Hardware Wallet protection on a online computer

[Pmalek]

@zaico
Hardware wallets are simple to use, but still provide a decent level of security. That's what makes them so popular in the community. Web and software wallets are even easier, but they aren't nearly as secure as hardware devices. The perfect setup is an airgapped device or a properly generated paper wallet. But both these options require better technical knowledge than using a USB-like device.

An airgapped computer is only used as an offline medium to sign your transactions. It's a computer you aren't using for other things. Some don't have that luxury unfortunately. Some people don't own or want to own any PC/laptop, but they can still use a hardware wallet with their mobile phone.   

[1714906633]

1714906633

[1714906633]

1714906633

[DireWolfM14]

VeraCrypt.

I downloaded VeraCrypt (maybe from sourceforge?) years ago, and the installer was full of a bunch of shit I had to decline.  I missed one and it took over my browser, the registry entries kept repairing themselves after I manually deleted them, and I had to purge the whole system to clean up the fucking mess.  Needless to say, it left a bad taste in my mouth, and haven't tried it again. 

Are partitions encrypted with VeraCrypt compatible with LUKS/cryptsetup?

[o_e_l_e_o]

I downloaded VeraCrypt (maybe from sourceforge?) years ago, and the installer was full of a bunch of shit I had to decline.

I've never experienced something similar, but since it is all open source you could opt to download the source code and build it yourself if you wanted.

Are partitions encrypted with VeraCrypt compatible with LUKS/cryptsetup?

I've never tried it, since I pretty much exclusively use LUKS for full disk encryption and use VeraCrypt for individual files and containers, but a quick search suggests that cryptsetup will indeed open TrueCrypt and VeraCrypt containers:

https://wiki.archlinux.org/title/TrueCrypt#Accessing_a_TrueCrypt_or_VeraCrypt_container_using_cryptsetup
https://man.archlinux.org/man/cryptsetup.8#TCRYPT_(TrueCrypt-compatible_and_VeraCrypt)_EXTENSION

[zaico]

I found the offline (original) wallet method to be the most reliable and after reading you, correct me if i'm wrong, it still is.

There are pros and cons to both methods, and there is nothing stopping you from using both methods. I prefer a permanently airgapped computer with full disk encryption for the bulk of my cold storage. I transfer transactions back and forth using QR codes, using two separate webcams which are unplugged immediately after use, therefore eliminating any concerns regarding transferring malware or malicious code via a USB drive. The computer is stripped of all unnecessary hardware, only runs a basic open source OS and my bitcoin wallet and no other software, does not share peripherals with any other device, is stored in a safe in my house when not in use, and is only used in a room with curtains closed. However, I also use a couple of hardware wallets for funds I want to keep offline, but I will also be transacting with more often than with my main cold storage, which I might only touch once or twice a year. The ease of use of a hardware wallet is significantly higher than that of my main cold storage - just plug it in to my main computer I can be transacting within seconds.

Further, setting up an airgapped and encrypted cold storage device is not a trivial task, especially for someone with little technical knowledge, and there are many places you can go wrong in both the initial set up and the ongoing use. Conversely, buying a hardware wallet achieves a very good level of security (and I'm certain that some would even argue a better level of security), and is far easier to set up and use.

Now that's a security setup! The question is, how do you manage DEFI (that was the origin of my questioning) if there is no option for signing offline (airgapped pc)?

[o_e_l_e_o]

Now that's a security setup! The question is, how do you manage DEFI (that was the origin of my questioning) if there is no option for signing offline (airgapped pc)?

I don't. The only coins I regularly use and hold long term (or think are worth anything, for that matter) are Bitcoin and Monero, both of which support airgapped wallets, offline signing, and transferring unsigned and signed transactions back and forth. I occasionally buy another altcoin for a specific purpose, but since it is always for a specific purpose I am never holding it long term so I just stick it on one of my hardware wallets for the short time I need it.

I have no interest in DeFi, as I think it will go the same way as the ICO craze, the IEO craze, or all the other crazes we see in crypto - a lot of vaporware, a handful of scams thrown in, the vast majority of coins/tokens/projects dropping to zero, meaning some people who gamble on the right project at the right time will make a lot of money, but most people will lose money, and very little of it will survive long term.

[zaico]

Now that's a security setup! The question is, how do you manage DEFI (that was the origin of my questioning) if there is no option for signing offline (airgapped pc)?

I don't. The only coins I regularly use and hold long term (or think are worth anything, for that matter) are Bitcoin and Monero, both of which support airgapped wallets, offline signing, and transferring unsigned and signed transactions back and forth. I occasionally buy another altcoin for a specific purpose, but since it is always for a specific purpose I am never holding it long term so I just stick it on one of my hardware wallets for the short time I need it.

I have no interest in DeFi, as I think it will go the same way as the ICO craze, the IEO craze, or all the other crazes we see in crypto - a lot of vaporware, a handful of scams thrown in, the vast majority of coins/tokens/projects dropping to zero, meaning some people who gamble on the right project at the right time will make a lot of money, but most people will lose money, and very little of it will survive long term.

Thanks for the answer and your view!