Encrypted Backups of Bitcoin Forum Credentials

[nullius]

Probably, no action is required for most people. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

Ah, but what if I lose the new password?  My password from 2017 is securely backed up.  Backups are trouble.

Here is a handy solution:  I’ll encrypt my new credentials with PGP, and store them in a forum post!  This assures that to log in to the forum, I need access only to my PGP private key.

Code:

-----BEGIN PGP MESSAGE-----

hF4DdPInIjWYj0gSAQdAyxI3cbG3HOyFylR5QjPzBYTh8ML/WlP7hoeGEzxxAiIw
vx157JyBfoztere8RBzTGiWxZ9S71/EuwXKDshaDLK3POhcAnW0ZexwH0wznFOiv
0sCzAetka8H918wl2XfZ5Vkq0/eIbwnS7AoOEP6XdXgJ/34crv8sgygxnCtHe71g
hridrkaR+rqk87pGaS91kQDIrG1cmupPZgL3YYxWMWdW35x6JmonqhzgDmXIVRb+
IPPsg3ztdy7ewFx1dP3GleMCaVf6ZipujxaI3OgYhXIC0B5Baw9JzrWxd26H+51x
hWNNl2hOy84PDNfZttt8wNvtlr7qHzdGZnfsTBnljJE87wNeMUgzC0Co0aMFNmTS
clB4vnVvx9mD2Oz4Z1BNyG6d1HcpRBEgQwWD5FwGw73ub8CH4E4P2OWaL21X4xgB
xqUyfvZLGLD8hWd/8ayKl9fCL5f+Hl+LaynuawMdWS2Twt7v+F0ZZP7UrEfxUZa1
pTvM4JM6Pto9J0LV2dTMFssyhTkhFWTKCj8Ssuv8BqXIjxPA2uvJJrQkYa+sAfMb
hym1ZFbOJF/CRftFLIZQc3OmmQLeFWEiNSnUtAz3zd3ATjuRoJA=
=l+dr
-----END PGP MESSAGE-----

This post will be edited, if I need to update it with new credentials.


Local rules:

• Do not post any credentials that are not securely encrypted.
• I’ll censor anything that I don’t like.

[nullius]

Reserved for secure backup of my wallet seed phrase and my dox.

[icopress]

In that case, you could also add instructions to the first post on how to store valuable data on the blockchain (for example, if you need to leave a country with strict border controls and censorship, and you cannot carry any data with you in physical form - or even a phone).

This method should work (as would the PGP method, though you’d need to consider how to store the private key). ProtonMail includes PGP (likely the simplest method), so, in all likelihood, all you need to remember is your username and password, plus a 9-digit recovery key for 2FA ... not too difficult, really.

Merited by klarki (24), suchmoon (7), xandry (5), Alex_Sr (5), DdmrDdmr (4), Symmetrick (4), ABCbits (2), Xal0lex (2), johhnyUA (2), IeSua (2), Husna QA (1), diks (1), satscraper (1), Heisenberg_Hunter (1), TheFuzzStone (1), taikuri13 (1), FontSeli (1), StartupAnalyst (1), mdv5967 (1),

[...] Localization of the guide is required.

[nullius]

Thanks for the interesting suggestion.  I’d consider the blockchain for succinct, long-term or permanent information.  However, I would not back up my forum credentials on the blockchain.  It’s the world’s most expensive database, and it’s append-only.  What do I do if I want to change my forum password next year, or maybe next month?

Forum credentials are only good to log in to the forum; if the forum ever goes kaput, the credentials are useless.  Therefore, I think the forum is the logical storage place.

(for example, if you need to leave a country with strict border controls and censorship, and you cannot carry any data with you in physical form - or even a phone).

For this threat model, I recommend splitting a symmetric key m/n with Shamir’s method, and exfiltrating the key shares by a variety of different covert channels, on both electronic and paper media, with steganography and other information-hiding methods, such that:

• Security: The risk is low of any adversary ever recovering at least m shares—or of today’s adversary detecting while you’re in their jurisdiction that you exfiltrate data; and,
• Availability: The risk is low that you fail to keep and reconstruct m shares, without which your precious data are lost forever.

Use that one key to encrypt other data—including PGP private keys, Bitcoin seeds, etc., and everything else.  Use a symmetric cipher in an AEAD mode (AES-256-GCM or Chacha20-Poly1305).  This is post-quantum, simple, and reliable iff you are competent about avoiding the nonce reuse footgun; I’d have other recommendations to use public-key cryptography for this, but it can get complicated.  Simplicity is good, when you may need to rewrite custom software twice (on both sides of the border) first to encrypt, then to recover your data.  Exfiltrate the encrypted bulk data by whatever insecure channels you may have available for this purpose; if someone is able to reach the Bitcoin Forum privately, I guess they can also simply use a storage VPS or other untrusted server.

Risks are never zero in these difficult situations.  How low can the risks go?  I must ask myself, how good am I at hiding things in plain sight?

In the Lauda memorial thread, I wasn’t trying to make the puzzle impossible for humans—to the contrary; yet almost six years later, with nontrivial prize money accumulated, no one has solved it.  I assure you, the answer is so much in plain sight that people would smack their foreheads if they saw it!  If, say, I wanted to cross the Russian border with my coins and with all of my encrypted political writings, would I bet that I can hide information well enough to exfiltrate a 256-bit key?  It is a grave question, not suitable for bragging.

Beyond that, I do not like to discuss such ideas publicly.  But if any dissident in the Russian-language boards has a practical need to bypass border controls somewhere that the guards speak Russian, I’d be happy to discuss this privately.

ProtonMail includes PGP (likely the simplest method), so, in all likelihood, all you need to remember is your username and password, plus a 9-digit recovery key for 2FA ... not too difficult, really.

Proton Mail is not post-quantum for long-term security.  For other reasons also, I don’t recommend them generally.

My current PGP key is also not post-quantum.  I intend to upgrade it soon.  However, it’s fine for storing my current forum login credentials.

[LoyceV]

Ah, but what if I lose the new password?  My password from 2017 is securely backed up.  Backups are trouble.
Here is a handy solution:  I’ll encrypt my new credentials with PGP, and store them in a forum post!

So now your backup comes down to backing up your PGP credentials. Isn't that just moving one problem into another problem? Unless you have it memorized, you'll still need to store it somewhere. And if you can securely store one password, you can just as well store a thousand.

In that case, you could also add instructions to the first post on how to store valuable data on the blockchain (for example, if you need to leave a country with strict border controls and censorship, and you cannot carry any data with you in physical form - or even a phone).

In such a scenario, I'd go back to my risky made-up brainwallet with heavy encryption.

In the Lauda memorial thread, I wasn’t trying to make the puzzle impossible for humans—to the contrary; yet almost six years later, with nontrivial prize money accumulated, no one has solved it.  I assure you, the answer is so much in plain sight that people would smack their foreheads if they saw it!

I'm still hoping for the day you'll reveal the answer (after sweeping the coins of course).

Welcome back!

[satscraper]

I though you’d need to consider how to store the private key).

I store mine on YubiKey 5. In fact, I have three of these dongles, so I have three copies.

The relevant PGP code for doing this is shown in this thread, which describes the way to store sensitive information on digital media.

@nullius, I also use it to store my Bitcointalk credentials, among other things. You seem to be a PGP's OG, so I’d appreciate your opinion on my method for keeping sensitive information.