Bitcoin Forum
September 20, 2018, 03:41:41 PM *
News: ♦♦ Bitcoin Core users must update to 0.16.3 [Torrent]. More info.
 
   Home   Help Search Donate Login Register  
Pages: [1] 2 »  All
  Print  
Author Topic: [SECURITY | GUIDE] How to protect your wallets and private keys  (Read 211 times)
Nestade
Full Member
***
Offline Offline

Activity: 308
Merit: 119


alias xuNsh1ne


View Profile WWW
May 30, 2018, 10:05:23 AM
Merited by Zwiebo (3), OmegaStarScream (2), MinoRaiola (1), mole0815 (1), Heisenberg_Hunter (1)
 #1

Hi,

I'd just like to share some suggestions to improve the security of your cold-wallets and private keys.
In general for cold storage wallets only malware could be a real problem and of course losing your wallet data.

1.: Always create a backup of your wallet data - for most wallets there is an option to create a backup.
     If there isn't, you will most likely find the data folder in the appdata directory (type %appdata% into the windows search).
     Store this files on an USB flash drive - DO NOT store it in any cloud! Also always write down your private keys on a paper and store it safely!

2.: If you're using your computer which contains your wallet for everyday activities you may also visit some unknown websites or download things.
     It's always possible to download malware and your antivirus won't detect properly encrypted malicious software. These would be some suggestions on how to bypass this possibility:
     - If you've got an old computer just reformat it and only use it for cryptocurrency-storage and transactions - don't do anything else on this machine
     - Create a new partition on your existing system, install an OS and don't assign it to your main OS - only use it for cryptocurrency-storage and transactions - don't do anything else on this partition.
     - Create a virtual machine, encrypt it (there are many guides on how to encrypt a whole system) and only use it for cryptocurrency-storage and transactions - don't do anything else on this VM.

3.: Usually you should never store your private-keys on your computer. For example IOTA only requires your private-key (seed) to log in to your wallet. However some people may do it anyway and it's really annoying
     always typing your private-key by hand. If you're storing it on your computer you should at least encrypt it. There are tons of ways of doing this (DO NOT use any online-platforms!!!) - however for me the following is
     most preferred.
     Notepad++ (my default editor anyway) offers the possibility of installing plugins. On of those already pre-listed is an encryption plugin. I'll include a short guide on how to do this at the end.

4.: I think it's not really necessary to say, but NEVER tell anyone your private-key and don't send any data files.

5.: You could store your important stuff in an encrypted container. Just inform yourself about recent encryption-software similar to TrueCrypt.

6.: Always keep your operating system up2date - some updates contain security updates or fixes for (critical) exploits

7.: Use a sandbox for running downloaded stuff if the source isn't 100% trustworthy


Now let's come to the promised (short) guide about encrypting your private-key or any other text.

Installing the plugin:
- Download Notepad++ (https://notepad-plus-plus.org/) and install it
- Open Notepad++ go to Plugins > Plugin Manager > Show Plugin Manager
- Select NppCrypt from the list, hit the 'Install' button and allow Notepad++ to restart after installation

Encrypting:
- Now you can enter your text (in this case your private-key or whatever you want to encrypt)
- Select (mark) the text you want to encrypt
- Go to Plugins > NppCrypt > Encrypt
- Optional: Select your preferred cipher and mode
- Enter a password, hit 'OK', confirm your password and hit 'OK' again.
- Your text is now encrypted - now you can safe it.

Decrypting:
- Go to Plugins > NppCrypt > Decrypt
- If you changed cipher and mode you'll have to change it accordingly
- Enter your password and click 'OK'
- Your text is now decrypted
> Make sure to close the tab or re-encrypt before closing Notepad++
> It's always a risk having your private-key in the chache when C&P it; you can erase it from your chache by running the command
Code:
cmd /c “echo off | clip
  in CMD (https://www.howtogeek.com/235101/10-ways-to-open-the-command-prompt-in-windows-10/)

Like I said there are more methods of encryption but at least for me this one is most convenient.
I'm not an expert and this are just some suggestions - you'll most likely have to do some Google-research on some of them.

(Small advise: Antivirus programms may not really help against professional malware but it can provide at least some security against crappy malicious stuff - there's no best antivirus but I'd suggest Malwarebytes: Anti-Malware in combination with the Windows integrated antivirus. However using antivirus software may mislead some people to believe they're completely safe - you should always pay attention to your surf behaviour and be careful about any downloads or fishy stuff)

If you're storing bigger values you should really think about getting a hardware-wallet like the Ledger Nano S or Trezor - it offers the best security you can possibly get at the moment.

Hope there's something useful for you Smiley
Any advice and suggestions will be greatly appreciated!

Best Regards,
Nestade


More Guides (Altcoins included)

MyEtherWallet/Metamask

[GUIDE] Exporting your private-key from ImToken, Jaxx, Eidoo and Parity

[GUIDE] How to import your private-key from another wallet to MEW/MetaMask

[MyEtherWallet] Creating a (new) keystore-file using your private-key


SECURITY

[SECURITY] Generate your secure IOTA-Seed without using insecure online-generators

[GUIDE] How to use MyEtherWallet safely [Security]

[Guide] MyEtherWallet Offline Transactions

OTHER

Increase your internet-speed and your privacy by using Cloudflare's new DNS

1537458101
Hero Member
*
Offline Offline

Posts: 1537458101

View Profile Personal Message (Offline)

Ignore
1537458101
Reply with quote  #2

1537458101
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1537458101
Hero Member
*
Offline Offline

Posts: 1537458101

View Profile Personal Message (Offline)

Ignore
1537458101
Reply with quote  #2

1537458101
Report to moderator
1537458101
Hero Member
*
Offline Offline

Posts: 1537458101

View Profile Personal Message (Offline)

Ignore
1537458101
Reply with quote  #2

1537458101
Report to moderator
princess22
Newbie
*
Offline Offline

Activity: 69
Merit: 0


View Profile
May 30, 2018, 09:05:39 PM
 #2

Thanks for this mate i found sime ides here on how to protect my securities in my wallets.,
Leenkoranan
Newbie
*
Offline Offline

Activity: 59
Merit: 0


View Profile
May 30, 2018, 09:08:02 PM
 #3

Its a big help especially for us newbies  we can achieve some advices,techniques by this,so very much thank you for this kind of matter.
market-beta
Jr. Member
*
Offline Offline

Activity: 280
Merit: 3


View Profile
May 30, 2018, 09:14:30 PM
 #4

I just barely lost my private key. I finally confused and tried my best to find the key. and no results. lucky my wife recorded it in her diary. and finally my private key got me back .if you can save or prin password all the assets we have. to be more secure

    icovo   

████ The World’s First ICO Platform Implementing DAICO  ████
hatshepsut93
Hero Member
*****
Offline Offline

Activity: 910
Merit: 600


Vires in numeris


View Profile
May 30, 2018, 09:22:12 PM
 #5

Those all are good security practices, but the best and the simplest method is to use cold storage - either hardware wallet or dedicated device that is never connected to the Internet to only sign transactions and then broadcast signed transactions from some other device. This is safer because even if you do everything perfectly with your computer, there's always some some chance of getting attacked with some zero-day vulnerability or just doing a mistake, while isolating your private keys from the Internet is extremely secure, airgap-jumping malware is very rare in the wild.

Nestade
Full Member
***
Offline Offline

Activity: 308
Merit: 119


alias xuNsh1ne


View Profile WWW
June 01, 2018, 04:04:21 PM
 #6

Those all are good security practices, but the best and the simplest method is to use cold storage - either hardware wallet or dedicated device that is never connected to the Internet to only sign transactions and then broadcast signed transactions from some other device. This is safer because even if you do everything perfectly with your computer, there's always some some chance of getting attacked with some zero-day vulnerability or just doing a mistake, while isolating your private keys from the Internet is extremely secure, airgap-jumping malware is very rare in the wild.

Hi,

You're completely right Smiley In general I'd always recommend buying a hardware-wallet but for some people a hardware-wallet would be too expensive if they're only storing lower amounts of BTC or cryptocurrencies in general. Also many altcoins aren't supported yet by hardware-wallets so my guide also may apply for other currencies than BTC. Using another (offline) device for signing your transactions would be the most secure alternative to a hardware-wallet I guess.
The best way of storing private-keys would be completely offline on a piece of paper - however I'm sure many people just store their private-keys unencrypted on their PC which is connected to the internet - in this case encryption would at least provide some more security than just storing it in plain text.

I'm not a security-expert and there may be even better methods than mine mentioned in the guide - but I'm sure it's still better than nothing.
Most important is keeping the PC free from malware - and the best protection against malware is not your antivirus but your brain.exe - using a Sandbox is also not a bad idea before executing anything on your PC.
Don't forget: There are exploits to infect PDF-files etc. and your antivirus will most likely fail detecting crypted malware so just be careful about what you download.
Fortunately exploit-kits which provide 0day-exploits to download malware and executing it just by visiting a website are not that common, very expensive and most likely you will never visit any affected website - at least if you're careful... It may still be important to know that even things like this are possible.


carlisle1
Hero Member
*****
Offline Offline

Activity: 896
Merit: 502


★YoBit.Net★ 350+ Coins Exchange & Dice


View Profile
June 01, 2018, 04:15:45 PM
 #7

Wow what a great thread,some of the things mentioned here has just not that crossed my knowledge,thank you so much about this mate,I bookmarked this for future reference because i need to learn many about this

Nestade
Full Member
***
Offline Offline

Activity: 308
Merit: 119


alias xuNsh1ne


View Profile WWW
June 03, 2018, 01:08:05 PM
 #8

Wow what a great thread,some of the things mentioned here has just not that crossed my knowledge,thank you so much about this mate,I bookmarked this for future reference because i need to learn many about this

Thank your very much for your feedback Smiley
Hope you'll find something useful.

You may want to check out this d.tube-Channel:
https://d.tube/#!/c/semperenglish

Well, he's German and he's got a really strong German accent but some of his videos are related to (general) security-stuff and may be really interesting.

Unfortunately his older videos are only available in German but if you understand German I'd really recommend checking out this channel:
d.tube: https://d.tube/#!/c/sempervideo or Youtube: https://www.youtube.com/user/SemperVideo [BOTH GERMAN!]

yazher
Member
**
Offline Offline

Activity: 210
Merit: 16

KryptoSea


View Profile WWW
June 03, 2018, 01:18:05 PM
 #9

Thanks for the Guide Bro, with this we can minimize the risk of being hacked by others. like other hacker trying hard to get our private key info with this help they will have a hard or almost impossible chance to hack us.

Twitter | Facebook | Telegram | Whitepaper
▶▷> KryptoSEA <◁◀
▶▷Your everyday crypto◀
huntingbtc5
Newbie
*
Offline Offline

Activity: 68
Merit: 0


View Profile
June 03, 2018, 03:42:26 PM
 #10

Thanks man, I was looking for this kind of topic in here. Thankfully you have posted it and did a great job explaining it.
johnokeefe09
Newbie
*
Offline Offline

Activity: 112
Merit: 0


View Profile
June 03, 2018, 04:13:20 PM
 #11

Very detailed and step by step guide for protecting wallet. I will surely follow the way you described. Thanks for sharing. Good Luck.
Akorharrison
Jr. Member
*
Offline Offline

Activity: 252
Merit: 2

https://foresting.io/


View Profile
June 03, 2018, 04:23:23 PM
 #12

Nice one this helpful to me, now i can know how to manage my address in terms of security aspect

██    FORESTING     ██
█ next-generation social media service █
based on blockchain technology
etin06
Member
**
Offline Offline

Activity: 280
Merit: 11

The Future of Decentralized Financial Services


View Profile WWW
June 03, 2018, 05:09:25 PM
 #13

Hi,

I'd just like to share some suggestions to improve the security of your cold-wallets and private keys.
In general for cold storage wallets only malware could be a real problem and of course losing your wallet data.

1.: Always create a backup of your wallet data - for most wallets there is an option to create a backup.
     If there isn't, you will most likely find the data folder in the appdata directory (type %appdata% into the windows search).
     Store this files on an USB flash drive - DO NOT store it in any cloud! Also always write down your private keys on a paper and store it safely!

2.: If you're using your computer which contains your wallet for everyday activities you may also visit some unknown websites or download things.
     It's always possible to download malware and your antivirus won't detect properly encrypted malicious software. These would be some suggestions on how to bypass this possibility:
     - If you've got an old computer just reformat it and only use it for cryptocurrency-storage and transactions - don't do anything else on this machine
     - Create a new partition on your existing system, install an OS and don't assign it to your main OS - only use it for cryptocurrency-storage and transactions - don't do anything else on this partition.
     - Create a virtual machine, encrypt it (there are many guides on how to encrypt a whole system) and only use it for cryptocurrency-storage and transactions - don't do anything else on this VM.

3.: Usually you should never store your private-keys on your computer. For example IOTA only requires your private-key (seed) to log in to your wallet. However some people may do it anyway and it's really annoying
     always typing your private-key by hand. If you're storing it on your computer you should at least encrypt it. There are tons of ways of doing this (DO NOT use any online-platforms!!!) - however for me the following is
     most preferred.
     Notepad++ (my default editor anyway) offers the possibility of installing plugins. On of those already pre-listed is an encryption plugin. I'll include a short guide on how to do this at the end.

4.: I think it's not really necessary to say, but NEVER tell anyone your private-key and don't send any data files.

5.: You could store your important stuff in an encrypted container. Just inform yourself about recent encryption-software similar to TrueCrypt.

6.: Always keep your operating system up2date - some updates contain security updates or fixes for (critical) exploits

7.: Use a sandbox for running downloaded stuff if the source isn't 100% trustworthy


Now let's come to the promised (short) guide about encrypting your private-key or any other text.

Installing the plugin:
- Download Notepad++ (https://notepad-plus-plus.org/) and install it
- Open Notepad++ go to Plugins > Plugin Manager > Show Plugin Manager
- Select NppCrypt from the list, hit the 'Install' button and allow Notepad++ to restart after installation

Encrypting:
- Now you can enter your text (in this case your private-key or whatever you want to encrypt)
- Select (mark) the text you want to encrypt
- Go to Plugins > NppCrypt > Encrypt
- Optional: Select your preferred cipher and mode
- Enter a password, hit 'OK', confirm your password and hit 'OK' again.
- Your text is now encrypted - now you can safe it.

Decrypting:
- Go to Plugins > NppCrypt > Decrypt
- If you changed cipher and mode you'll have to change it accordingly
- Enter your password and click 'OK'
- Your text is now decrypted
> Make sure to close the tab or re-encrypt before closing Notepad++
> It's always a risk having your private-key in the chache when C&P it; you can erase it from your chache by running the command
Code:
cmd /c “echo off | clip
  in CMD (https://www.howtogeek.com/235101/10-ways-to-open-the-command-prompt-in-windows-10/)

Like I said there are more methods of encryption but at least for me this one is most convenient.
I'm not an expert and this are just some suggestions - you'll most likely have to do some Google-research on some of them.

(Small advise: Antivirus programms may not really help against professional malware but it can provide at least some security against crappy malicious stuff - there's no best antivirus but I'd suggest Malwarebytes: Anti-Malware in combination with the Windows integrated antivirus. However using antivirus software may mislead some people to believe they're completely safe - you should always pay attention to your surf behaviour and be careful about any downloads or fishy stuff)

If you're storing bigger values you should really think about getting a hardware-wallet like the Ledger Nano S or Trezor - it offers the best security you can possibly get at the moment.

Hope there's something useful for you Smiley
Any advice and suggestions will be greatly appreciated!

Best Regards,
Nestade


More Guides (Altcoins included)

MyEtherWallet/Metamask

[GUIDE] Exporting your private-key from ImToken, Jaxx, Eidoo and Parity

[GUIDE] How to import your private-key from another wallet to MEW/MetaMask

[MyEtherWallet] Creating a (new) keystore-file using your private-key


SECURITY

[SECURITY] Generate your secure IOTA-Seed without using insecure online-generators

[GUIDE] How to use MyEtherWallet safely [Security]

Making offline transactions on MyEtherWallet (official)

OTHER

Increase your internet-speed and your privacy by using Cloudflare's new DNS

Special thanks to you I actually find the write up educative and informative.

▬▬▬ ALREADY WORKING EXCHANGE ▻▻▻ IGT - CRYPTO ◁◁◁50% SOFT CAP COMPLETED▬▬▬
▬▬▬ G I V E A W A Y ETH every week LIFETIME PASSIVE INCOME▬▬▬▬     
▻▻▻WHITE PAPERANN THREAD◁◁◁
oseikuf44
Member
**
Offline Offline

Activity: 280
Merit: 10


View Profile WWW
June 03, 2018, 05:15:50 PM
 #14

A good point for serious cryptocurrency trader is the use of a separate computer or device for storing all your coins without using it for no other activities
cryptorTUX
Member
**
Offline Offline

Activity: 238
Merit: 11


View Profile
June 03, 2018, 05:19:31 PM
 #15

This is really well written theared. No matter that myself and many other people here understand the best practices and know how and what to do many fall behind and forget about them. Thus I truly believe that such articles as this one can have good side effect and actually have an affect on people by reminding them what to do and that they must keep some things secure and private. No matter how many times we tell people they simply forget about few things which is why it is good to remind them in this way. This guide is really great with articles linked at the bottom if the reader is interested to learn more about it.
hatshepsut93
Hero Member
*****
Offline Offline

Activity: 910
Merit: 600


Vires in numeris


View Profile
June 03, 2018, 05:23:56 PM
 #16


I'm not a security-expert and there may be even better methods than mine mentioned in the guide - but I'm sure it's still better than nothing.
Most important is keeping the PC free from malware - and the best protection against malware is not your antivirus but your brain.exe - using a Sandbox is also not a bad idea before executing anything on your PC.



Awareness and carefulness can protect users from common threats, but they can't protect even the most experienced users from zero-day vulnerabilities. For example, nowadays almost every site uses Javascript, and hackers can use it for attacking visitors, so you can get hacked by simply visiting a site. A few months ago there was a vulnerability in popular Bitcoin wallet that allowed malicious sites to steal coins from unsecured wallets. Javascript could also be used to execute Spectre and Meltdown exploits. So, for this and some other reasons, people should avoid storing big amounts of coins on their online machines, it's just an unnecessary risk.

freakcoins
Newbie
*
Offline Offline

Activity: 195
Merit: 0


View Profile
June 06, 2018, 06:56:36 AM
 #17

I just barely lost my private key. I finally confused and tried my best to find the key. and no results. lucky my wife recorded it in her diary. and finally my private key got me back .if you can save or prin password all the assets we have. to be more secure
I actually do that mate i wrote also my personal files at my notebook,.because accidentally ny childrwn used to use my smartphones and he accisentally he delet my personal files,so i make a double store into my ohone and the other is in my secretive notes,and rhanks mate for your guides and informative suggestions.,
Liternyy
Member
**
Offline Offline

Activity: 238
Merit: 11


View Profile
June 06, 2018, 07:02:17 AM
 #18

Monitor the security of your PC
Use a dedicated PC or mobile device, as well as a secure network
Do not be lazy to create strong passwords
Encrypt data
Be careful with mobile authentication
Back up your data
Install two purses: the main and multicurrency
Say goodbye to mobile wallets
Pay attention to browsers
Use third-party cyber security services
Be careful with the network
neliawesome
Jr. Member
*
Offline Offline

Activity: 210
Merit: 1


View Profile
June 06, 2018, 07:12:09 AM
 #19

Thanks for posting this topic coz its really a big help to everyone to secure their wallet.Not all people in this forum knows how to secure their wallet and your post is a very big help for them.Especially day by day the forum members keep growing.
Nestade
Full Member
***
Offline Offline

Activity: 308
Merit: 119


alias xuNsh1ne


View Profile WWW
June 07, 2018, 01:39:18 AM
 #20

Thanks for posting this topic coz its really a big help to everyone to secure their wallet.Not all people in this forum knows how to secure their wallet and your post is a very big help for them.Especially day by day the forum members keep growing.

Thank you very much for your feedback Smiley

Monitor the security of your PC
Use a dedicated PC or mobile device, as well as a secure network
Do not be lazy to create strong passwords
Encrypt data
Be careful with mobile authentication
Back up your data
Install two purses: the main and multicurrency
Say goodbye to mobile wallets
Pay attention to browsers
Use third-party cyber security services
Be careful with the network

I agree but be careful with third-party cyber security services if you mean antivirus-software.
It may protect you against many threats but unfortunately the really dangerous ones won't be detected by any AV software - in some cases it may even decrease your security as AV software most likely has admin privileges and if there are vulnerabilities it may even make it easier for the malware to get admin rights. I can't tell you if AV software is useful or not (I'm using Malwarebytes Anti-Malware)... There have been many discussions about this topic but no clear answer.

Pages: [1] 2 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!