BITCOIN WALLET

[NeuroticFish]

I’m talking from personal experience where someone was very irresponsible and lost a significant amount of coins, and then I was the one who was most responsible for it - because I made someone deal with it at all - it’s that classic accusation “that you didn’t mention Bitcoin, I wouldn't lose money". I paid a loss out of my own pocket for someone not to blame me for something my whole life, but this is the last time I will allow myself something like that.

Sad story. The lesson should be to tell people clearly (and emphasize too!) that it's completely their decision for what they do with their money, whether you do this online or in real life.

I will not exaggerate if I say that from my personal experience at least 90% of people are not ready to be their own bank, and anyway they are only interested in how to profit, preferably in a very short time.

100% correct. And most people prefer to blame anybody else than themselves when something goes wrong.

I made a decision a long time ago, I will not help anyone to invest in crypto if that person does not understand some basic things before, and if they will keep their coins online or in a mobile/desktop wallet on devices they use every day for various activities. Then it's just a question of when something bad will happen, and then it's usually someone else's fault that it happened.

For newbies I lately recommend HW exactly because of this. Then the chance that the blame is on me decreases greatly.

[DaveF]

A while ago I posted this: https://bitcointalk.org/index.php?topic=5205304

And it's still valid today. It's not just what wallet but what you want to do with it, and how much is it holding, etc.
Also, as I keep saying, having a hardware wallet for a hot wallet that at most is going to have $50 is just time consuming and not worth it.

It's not a one size fits all.

-Dave

[Pmalek]

Also, as I keep saying, having a hardware wallet for a hot wallet that at most is going to have $50 is just time consuming and not worth it.

I would never purchase a hardware wallet to store $50 in it if that amount is the first and last time I own Bitcoin. But if that's not the case, and you are planning to periodically increase that stash to say $100, $200, etc., it's well worth the money and the trouble. I think that if someone's first experience with Bitcoin is a positive one, that person would likely want more. Let's not forget that if Bitcoin reaches a valuation we all hope for, those initial $50 would be worth a lot more. 

[DaveF]

Also, as I keep saying, having a hardware wallet for a hot wallet that at most is going to have $50 is just time consuming and not worth it.

I would never purchase a hardware wallet to store $50 in it if that amount is the first and last time I own Bitcoin. But if that's not the case, and you are planning to periodically increase that stash to say $100, $200, etc., it's well worth the money and the trouble. I think that if someone's first experience with Bitcoin is a positive one, that person would likely want more. Let's not forget that if Bitcoin reaches a valuation we all hope for, those initial $50 would be worth a lot more. 

Agree 100%, part of the issue with forums and my typing is I can put out a point and type it knowing what I am thinking but you don't. So the background is kind of missing.

So yes, if you are going to keep adding to the wallet to have it grow from $50 then $90 then $175 etc, that is one thing.

In MY view, that is NOT a hot wallet, that is a cold storage wallet. Or a 'warm' wallet.

The 'hot wallet' say the one on my phone that my signature campaign pays into, even someone as paranoid as I am has no security on it beyond a password / fingerprint.

The BTC comes in, 75% of BTC goes out just as quickly. That is what I think of as a hot wallet.

If someone is just getting into BTC and wants to get some and spend it and then get some more and spend it, IMO going hardware is just going to frustrate them.
I explain to them that it is just like cash in a regular wallet and if you do something stupid or careless with it, it's gone.
I then can tell them there are MUCH better ways to do it for long term and even 'middle term' storage. THEN I can get into the hardware, multisig, and other options and determine what works best for them.

-Dave

[Lucius]

Sad story. The lesson should be to tell people clearly (and emphasize too!) that it's completely their decision for what they do with their money, whether you do this online or in real life.

I understood this as a very important lesson, and it is important that it happened at a time when the price of BTC was around $200, and I could afford to go in the direction of compensating someone for the damage caused by insufficient knowledge and insufficient awareness of how important security is when it comes to crypto. Back then, HWs weren't as popular as they are today, and a hot wallet on a computer used for everything was an ideal target for some malware that came into possession of seed stored on PC.

[suzanne5223]

Can you guys tell which wallet is safest according to your experience.

The wallet that the crypto community believes to be safest because they are not exposed to danger is a hardware wallet (ledger) or non-custodial open source wallet (electrum) which has already been evaluated but avoiding human error is needed to be your top priority for the safety of your wallet from online theft still lies in your hand.

[Pmalek]

The wallet that the crypto community believes to be safest because they are not exposed to danger is a hardware wallet (ledger)

Danger is too broad of a term. If we are only talking about the safety of your private keys and ultimately your crypto, sure, Ledger manages to achieve that. But Ledger hasn't handled themselves properly during the database leak, so they failed to protect the privacy of their customers. They are currently failing at the production of Nano X's because too many of them have battery issues. Ledger isn't great, neither is Trezor or Electrum. Electrum is a software wallet. Although it's one of the best in its class, it's still a hot wallet (unless you are using it as a cold storage) and can't be compared to a hardware wallet or a properly airgapped device.   

[suzanne5223]

The wallet that the crypto community believes to be safest because they are not exposed to danger is a hardware wallet (ledger)

Danger is too broad of a term. If we are only talking about the safety of your private keys and ultimately your crypto, sure, Ledger manages to achieve that. But Ledger hasn't handled themselves properly during the database leak, so they failed to protect the privacy of their customers. They are currently failing at the production of Nano X's because too many of them have battery issues. Ledger isn't great, neither is Trezor or Electrum. Electrum is a software wallet. Although it's one of the best in its class, it's still a hot wallet (unless you are using it as a cold storage) and can't be compared to a hardware wallet or a properly airgapped device.   

Thank you for pointing this issue out cause I'm aware of the NanO x problem but the ledger database leak that happened then will only expose those that purchased the ledger before the data leak to a possible physical attack.
If we talked about things that have to do with internet activities there will always be a danger involve due to inexperienced or human error and pcmag once claim that air-gapped devices are also not secure as we believe it was.

This is what I have thought about several times and what we can do now is to use one of the best wallets in there class until a total solution arrive.

[n0nce]

Can you guys tell which wallet is safest according to your experience.

The wallet that the crypto community believes to be safest because they are not exposed to danger is a hardware wallet (ledger) or non-custodial open source wallet (electrum) which has already been evaluated but avoiding human error is needed to be your top priority for the safety of your wallet from online theft still lies in your hand.

Please check these threads and rethink your recommendations (I myself wouldn't recommend a single brand at all, just give resources for an interested person to form their own opinion - there is no perfect hardware or software wallet):

Ledger Nano X Battery Pandemic
[BIG LIST] Hardware wallets (80+)
[ list ] Open Source Hardware Wallets
Secure Element in Hardware Wallets

I'm aware of the NanO x problem but the ledger database leak that happened then will only expose those that purchased the ledger before the data leak

Oh, so you're aware of all these BIG issues, yet still recommend Ledger?

[Charles-Tim]

Oh, so you're aware of all these BIG issues, yet still recommend Ledger?

That does not mean any other hardware wallet database is perfect, anyone of the can be hacked at any time. The best is to find a way you can purchase hardware wallet in a way information you provide hardware wallet company can not be linked to your real identity. Do not be surprised if you heard the database of another hardware company is leaked, try to protect you identity yourself is the best.

Only what I do not like about Ledger Nano is because it is not completely open source, its secure element which generates and store the seed phrase is close source, while many reputed members are still recommending the wallet. That is the fact that makes me prefer Trezor which is completely open source but which should be used with passphrase to make the possible physical attack not to be able to reveal your keys if possible the hardware wallet was stolen.

But, you are not wrong, more hardware wallet are recommendable but people do recommended Trezor and Ledger Nano because they are the most used and most tested for vulnerabilities.

[o_e_l_e_o]

and pcmag once claim that air-gapped devices are also not secure as we believe it was.

There is no system in the world which is 100% safe and secure and completely impervious to all attacks. However, this article makes it sound like stealing data from an air gapped machine is almost trivial, which it obviously is not. For any of these attacks to work, someone must first gain access to your airgapped computer, install malware on it, place some kind of microphone, radio receiver, or similar in the same room you would be using it, and do all this without it being noticeable. For most people who keep their airgapped device inside their locked house (as long as you are not silly enough to plug in a random USB drive someone gave you to your airgapped device), then that is next to impossible. Airgapped wallets set up properly remain very secure.

[Lucius]

But, you are not wrong, more hardware wallet are recommendable but people do recommended Trezor and Ledger Nano because they are the most used and most tested for vulnerabilities.

Unfortunately, there is no other manufacturer that has managed to impose itself as an adequate alternative to Ledger or Trezor if we take into account everything that happened to Ledger, but also the irreparable vulnerability that was discovered on Trezor. This shows us that there are no serious players in the market, but only some who obviously do not have enough money or ideas to become somewhat relevant.

All this together benefits those who live from the old glory, and instead of achieving the highest possible quality and safety, they constantly run into new problems. I am of the opinion that people should be advised to consider buying hardware wallets, but they should not be explicitly suggested what exactly to buy.

[n0nce]

But, you are not wrong, more hardware wallet are recommendable but people do recommended Trezor and Ledger Nano because they are the most used and most tested for vulnerabilities.

Unfortunately, there is no other manufacturer that has managed to impose itself as an adequate alternative to Ledger or Trezor if we take into account everything that happened to Ledger, but also the irreparable vulnerability that was discovered on Trezor. This shows us that there are no serious players in the market, but only some who obviously do not have enough money or ideas to become somewhat relevant.

All this together benefits those who live from the old glory, and instead of achieving the highest possible quality and safety, they constantly run into new problems. I am of the opinion that people should be advised to consider buying hardware wallets, but they should not be explicitly suggested what exactly to buy.

There are certainly tons of tried and trusted alternatives today, just a few that come to mind are BitBox and ColdCard.
Check out this great list: [ LIST ] Open Source Hardware Wallets

I agree, I prefer to give the resources and let the person decide on their own; no wallet is perfect and it comes down to personal preference what drawbacks are okay for you and what is unacceptable for you.

[Lucius]

There are certainly tons of tried and trusted alternatives today, just a few that come to mind are BitBox and ColdCard.

Then answer the question why these alternatives are not sold in larger quantities after the competition has proven that it is not capable of being up to the task when it comes to the safety of their customers, or vulnerabilities that cannot be fixed? I'll tell you why, because they're not powerful enough to deserve that trust at all - nothing sells on its own, no matter how good it is.

[n0nce]

There are certainly tons of tried and trusted alternatives today, just a few that come to mind are BitBox and ColdCard.

Then answer the question why these alternatives are not sold in larger quantities after the competition has proven that it is not capable of being up to the task when it comes to the safety of their customers, or vulnerabilities that cannot be fixed? I'll tell you why, because they're not powerful enough to deserve that trust at all - nothing sells on its own, no matter how good it is.

They do sell in large quantities.

[Pmalek]

There is no system in the world which is 100% safe and secure and completely impervious to all attacks. However, this article makes it sound like stealing data from an air gapped machine is almost trivial, which it obviously is not.

it's one thing to want to stay protected from a thief who targets you and wants to steal from you. It's a whole other level if you get on the radar of a serious government agency who decides to take you down (darknet markets, Silk Road, etc.). Your primary concern should be to to remain protected from the first type of adversary. Your secondary concern should be not to do illegal things that would result in you becoming a target for the latter. Because if you do, you are gonna have more important things to worry about than how safe your bitcoin wallet is. This is not a response to you personally, just some of my thoughts. No one is untouchable.    

[Lucius]

They do sell in large quantities.

Is that something you can back up with a fact or just your personal opinion? I did not find data on how many of these HWs were sold, but Ledger announced a few months ago that it had sold over 3 million devices, while some estimate that the number of Trezors is slightly less than that, but still in the millions.

[o_e_l_e_o]

it's one thing to want to stay protected from a thief who targets you and wants to steal from you. It's a whole other level if you get on the radar of a serious government agency who decides to take you down (darknet markets, Silk Road, etc.).

If you are a target of a major government or one of their agencies such as the FBI, then the security of your wallets is almost inconsequential. They'll put you in jail regardless.

Laws specifying whether you can be required to provide your decryption key or password for data files to law enforcement or other agencies vary depending on the country you live in. US courts seem to (so far) be saying that doing so would violate an individual's Fifth Amendment rights. I'm not aware of any rulings in the US relating to handing over your bitcoin wallet passwords, seed phrases, private keys, etc., though. There was a case in Germany of someone who spent two years in jail (he's since been released) for installing mining software on other people's computers, but refused to hand over the password to a wallet containing around 1,700 BTC. I can't find out whether he has since been able to recover or spend any of those 1,700 BTC without the police coming knocking, though.

But yes, I agree. When thinking about wallet security you should be focusing on the most likely attack vectors, which for most people will be the opportunistic attacker or maybe a targeted attack by one or two individuals. If you think that your most likely attack vector is that of a nation state, then you've got far bigger problems to deal with.

[n0nce]

They do sell in large quantities.

Is that something you can back up with a fact or just your personal opinion? I did not find data on how many of these HWs were sold, but Ledger announced a few months ago that it had sold over 3 million devices, while some estimate that the number of Trezors is slightly less than that, but still in the millions.

I don't work at a hardware wallet company, so I have no numbers, but if you look outside the Trezor-Ledger-bubble, you'll find big communities of each of the other wallet brands (chat groups, Twitter followings, etc. - I know any one of those metrics can be faked, but look at the bigger picture).

Even though they may not sell millions, they still sell many. And I'd encourage that, instead of continuing to shill Ledger, 'it must be good because they sell many', because this shilling may be the exact reason why the others sell less than a million devices each.

I know, I know, hen and egg problem and all, but I think you get the idea.

Actually, I don't even understand your point or opinion, starting here:

Unfortunately, there is no other manufacturer that has managed to impose itself as an adequate alternative to Ledger or Trezor if we take into account everything that happened to Ledger, but also the irreparable vulnerability that was discovered on Trezor

You are trying to say that there are no good alternatives to Trezor and Ledger, because they have security bugs and bad customer data handling? How does this make sense? Exactly because these wallets have flaws, we should look at the alternatives..

[Pmalek]

Laws specifying whether you can be required to provide your decryption key or password for data files to law enforcement or other agencies vary depending on the country you live in. US courts seem to (so far) be saying that doing so would violate an individual's Fifth Amendment rights.

The United States is a legal and logistical nightmare in such matters. They have Supreme Courts and Federal Courts.

This source that I found says that in 2019, the Massachusetts Supreme Court forced a defendant to reveal the unlocking code for this phone. During the same year, Pennsylvania’s Supreme Court ruled that an accused individual does not have to disclose the password for his computer. Those are just some cases with courts of the highest level.
When it comes to Federal Courts, the Third Circuit Court of Appeals ruled that a defendant had to unlock multiple computers and devices. But, the 11th Circuit Court of Appeals ruled in favor of the defendant in a similar case. 

Then we have the issue of biometrics. The source says:

Law enforcement is allowed to use people’s bodies as evidence against them, for instance by compelling them to participate in suspect lineups or provide their DNA. So if the police can take your fingerprints, can’t they use them to unlock your phone?

...

courts have been more likely to rule that the Fifth Amendment does not apply to biometrics than they are that it applies to passcodes.

...

Yet another factor to consider here is that, while it’s impossible for police to read your mind and get your passcode, they can hold a phone up to your face or press your finger on it to bypass the biometric lock. And while your lawyer can (and should) argue that any evidence found this way was illegally obtained and should be suppressed, there’s no guarantee they’ll win.

 

The conclusion is that it's safer to use a password/pin code than biometrics when it comes to password-protecting your personal devices.

So, all things considered, if you’re worried about law enforcement getting access to your phone, your safest bet is to just use a passcode.

*All quotes are from the source mentioned above.