Do i need Electrum’s latest version

[dufresne]

I turned one of my old mobile phones into an airgapped device a few years ago and installed Electrum. I know it might not be the best setup and i would probably be safer if i did this on a PC, but this is what is, or was available to me and i did it this way.

I have the phone in airplane mode, i don’t use bluetooth or Wifi on the device, and other than the fact that mobile devices can’t be airgapped by design, i think i am comfortable with my setup.

But i am worried about a few things and i really need your recommendations. My cold storage is at version 4.0.9.

• What is the security risk in using such an older version?
• Do i need to update my Electrum to a newer version to feel safer?
• Can i just continue using this older version without any risks?
• Now this is the most important question: if i must update Electrum to the newest version, what is the safest way to do it offline, without my keys touching the internet?
• My mobile phone is also a really old phone, does that even make me less secure?

[OmegaStarScream]

All of the changes can be found here: https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES

The version you're using was released in December 2020. I don't believe there are any serious vulnarabilities but it's probably a good idea to update, it's been 6 years after all.

For updating the wallet, I guess the proper way to do it would be to download it from another device (your computer for example) and then (after verifying it) transferring the .apk using a USB cable, microSD, etc. Just make sure you have your seedphrase with you before installing the new wallet.

As for your device being old, and given that it's offline, I would imagine that you have missed few security updates from your manufacturer, but I wouldn't be too paranoid about it.

If your concern is about the newest update (4.8.1) then using an older version is not that much of a problem. From my understanding, this is about submarine swaps which were only introduced in Android at 4.1.0

https://x.com/ElectrumWallet/status/2087808003663687759

[dufresne]

If your concern is about the newest update (4.8.1) then using an older version is not that much of a problem.

No, that is not my concern. This is just something i have been thinking about for a while now, and a bit worried if i am doing everything right by having a really older version as my cold wallet. I have Electrum up-to-date in my watch-only/spending wallet, so i see all of the added features and minor fixes, but they are not really necessary in a cold wallet.

The version you're using was released in December 2020. I don't believe there are any serious vulnarabilities

So in other words, as long as there were no serious vulnerabilities found in that version of Electrum, that had to be patched up in subsequent versions, it is safe to use it and there can be no surprises sometime in the future? Forgive my paranoia, based on my financial level, i have a lot of money in the wallet.

For updating the wallet, I guess the proper way to do it would be to download it from another device (your computer for example) and then (after verifying it) transferring the .apk using a USB cable, microSD, etc. Just make sure you have your seedphrase with you before installing the new wallet.

I think i’d go with this. As long as i download the right Electrum and confirm my backup, i believe i should be fine.

[nc50lc]

So in other words, as long as there were no serious vulnerabilities found in that version of Electrum, that had to be patched up in subsequent versions, it is safe to use it and there can be no surprises sometime in the future?

For that, bookmark their Github Repo's security tab for the disclosed security patches and the affected versions.
You can open each entry to see the affected versions and when it's fixed.
Here: github.com/spesmilo/electrum/security

To summarize; only 1 out of those 5 is active in your cold-storage Electrum version but it's not directly affected since it's for malicious BIP70 invoice which is a problem only if your watch-only wallet is also outdated.
Since you've updated you online Electrum, the setup should be fine.

[pooya87]

Unless you are actually facing an issue with the wallet, I wouldn't bother updating it since the biggest flaw in your setup is not the version of the software, it is the fact that you are using a smart phone that by design cannot be considered a cold storage at all.

But generally speaking, deciding whether to upgrade a cold storage software depends on the way you are using it. Usually people use it to generate a set of keys, get an address or two to send coins to it. That's all. So for them, there is no need to upgrade. Nothing has changed ever since 4.0.9 (or even older) until today.
For spending from the cold storage, the situation is similar with small changes. If you go through the Release-Notes file you can see most of the times, the bugs they fix involve hardware wallets and majority of the rest don't impact the way people want to use the software as a cold storage.

[dufresne]

Unless you are actually facing an issue with the wallet, I wouldn't bother updating it since the biggest flaw in your setup is not the version of the software, it is the fact that you are using a smart phone that by design cannot be considered a cold storage at all.

I an not facing any issues with the wallet, it works well for me. I know that a mobile phone can’t be considered as cold storage, but i want to believe the risk is minimal, since the phone is not used for any internet activity. I would have done this with a pc, but i do not have an old one. How safe is it to buy a pre-owned laptop and turn it into my cold device, what would i need to do to be sure none of the previous owner’s actions affect me?

For spending from the cold storage, the situation is similar with small changes.

I only use my cold device to sign transactions. I transfer the unsigned transactions through QR code from my online wallet, and after signing, i send it back through the same means, to broadcast it.

[pooya87]

You don't need a dedicated PC/Laptop for a cold storage. You can use your existing PC but booted from a live Linux from a removable disk. If you are familiar with Linux or are willing to spend the time to learn it, you can even create your very own "hardware" wallet that can boot from.
That would require:
- Installing a Linux OS on a USB disk (partitioning and formatting the USB disk using EXT)
- Encrypting it so that nobody except you can boot into it (disabling guess user, etc.)
- Modifying some settings so that there is no network access, no mounting the disks, etc.
- Installing Electrum on it and encrypting your wallet as an additional layer of security

Here is a very old topic that gives you the idea of what you can do:
https://bitcointalk.org/index.php?topic=853288.0

[Yamane_Keto]

• My mobile phone is also a really old phone, does that even make me less secure?

The main concern is that this phone might fail, requiring frequent charging, and there's also the risk of theft since these phones are less secure against physical attacks. Booting from a live Linux distribution using a removable disk, while keeping the seeds in a safe place, is a better option.

[SilverCryptoBullet]

You don't need a dedicated PC/Laptop for a cold storage. You can use your existing PC but booted from a live Linux from a removable disk. If you are familiar with Linux or are willing to spend the time to learn it, you can even create your very own "hardware" wallet that can boot from.
That would require:
- Installing a Linux OS on a USB disk (partitioning and formatting the USB disk using EXT)
- Encrypting it so that nobody except you can boot into it (disabling guess user, etc.)
- Modifying some settings so that there is no network access, no mounting the disks, etc.

Using Tail OS is good for security and wallet purpose.
How to Install Tails OS on USB flash drive for Wallet Purpose.

- Installing Electrum on it and encrypting your wallet as an additional layer of security

For security purpose, and people don't actually have to be paranoid to learn more about security and have better security practice for their devices and wallets.
The paranoid user's security guide for using Electrum safely.

Security is very vital for keeping devices and wallets safe from any hacks, exploitations.

[dufresne]

The main concern is that this phone might fail, requiring frequent charging, and there's also the risk of theft since these phones are less secure against physical attacks.

Those are really not my main concern, because i have my seed phrase written down. If my phone fails, i would just restore my wallet into a new device.

- Installing Electrum on it and encrypting your wallet as an additional layer of security

I have not tried this method before, but i think it would be a good way to spend my time learning about it. Thank you!

[LoyceV]

I an not facing any issues with the wallet, it works well for me.

I'd say "Don't fix it if it ain't broken!" applies. You have nothing to gain and everything to lose.

How safe is it to buy a pre-owned laptop and turn it into my cold device, what would i need to do to be sure none of the previous owner’s actions affect me?

This is what I would do: get a second hand business laptop (a few years old), preferrably with working battery, low-power CPU and 8 GB RAM. By now all of them should come with SSD. Depending on where you live this can be cheaper than a hardware wallet.
Wipe the laptop, install Linux, keep it offline. Encrypt the drive if you're sure you won't forget the password. Create, test and securely store your backups before funding a wallet.

[bitmover]

I an not facing any issues with the wallet, it works well for me.

I'd say "Don't fix it if it ain't broken!" applies. You have nothing to gain and everything to lose.

How safe is it to buy a pre-owned laptop and turn it into my cold device, what would i need to do to be sure none of the previous owner’s actions affect me?

This is what I would do: get a second hand business laptop (a few years old), preferrably with working battery, low-power CPU and 8 GB RAM. By now all of them should come with SSD. Depending on where you live this can be cheaper than a hardware wallet.
Wipe the laptop, install Linux, keep it offline. Encrypt the drive if you're sure you won't forget the password. Create, test and securely store your backups before funding a wallet.

I agree that this might be cheaper than a hardware wallet. But I always think it is safer for people who aren't very knowledged about bitcoin to buy a hardware wallet.

After the incident of coldcard, I strongly recommend buying a Trezor and setting up a strong passphrase (at least 8 characters with upper case, lowercase and numbers)

[dufresne]

Wipe the laptop, install Linux, keep it offline. Encrypt the drive if you're sure you won't forget the password. Create, test and securely store your backups before funding a wallet.

I can easily set this up and for me it is a more simpler solution that the one suggested by pooya87, involving USB sticks. I only need to spend a very short time to understand it, but the only problem with what i already have is that it is on a mobile phone, so i think a dedicated laptop is a better option for me. The only disadvantage is that it is more expensive than a USB stick.

I agree that this might be cheaper than a hardware wallet. But I always think it is safer for people who aren't very knowledged about bitcoin to buy a hardware wallet.

I have bitcoin knowledge, nothing close to some of the guys that have offerred solutions here, but doing this safely would not be hard for me. I don’t think i need a hardware wallet right now, except you believe it is more secure than the options suggested?

[LoyceV]

The only disadvantage is that it is more expensive than a USB stick.

You'd still need a laptop with that USB stick
I did a quick local search, if I'd need one for this purpose right now, I found 1, 2, 3 small laptops from €60 to €80 that look good for the job.

I don’t think i need a hardware wallet right now, except you believe it is more secure than the options suggested?

It depends A shitty hardware wallet can upload your seed phrase to their servers, or create a weak random seed. And people fall for phishing by entering their seed words in a website after a scammer asks for it in an email.
But you can just as well mess up your own cold storage setup. In general, I'd say a Trezor is more Newbie-proof than your own cold storage setup, and it's much easier to use.

[decodx]

<...>
But you can just as well mess up your own cold storage setup. In general, I'd say a Trezor is more Newbie-proof than your own cold storage setup, and it's much easier to use.

I agree with this. Potential attack vectors on a hardware wallet are usually way less dangerous for a beginner than the mistakes they'll make trying to build a DIY cold storage setup from scratch. There is so much for them to know and thus so much to make wrong, if they have never done it before.