourced projects and Samourai Bitcoin Wallet expand into other areas.

Lots of people like the idea of open source but really don't walk the walk. They expect others to do the heavy lifting of checking things and them informing them on their behalf. And I am one of them cos I'm clueless.

Samourai wallet does seem to be getting cleverer by the day.

[HCP]

Samourai wallet does seem to be getting cleverer by the day.

Does it still have a limitation on the number of transactions displayed in the transaction history?

Last time I checked, it only displays the 25 most recent transactions and there didn't seem to be a way to either increase this number or show earlier transactions

[gentlemand]

Does it still have a limitation on the number of transactions displayed in the transaction history?

Last time I checked, it only displays the 25 most recent transactions and there didn't seem to be a way to either increase this number or show earlier transactions

Not sure. It's clever. I still wouldn't really call it all that user friendly.

I downloaded and fiddled with it and it didn't feel all that welcoming to me. It's for the crypto warriors. I like cheerful colours and dancing hamsters, me.