Blockchain Security Questions

[viking02]

1.  Do you put anything for second password or password hint?  I make sure i know what my password is so there won't be an issue so i assume just don't even bother leaving a hint then?


2.  Do i check always keep browser backup?


3.  Do i put any secret phrase or leave it blank?


4.  Do i enable api access?


5.  Do i block TOR ip addresses?


6.  IP address whitelist... i see my current ip.  Do i just leave this blank?


7.  Should i restrict to whitelisted ip addreses only?  If i do.. then isn't that going to make it really safe?

[Blazr]

1.  Do you put anything for second password or password hint?  I make sure i know what my password is so there won't be an issue so i assume just don't even bother leaving a hint then?

Nobody plans on forgetting their password. Always have some way of helping you remember it or some way of getting into your wallet in case you forget your passwords.

Most of the people who lost Bitcoin lost them because they forgot their password or lost their wallet file, not because they got hacked.

I believe second password with bc.info wallet is a password for actually sending funds. I would highly recommend using this.

2.  Do i check always keep browser backup?

I believe this stores a backup of your wallet in your browser. You should probably use this, though I would recommend having a better system for backing up your wallet.

3.  Do i put any secret phrase or leave it blank?

I believe this is to help speed up support issues, such as if you lose your 2FA device. You should use this.

4.  Do i enable api access?

If you are not using the API, then don't enable it.

5.  Do i block TOR ip addresses?

If you don't use Tor, you can if block Tor IP's if you want to. Though this is security by obscurity as anyone trying to hack your wallet will just chain a proxy/VPN onto Tor once they see it's blocked. Realistically this option provides no extra security at all.

6.  IP address whitelist... i see my current ip.  Do i just leave this blank?

7.  Should i restrict to whitelisted ip addreses only?  If i do.. then isn't that going to make it really safe?

The IP whitelist is a list of the only IP's allowed to access your wallet. This is a dangerous feature as if you are away from your PC or your ISP recycles your IP you won't be able to access your wallet. You should only turn this on if you REALLY know what you are doing, it is very easy to lock yourself out. This feature is really only for certain situations, such as if you are setting up a wallet for a website.

[viking02]

Thanks for the response.


Well i will make sure i dont forget the password.  Will put it in my password program that i have saved as well as backup.


But would you say its necessary to do a blockchain wallet backup?  I read this isn't necesssary with blockchain but if i used say multibit or electrum, then i should 100 percent do this.  Should i be fine not creating a backup of the blockchain wallet as long as i remember my password etc?  So this is the browser backup?


What secret phrase am i suppose to even put down?  You mean thats not related to password right?  So it could be i went to the outdoor or some useless phrase?
Thank you.

[Blazr]

Well i will make sure i dont forget the password.  Will put it in my password program that i have saved as well as backup.

Might help to leave a hint that it's stored in your password database, just in case one day you forget

But would you say its necessary to do a blockchain wallet backup?  I read this isn't necesssary with blockchain but if i used say multibit or electrum, then i should 100 percent do this.  Should i be fine not creating a backup of the blockchain wallet as long as i remember my password etc?  So this is the browser backup?

The reason you need a backup is in case something happens to the blockchain.info service, for example, they unexpectedly shut down or suffer data loss/corruption. If you don't keep regular backups then you are entirely at their mercy should something go horribly wrong.

What secret phrase am i suppose to even put down?  You mean thats not related to password right?  So it could be i went to the outdoor or some useless phrase?
Thank you.

The secret phrase is like a secret word that you can give to support in case you need help. It should have absolutely nothing to do with your password. It can be anything.

[viking02]

Okay.  So im curious what hint do you guys put for your passwords.  Example let say someones password is very simple which is not smart and they put down PASSWORD as the password.  So the hint will have to relate to it somewhat?  I assume the hint has to be related to it somehow right?


Another question i have is what type of password do you put for it?  I use keepass and it generate passwords for me for my email and other sites.  thus i have no clue what my password are for sites b/c its something like afkldsjf923892380e480929iiewi90fasjklfdsanfn0230294-09234i23ifkkafjaksj.fasklfjs as i let keepass generate it for me.  However for blockchain i didnt do this b/c i wanted to make sure it was a password i remember.  I assume no one here does a generated password like the one above through a password generator then for blockchain or coinbase b/c of the risk of forgetting the password?


Has blockchain ever suffered data loss or corruption?  How long does it take to do a backup?  Regular backups?  What does that mean?  You mean you have to back it up once every how long?  And is doing this hard or easy?  Because im not computer savy at all.  Thus last time someone told me about paper wallets and i gaved up even trying to do something like that.

[viking02]

thanks for that information.  One other question that im confused.  I see i have an address for coinbase and blockchain.  So if i have a site send me bitcoin to my blockchain address... dont i always give them the same address?  Not sure why ppl say new address or generate new address.  Is that necessary?  Im confused why can't i use same bitcoin address for my blockchain.


What about coinbase as well?  I will be mostly using blockchain and only time i would use coinbase is if im buying bitcoin or selling bitcoin from blockchain so i could receive money into my bank of america account.

[avatar_kiyoshi]

thanks for that information.  One other question that im confused.  I see i have an address for coinbase and blockchain.  So if i have a site send me bitcoin to my blockchain address... dont i always give them the same address?  Not sure why ppl say new address or generate new address.  Is that necessary?  Im confused why can't i use same bitcoin address for my blockchain.


What about coinbase as well?  I will be mostly using blockchain and only time i would use coinbase is if im buying bitcoin or selling bitcoin from blockchain so i could receive money into my bank of america account.

I am personally store my btc to cold/desktop wallet. And use exchanger for trade btc to fiat. Not store my coins to exchanger wallet.

[viking02]

Which one do you use?  Electrum, multibit?

[pooya87]

you forgot about the most important part witch is 2 factor authentication. make sure to enable it.
also for passwords and reminders you can always write it down on a piece of paper and keep it in a safe place

[pereira4]

Here's my question: When im using Bitcoin-qt in windows 7, I get all kinds of "blocked ip" messages coming from MBAM (Malwarebytes Anti Malware).

Are these false positives or are they bad ip's and should I block them?

[Blazr]

Here's my question: When im using Bitcoin-qt in windows 7, I get all kinds of "blocked ip" messages coming from MBAM (Malwarebytes Anti Malware).

Are these false positives or are they bad ip's and should I block them?

Yes these are false positives. There are some Bitcoin nodes that are running on IP's associated with spamming etc. For the most part, a single Bitcoin node cannot do anything malicious, so it's safe to allow your client to connect to them.

[viking02]

thanks for that information.  One other question that im confused.  I see i have an address for coinbase and blockchain.  So if i have a site send me bitcoin to my blockchain address... dont i always give them the same address?  Not sure why ppl say new address or generate new address.  Is that necessary?  Im confused why can't i use same bitcoin address for my blockchain.

Reusing a Bitcoin address works but it isn't the best idea.

If you give everyone the same Bitcoin address, it can be hard to tell who sent you money and who didn't. When you give everyone a unique address, then you know that any payment to that address is from the person you gave it to.

It is also bad for privacy. With the right tools, anyone can figure out who you are transacting with, how much BTC you have etc

It is always a good idea to use a new address whenever you can.

Which one do you use?  Electrum, multibit?

Blockchain.info is a convenient client, but it has some downsides. Recently they had a severe bug that caused people to lose money. The problem is that because it runs in your browser blockchain.info has to be written in Javascript , which is not a good language to write a Bitcoin client in as it is easy to make a mistake with it, and with Bitcoin even a small mistake could cost people a lot of money.

There are other problems too. If one day the blockchain.info website is hacked, the hacker can change the Javascript code and use it to steal your Bitcoins. There are also ways a hacker can intercept the page and change it while in transit (mitm SSL stripping for example), though this is quite difficult (although it is becoming more common).

It is better to use a "real" wallet that runs on your PC.

I would recommend Electrum. Electrum is a very lightweight/quick wallet. Unlike blockchain.info, it is a deterministic wallet, which means you only need to back it up once. It also has a seed that you write down when setting it up, and in the event you forget your password or lose your wallet file you can use this seed to regain access to your Bitcoin. You can also use it to setup "cold storage" if you have a spare PC.

Another good client is of course, Bitcoin Core which is a good client for powerusers. It has lots and lots of features, though it is really resources heavy, it requires nearly 30GB of diskspace and takes a long time to sync. So unless you need lots of features Electrum is probably a better choice.

Multibit is also a pretty good client, though I don't like it as much. I find it is slower than Electrum. It also also not deterministic (IIRC) so you have to back it up regularly. I have also experienced connectivity problems with it a couple of times. It also requires you to install Java runtimes which are pretty bulky, though many people will already have these installed.

Okay if i download electrum and use it, i first have to backup it first?  Do i have to backup it everytime i do a transaction or just when i install it?  How long does it take to backup it?


So where should i save the backup to?  a usb?  Dropbox?


So if i lose my computer or have to format computer, then i use that file i saved?  So if i don't create a backup with electrum and my computer gets lost or its broken, then i lose all my bitcoins?  That was one of the reason i didnt want to use electrum because i heard if computer has problems, u lose all the bitcoin.

[viking02]

How do i create backup of blockchain?  I see option for dropbox and email.  But when i click on it, it require me to log in again and password but doesn't do anything.  Basically same thing again over and over...


Backing up your wallet is an important step which is easy to forget. Blockchain.info takes every precaution to keep your wallet safe but it's always better to keep a local copy just in case.

[viking02]

can someone explain how to backup in blockchain?  Clicking dropbox doesnt do anything and email didnt send any email to me.

[viking02]

Okay i downloaded the backup blockchain to my computer.  Then i sent it to my email address.  Would that be fine?  I know its bad if your email gets hacked but i put a very strong password for my email.  Thoughts on this?  Also im unsure but this isn't the 12 word phrase as backup right? 

[rokkyroad]

Okay i downloaded the backup blockchain to my computer.  Then i sent it to my email address.  Would that be fine?  I know its bad if your email gets hacked but i put a very strong password for my email.  Thoughts on this?  Also im unsure but this isn't the 12 word phrase as backup right? 

You're probably alright if you have 2FA setup for your email. Better yet, place the backup file into a folder and make an encrypted zip file; then upload it. Name the file something like "cindys love letter.feb.8". Hackers are looking for wallet.dat not love letters.

[viking02]

How do i make it encrypted file?  Also what is that document?  Is it my 12 word phrase?  Im unsure b/c i couldn't even open it.  Its 2kb or so.

[Crypt0x]

1.  Do you put anything for second password or password hint?  I make sure i know what my password is so there won't be an issue so i assume just don't even bother leaving a hint then?

Yes, you have to put second password, 2FA & password hint to keep your wallet secure

2.  Do i check always keep browser backup?

No, hacker might stole the backup

3.  Do i put any secret phrase or leave it blank?

Up to you

4.  Do i enable api access?

No, expect you want to use API

5.  Do i block TOR ip addresses?

You MUST block Tor IP addresses, some hackers always stole from this browser

6.  IP address whitelist... i see my current ip.  Do i just leave this blank?

Just leave it blank

7.  Should i restrict to whitelisted ip addreses only?  If i do.. then isn't that going to make it really safe?

Yes, if you always use whitelisted IP addresses to access you wallet

[ranochigo]

5.  Do i block TOR ip addresses?


6.  IP address whitelist... i see my current ip.  Do i just leave this blank?


7.  Should i restrict to whitelisted ip addreses only?  If i do.. then isn't that going to make it really safe?

Blocking TOR IPs is always a good idea however, if you are in a situation which you can only use TOR to access internet, you can't access the wallet as you have blocked the IP. If you whitelist and restrict IP, you would not be able to access your wallet if you go anywhere else and the network don't have the same IP as the whitelisted one. Do not do this if your address is dynamic as the IP will change.

Okay i downloaded the backup blockchain to my computer.  Then i sent it to my email address.  Would that be fine?  I know its bad if your email gets hacked but i put a very strong password for my email.  Thoughts on this?  Also im unsure but this isn't the 12 word phrase as backup right? 

It is better to keep a physical backup, if the email ever goes down or if your account gets suspended, you will be able to get them back.

[Mountain Jew]

Blocking TOR IPs is always a good idea however, if you are in a situation which you can only use TOR to access internet, you can't access the wallet as you have blocked the IP. If you whitelist and restrict IP, you would not be able to access your wallet if you go anywhere else and the network don't have the same IP as the whitelisted one. Do not do this if your address is dynamic as the IP will change.

Blocking tor probably doesn't matter much. If someone tries to log in via tor and they can't they'll just find a proxy that they can.