What are the most common mistakes made when Setting Up an offline wallet.

[bill_colton]

There are a number of things to take into consideration when Setting Up a secure offline wallet.

Key management, seed backups, signing, and verifying addresses.

For example, if you have an air gapped signing machine you will need to send unsigned and signed transactions to your online watch only wallet. This can cause issues when verifying addresses if you don’t understand the process.

What do experienced users do?

What security measures would you implement to ensure the wallet is secure and you can store valuable funds in it?

Do you favour using a hardware wallet, air gapped computer, multi-signature or any combination of these?

[bitmover]

Do you favour using a hardware wallet, air gapped computer, multi-signature or any combination of these?

I think that for a newbie, hardware wallet is the best. Buy a trezor from their official website. Note down the seed and create a passphrase. 99.9999% safe.

Another options, which you will have a lot more trouble and will be at risk if you do something wrong:

Use an old laptop and remove the network card. Install electrum and sign transactions there. Just scan QR codes of signed transaction to broadcast the transactions in a phone/computer with internet access. Never insert a pendrive in this machine. Looks too much trouble for most people.

[Lontor]

OP I believe you will be fine using a Trezor wallet.
All you need to do is write down the recovery seed in a place far away from the internet.

I still believe that using a hardware wallet is the best way to avoid losing your digital assets, right now I would choose Trezor wallet or Keystone wallet.


Bitmover I have 2 question too

Do you think it's safe to write down recovery seed and the passphrase in the same location? Like if I found a steel or card like paper then write down the recovery seed at the front then turn the back and write down the passphrase.

Do you think this method is safe? Can recovery seed and passphrase be in same location?


There is one more.

What about Multisig? Let's say I create one for myself and just like the example I dropped at the start of my post, do you think it's safe practice to have all recovery seed written down in the same location?

On one same book or steel or other?

[boyptc]

Buy a trezor from their official website.

This important and it applies to all other hardware products. It's hard to trust a reseller these days after the Ledger reseller tampered the chips of their product.

While there's still another risk for this but I think it's an isolated case, and that's about the courier/logistics where they can replace the product on their warehouse upon shipment.

Although I don't think that there's a lot of those cases and it's still safer to order directly to the official manufacturer website of trezor or any other hardware wallets.

Do you think it's safe to write down recovery seed and the passphrase in the same location? Like if I found a steel or card like paper then write down the recovery seed at the front then turn the back and write down the passphrase.

Do you think this method is safe? Can recovery seed and passphrase be in same location?

My opinion on this is it will only be safe if you're the only one knows where you'll place it.

Otherwise, if someone finds it where you're hiding it and then have an idea of what it is you know what's coming next.

This is the same as putting the 2FA on the same phone where the wallet is installed.

[OcTradism]

There are a number of things to take into consideration when Setting Up a secure offline wallet.

The biggest mistake is you create a wallet online, and on a device that can be turn on the Internet connection, then connects to Internet anytime in the future.

If you want to create an offline wallet, that means it's a cold wallet, you but you must remove some of its items (read in the following thread) if you don't want to sometimes connect it to Internet, and turn it to a hot wallet.

[Guide] Secure air-gapped crypto wallet storage method.

[pooya87]

What are the most common mistakes made when Setting Up an offline wallet.

Disconnecting the network cable on a computer that was online and thinking it makes it secure to create a wallet on!

You'll need a clean system that is air-gapped to create a secure wallet. A system that was already connected to the internet should be considered already-compromised.

For example, if you have an air gapped signing machine you will need to send unsigned and signed transactions to your online watch only wallet. This can cause issues when verifying addresses if you don’t understand the process.

What do experienced users do?

It is not that complicated to verify the addresses. The input (addresses) as well as change address belong to your own wallet and the wallet software should highlight them already to make it easier to visually detect them. The other address(es) can be verified by checking first, middle and last handful of characters.

What security measures would you implement to ensure the wallet is secure and you can store valuable funds in it?

Do you favour using a hardware wallet, air gapped computer, multi-signature or any combination of these?

The most important thing is to learn the correct way of doing each of these. I already pointed out the fallacy of believing your previously online system is safe just by removing the network cable. Another thing is about multi-sigs, the common mistake is that people create all keys on the same machine and store all of them in the same place and use them in the same place too and think they are "more" secure because of that. That is wrong. The keys need to be created, stored and used completely separately to provide that additional security.

[tbct_mt2]

Disconnecting the network cable on a computer that was online and thinking it makes it secure to create a wallet on!

You'll need a clean system that is air-gapped to create a secure wallet. A system that was already connected to the internet should be considered already-compromised.

It's very important security advice because if people don't have a clean system, everything they do on that device later will contain many risks which can turn to security exploitation and fund might be stolen.

Some extra reminders on how to set up an air-gapped computer and wallet.
How to set up a Bitcoin air-gap computer?
AirGapped Hardware Wallets.

[bitmover]

Do you think it's safe to write down recovery seed and the passphrase in the same location? Like if I found a steel or card like paper then write down the recovery seed at the front then turn the back and write down the passphrase.

Do you think this method is safe? Can recovery seed and passphrase be in same location?

I see no problem with that. Also , keep a bakcup of both in another location.
Passphrase is important  to add randomness , in a situation like the coldcard incident

What about Multisig? Let's say I create one for myself and just like the example I dropped at the start of my post, do you think it's safe practice to have all recovery seed written down in the same location?

On one same book or steel or other?

No not in this case. Multisig is important when 2 parties need to confirm the transaction,  like you and your wife or you and your partner.

Too much trouble to create a multisig to one person control all keys

[Antidote47k]

You'll need a clean system that is air-gapped to create a secure wallet. A system that was already connected to the internet should be considered already-compromised.

Isn’t that too absolute? I agree that simply disconnecting the system from internet doesn’t mean it’s now safe and previous exposure means the possibility of malware is significantly higher but that shouldn’t mean the whole system is compromised, I think establishing trust in the operating system is the important thing. So correct me I’m wrong but shouldn’t a fresh, trusted operating-system installation using verified installation media establish a much stronger starting point?

For example, if you have an air gapped signing machine you will need to send unsigned and signed transactions to your online watch only wallet. This can cause issues when verifying addresses if you don’t understand the process.

It’s important to verify address and amount on the offline signer too, one shouldn’t rely solely on the info on the online wallet, PSBT helps in transfering transaction information between the online and offline devices but you should still verify what you’re signing.

[Aanuoluwatofunmi]

Key management, seed backups, signing, and verifying addresses.

Let me talk more about backing up your seed: ensure that you are accurate in copying your seed phrase and also translate it to the appropriate material or storage that is durable and will not, by any chance, be great to miss any of those words over time. The moment you make a mistake in writing them down, it could place a future implication when trying to recover your wallet from the use of those seed phrase, we must verify and ensure that we copy the right words in the correct order and make use of durable storage for the seeds.

[hd49728]

Let me talk more about backing up your seed: ensure that you are accurate in copying your seed phrase and also translate it to the appropriate material or storage that is durable and will not, by any chance, be great to miss any of those words over time.

I really don't know what did you imply with "translate" for backing up a wallet, and its seed phrase?
It's easy and simple, you can do either copy and paste it into a file and save it, or write it down word by word.

The first method (copy & paste) is not recommended because this method means you will have digital backups, that is not recommended.
The second method is writing down your seed phrase, and it gives you a physical backup.

Both methods need a testing step, to recover your wallet, and compare the recovered wallet with an original wallet.
How to back up a seed phrase?
Securing Your Seed Phrase with Washers.
Stainless steel Bitcoin Recovery Seed Plate.

[knowngunman]

Do you think it's safe to write down recovery seed and the passphrase in the same location? Like if I found a steel or card like paper then write down the recovery seed at the front then turn the back and write down the passphrase.

Do you think this method is safe? Can recovery seed and passphrase be in same location?

Are you really asking this? Even your seed phrase, if possible you should divide them into separate locations. Moreover, the passphrase is something you created yourself which is just like your phone password. If I may ask, do you write your phone password somewhere? I think No. So it's not necessary to write down your passphrase because I think you should create something that you'll easily remember and hard for others to guess but you shouldn't create something difficult that you'll have to write it down. It's possible for someone to have access to somewhere you wrote the seed phrase but they can't have access to something in your memory.

[elda34b]

Even your seed phrase, if possible you should divide them into separate locations.

I remember a case where someone forgot where he stored his seed phrase backup. Not sure when someone is prepared to make more complicated setup for this, but newbies probably shouldn't make it too complicated at the beginning. I guess you could say they should understand the risk of each setup first before deciding which one to pick, until then, just stick with general suggestions related to backups and whatnot.

[Youngrebel]

Using a hardware wallet with a proper offline seed backup is a good way to start in that aspect of security, but the most important thing to me is making sure nobody can access your private keys or seed phrase and that should even be the main concern of every users not just me. And also in terms of security when it comes to bitcoin I always verify every transaction and receiving address before approving anything at all observation first and for someone that’s having a large amount of Bitcoin, multisig can provide extra protection because the funds are not controlled by just one key.

[pooya87]

You'll need a clean system that is air-gapped to create a secure wallet. A system that was already connected to the internet should be considered already-compromised.

Isn’t that too absolute? I agree that simply disconnecting the system from internet doesn’t mean it’s now safe and previous exposure means the possibility of malware is significantly higher but that shouldn’t mean the whole system is compromised, I think establishing trust in the operating system is the important thing. So correct me I’m wrong but shouldn’t a fresh, trusted operating-system installation using verified installation media establish a much stronger starting point?

When improving security you should try to eliminate as many vulnerabilities and attack vectors as possible. If you use a fresh OS install, you eliminate the possibility of existing malware. By using an open source OS you eliminate possibility of existing backdoors! By going offline you eliminate possibility of future attacks. By being on an air-gap machine from the start you also eliminate the possibility of existing malware...

[hd49728]

When improving security you should try to eliminate as many vulnerabilities and attack vectors as possible. If you use a fresh OS install, you eliminate the possibility of existing malware. By using an open source OS you eliminate possibility of existing backdoors! By going offline you eliminate possibility of future attacks. By being on an air-gap machine from the start you also eliminate the possibility of existing malware...

Security of a device, a wallet does not come from a single factor in our practice but actually comes from multiple factors. Practice for having good security is very complex but if we are ready to read, learn, change our security mindset and practice, we can improve our practice and get better security. Not best or perfect security but still far better than if we're not knowledgeable about necessary practice for security, and careless with our practice.

How to Install Tails OS on USB flash drive for Wallet Purpose.
What to do to avoid phishing sites.
How to keep bitcoin secure.

[5W-KILO]

Same thing we have been warned too many times in this forum already.

1. Avoid storing your seed phrase in the cloud storage.
2. Don't take screenshot of your seed phrase.
3. Better write on paper and move to safe location or carve on a stainless steel.
4. No wallet companies will ask you for your seed, if they do it's scammers at work.
5. Take your seed phrases far away from your computer and phones, no internet connection allowed.
6. Regularly keep your crypto wallet firware up to date.

Avoid public WiFi if your type of crypto wallet is hot wallet on smartphones, although I don't recommend using one this days, iPhone users are getting drained since October last month, Trust wallet users to be precise, too much vulnerability with anything that uses the internet.

[EL MOHA]

Do you think it's safe to write down recovery seed and the passphrase in the same location? Like if I found a steel or card like paper then write down the recovery seed at the front then turn the back and write down the passphrase.

Do you think this method is safe? Can recovery seed and passphrase be in same location?

I usually have different opinion about this because personally I feel both seed phrase and passphrase shouldn’t be stored in the same place since the passphrase is a second layer protection to the seed phrase and having them both on the same place is not a great idea because imagine the back up gets exposed and someone gets the steel sheet then they will be able recover that wallet.

What about Multisig? Let's say I create one for myself and just like the example I dropped at the start of my post, do you think it's safe practice to have all recovery seed written down in the same location?

On one same book or steel or other?

One thing about multi sig is its best with a different devices so even if you wish to set it up yourself you would need to have differen device for each signer and then all back for each signer should be in different locations, this complication is why for an individual the best is single sig with passphrase added as extra security

[Sammysmart001]

both seed phrase and passphrase shouldn’t be stored in the same place since the passphrase is a second layer protection to the seed phrase

This are the main point that prople do miss, the moment you put seed and passphrase in same steel, you have cancel the extra protection that passphrase is suppose to give you.

Seed only can not open wallet if there is passphrase, but once someone finds that one steel he has everything already.

What I will advise is for your seed to go one place, passphrase go another place we’re only you is aware of. Same thing goes with multisig, if all the keys are in one place it no longer multisig, it just single dog witj extra stress.

[BlackHatCoiner]

The most common mistake when setting up a cold storage wallet is to not actually make it airgapped. Many people believe that formatting an old laptop with a fresh linux distro and using it just as a wallet comes with equal security as a signing device that never connects to any network.

The second most common mistake is not looking at the transactions you sign properly, or not verifying the signatures of the bitcoin programs you install.