WTS my smartphone but I've got crypto in it. HELP!

[Stedsm]

One different question than what I've asked here

I've got a smartphone that's gone old and I wanna sell it so that it helps me pay at least 1 EMI for my next new smartphone. Well there's a catch, I've got all my crypto and privkeys as well as wallets (even exchange apps) installed in my current smartphone but to my knowledge, I think the new owner is able to fetch almost everything if he knows about crypto or he's got any sort of technical knowledge about how to restore everything or at least something that I used to have in my smartphone even after factory-resetting it without keeping any backups in that smartphone.

Is that possible at the first place?
If yes, should I even sell it to anyone or not? If yes, what type of preventive measures should be taken to assure myself that my crypto is safe after my smartphone is sold and given to the buyer?

[jackg]

Just move the coins off of a wallet made on the phone?

If your wallet was protected by a pin or password then you might be alright just with that. However it's safer just to move the coins.
They will be able to get your data afaik, the only way to prevent that is to either pull out the sd card and wipe it on a computer or factory reset the phone and completely fill the phone to the nearest mb or even kb...

[bob123]

First, which android version are we talking about?
Usually simply wiping the phone is all you need to do.

Newer android versions (6.0 + ) automatically encrypt the whole internal storage.
The key to decrypt is stored on the storage which is protected by your pin (not sim pin, but unlock pin (e.g. pattern)).

Once wiped, the decryption key is gone. And afterwards no data can be recovered anymore.

With android < 6.0, you need to manually encrypt the mobile before wiping to achieve the same result.


If you want to be absolutely certainly 100% sure, just put some junk data afterwards on the mobile to fill up the storage which will lead to all data being completely overwritten (instead of simply being marked as free space).

However, even without filling it up after wiping, you are already extremely safe from data recovery.

[NeuroticFish]

Usually simply wiping the phone is all you need to do.

There are voices telling that wiping an android phone is an incomplete solution for security/privacy. So if OP is super-paranoid about security (and still doesn't have a hardware wallet), he could move all the coins into new created wallets (come on, it should not such a big task), change his passwords and reset all the 2FA seeds.
OK, keeping the old private keys for cashing in forks may also be an useful step.


Edit: It looks like encrypting it before wiping does the job. Thanks @bob123 for the cold shower, I guess that part of my brain was not fully awake.

[bob123]

Usually simply wiping the phone is all you need to do.

There are voices telling that wiping an android phone is an incomplete solution for security/privacy.

Did you even completely read my post and the article you have linked?

[...]
Newer android versions (6.0 + ) automatically encrypt the whole internal storage.
[...]
Once wiped, the decryption key is gone. And afterwards no data can be recovered anymore.

With android < 6.0, you need to manually encrypt the mobile before wiping to achieve the same result.
[...]

Your linked article:

Before you sell your device, here's a how to on really protecting your data by encrypting it before attempting the reset.

You need to read the whole post/article and not quote it out of context.

[bitmover]

Just move the coins off of a wallet made on the phone?

This is certainly the best solution.

You do not have to worry any more about completly wiping your phone as long those "leaked" private keys contains zero funds.

Just  move all your coins that ever touched your old phone.

[Stedsm]

Just move the coins off of a wallet made on the phone?

And what if I need those addresses in the wallet I use in my current smartphone? Then I'll need to do anything to save it from being hacked, right? I can't stop using that wallet as it contains most of the addresses that verify me (e.g.: my profile BTC address) basically for my identity.

First, which android version are we talking about?

Android 7.0 (I guess it's Nougat maybe).

If you want to be absolutely certainly 100% sure, just put some junk data afterwards on the mobile to fill up the storage which will lead to all data being completely overwritten (instead of simply being marked as free space).

You mean this should be done after I transfer (backup) all my files / privkeys / wallets to another device, right?

[pereira4]

I've got a smartphone that's gone old and I wanna sell it so that it helps me pay at least 1 EMI for my next new smartphone. Well there's a catch, I've got all my crypto and privkeys as well as wallets (even exchange apps) installed in my current smartphone but to my knowledge,

There's no guarantee that you have completely removed data from anything that isn't a physical HDD, in any case even if there was, it's simply insanity to sell it. Never sell it once you've put private keys in there. In fact, learn the fact that private keys should never be connected to wireless crapvices such as an smartphone. Move keys to a safe computer, process to destroy the phone with a hammer if necessary. It could cost you more money on the long run than what you would make selling it.

[elda34b]

And what if I need those addresses in the wallet I use in my current smartphone? Then I'll need to do anything to save it from being hacked, right? I can't stop using that wallet as it contains most of the addresses that verify me (e.g.: my profile BTC address) basically for my identity.

You can back up the seed/private key etc but you need to sweep the funds. That way you can still use it to verify your signature but that address won't be safe to store your money.

Assuming the buyer gets his hand on your private key/seed, that doesn't mean he can simply log in to Bitcointalk and start posting with your account. On top of that, you can also change your registered Bitcoin address to your new address. If we're talking about signature verification, just made a new sign message stating that you no longer use X address for verification and move to Y address.

[jackg]

Just move the coins off of a wallet made on the phone?

And what if I need those addresses in the wallet I use in my current smartphone? Then I'll need to do anything to save it from being hacked, right? I can't stop using that wallet as it contains most of the addresses that verify me (e.g.: my profile BTC address) basically for my identity.

I kinda covered that further down with what you need to do to keep the keys secure - wipe the phone and then fill it with dummy data (bitcoins logo maybe haha, you could make a single image file huge)...

I'd advise signing a new key here and wait a while before selling it (if possible).

Typically, someone can only steal money from once before you work it out and stop using that address.

what's an emi?

[bob123]

If you want to be absolutely certainly 100% sure, just put some junk data afterwards on the mobile to fill up the storage which will lead to all data being completely overwritten (instead of simply being marked as free space).

You mean this should be done after I transfer (backup) all my files / privkeys / wallets to another device, right?

You need to backup all important data first, of course.

Then - since your mobile is encrypted already (automatically in android 7) - simply wipe your mobile and fill it with junk data.
Afterwards you can be sure that no data can be recovered anymore.

[Lucius]

I've got a smartphone that's gone old and I wanna sell it so that it helps me pay at least 1 EMI for my next new smartphone.

The best thing you can do is to keep that phone, and after you stop using it completely, destroy it in an adequate manner (burn it). I never sold my old devices which contained any personal information, and especially not those who have anything to do with cryptocurrency.

Do you have possibility to buy new smartphone with crypto directly maybe? You can use this price increase and buy great smartphone for 0.05-0.06 BTC, or wait to price go up even more and save more money.

[Stedsm]

what's an emi?

It's Easy Monthly Installments we can choose to pay the price of a product in parts (here: INSTALLMENTS). We can choose the number of months we want to divide the installments into (although, it's already provided at seller's discretion and they set the limit of the number of months and we get the choice to pay quick for less time or wait more time and pay less each month). Interest is levied for the selected period.


A question out of the box:
If I've got a memory card slot in my smartphone and I've stored/kept everything (almost everything related to crypto) and even installed my wallets in that memory card (by selecting it as default), do I need to worry at all about my stuff that I can just take out when memory card is removed?

[HCP]

A question out of the box:
If I've got a memory card slot in my smartphone and I've stored/kept everything (almost everything related to crypto) and even installed my wallets in that memory card (by selecting it as default), do I need to worry at all about my stuff that I can just take out when memory card is removed?

Theoretically no... Once you removed the memory card then it isn't available to the system... But practically speaking, it's kind of impossible to know for certain exactly where the OS has been storing data. It's possible that data has been put into the /cache partition "temporarily".

Unless the resale value of your device is significantly more than the crypto holdings that might be exposed by someone retrieving data from the device... you might be better off just keeping/destroying the device.

[Stedsm]

Theoretically no... Once you removed the memory card then it isn't available to the system... But practically speaking, it's kind of impossible to know for certain exactly where the OS has been storing data. It's possible that data has been put into the /cache partition "temporarily".

I asked this because I've seen the phone storage to mess up things for me by storing a few things in my phone (on its own) even after me setting it to store everything in my memory card and my memory card still has more than 8 GB available in it. Maybe some apps get stored to phone compulsorily?

Unless the resale value of your device is significantly more than the crypto holdings that might be exposed by someone retrieving data from the device... you might be better off just keeping/destroying the device.

I believe I should not go for just some money to pay an EMI and put my crypto holdings in danger just because I want a new phone, so I've finally decided to destroy my device completely.

One final question:
While destroying it, what should I take care of?
I mean, I don't want to get blasted off my phone while trying to destroy it. Also, which part should be mainly destroyed to end the possibility of fetching any sort of data from that piece if it ever gets to anybody's hands?

[bob123]

If I've got a memory card slot in my smartphone and I've stored/kept everything (almost everything related to crypto) and even installed my wallets in that memory card (by selecting it as default).

Holy shit.. that's a really bad idea.

Any data stored on the SD card can be accessed by any application on your mobile.
What you basically did is to circumvent security measurements of android which encapsulate storage from applications from each other.

On the internal memory, an application can only access the data in their own folder. But every application has access to the external memory.


You should never store sensitive information (which a wallet application definitely is) on an SD card. Always store it on the internal memory.

One final question:
While destroying it, what should I take care of?
I mean, I don't want to get blasted off my phone while trying to destroy it. Also, which part should be mainly destroyed to end the possibility of fetching any sort of data from that piece if it ever gets to anybody's hands?

Well.. theoretically.. wipe the (encrypted) mobile and fill it with junk data. That's the easiest way.
Then you are already safe, and don't need too much effort to destroy it physically.

All you need to destroy are the memory chips.

[HCP]

Bear in mind that "destroying" a mobile device can be a bit dangerous... especially if it has a non-removable Lithium Ion or Lithium Polymer battery in it that you can't remove first.

If the outer shell of the battery is compromised and the innards of the battery are exposed to air, it's very likely to oxidise violently and most likely catch fire and/or explode. There are plenty of YouTube videos showing what happens when Li-Ion and LiPo batteries are punctured.

[jackg]

Bear in mind that "destroying" a mobile device can be a bit dangerous... especially if it has a non-removable Lithium Ion or Lithium Polymer battery in it that you can't remove first.

If the outer shell of the battery is compromised and the innards of the battery are exposed to air, it's very likely to oxidise violently and most likely catch fire and/or explode. There are plenty of YouTube videos showing what happens when Li-Ion and LiPo batteries are punctured.

Heat with anything in group 1 or 2 is going to damage something and produce a lot of heat...

Not to mention that you have to do it outside and if you're in a foggy or smoggy area, just don't try doing it. You might release a load of chloroethene and others that will just stay there if dust and carbon structures denser are blocking it....

If the batteries in there, you can almost always open the unit even if it looks like you can't. Batteries aren't designed to be dropped from a great height or onto a hard surface so don't try smashing it...