Paper wallet on Android phone

[Oshosondy]

I have a friend that wants to buy bitcoin, he wants to hold it for a very long time, he has no device he can use for it and only what I can think about now is for him to go for a paper wallet and he accepted after I explained about it to him, but the problem is that he does not have a computer at all. What I think he should do is to create a paper wallet, but he does not have the device which he can use.

He has an Android phone and he is ready to format it to make the phone look like new, install a bitcoin wallet on it offline and use it to create a paper wallet. The problem is that he can not remove the bluetooth and wifi, he can just only not enable them and make the phone to be offline. Is that not enough to create a paper wallet?

After he use that to create a paper wallet, he will format the phone again.

[1714881135]

1714881135

[1714881135]

1714881135

[1714881135]

1714881135

[1714881135]

1714881135

[1714881135]

1714881135

[o_e_l_e_o]

Without a computer, this is probably the best he can realistically achieve.

What software is he planning to use to generate his wallet? Probably the simplest method would be to use Electrum.

I would then start by putting tape over any cameras on the phone, and doing the rest of the process is an empty room with no other electronic devices and curtains closed. Format an SD card in advance. Then, format the phone, let it boot up, connect to your WiFi, download and verify the Electrum .apk, and transfer it to the SD card and remove the SD card. Then, format the phone again. This time, as soon as possible after the phone has restarted ensure everything is turned off - WiFi, mobile data, Bluetooth, NFC, etc. Turn on airplane mode. Bonus points if he can make some kind of Faraday box to put the phone in while he is doing all this. Install Electrum from the SD card. Use it to generate a wallet, and then write down by hand the seed phrase and a couple of receiving addresses. Then create a new wallet on Electrum, enter the seed phrase from the hand written back up he just made and double check it generates the same addresses as he has written down. Format the SD card and then the phone.

[dkbit98]

After he use that to create a paper wallet, he will format the phone again.

Dude, phone can't be a paper... ever. 
He can use his old phone (or cheap laptop) as offline wallet and that will work just fine in most cases, it's enough to reset the phone, and install one Bitcoin wallet app.
Then he should remove sim card, turn of wifi and bluetooth, and enable airplane mode, and use QR codes for communication with other devices.
Some people are going extra measure and they are removing components from phones, but I don't think that is needed.

Better option than old smartphone are hardware wallets, he can make his own DIY signing device that are very cheap (starting from few $) or buy official hardware wallet devices (starting from $50).
There are even hardware wallets in form of credit cards, that are cheap and very secure, they can be used in combination with smatphones for making transactions.

[Welsh]

Manuel generation might be worth considering. However, since they're a new user to Bitcoin it might be suspect to errors, which could be problematic. I'm just not sure I'd trust the hardware on a phone. Obviously, tons of people have hot wallets on a phone, and ultimately to trust them.

Format an SD card in advance.

Under a secure environment. Technically, without a computer formatting the SD card might be difficult, because you've got to trust that the phone is actually wiping that SD card clean. Usually, this is handled through the manufacturers recovery process. Depending on your device, you can access it through holding the power button, and one of the volume buttons at boot up. You can do it via the Android wiping process, however personally I prefer writing via /dev/random whenever possible.

I suppose you also have to trust the computer hardware you're using, and ultimately you have t connect the phone to that trusted computer, which could potentially then become untrusted.

format the phone

While, taking the above into consideration it also applies to formatting the actual phone. Again, the manufacturers recovery partition is usually responsible for this. When you want to install a custom ROM on a phone, you usually replace this recovery partition with a custom one, especially if you're concerned about security, since even when formatting the phone completely, certain manufacturer partitions remain untouched, as well as the recovery. Some of which, make sense since phones usually have custom functions within their machine code to actually work.

So, you've got to trust the hardware in the first place, since even wiping the operating system doesn't wipe all partitions on the phone, just the system or sometimes refereed to as boot.

I'd probably even potentially recommend a custom ROM for the process, one that doesn't rely on Google Play being installed. Might help with privacy considering that phone has to go online at some point to download Electrum. Something like Aurora Store via F-Droid to download it instead.

Is that not enough to create a paper wallet?

It probably is for most people. Plenty of people do it this way, and we don't hear about people losing their Bitcoin on mass. So, it's probably okay. If you really want to dive down the rabbit hole, there's a few security issues which might be raised, but honestly there's no perfect way of doing it, since for most methods you have to trust something or some hardware at some point. Even if you manually generate the private key / seed, which is prone to errors, and there's potential security concerns about the way it's generated, i.e making sure it's random. However, there's also the issue of verification, the only way you can verify it is via importing the seed or private key, into hardware.

[Pmalek]

<Snip>

I have two questions.
 
1. Why put tape over the phone's camera? It can't record your screen or your keyboard, and since the person has already used this phone before, he might have taken numerous pictures of himself and others around him. Is it because Electrum requires camera permissions (for scanning QR codes)? Do you have reasons to believe the camera access can be used for something else? In that case the proof must be in the code.

2. What happens with the phone afterwards? If the person will use it with all its features as a normal smartphone, can we really trust that all sensitive data got wiped with the last format? 

[o_e_l_e_o]

1. Why put tape over the phone's camera? It can't record your screen or your keyboard

No, but it could record his hand written seed phrase. No reason to take the risk when the solution is so trivial.

If the person will use it with all its features as a normal smartphone, can we really trust that all sensitive data got wiped with the last format?

No, you can't. Ideally the phone is either destroyed or remains permanently airgapped from now on (although I am of the belief that without physically opening the phone and removing the necessary hardware a phone is never truly airgapped). However, that does not appear to be an option here, just as the additional steps proposed by Welsh (such as writing over the SD card with junk data from /dev/urandom or accessing the recovery partition) are also not an option here, since there is no computer involved.

As I said above, if OP's friend has a single phone and nothing else, then "this is probably the best he can realistically achieve".

[Pmalek]

No, but it could record his hand written seed phrase. No reason to take the risk when the solution is so trivial.

I see. Do you believe this could be an accidental recording done by the user or something malicious by the phone system or one of the pre-installed Google bloatware on it? If we go back to the Android being open-source, that's the place to look for those who know how to. I doubt any of the pre-installed Google apps are or anything else you install from Google that requires camera permissions. It's not a secret that Facebook and Google record everything you say and then you see ads of the things you talked about on social media for example. 

[Welsh]

I see. Do you believe this could be an accidental recording done by the user or something malicious by the phone system or one of the pre-installed Google bloatware on it?  

These days, Android lets you know when your camera is being used, however the question is do you trust Google? Also, it's worth mentioning, that a lot of phones are actually not unaltered stock Android, instead the manufacturer will install their own system applications on the phone. For example, I used to have a phone which had certain survivial tools preinstalled on it. That came preinstalled on their phones, so I knew that the operating system they were delivering the phones with was altered by them. So, obviously the next step is uninstall, and install a custom ROM on it.

However, it's quite possible that the manufacturer could actually disable this notification when applications are using your camera. I only know this since, a custom ROM implemented it incorrectly, and it wasn't displaying. So, it isn't out of the possibility that a malicious vendor, or manufacturer could do this. If you aren't buying directly from the manufacturer itself, then the third party could easily install a custom ROM intended for malicious purposes.

In short, yeah I believe a malicious actor could potentially monitor your camera for malicious purposes, and it's probably been done.

It comes down to this; do you trust:
- The Manufacturer
- Whoever you bought the phone from
- Google
- Custom ROM developer

You can verify if your Android is stock through a few ways. A lot of ROMS have issues being a certified Google device, however that can be faked. There's also a lot of ROMs which don't change certain things like the version they used. For example, a lot of custom ROMS are built via AOSP treble, and that leaves behind some custom settings, but also some fingerprinting in terms of version name etc.

If we go back to the Android being open-source, that's the place to look for those who know how to. I doubt any of the pre-installed Google apps are or anything else you install from Google that requires camera permissions. It's not a secret that Facebook and Google record everything you say and then you see ads of the things you talked about on social media for example.  

The preinstalled applications aren't open source, the operating system is at least open source. Things like the SIM card tool, and a number of other system applications aren't open source. Maps, Play Store etc aren't open source. Technically, any one of these could compromise the isolation that Android typically has, since it's been implemented by Google themselves, and a lot of the are system applications which have a little more capability compared to ordinary user installed applications.

It's not a secret that Facebook and Google record everything you say and then you see ads of the things you talked about on social media for example.  

Right, my attitude is anything that you can't verify yourself, shouldn't be entirely trusted. Now, going back to the question of the OP; Would I feel comfortable generating a seed on a phone? It entirely depends on the use, if it's a hot wallet only used for storing small amounts, probably. If it's for a cold storage wallet, I'd probably explore alternatives before resorting to this. I'd feel more comfortable with Google Play removed, and a lot of the Google services, i.e using a custom ROM, mainly due to privacy issues rather than malicious suspicions though. Since, ultimately I'm not a massive target.

Also, worth noting the very camera application on your phone, likely is closed source. I use OpenCamera as an alternative, but you don't get features that come with the preinstalled camera application. You can use adb to potentially remove any unwanted applications that can't be uninstalled from within the operating system.

Ultimately, it depends on how far you want to go down the rabbit hole. We know, keeping a clean slate in terms of privacy, and security from the big companies like Google is almost impossible. Almost all of this implies to your computer hardware as well though. Since, you have to ultimately trust Microsoft, Intel, AMD, and the manufacturer. You can replace the operating system, just like a phone, but you ain't replacing the machine code that the computer runs on.

After he use that to create a paper wallet, he will format the phone again.

Not too worry you or your friend too much, most of this is rather into it; it's not exactly something that a normal user will worry about, and honestly most people aren't even thinking about this sort of stuff, and plenty of users here have mobile phone wallets which haven't been compromised.

So, it's probably safe enough, unless you're a very big target to malicious attackers or companies. Even, then it's based on pure speculation. Most of us trust our computers to generate our private keys.

Anyhow, what I would recommend your friend do is; make sure he formats it with random data, and not simply using the format option via the operating system or recovery partition.

[NeuroticFish]

He has an Android phone and he is ready to format it to make the phone look like new, install a bitcoin wallet on it offline and use it to create a paper wallet. The problem is that he can not remove the bluetooth and wifi, he can just only not enable them and make the phone to be offline. Is that not enough to create a paper wallet?

After he use that to create a paper wallet, he will format the phone again.

I would do something extra. After creating the useful paper wallet, writing it down (including address), I would ... create one more wallet (with the same name, if asked).
The point is that there's a chance that if you do this the old wallet file gets already overwritten.
I would also format the phone afterwards, but it's known that phone format is not perfect and may be missing some files (I don't know more details, hence that extra step of mine, which may or may not be useful).

[Pmalek]

In short, yeah I believe a malicious actor could potentially monitor your camera for malicious purposes, and it's probably been done.

Do we have any reports it has happened to crypto users or that they have been targeted by whatever party was interested in obtaining their sensitive data? It's not easy to prove and probably not documented so people can only speculate if it's happening and how.

[LoyceV]

He has an Android phone and he is ready to format it to make the phone look like new, install a bitcoin wallet on it offline and use it to create a paper wallet. The problem is that he can not remove the bluetooth and wifi, he can just only not enable them and make the phone to be offline. Is that not enough to create a paper wallet?

After he use that to create a paper wallet, he will format the phone again.

I've had a funded Bitcoin wallet on my phone for years, and never lost anything. Installing the wallet offline, writing down the seed words, funding the address, and wiping the phone again will probably be okay. But you'll never be 100% sure.

Has "your friend" thought about how he wants to proceed in the future, when he wants to use his funds? If that includes using the same phone as a hot wallet, it gets riskier. Offline signing is the safest, but I've never done that on a phone.

[o_e_l_e_o]

Do you believe this could be an accidental recording done by the user or something malicious by the phone system or one of the pre-installed Google bloatware on it?

Either.

I doubt any of the pre-installed Google apps are or anything else you install from Google that requires camera permissions.

You would probably be wrong here. Most phones come with a ton of bloatware, not just from Google, but from the phone manufacturer and bunch of their third party buddies who pay to get their bloatware on to your device. Some of this bloatware can be uninstalled, but much cannot without rooting your phone, which most people don't do. Open your phone settings and go to the permissions section and see just how many apps want access to your camera. I think you'd be surprised. Next time you have your hands on a brand new phone, do the same thing. I would expect at least a dozen pieces of software wanting access to your camera, and those are only the ones the OS is showing you, never mind all the hidden system apps and software.

Offline signing is the safest, but I've never done that on a phone.

Easily done with Electrum on Android - import an unsigned transaction via QR code, sign it, then display a QR code for export.

[Welsh]

Do we have any reports it has happened to crypto users or that they have been targeted by whatever party was interested in obtaining their sensitive data? It's not easy to prove and probably not documented so people can only speculate if it's happening and how.

Crypto users, not that I'm aware of. There's probably easier ways than to use the camera specifically, since the camera would likely yield unreliable results. It would likely be easier to just install an app which monitors the screen rather than utilizing the camera or compromising the keyboard, which the majority of users use Gboard. However, when users report that they've lost their Bitcoin on their phone, I don't think any official, actual fair reviews have looked at what caused it.

Yeah, it's pure speculation, and I mainly wanted to highlight it's a possibility, and exactly how. There's been reports here which were pre installed by the manufacturer. Although, they tend to be for serving adverts or gathering data.

However, since we know malware is a problem on devices, whether preinstalled or not; it's only a matter of time before we hear about a crypto related attack.

[LoyceV]

Easily done with Electrum on Android - import an unsigned transaction via QR code, sign it, then display a QR code for export.

QR-codes are more or less black boxes to humans. I wouldn't feel comfortable without at least verifying the QR-code with a different (offline) QR-code reader to confirm actually signed what I wanted.
But at least it's possible, so that gives options

[o_e_l_e_o]

QR-codes are more or less black boxes to humans. I wouldn't feel comfortable without at least verifying the QR-code with a different (offline) QR-code reader to confirm actually signed what I wanted.

Once you scan the QR code with your airgapped Android Electrum, it loads the transaction on your screen so you can see the addresses, amounts, fee, and so on, so you can easily double check what you have scanned before you sign it. Similarly, you can do the same thing when you scan the QR code of your now signed transaction to be able to double check what you are about to broadcast. You could even just scan the QR code of the signed transaction and decode it immediately, manually double check the decoded transaction, and then broadcast it via your own node or somewhere like https://mempool.space/tx/push.

[Pmalek]

You would probably be wrong here. Most phones come with a ton of bloatware, not just from Google, but from the phone manufacturer and bunch of their third party buddies who pay to get their bloatware on to your device. Some of this bloatware can be uninstalled, but much cannot without rooting your phone, which most people don't do. Open your phone settings and go to the permissions section and see just how many apps want access to your camera. I think you'd be surprised. Next time you have your hands on a brand new phone, do the same thing. I would expect at least a dozen pieces of software wanting access to your camera, and those are only the ones the OS is showing you, never mind all the hidden system apps and software.

I went back and re-read my post you quoted and I see that I didn't express myself properly. You seem to have gotten the opinion that I was trying to say that not many phone apps require camera access. I know they do. I have manually removed all kinds of permissions (not just the ones requiring access to the camera). Some have to remain though for the underlying apps to function properly unless you turn permissions on whenever you want to use an app and turn it back off afterwards.

I wanted to say that the Android OS is open-source but the Google bloatware and apps by other services aren't. If the system takes random pictures, those who know how to read code should be able to find that in the codebase. It would make Android look really bad if someone discovered something like that. But looking at the code isn't possible with the standard Google apps where you remain in the dark. 

[o_e_l_e_o]

Ahh yes, I misunderstood. I thought you were saying such apps didn't require camera access, rather than such apps are not open source.

But yes, I agree. Even if you decide you trust the Google apps which are bundled with Android (which is insane given their consistent history of invading your privacy and harvesting your data at every level), the amount of third party bloatware on most new phones is staggering. And as I said above, while the average user can uninstall some of it, much of it cannot be removed without root access.

It's one of the reasons why I dislike using phones for any serious money, and the fact that it is significantly harder, if not impossible, to truly airgap a phone. There is no doubt that OP's friend would achieve better security with an airgapped computer running a live OS, but if a phone is the only option, then it makes sense to cover the cameras.

[Lida93]

I have a friend that wants to buy bitcoin, he wants to hold it for a very long time, he has no device he can use for it and only what I can think about now is for him to go for a paper wallet and he accepted after I explained about it to him, but the problem is that he does not have a computer at all. What I think he should do is to create a paper wallet, but he does not have the device which he can use.

He has an Android phone and he is ready to format it to make the phone look like new, install a bitcoin wallet on it offline and use it to create a paper wallet. The problem is that he can not remove the bluetooth and wifi, he can just only not enable them and make the phone to be offline. Is that not enough to create a paper wallet?

After he use that to create a paper wallet, he will format the phone again.

A colleague had similar issue and confiding in me I had to suggest he buys a London used computer which ranges around $50-$80 here my part of Africa, for they are very cheaper compared to a brand new one. He got the computer then completely formatted it to a brand new and used it to create the wallet. Since then I haven't gotten any complained from him relating to it, So i assume it worked out well for him.

OP I assume your friend should be able to afford it too since it's cheaper compared to owning a brand new computer, and it's also an alternative for your friend to avoid losing all his informations and data on his android phone by formatting it. For someone that plans to buy a good amount of bitcoin and hold for a long time then this suggestion isn't a bad one compared to using an android phone.

[Synchronice]

I have a friend that wants to buy bitcoin, he wants to hold it for a very long time, he has no device he can use for it and only what I can think about now is for him to go for a paper wallet and he accepted after I explained about it to him, but the problem is that he does not have a computer at all. What I think he should do is to create a paper wallet, but he does not have the device which he can use.

He has an Android phone and he is ready to format it to make the phone look like new, install a bitcoin wallet on it offline and use it to create a paper wallet. The problem is that he can not remove the bluetooth and wifi, he can just only not enable them and make the phone to be offline. Is that not enough to create a paper wallet?

After he use that to create a paper wallet, he will format the phone again.

How long is that long-term holding? And why should your friend remove bluetooth or wifi parts? I think that's excessive. I don't think that this process should turn into obsessive compulsive disorder. If you bought smartphone in store, if you have never visited malicious websites and have never downloaded malwares manually, I think that your friend will be fine by resetting it and creating a wallet. I don't think that normal person is a victim advanced espionage.

Btw if I had to create a bitcoin wallet where I would hold a lot of bitcoin for a long time, I would use old PC, with old monitor, reinstall old OS from old disks/flash cards and create an address from that computer.

Maybe I'm wrong but if I had to hold a lot of bitcoins, I mean higher than 100, I wouldn't trust modern PCs or Smartphones in any way. But anyways, if he wants to hold 1-10 bitcoin, I genuinely believe he doesn't have to act so cautiously.

[LoyceV]

If you bought smartphone in store, if you have never visited malicious websites and have never downloaded malwares manually

That's quite an assumption! The thing is: you can never know for sure. And when creating cold storage, being wrong means losing your money.

I think that your friend will be fine by resetting it and creating a wallet.

I think so too. But I prefer to know for sure, which means not taking any risks.

if I had to hold a lot of bitcoins, I mean higher than 100, I wouldn't trust modern PCs or Smartphones in any way. But anyways, if he wants to hold 1-10 bitcoin, I genuinely believe he doesn't have to act so cautious.

I see no reason to be less careful with 1 Bitcoin than with 100 Bitcoins.