please stop using the bitcoin client on your home computers to store your BTC

[Tasty Champa]

*This isn't intended for security experts
**rant alert!

It was great in the beginning, the client was bitcoin's harbinger,
but now it's a completely new game that requires a level of security,
that isn't here or foreseeable yet. It's talked about, but it's still far away.

Out of maybe 20-40 issues I've seen since signing up to this forum the people with the most bitcoins lost due to theft, computer or even user failure was from running the client.

The real options right now that is not widely spread to new people, and is actually turning people away is not knowing to entrust your stake with an exchange or online wallet.
The people that run exchanges and online wallets have so much more to lose than you, so please use them.

If their site goes down, their business goes down, therefore the site being up and secure is of the utmost importance to them. This can be relied on, as trust and security is interdependent to them. If one is lost the other is taken for as long as the imbalance is happening.

Remember to do your own research into this.
If running the client is the most secure method for your situation, and you are not at Mensa level, I'm the only person telling you to reflect on this rant. I don't like seeing people pissed off, confused and just being kind of hateful and hugely skeptical toward and of one another. 

So, if after all the research you have done, all of this is still becoming way to daunting for you, use an exchange or online wallet. You will feel so much better having that layer of detachment and you might even notice no transaction fees. After that all you have to really be mindful of is managing all of your passwords, and the computer you are using.

/end of line

[1715487846]

1715487846

[1715487846]

1715487846

[1715487846]

1715487846

[SmokeAndMirrors]

I can take care of myself, thank you very much. Last time I checked, public websites/servers are the least secure places on the internet aside from people who link surf. Remember MTGox incident?

[coingenuity]

As a bitcoin web service developer/service provider: I wouldn't have a problem with this for the average end user, were it for one simple fact. Wallet providers don't consistently enough route the outbound address of a user back to that user's account. Most bitcoin-related services require an original client that will give users access to any bitcoin generated by the service, so until it becomes industry standard with wallet operators to route payments from outbound addresses back to the account they originated from, I won't be supporting them.

[EricJ2190]

As a bitcoin web service developer/service provider: I wouldn't have a problem with this for the average end user, were it for one simple fact. Wallet providers don't consistently enough route the outbound address of a user back to that user's account. Most bitcoin-related services require an original client that will give users access to any bitcoin generated by the service, so until it becomes industry standard with wallet operators to route payments from outbound addresses back to the account they originated from, I won't be supporting them.

I am pretty sure that "most bitcoin-related services" work just as well with an e-wallet. Some services like BitLotto and your RaffleBit don't, but none that I have used. In fact, those are the only two I can name of the top of my head.

[ctoon6]

storing your own BTC in a wallet you made on a computer not connected to the net, ie the ubuntu live cd method, you are almost guaranteed to not get your coins stolen. as soon as we get the ability to export private keys easily, we will even be able to print them out and be able to realistically type them back into the computer.

[bitprotection]

At the end of the day it's going to come down to trust with whomever you use.

We just opened today http://bitprotection.info  we provide a backup solution for peoples wallet's.  If you loose your wallet the game is over. We saw this happening to much and figured at some point someone has to step in and try to offer a way to help people protect what they own. We can't stop stolen coins but we can sure help protect your Bitcoin Wallet 

[ttk2]

What we need for this situation is actually quite simple to make. Take chromium OS, package in a headers only Bitcoin client and a strong encryption program. Create two partitions, one for chromium OS the other for wallet storage, the wallet storage partition is of course encrypted. This entire setup can fit on a small flash drive, and can easily be made into a simple 'Create secure Bitcoin flash drive' program that even a monkey could use (insert flash drive, press button) To make it even simpler you could sell Flash drives pre installed with this software.  on first boot the user will chose his password and the encrypted volume will be created. I think chromium OS (or something similar) is best suited for this task for a few reasons.

1) Its lunix based, and as such brings with it a measure of security.
2) It is bare bones, totally lacking anything but a web browser, this may hinder the porting of the Bitcoin client, but it will help security, less programs mean less potential holes.
3) Its fast to start (even off of a old flash drive on a slow machine less than 10 seconds) people do not want to spend 10 minutes just waiting for a single purpose system to boot.
4) Google has already coded the OS to preform a self check on start up and restore it self to a original state if unauthorized changes are made, this is an excellent anti-virus move since all user data is in the encrypted wallet partition
5) Its already mostly coded and its open source, making this task an approachable one, if still difficult.   



I think this would be the best approach for the creation of a secure, fast, and simple environment to store and handle Bitcoins.

[foggyb]

I agree with OP.

Until someone creates a drop-dead easy app that does all the exciting stuff in the previous post, there will continue to be a stream of incidents of mainstream users' bitcoin wallets being compromised by hackers & trojans.

[ctoon6]

What we need for this situation is actually quite simple to make. Take chromium OS, package in a headers only Bitcoin client and a strong encryption program. Create two partitions, one for chromium OS the other for wallet storage, the wallet storage partition is of course encrypted. This entire setup can fit on a small flash drive, and can easily be made into a simple 'Create secure Bitcoin flash drive' program that even a monkey could use (insert flash drive, press button) To make it even simpler you could sell Flash drives pre installed with this software.  on first boot the user will chose his password and the encrypted volume will be created. I think chromium OS (or something similar) is best suited for this task for a few reasons.

1) Its lunix based, and as such brings with it a measure of security.
2) It is bare bones, totally lacking anything but a web browser, this may hinder the porting of the Bitcoin client, but it will help security, less programs mean less potential holes.
3) Its fast to start (even off of a old flash drive on a slow machine less than 10 seconds) people do not want to spend 10 minutes just waiting for a single purpose system to boot.
4) Google has already coded the OS to preform a self check on start up and restore it self to a original state if unauthorized changes are made, this is an excellent anti-virus move since all user data is in the encrypted wallet partition
5) Its already mostly coded and its open source, making this task an approachable one, if still difficult.   



I think this would be the best approach for the creation of a secure, fast, and simple environment to store and handle Bitcoins.

The main problem with that is, how to teach people to boot a flash drive on a computer. its not even a simple task for even tech people that fix computers. the main problem is that almost every motherboard does it differntly. on 3 of my computers heres how i do it

1: i go into the boot menu and set the flash drive to #1
2: push f12 while booting up and select the flash drive
3: is not able to boot from flash.

I do love the idea though.

As i said in countless other threads, we need specific bitcoin hardware, weather it be a bitcoin certified sticker on cheap laptops, bitcoin credit cards with all the hardware needed on them or even smartphone sized bitcoin devices, or smartphones themselves branded as bitcoin certified.

If we had enough capital, we could buy like 10 of these http://www.newegg.com/Product/Product.aspx?Item=N82E16834215131 and reformat them and install only the stuff required to have a dedicated bitcoin machine that will only have bitcoin installed. it would also only allow bitcoin related connections so it would be secure against common attacks.

[ttk2]

What we need for this situation is actually quite simple to make. Take chromium OS, package in a headers only Bitcoin client and a strong encryption program. Create two partitions, one for chromium OS the other for wallet storage, the wallet storage partition is of course encrypted. This entire setup can fit on a small flash drive, and can easily be made into a simple 'Create secure Bitcoin flash drive' program that even a monkey could use (insert flash drive, press button) To make it even simpler you could sell Flash drives pre installed with this software.  on first boot the user will chose his password and the encrypted volume will be created. I think chromium OS (or something similar) is best suited for this task for a few reasons.

1) Its lunix based, and as such brings with it a measure of security.
2) It is bare bones, totally lacking anything but a web browser, this may hinder the porting of the Bitcoin client, but it will help security, less programs mean less potential holes.
3) Its fast to start (even off of a old flash drive on a slow machine less than 10 seconds) people do not want to spend 10 minutes just waiting for a single purpose system to boot.
4) Google has already coded the OS to preform a self check on start up and restore it self to a original state if unauthorized changes are made, this is an excellent anti-virus move since all user data is in the encrypted wallet partition
5) Its already mostly coded and its open source, making this task an approachable one, if still difficult.   



I think this would be the best approach for the creation of a secure, fast, and simple environment to store and handle Bitcoins.

The main problem with that is, how to teach people to boot a flash drive on a computer. its not even a simple task for even tech people that fix computers. the main problem is that almost every motherboard does it differntly. on 3 of my computers heres how i do it

1: i go into the boot menu and set the flash drive to #1
2: push f12 while booting up and select the flash drive
3: is not able to boot from flash.

I do love the idea though.

As i said in countless other threads, we need specific bitcoin hardware, weather it be a bitcoin certified sticker on cheap laptops, bitcoin credit cards with all the hardware needed on them or even smartphone sized bitcoin devices, or smartphones themselves branded as bitcoin certified.

If we had enough capital, we could buy like 10 of these http://www.newegg.com/Product/Product.aspx?Item=N82E16834215131 and reformat them and install only the stuff required to have a dedicated bitcoin machine that will only have bitcoin installed. it would also only allow bitcoin related connections so it would be secure against common attacks.

I know its not perfect, but i think its the best security/ease of use ratio we are going to get without dedicated devices (which i agree are needed, but may be a while coming, and even then this approach will have advantages) it could be set up so that if you plug it in while in windows a box will pop up telling you you need to reboot the computer with the drive inserted, and a nice big button saying "help me use ChromeCoin" that would place a boot loader entry that pointed to the drive, yes it would be annoying and a little heavy handed, but certainly simple enough.

[Tasty Champa]

I can take care of myself, thank you very much. Last time I checked, public websites/servers are the least secure places on the internet aside from people who link surf. Remember MTGox incident?

I was.
I even skim over the threads with the few people who have still not reclaimed their accounts and stolen funds before the fiasco to see how they are coming along, some have and some haven't.

That time delayed swift kick in the ass, hurt them quite a bit with reputation. However it indeed made them much more resilient. As well as upping the bar on security across the entire board, so much so that some exchanges use that utmost important factor of security as their main selling point.
We don't see those inquisition/crusades threads anymore toting a raging boner for full disclosure either.

It sounds like you have your area covered, been around long enough, so my best guess it that this thread isn't really for you.

[luv2drnkbr]

LOL seriously!?  Thread about security:  don't learn about security, just give your money to other people.

Great security advice right there.

Don't think, let us do the thinking for you.  We're the ones who have a vested interest in thinking, not you.  Why should you think?  Do you really NEED to think to get by when I could just think FOR you?

Do you see how absurd that is?

[Tasty Champa]

LOL seriously!?  Thread about security:  don't learn about security, just give your money to other people.

Great security advice right there.

Don't think, let us do the thinking for you.  We're the ones who have a vested interest in thinking, not you.  Why should you think?  Do you really NEED to think to get by when I could just think FOR you?

Do you see how absurd that is?

It's the ratio of mortality between airplane to car travel.

[joepie91]

The real options right now that is not widely spread to new people, and is actually turning people away is not knowing to entrust your stake with an exchange or online wallet.
The people that run exchanges and online wallets have so much more to lose than you, so please use them.

If their site goes down, their business goes down, therefore the site being up and secure is of the utmost importance to them. This can be relied on, as trust and security is interdependent to them. If one is lost the other is taken for as long as the imbalance is happening.

Yes, that worked out so well with Mt. Gox and MyBitcoin.

[Vod]

How do we delete posts we created by accident?

[Tasty Champa]

The real options right now that is not widely spread to new people, and is actually turning people away is not knowing to entrust your stake with an exchange or online wallet.
The people that run exchanges and online wallets have so much more to lose than you, so please use them.

If their site goes down, their business goes down, therefore the site being up and secure is of the utmost importance to them. This can be relied on, as trust and security is interdependent to them. If one is lost the other is taken for as long as the imbalance is happening.

Yes, that worked out so well with Mt. Gox and MyBitcoin.

I don't know the full story with mybitcoin, but when I got back into my mtgox account, everything was still there.

[pennytrader]

Agreed with OP.

I stored most of my funds in mtgox (and some in tradehill). Yes, I'm aware of the past incident. But my friend got all his money/BTC back from mtgox. And it's the biggest exchange, I believe they will recover all your funds for any mistakes/incidents related to their operations.

[triforcelink]

I hate to say it, but at this point in time I trust MtGox more than I trust Windows and my own competence to handle any decent amount of bitcoins.

[spruce]

You can always use a paper bitcoin wallet from someone like Casascius. I would rather trust him to have done it right and not kept a copy than trust my ability to keep the wallet secure on my own computer. You can also encode the private key(s) easily by hand in a totally unbreakable fashion so that you can leave the (encoded) private key lying around and it is not unsafe — see SpruceCodes link in my signature for details.

[CurbsideProphet]

Storing a decentralized currency on a centralized database (exchange, eWallet, whatever).  How ironic.

[Tasty Champa]

Storing a decentralized currency on a centralized database (exchange, eWallet, whatever).  How ironic.

Is storing "decentralized currency in a centralized database on yr home computer" somehow different though?

You do have an underlying great idea there, one I would really like to see expanded on and in development.
A method of decentralizing a wallet could be perfect. AFAIK that doesn't exist yet, I don't follow much of the development however. (I'm not a developer so it's not really my place to try pushing ideas too them until I can come up with something they don't know they need. One day I would like to be a part of it somehow even if it's just usability. I'm great with usability.)

Certainly good practice, not keeping all of your eggs in one basket.
Something I should add to the rant if I edit it, thanks for that.

[spruce]

A method of decentralizing a wallet could be perfect. AFAIK that doesn't exist yet, I don't follow much of the development yet.

A paper bitcoin wallet doesn't exist on your home computer. Your money would really only exist in the block chain, which is decentralized. The private key would not be decentralized, of course, assuming you didn't want everyone to be able to spend your coins.

[smoothie]

*This isn't intended for security experts
**rant alert!

It was great in the beginning, the client was bitcoin's harbinger,
but now it's a completely new game that requires a level of security,
that isn't here or foreseeable yet. It's talked about, but it's still far away.

Out of maybe 20-40 issues I've seen since signing up to this forum the people with the most bitcoins lost due to theft, computer or even user failure was from running the client.

The real options right now that is not widely spread to new people, and is actually turning people away is not knowing to entrust your stake with an exchange or online wallet.
The people that run exchanges and online wallets have so much more to lose than you, so please use them.

If their site goes down, their business goes down, therefore the site being up and secure is of the utmost importance to them. This can be relied on, as trust and security is interdependent to them. If one is lost the other is taken for as long as the imbalance is happening.

Remember to do your own research into this.
If running the client is the most secure method for your situation, and you are not at Mensa level, I'm the only person telling you to reflect on this rant. I don't like seeing people pissed off, confused and just being kind of hateful and hugely skeptical toward and of one another. 

So, if after all the research you have done, all of this is still becoming way to daunting for you, use an exchange or online wallet. You will feel so much better having that layer of detachment and you might even notice no transaction fees. After that all you have to really be mindful of is managing all of your passwords, and the computer you are using.

/end of line

OR just backup your damn wallet and sleep at peace.

[Tasty Champa]

*This isn't intended for security experts
**rant alert!

It was great in the beginning, the client was bitcoin's harbinger,
but now it's a completely new game that requires a level of security,
that isn't here or foreseeable yet. It's talked about, but it's still far away.

Out of maybe 20-40 issues I've seen since signing up to this forum the people with the most bitcoins lost due to theft, computer or even user failure was from running the client.

The real options right now that is not widely spread to new people, and is actually turning people away is not knowing to entrust your stake with an exchange or online wallet.
The people that run exchanges and online wallets have so much more to lose than you, so please use them.

If their site goes down, their business goes down, therefore the site being up and secure is of the utmost importance to them. This can be relied on, as trust and security is interdependent to them. If one is lost the other is taken for as long as the imbalance is happening.

Remember to do your own research into this.
If running the client is the most secure method for your situation, and you are not at Mensa level, I'm the only person telling you to reflect on this rant. I don't like seeing people pissed off, confused and just being kind of hateful and hugely skeptical toward and of one another. 

So, if after all the research you have done, all of this is still becoming way to daunting for you, use an exchange or online wallet. You will feel so much better having that layer of detachment and you might even notice no transaction fees. After that all you have to really be mindful of is managing all of your passwords, and the computer you are using.

/end of line

OR just backup your damn wallet and sleep at peace.

...still requires running the client.

[Tasty Champa]

A method of decentralizing a wallet could be perfect. AFAIK that doesn't exist yet, I don't follow much of the development yet.

A paper bitcoin wallet doesn't exist on your home computer. Your money would really only exist in the block chain, which is decentralized. The private key would not be decentralized, of course, assuming you didn't want everyone to be able to spend your coins.

From what I gather that is a long term storage solution with not so much in usability correct?

[nmat]

I hate to say it, but at this point in time I trust MtGox more than I trust Windows and my own competence to handle any decent amount of bitcoins.

This.

Well, I don't consider it a valid point for myself, but if bitcoins' userbase grows (i.e. if people that don't know what RSS is join the movement), wallets are much more secure at some server than they are at people's computer. Most people don't know what encryption is, they don't know anything about securing a file and there is at least one type of virus/malware/spyware happily living in their windows computer.

[spruce]

A method of decentralizing a wallet could be perfect. AFAIK that doesn't exist yet, I don't follow much of the development yet.

A paper bitcoin wallet doesn't exist on your home computer. Your money would really only exist in the block chain, which is decentralized. The private key would not be decentralized, of course, assuming you didn't want everyone to be able to spend your coins.

From what I gather that is a long term storage solution with not so much in usability correct?

Correct, right now.

I believe that version 4 of the client will include the ability to import and export private keys, though.

[ctoon6]

Correct, right now.

I believe that version 4 of the client will include the ability to import and export private keys, though.

they need to hurry up, this is really the only feature i want except encryption and the ability to have the default bitcoin gui connect to a remote server with a wallet file.

[CurbsideProphet]

Storing a decentralized currency on a centralized database (exchange, eWallet, whatever).  How ironic.

Is storing "decentralized currency in a centralized database on yr home computer" somehow different though?

You do have an underlying great idea there, one I would really like to see expanded on and in development.
A method of decentralizing a wallet could be perfect. AFAIK that doesn't exist yet, I don't follow much of the development however. (I'm not a developer so it's not really my place to try pushing ideas too them until I can come up with something they don't know they need. One day I would like to be a part of it somehow even if it's just usability. I'm great with usability.)

Certainly good practice, not keeping all of your eggs in one basket.
Something I should add to the rant if I edit it, thanks for that.

Yes, it's quite different.  No one else is storing their wallet on my computer, just me.  If my computer is compromised, then my security is compromised.  No one else.  It's decentralized.  MtGox is compromised and thousands of users and their personal information is compromised.  It has already happened.

[Tasty Champa]

Storing a decentralized currency on a centralized database (exchange, eWallet, whatever).  How ironic.

Is storing "decentralized currency in a centralized database on yr home computer" somehow different though?

You do have an underlying great idea there, one I would really like to see expanded on and in development.
A method of decentralizing a wallet could be perfect. AFAIK that doesn't exist yet, I don't follow much of the development however. (I'm not a developer so it's not really my place to try pushing ideas too them until I can come up with something they don't know they need. One day I would like to be a part of it somehow even if it's just usability. I'm great with usability.)

Certainly good practice, not keeping all of your eggs in one basket.
Something I should add to the rant if I edit it, thanks for that.

Yes, it's quite different.  No one else is storing their wallet on my computer, just me.  If my computer is compromised, then my security is compromised.  No one else.  It's decentralized.  MtGox is compromised and thousands of users and their personal information is compromised.  It has already happened.

I don't want to pick apart your argument on semantics, but the basic idea I am trying to convey is safety in numbers.
Indications do point to Mt Gox having been infiltrated days before the sell off, however once they were able to realize what happened, that the threat was indeed real. They did immediately issue a statement that they were in fact compromised. We really were lucky to get that upfront approach so quickly. Most of us did have strong passwords, so that list wouldn't have been completed until months later of 24/7 FPGA cracking, and yes I do agree with you it was fucked up. First time anything like that had ever happened to me, to my knowledge at least.

However, the affect of which raised the entire baseline to the utmost importance of user-base integrity.
That's why I do feel we can begin trusting again. Not an absolute trust, but a healthy & justifiable trust.
Sounds like you have a well thought out approach, the people I'm trying to reach with this thread is those that really feel an unhealthy anxiety about bitcoin in general. I'm telling them that they really don't have to feel that way.

[elggawf]

Numbers also means a juicier target. There is no safety in numbers in terms of internet security.

[tvbcof]

I have to be honest and admit that I am delighted that wallet.dat files are being stolen.  It introduces a very valuable element into the mix that one would need to consider when tracking transaction paths.  I hope that it continues at a level which provides some utility over time.

[jackjack]

Correct, right now.

I believe that version 4 of the client will include the ability to import and export private keys, though.

they need to hurry up, this is really the only feature i want except encryption and the ability to have the default bitcoin gui connect to a remote server with a wallet file.

You might take a look at my pywallet fork ( http://github.com/jackjack-jj/pywallet ), which can import/export keys, even hidden ones, with labels
It's highly based on Joric's work http://github.com/joric/pywallet

[joepie91]

Agreed with OP.

I stored most of my funds in mtgox (and some in tradehill). Yes, I'm aware of the past incident. But my friend got all his money/BTC back from mtgox. And it's the biggest exchange, I believe they will recover all your funds for any mistakes/incidents related to their operations.

Evidently not. I was told very clearly that I would not be reimbursed.