Bitkey for cold storage

[Wind_FURY]

I saw some topics suggesting their cold-storage strategies. The idea of this Debian-based distribution might also be useful/helpful, and make your cold-storage needs easier and more manageable.

The software included IS outdated, be careful.

https://bitkey.io/

Bitcoin Swiss Army Knife in a verifiably secure self-contained Live CD/USB. Supports air-gapped Bitcoin transactions. Makes offline cold storage (slightly more) practical.

[Husires]

The idea is to make it easier for beginners and easy made an air-gapped system, but if they do not know the basic steps, it will not help him to rely on the system, because he will be confident that it is impossible to hack the air-gapped system.

There are many ways an evil air-gapped system can betray its user, including creating bad transactions and smuggling out secret keys via covert channel (e.g., USB keys, high frequency sound, covert activation of Bluetooth/wifi chipset, etc.)

Physical access to the device and random use are the challenges, but the idea is worth a try.



buy hardware wallet is better

[Wind_FURY]

buy hardware wallet is better

That's true, but as Bitcoiners, it's also good to learn something simple but technical things, and do it yourself. As plebs, it's also good to find the cheaper way to cold storage. Haha.

[HCP]

The software included IS outdated, be careful.

Outdated is an understatement... it has not been updated in over 2 years!!?!




I was wondering why "bitkey" sounded familiar, but I couldn't remember seeing or hearing anything about it recently... it's effectively a "dead" project. Which is a bit sad, as the concept was pretty good.

[hugeblack]

Thanks for the warning, I wanted to download it yesterday and did not check the detailed information about its latest update.

The strange thing is that the site is still working without giving any indication that the source has not been updated for some time.

I have followed a few issues^[1] and found a lot of them unresolved.


read this

No problems. FWIW, this project is all done in our spare time too! smile

Won't boot from USB 3.0 port
Stuck on boot
[1] https://github.com/bitkey/bitkey/issues

[Wind_FURY]

The software included IS outdated, be careful.

Outdated is an understatement... it has not been updated in over 2 years!!?!




I was wondering why "bitkey" sounded familiar, but I couldn't remember seeing or hearing anything about it recently... it's effectively a "dead" project. Which is a bit sad, as the concept was pretty good.

But it can still be useful solely as a wallet for cold-storage, if it boots for your hardware. You can disable the non-essential applications, and update the more important applications for Bitcoin storage usage.

[Wind_FURY]

But it can still be useful solely as a wallet for cold-storage, if it boots for your hardware. You can disable the non-essential applications, and update the more important applications for Bitcoin storage usage.

If it's the goal, you could use any live-OS (which is more up-to-date) with persistent storage support, then fill the persistant storage with the wallet file, application (could be .deb, .appimage or simply .tar.gz) or other files you need.

Using tails is better option IMO, especially because it's designed with security and privacy in mind.

Bitkey is actually different. The distribution was built more as a cheaper cold-storage solution, with all tools that you can find in one package.

[bob123]

Bitkey is actually different. The distribution was built more as a cheaper cold-storage solution, with all tools that you can find in one package.

And where is the differernce to any random live distro containing the packages you need (or installing them yourself, it's just one command after all) ?

I'm with ETFbitcoin here. Installing any distro (e.g. Tails) with the necessary software (electrum or whatever) is better than using outdated software.

[HCP]

The "advantage" was that Bitkey was preconfigured with some "no network" options, so on boot you could choose to boot with zero networking... and it then launched a version that had no networking enabled. I believe it was actually disabled at kernel level, so no need to worry about disconnecting ethernet or switching off WiFi etc...

Otherwise, it really wasn't any different to using a "normal" LiveOS.

[bob123]

The "advantage" was that Bitkey was preconfigured with some "no network" options, so on boot you could choose to boot with zero networking... and it then launched a version that had no networking enabled. I believe it was actually disabled at kernel level, so no need to worry about disconnecting ethernet or switching off WiFi etc...

There are multiple distros available which also offer exactly this.

If i am not mistaken, tails or parrot should offer that (not completely sure since i'm not using tails and didn't boot parrot for quite some time).

Not a real advantage compared to other distros IMO.

[Wind_FURY]

buy hardware wallet is better

That's true, but as Bitcoiners, it's also good to learn something simple but technical things, and do it yourself. As plebs, it's also good to find the cheaper way to cold storage. Haha.

Another thing about this is, a friend of minr had an argument about the "danger" of hardware wallets is, "it's a device that makes it known that you own Bitcoin. If you want to store a large amount of Bitcoin, it's better in hardware that isn't assumed that it will be used for Bitcoin upon purchase of that said hardware".

[o_e_l_e_o]

Depending on the risks, you could always destroy the package/manual & hide the HW wallet.

If you are using it purely as cold storage which is never going to leave your house, then someone discovering it by chance is far less of risk than someone in supply chain making a note of your address and the fact you are ordering a bitcoin wallet, or a database leak revealing the fact that you have purchased a hardware wallet. It is definitely far easier to use any old computer hardware which you have repurposed in to cold storage than it is to anonymously order and have delivered a hardware wallet under a fake name and to a different address.

[Wind_FURY]

Depending on the risks, you could always destroy the package/manual & hide the HW wallet.

If you are using it purely as cold storage which is never going to leave your house, then someone discovering it by chance is far less of risk than someone in supply chain making a note of your address and the fact you are ordering a bitcoin wallet, or a database leak revealing the fact that you have purchased a hardware wallet. It is definitely far easier to use any old computer hardware which you have repurposed in to cold storage than it is to anonymously order and have delivered a hardware wallet under a fake name and to a different address.

Ledger had a database leak recently, with customer private/personal information, from 2019 - now, currently in the hands of bad-actors. They are targets now, for sim-swaps and spear-phishing. Some confirmed that personal information before 2019 was leaked too.

[o_e_l_e_o]

Ledger had a database leak recently, with customer private/personal information, from 2019 - now, currently in the hands of bad-actors. They are targets now, for sim-swaps and spear-phishing.

Yeah, this leak/hack was what I had in mind when writing my previous comment. Not only are the users potential targets for electronic attacks, but since physical addresses were part of the data leak for many users, they are also now potential targets for thefts and $5 wrench attacks. Further, there is very little users can do about it. It's not as simple as thinking "My wallet is compromised, I'll transfer everything to a new one." People affected would need to change their email, change their phone number, potentially move home.

I'm a big fan of using an old computer as airgapped cold storage, but if you really want a hardware wallet, then you should look at how to buy one without giving away your real details.

[Wind_FURY]

Ledger had a database leak recently, with customer private/personal information, from 2019 - now, currently in the hands of bad-actors. They are targets now, for sim-swaps and spear-phishing.

Yeah, this leak/hack was what I had in mind when writing my previous comment. Not only are the users potential targets for electronic attacks, but since physical addresses were part of the data leak for many users, they are also now potential targets for thefts and $5 wrench attacks. Further, there is very little users can do about it. It's not as simple as thinking "My wallet is compromised, I'll transfer everything to a new one." People affected would need to change their email, change their phone number, potentially move home.

I'm a big fan of using an old computer as airgapped cold storage, but if you really want a hardware wallet, then you should look at how to buy one without giving away your real details.

You can use your real name, BUT register another email address for the order, don't use your personal email address, AND open a P.O. Box with your local post office, then have it sent there. I believe that would be the safest way.

[Wind_FURY]

This meme made a funny viewpoint on Ledger's database leak.



Protect your real identities during Bitcoin's path of price discovery to 6 digits, not only from bad actors, but maybe from the government as well.

[hfgscvsd]

    It's not even better to use tails without persistence? In this way you can create the wallet, note down the seeds and export the public keys for a watch wallet. After that, the wallet files and private keys will be destroyed, that means you can't loose them. After 10 or 20 years when you want to spend from this wallet you just need the seeds to recover the wallet and to regenerate the private keys. In all of this time you just need to have on a safe place the seeds, you can't be hacked if your private keys doesn't exist anywhere. Of course, for an improved security measure you can use seeds extension to add more words and store them in a separate location, it'll work like a passphrase for the initial seeds.
    What can go wrong with this setup, assuming that you'll not loose the seeds?

[o_e_l_e_o]

What can go wrong with this setup, assuming that you'll not loose the seeds?

Assuming you are planning to hold long term and not make many transactions out of this wallet, then this is a good set up. It is essentially a paper wallet, in that the only place your seed phrase/private keys are stored is on paper, and all electronic traces of them are wiped soon after creation.

Things which could go wrong (not an exhaustive list):

• Creating a seed phrase which has been predetermined by some malware. This risk can be reduced by verifying Tails prior to use, or removed entirely by using entropy from coin flips or dice rolls and manually converting it in to a seed phrase.
• Leaking information while creating the seed phrase. Ensure your device is airgapped, there are no uncovered cameras in the vicinity (including your phone), no one is watching, write it by hand instead of using a printer, etc.
• Persistence between Tails and your main OS.
• Someone accessing your seed phrase while it is being stored.
• Your seed phrase storage being lost or damaged over time.

[hfgscvsd]

@o_e_l_e_o Thanks a lot for your suggestions.

[Max_Headroom]

/*research status*/

I like low budged read only media Env,

like to boot up on CD-ROM at old and well tested CPU layout diagram (ref. https://www.fsf.org/blogs/licensing/intel-me-and-why-we-should-get-rid-of-me )

projects like
OpenPGPCleanRoomLiveEnvironment
https://wiki.debian.org/OpenPGP/CleanRoomLiveEnvironment

but Bitkey may lack of more robust Linux distribution package management