That is not paranoid at all, it should be the default operation mode for all the bitcoin users. Encrypting the wallet is the basic stuff and a must. Truecrypt partition complements that well, good reminder.
Ok, so what is paranoid mode then? For true security maniacs?
I did not read the whole thread, but saw a couple of joke answers to this. The truly paranoid will avoid Truecrypt because of the weird license. I am not sure how much encryption actually increases your security. If you decide to encrypt your wallets, you still have to store the (high entropy) pass-phrase somewhere.
The first thing to realize is that you are guarding against two equally devastating losses of Bitcoin: theft and losing the private key. Copying the private key and storing it in a remote location will guard against the second risk, but may increase the first risk. If one location gets raided by police or thieves, it may give you time to spend the compromised coins first, but I would not count on that fact. For Bitcoin there is no deposit insurance to replace your coins in the event of fire: so you really should consider geographically separate storage locations.
If you want to back up to more than 2 locations, consider encrypting the wallet, then splitting the key with
Shamir's Secret Sharing Scheme. If one location is destroyed or compromised (or added), you would regenerate the keys at the remaining locations.
I think it is unrealistic to have a machine that never touched the Internet: but once used as a offline wallet generator, should never touch the Internet again (unless carefully wiped). This implies disconnecting the network, wireless cards, as well as any microphones and sound-cards. If the OS you are using supports autorun, disable it. I recommend choosing a generic live CD you hope does not have a compromised random number generator. You should try to copy all of the tools you need over to the machine when you are initially setting it up: because introducing code later is always a risk.
When printing your paper wallet, try to choose a printer that is as "dumb" as possible. That means no network (wired or wireless). Hard-drives storing every printed document are also a no-no. For printing my vanity addresses, I used a dot-matrix printer with about 32kB of RAM. That RAM gets cleared when the printer is powered off. Newer computers lack the necessary parallel ports though
I should write a guide on how to set up a "secure computer" and post it on my web-site. My only worry is that the NSA or CSEC will then know how to work around my precautions
PS: Don't trust hardware random number generators: run their output trough AES (in CBC mode) with a long key that you then delete.
Note: "high entropy" means never published. The "common crawl" dataset (Text of the Internet!) is about 81TB and freely available on Amazon Web Services (still need to pay Amazon to process it though).
- think about a good, strong password, which is easy to remember (first letters of your all time favarite song)
Those are published on the internet. since most people probably don't have over 5 favorite songs, we are talking 50 bits of entropy, max. Over 64 is better, over 80 should be good, 128 is secure. To guarantee entropy, pass-phrases should be randomly generated.
edit I mis-read that as "first letter of your all time favorite song
s." Make that 20 bits of entropy (max, or about 125,000 songs with 32 variations).
theres no safest wallet if its online , save it in paper or your computer !
And still better in your head!!!
This does not protect against forgotten pass-phrase unless the key is simple enough that it does not protect against wallet theft.
