Do i need Electrum’s latest version

[dufresne]

I turned one of my old mobile phones into an airgapped device a few years ago and installed Electrum. I know it might not be the best setup and i would probably be safer if i did this on a PC, but this is what is, or was available to me and i did it this way.

I have the phone in airplane mode, i don’t use bluetooth or Wifi on the device, and other than the fact that mobile devices can’t be airgapped by design, i think i am comfortable with my setup.

But i am worried about a few things and i really need your recommendations. My cold storage is at version 4.0.9.

• What is the security risk in using such an older version?
• Do i need to update my Electrum to a newer version to feel safer?
• Can i just continue using this older version without any risks?
• Now this is the most important question: if i must update Electrum to the newest version, what is the safest way to do it offline, without my keys touching the internet?
• My mobile phone is also a really old phone, does that even make me less secure?

[OmegaStarScream]

All of the changes can be found here: https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES

The version you're using was released in December 2020. I don't believe there are any serious vulnarabilities but it's probably a good idea to update, it's been 6 years after all.

For updating the wallet, I guess the proper way to do it would be to download it from another device (your computer for example) and then (after verifying it) transferring the .apk using a USB cable, microSD, etc. Just make sure you have your seedphrase with you before installing the new wallet.

As for your device being old, and given that it's offline, I would imagine that you have missed few security updates from your manufacturer, but I wouldn't be too paranoid about it.

If your concern is about the newest update (4.8.1) then using an older version is not that much of a problem. From my understanding, this is about submarine swaps which were only introduced in Android at 4.1.0

https://x.com/ElectrumWallet/status/2087808003663687759

[dufresne]

If your concern is about the newest update (4.8.1) then using an older version is not that much of a problem.

No, that is not my concern. This is just something i have been thinking about for a while now, and a bit worried if i am doing everything right by having a really older version as my cold wallet. I have Electrum up-to-date in my watch-only/spending wallet, so i see all of the added features and minor fixes, but they are not really necessary in a cold wallet.

The version you're using was released in December 2020. I don't believe there are any serious vulnarabilities

So in other words, as long as there were no serious vulnerabilities found in that version of Electrum, that had to be patched up in subsequent versions, it is safe to use it and there can be no surprises sometime in the future? Forgive my paranoia, based on my financial level, i have a lot of money in the wallet.

For updating the wallet, I guess the proper way to do it would be to download it from another device (your computer for example) and then (after verifying it) transferring the .apk using a USB cable, microSD, etc. Just make sure you have your seedphrase with you before installing the new wallet.

I think i’d go with this. As long as i download the right Electrum and confirm my backup, i believe i should be fine.

[nc50lc]

So in other words, as long as there were no serious vulnerabilities found in that version of Electrum, that had to be patched up in subsequent versions, it is safe to use it and there can be no surprises sometime in the future?

For that, bookmark their Github Repo's security tab for the disclosed security patches and the affected versions.
You can open each entry to see the affected versions and when it's fixed.
Here: github.com/spesmilo/electrum/security

To summarize; only 1 out of those 5 is active in your cold-storage Electrum version but it's not directly affected since it's for malicious BIP70 invoice which is a problem only if your watch-only wallet is also outdated.
Since you've updated you online Electrum, the setup should be fine.

[pooya87]

Unless you are actually facing an issue with the wallet, I wouldn't bother updating it since the biggest flaw in your setup is not the version of the software, it is the fact that you are using a smart phone that by design cannot be considered a cold storage at all.

But generally speaking, deciding whether to upgrade a cold storage software depends on the way you are using it. Usually people use it to generate a set of keys, get an address or two to send coins to it. That's all. So for them, there is no need to upgrade. Nothing has changed ever since 4.0.9 (or even older) until today.
For spending from the cold storage, the situation is similar with small changes. If you go through the Release-Notes file you can see most of the times, the bugs they fix involve hardware wallets and majority of the rest don't impact the way people want to use the software as a cold storage.

[dufresne]

Unless you are actually facing an issue with the wallet, I wouldn't bother updating it since the biggest flaw in your setup is not the version of the software, it is the fact that you are using a smart phone that by design cannot be considered a cold storage at all.

I an not facing any issues with the wallet, it works well for me. I know that a mobile phone can’t be considered as cold storage, but i want to believe the risk is minimal, since the phone is not used for any internet activity. I would have done this with a pc, but i do not have an old one. How safe is it to buy a pre-owned laptop and turn it into my cold device, what would i need to do to be sure none of the previous owner’s actions affect me?

For spending from the cold storage, the situation is similar with small changes.

I only use my cold device to sign transactions. I transfer the unsigned transactions through QR code from my online wallet, and after signing, i send it back through the same means, to broadcast it.

[pooya87]

You don't need a dedicated PC/Laptop for a cold storage. You can use your existing PC but booted from a live Linux from a removable disk. If you are familiar with Linux or are willing to spend the time to learn it, you can even create your very own "hardware" wallet that can boot from.
That would require:
- Installing a Linux OS on a USB disk (partitioning and formatting the USB disk using EXT)
- Encrypting it so that nobody except you can boot into it (disabling guess user, etc.)
- Modifying some settings so that there is no network access, no mounting the disks, etc.
- Installing Electrum on it and encrypting your wallet as an additional layer of security

Here is a very old topic that gives you the idea of what you can do:
https://bitcointalk.org/index.php?topic=853288.0