Hardware wallets vs paper wallets

[Vampobit]

Hello everyone.

I have some experience with various hardware wallets and I admit that I am more than happy with the ones I have tried, especially with the coldcard.

However, even though I have watched multiple videos concerning paper wallets and why people shouldn't trust them nowadays, I feel like they are safer alternatives and I want to discuss it here.

So, how can a hardware wallet be a better option than a paper wallet?

I know, that a simple piece of paper can be damaged or lost, but, apart from that, how can it be hacked ?

It seems too safe to me and I reckon that the only thing I need to do is to protect this small piece of paper from thieves or from physical damage.

I have implemented a key-pair generator myself and I run it on a computer that has never touched the internet. Thus, I get a private and a public key and then I print it on a piece of paper.
Alternatively, I could save the keys on 2-3 usb sticks and then protect the usb sticks, in order to avoid every point of paper failure (i.e ink stains, water etc). Isn't that extremely safe ? Am I missing something here ?

On the other hand, when you set up a digital device, even though the keys don't "touch" the internet, don't you actually trust the manufacturer and the code that they provide? And, simultaneously, you must maintain a piece of paper (or metal plate) where the seed phrase is written, so, technically it's the same thing.

thanks

[1715540399]

1715540399

[1715540399]

1715540399

[1715540399]

1715540399

[1715540399]

1715540399

[1715540399]

1715540399

[OmegaStarScream]

-snip-
On the other hand, when you set up a digital device, even though the keys don't "touch" the internet, don't you actually trust the manufacturer and the code that they provide?
-snip-

Not necessarily, some hardware wallets are fully open-source [1].

Paper wallets are pretty safe until you decide to spend your funds. If you're someone who spends regularly, it's probably not the best option because each time you're scanning that private key QR code to send a transaction, you're taking a risk of exposing it.

[1] https://bitcointalk.org/index.php?topic=5288971.0

[mindrust]

Paper wallets are perfectly safe, if you make it yourself. If you use a third party like bitadress.com then yes, you might get hacked.

In the end a paper wallet is just a paper with your private keys written on. You can create your own on an offline PC and it will be safer than anything else.

[Vampobit]

Paper wallets are perfectly safe, if you make it yourself. If you use a third party like bitadress.com then yes, you might get hacked.

In the end a paper wallet is just a paper with your private keys written on. You can create your own on an offline PC and it will be safer than anything else.

Yes, thank you, that's why I implemented it myself. Otherwise, I would consider it the exact same thing as a hardware wallet. In fact a hardware wallet would win this comparison thanks to it's convenience and feature-rich application.

On the other hand, when you set up a digital device, even though the keys don't "touch" the internet, don't you actually trust the manufacturer and the code that they provide? And, simultaneously, you must maintain a piece of paper (or metal plate) where the seed phrase is written, so, technically it's the same thing.
-snip-

Not necessarily, because some hardware wallets are fully open source[1].

Paper wallets are pretty safe until you decide to spend your funds. If you're someone who spends regularly, it's probably not the best option because each time you're scanning that private key QR code, you're taking a risk of exposing it.

[1] https://bitcointalk.org/index.php?topic=5288971.0

Thanks for the answer. I only use open source wallets, but I have the ability to do so because I am a software engineer. Well the only thing I want to do is to create a wallet for my children (not yet born haha). I plan to send BTC every month and never withdraw. Essentially that's what I do for myself too, using a hardware wallet. But I thought, why not trying paper wallets for my kids? it still seems safer to me.

[jackg]

Paper wallets with a written down key were considered insecure since a while ago because of things like the ink being damaged/fading and it being transcribed wrong when trying to spend. If you're a software engineer is there a reason you can't take the bip39 wordlist and a private key and get a tool so that one can generate the other? I think it'd then be safe as each word could act as a sort of checksum (there's other - longer - wordlists available too based on best practices for passwords).

A lot of the security and usability of a hardware wallet comes down to how you're printing it and how you're storing it (things you might think would preserve it - such as laminating it - can actually do more harm than good).

[mindrust]

Tbh you don’t even need to make it that complicated. (Writing down your priv keys)

Writing down your seed words is even more practical. You may even memorize them. It will come in handy in case you lose your paper wallet somehow. (Gets damaged etc)

[m2017]

Paper wallets with a written down key were considered insecure since a while ago because of things like the ink being damaged/fading and it being transcribed wrong when trying to spend. If you're a software engineer is there a reason you can't take the bip39 wordlist and a private key and get a tool so that one can generate the other? I think it'd then be safe as each word could act as a sort of checksum (there's other - longer - wordlists available too based on best practices for passwords).

A lot of the security and usability of a hardware wallet comes down to how you're printing it and how you're storing it (things you might think would preserve it - such as laminating it - can actually do more harm than good).

What harm can lamination cause? Can you describe in more detail?

I believe that the purpose of hardware wallet and paper wallet is fundamentally different and therefore, it should not be compared. HW device is better for everyday use and allows to securely send / receive btc, while paper wallet is for long-term storage and the less often you open it, the better. Entering the private key from paper wallet every time to send a transaction is a dubious exercise.

[DaveF]

Tbh you don’t even need to make it that complicated. (Writing down your priv keys)

Writing down your seed words is even more practical. You may even memorize them. It will come in handy in case you lose your paper wallet somehow. (Gets damaged etc)

Short term perhaps. but never ever rely on your memory for the seed. It's been discussed many times.

Paper wallets with a written down key were considered insecure since a while ago because of things like the ink being damaged/fading and it being transcribed wrong when trying to spend. If you're a software engineer is there a reason you can't take the bip39 wordlist and a private key and get a tool so that one can generate the other? I think it'd then be safe as each word could act as a sort of checksum (there's other - longer - wordlists available too based on best practices for passwords).

A lot of the security and usability of a hardware wallet comes down to how you're printing it and how you're storing it (things you might think would preserve it - such as laminating it - can actually do more harm than good).

What harm can lamination cause? Can you describe in more detail?

I believe that the purpose of hardware wallet and paper wallet is fundamentally different and therefore, it should not be compared. HW device is better for everyday use and allows to securely send / receive btc, while paper wallet is for long-term storage and the less often you open it, the better. Entering the private key from paper wallet every time to send a transaction is a dubious exercise.

Because the quality of lamination varies a lot along with the quality of paper. You could be sealing in some crap, or find out 10 years later that the lamination has turned yellow / brown and you can't read the words though it and can't un-laminate it without risking damaging the wallet.

A good 'indestructible' paper is probably better to print on: https://bitcointalk.org/index.php?topic=5296179.0

As with everything YMMV some people like the seedplates others like other methods.

-Dave

 

[Vampobit]

Thank you all for the answers.

How about that:

I use the program I have implemented on an offline computer. I produce a key pair. Then I produce a seed phrase that produces the private key for the public address and finally, I save the seed phrase in offline USB sticks?

How does it sound?

[o_e_l_e_o]

I use the program I have implemented on an offline computer. I produce a key pair. Then I produce a seed phrase that produces the private key for the public address and finally, I save the seed phrase in offline USB sticks?

That's not how seed phrases work. The process of using a seed phrase to generate key pairs is a one way process via various hash functions. You cannot start with a private key and derive a seed phrase which produces that private key, unless you are doing something very non-standard which I absolutely would not recommend.

I would say the main benefits of a hardware wallet over a paper wallet is that they are much easier to set up and configure for the average person, and they are also much easier to spend from in the future. Paper wallets are a poor choice for the majority of crypto users, as they do not have the ability to set them up in a safe and secure fashion without doing something wrong, relying on third party software, leaking information online, etc., and will also tend to import them in to a hot wallet when they want to spend from them. Paper wallets can be very safe, but only if you really know what you are doing with them. You should be using a permanently airgapped device (i.e. not just one which is temporarily offline) to create them, and they should only ever be imported back on to this permanently airgapped device to sign airgapped transaction when you want to spend from them. I would also suggest using verified and open source wallet software such as Bitcoin Core or Electrum to generate your entropy/key pairs/seed phrase.

[Vampobit]

I use the program I have implemented on an offline computer. I produce a key pair. Then I produce a seed phrase that produces the private key for the public address and finally, I save the seed phrase in offline USB sticks?

That's not how seed phrases work. The process of using a seed phrase to generate key pairs is a one way process via various hash functions. You cannot start with a private key and derive a seed phrase which produces that private key, unless you are doing something very non-standard which I absolutely would not recommend.

I would say the main benefits of a hardware wallet over a paper wallet is that they are much easier to set up and configure for the average person, and they are also much easier to spend from in the future. Paper wallets are a poor choice for the majority of crypto users, as they do not have the ability to set them up in a safe and secure fashion without doing something wrong, relying on third party software, leaking information online, etc., and will also tend to import them in to a hot wallet when they want to spend from them. Paper wallets can be very safe, but only if you really know what you are doing with them. You should be using a permanently airgapped device (i.e. not just one which is temporarily offline) to create them, and they should only ever be imported back on to this permanently airgapped device to sign airgapped transaction when you want to spend from them. I would also suggest using verified and open source wallet software such as Bitcoin Core or Electrum to generate your entropy/key pairs/seed phrase.

This sounds like a great idea and thanks for the knowledge transfer. Could you elaborate more? I am interested in what you say. What devices are you referring to? Can you give me specific mentions? I know what airgaped means, but I thought my coldcard already meets these criteria

[dkbit98]

So, how can a hardware wallet be a better option than a paper wallet?

With hardware wallets you can generate multiple addresses, send coins quickly, make additional passphrases, create multisig setup, etc.
Paper wallets are still usable but they are used much less nowadays, there is nothing wrong if you use both of this options.

I know, that a simple piece of paper can be damaged or lost, but, apart from that, how can it be hacked ?

You obviously can't hack paper, but someone can find them, duplicate or take picture of them and steal your coins.
Paper wallets are lately used a lot in scamming people, there was many reported cases in Australia, scammers tricked people in thinking they found free bitcoins.
This means that paper wallets have been used to make phishing attacks with success.

Alternatively, I could save the keys on 2-3 usb sticks and then protect the usb sticks, in order to avoid every point of paper failure (i.e ink stains, water etc). Isn't that extremely safe ? Am I missing something here ?

USB sticks are worse than paper, and I prefer keeping backups in physical form, not in digital.

[Vampobit]

So, how can a hardware wallet be a better option than a paper wallet?

With hardware wallets you can generate multiple addresses, send coins quickly, make additional passphrases, create multisig setup, etc.
Paper wallets are still usable but they are used much less nowadays, there is nothing wrong if you use both of this options.

I know, that a simple piece of paper can be damaged or lost, but, apart from that, how can it be hacked ?

You obviously can't hack paper, but someone can find them, duplicate or take picture of them and steal your coins.
Paper wallets are lately used a lot in scamming people, there was many reported cases in Australia, scammers tricked people in thinking they found free bitcoins.
This means that paper wallets have been used to make phishing attacks with success.

Alternatively, I could save the keys on 2-3 usb sticks and then protect the usb sticks, in order to avoid every point of paper failure (i.e ink stains, water etc). Isn't that extremely safe ? Am I missing something here ?

USB sticks are worse than paper, and I prefer keeping backups in physical form, not in digital.

As far as I have understood, paper wallets act mainly as deposit accounts, where the optimal usage is to accumulate BTC and make as less withdrawals as possible. Am I correct?

[hosseinimr93]

As far as I have understood, paper wallets act mainly as deposit accounts, where the optimal usage is to accumulate BTC and make as less withdrawals as possible. Am I correct?

What matters is how you generated your wallet and how you use it.
If you generate your paper wallet and use it in the correct way, you can send fund from your wallet whenever you want without any problem.
In the case you generate your paper wallet in the incorrect way, your fund may be stolen even if you have never sent any fund from that.

[witcher_sense]

As far as I have understood, paper wallets act mainly as deposit accounts, where the optimal usage is to accumulate BTC and make as less withdrawals as possible. Am I correct?

Paper wallets are more like login/password for your banking application; you can use them to access your deposit account, but they themselves don't provide you an option to withdraw funds. I mean, you still need a banking application with UI you can interact with to do manipulations with your balance. That's the main drawback of paper wallets: with them, you need to always rely on external (and probably insecure) software to sign and broadcast your transactions. Hardware wallets are way better in this sense because no matter what software you will choose, the private keys remain isolated on a device's secure element, whereas paper wallets hold private keys in the open. If in doubt, then paper wallets are definitely not for you. At least for now. Keep it simple and buy a reliable device created by people who are experts in security but choose only with open-source codebase.

[Vampobit]

As far as I have understood, paper wallets act mainly as deposit accounts, where the optimal usage is to accumulate BTC and make as less withdrawals as possible. Am I correct?

Paper wallets are more like login/password for your banking application; you can use them to access your deposit account, but they themselves don't provide you an option to withdraw funds. I mean, you still need a banking application with UI you can interact with to do manipulations with your balance. That's the main drawback of paper wallets: with them, you need to always rely on external (and probably insecure) software to sign and broadcast your transactions. Hardware wallets are way better in this sense because no matter what software you will choose, the private keys remain isolated on a device's secure element, whereas paper wallets hold private keys in the open. If in doubt, then paper wallets are definitely not for you. At least for now. Keep it simple and buy a reliable device created by people who are experts in security but choose only with open-source codebase.

Well for now I have a coldcard and I am happy with it. But, my next project will be to create my own key pair generator and create my own paper wallet and keep it eternally, only depositing btc and never withdrawing

[hosseinimr93]

But, my next project will be to create my own key pair generator and create my own paper wallet and keep it eternally, only depositing btc and never withdrawing

It may be better to generate a seed phrase and have a HD wallet instead of dealing with a single private key and a single address. In this way, you can have numerous addresses all generated from a seed phrase. Using a same address for all your transactions may not be good for your privacy.

[TalkativeCoin]

I'm more fond of having a paper wallet for some reason (practicality, probably?). I still have my Ledger sitting unpacked, I thought that I was going to do it, but in the end, I gave up.

[o_e_l_e_o]

Could you elaborate more? I am interested in what you say. What devices are you referring to? Can you give me specific mentions?

You can use any old computer as an airgapped device to either run a digital cold wallet, or to securely generate paper wallets. An old desktop or laptop works well. I always suggest opening up the device in question and physically removing any connectivity hardware, such as ethernet cards, WiFi cards, Bluetooth chips, etc. That way you can be certain you will never accidentally connect to a network and risk your data or your coins. Once you've done that, you should format the device and install a good open source Linux distro of your choosing.

Once you have a permanently airgapped device, then you can install software such as Bitcoin Core or Electrum to generate and run an airgapped wallet. You would create a complementary watch only wallet which contains only your public keys or addresses on your internet connected computer in order to watch your addresses for incoming transactions and so on. You can then use this watch only wallet to create unsigned transactions, move the unsigned transaction to your airgapped device via either QR codes or a USB drive to be signed, and then move the signed transactions back again to be broadcast to the network.

Alternatively, you can use your airgapped device to generate paper wallets. For paper wallets, I much prefer using a seed phrase to generate an entire wallet rather than a single key pair for a variety of reasons. It means I can have multiple addresses rather than just one, which is better for privacy. I can create my paper wallet by writing down a seed phrase accurately by hand. Writing down a key pair is prone to errors, and printing a key pair adds additional risk in that the printer may be WiFi capable or have internal storage and so on. Importing a seed phrase also avoids the risk of importing a private key to some software which will send your change to an address you do not have saved anywhere and will therefore be lost. To spend from the paper wallet it should only ever be imported back on to your airgapped device and spent from in the same way I described above for a digital cold wallet.

I know what airgaped means, but I thought my coldcard already meets these criteria

Yes, a ColdCard is an airgapped hardware wallet.

As far as I have understood, paper wallets act mainly as deposit accounts, where the optimal usage is to accumulate BTC and make as less withdrawals as possible. Am I correct?

I would agree with this. Every time you have to go and get your paper wallet out of its secure storage location and import it in to a digital device in order to make a transaction from it, there are risks involved. The fewer times you do this, the less risk.

[Vampobit]

Alternatively, you can use your airgapped device to generate paper wallets. For paper wallets, I much prefer using a seed phrase to generate an entire wallet rather than a single key pair for a variety of reasons. It means I can have multiple addresses rather than just one, which is better for privacy. I can create my paper wallet by writing down a seed phrase accurately by hand. Writing down a key pair is prone to errors, and printing a key pair adds additional risk in that the printer may be WiFi capable or have internal storage and so on. Importing a seed phrase also avoids the risk of importing a private key to some software which will send your change to an address you do not have saved anywhere and will therefore be lost. To spend from the paper wallet it should only ever be imported back on to your airgapped device and spent from in the same way I described above for a digital cold wallet.

Thanks to your guidance and info from previous posts, I have identified that my key-pair generator was based on a completely wrong implementation haha! Need to start it over...