/biz/ - Business & Finance

>>13954187
I might split my funds onto 3

>>13954299
So you consider them safe? Or are you going to get three different hardware wallets?

they're safe

t. expert

source: dude trust me

>>13954187
that's pretty bad security you got there.
here is what you should do:
create 3 groups of the 24 words and store them at 3 separate locations.

this not only gives you the same resiliency against loss or disaster but also prevents an attacker to get your finds if he finds one.

secondly the ledger itself is only secure so long you can prevent physical access to it. and for "hodl" you don't even really need it. you should just wipe it or put a decoy/hot wallet on it with small amounts until you want to cash out in the future.

>>13954336
Idk which wallet is best, but I'd want backups in case 1 fails or disappears

>>13954187
>hodl
kys

>>13954389
the wallets are not important in this regard, they are trinkets that can be replaced or substituted by software.

on the other hand if you lose one it can be used to access your funds as it has very weak to nonexistent cryptographic security (we don't know if the pin is used to encrypt the keys inside or not i would bet in not)

>>13954187
Damn O.P
I need to back up my Word Seeds too, and get them laminated. I only have 1 Copy, I might just make another.

>>13954380
I like your idea for storing the 24 words. I'll have to figure out if it's feasible for me and if not figure out how to make it work. I'm definitely the only one with access to the ledger (unless I get $5 wrench'd obviously). But I like your idea of a decoy wallet. So how should I hodl the majority of my funds? I'd use a paper wallet but I don't have access to an air gapped computer/printer.
>>13954406
>no fun allowed
Imagine being this person
>>13954433
I've always wondered this. Couldn't someone theoretically just try random combinations of the 24 words and access random wallets? I know that'd take an exorbitant amount but I've been curious about what's preventing that kind of attack.
>>13954506
I'm fortunate enough to have access to a laminator for work. They're not that expensive if you don't have access to one.

>>13954187
as long as you invest in different places you are diversified

>>13954524
>Couldn't someone theoretically just try random combinations of the 24 words and access random wallets?
that would take longer than how long the universe exists if you could try billions per sec. but it actually takes time to generate wallets.

>>13954585
I understand that, but wouldn't they be able to at least get a few wallets through that method?

>>13954561
I don't trust exchanges. But I am thinking about getting multiple hardware wallets like >>13954299 suggested, probably different brands.

>>13954187
Your funds are safu

>>13954380

This, you need to split them up. This is a really good detail, though, anon - so any two lists are sufficient, out of the three?

I currently just have half in one location, half in another, both of them hours away from where I live.

I've just ordered a second Ledger, also, OP, because if your first one bricks when the market is Hot you won't be able to order another for fucking ages and you might end up getting fucked.

Also I want to try restoring onto it.

Someone give us a run down on creating decoy wallets pls? Does it log in with a different pin code?

>>13954605
The combinations present on the ledger are more than double the total amount of atoms on the world.

>>13954524
>So how should I hodl the majority of my funds? I'd use a paper wallet but I don't have access to an air gapped computer/printer.
paper wallets are good also, just make sure you use bip38 password encrypted ones! your normal computer booted to a live os and disconnected from the network would suffice.

however if you already have a 24 word mnemonic wallet that's plenty secure it's just that i have issues with writing down all the words and especially keeping them all at one place.

best would be to keep 6 words committed to memory and use the 3 group method on the remaining 18. (if you are concerned about inheritance - in case you die - then maybe better if you write down all 24 just do the groups!)

>>13954585
Ledger distributes seed phrases in 12/24/48 words so its not that simple.

I have one of these too. I backed up my 24 words by scrambling them into a random order and then writing down the correct order of numbers.

So say you put them in random order, and now they have a new order 1 through 24. Then you save the correct order (e.g, 16, 23, 1, 5, etc...).

Then I etched the words into a steel plate with a Dremel. The steel plate would never melt in a fire, but just in case it's also in a fireproof safe.

My number order is saved in an encrypted keepass database. The benefit here is that if someone gets a hold of your steel plate, it's completely useless to them. Likewise, if someone gets into your keepass and sees the numbers, they mean nothing without the plate.

Someone would need to get both the steel plate and the number order to compromise your Bitcoin.

paper wallets are the safests you dumb brainlets

>>13954605
look each word is roughly 10^5 security so a 24 word is about 10^120. if you can try say a billion per seconds it would take 10^100 years at least to statistically get a hit. the age of our universe is 13*10^9.

>>13954664
sorry, but the fuck does that sentence supposed to mean?

>>13954647
>>13954676
>>13954691
Gotcha. Thank you.
>>13954651
>if you are concerned about inheritance
Holy shit I didn't even think about that. My family is so technically illiterate I don't know how I'd create instructions to walk them through all of this in case something happens to me.

>>13954647
not double... it's a quintillion times bigger number which in itself is mindbogglingly big.

>>13954646

>>13954704
yeah family is tough.

also not many know but bitcoin script can do some funky things... you can write a script that allows you to pay out in sequence with delays.

for example the script could pay out to key A + B 2of2 multisig immediately where A is your electrum wallet (protected by strong password) B is your hardware wallet, but if you lose any then with 30 days delay it pays to C + D where C is your backup key kept at home in a safe, and D is the backup key kept at a different location, and finally, after 90 days it pays out to key E which you can give to any family member. if they try to access your funds while you are alive you can just cut in and move to a new wallet. pretty nifty. i don't know any software that lets you set this up but the script itself can do this since 2015.

>>13954773
I want to use Electrum wallet for BTC but I do d not have the technical skills to run my own personal server for my node. Is this safe and secure? Wouldn't this mean I would have to trust someone else and could they steal my coins or give me a fake address?

>>13954767
i don't consider a single passphrase good security tho. 1 word is nothing maybe 3 hours for a laptop. 6 words on the other hand are an eternity for any non 3 letter org.

>>13954798
no you are in total control of your money with a multisig wallet. it's more challenging to set it all up tho than a simple mnemonic wallet.

>>13954767
Oh wow I never thought of generating multiple wallets on one ledger. Thanks.

>>13954773
>>13954813
basically i would wait until electrum supports time locked multi tier multisig wallets before i tried this.

until than grouping of mnemonic wallets are good enough a ot better than writing it all down and or trusting a single word as security.

>>13954813
Thank you. If you use a hardware wallet with a passphrase for multisig, and you also use that same wallet without a passphrase for singlesig, does that compromise the security of the multisig? Could a hacker figure out some info from the singlesig without passphrase to attack the multisig with passphrase?

>>13954820
that is what i meant by decoy wallet btw. do not keep the cold store wallet on the ledger! do not! it's not good security! on the other hand when you do want to access it, having a hardware wallet protects you at a sensitive time against cyber attacks malware whatever (in theory) unlike a paper wallet which needs to be swiped on a trusted computer..

>>13954862
Thank you. You've been a tremendous help.

>>13954849
i'm not sure i understand the question right, but do not have two wallets that only differ by a single word!! do fucking not!

>>13954884
Here is why I ask:
>A 12 word seed provides 128 bit entropy. A 24 word seed provides 256 bit entropy (reduced to 160 bits by ripemd160). How much entropy does a 12 word seed with additional self-chosen password/passphrase provide?
>Edit: My conclusion (see comments in the thread) is that already a rather weak password added to the 12 word seed is sufficient to boost the seed's overall entropy from 128 bit to above 160 bit, which is the entropy of a private key itself (due to RIPEMD160 hash).
>So with a sole 12-word seed, a brute force attacker would be much better off attacking the seed (128 bit) than the private key itself (160 bit). But with a moderately complex 13th password on top of the 12-word seed, the seed's entropy would exceed 160 bit and the attacker would be better off brute-forcing the private key directly.
>Important: This logic only holds if I do NOT use the password-free 12-word-seed wallet at all! Because, if I store some dummy bitcoins on the wallet without passphrase, the successful attacker has already found a valid seed with a 128-bit attack and needs negligible additive (instead of otherwise multiplicative) extra effort (say 32 bits) to find my full wallet, which thereby lost its 160 bit security!

and one final thing you paid like a $100 for that thing. it would be a fucking shame not to use it! put a hot wallet on it (which also serves as a decoy from the cold store) and fucking use it!

>>13954907
yes generally speaking the address space of ripemd 160 is the cap on your entropy. but if your pass phrase may become partially known it could become the weaker attack surface.

that is why i like the 24 word seed as opposed to a 12 word seed (which would be plenty btw) because if it becomes partially known it's still fucking strong.

>>13954907
also not that actually deterministic wallets only use ripemd160 at two places singular addresses generated and the script hash. but if you put your btc on multiple addresses then private key collision is greatly mitigated and your attacker is back to guessing the seed.

>>13954912
>you paid like a $100 for that thing
I paid only ~$60.
>it would be a fucking shame not to use it!
If bitcoin moons again I'll buy myself something nice, but I really don't plan on spending my bitcoin. I'm more concerned about securing my wealth against the economy going 2008 all over again. I might buy some other coins just to diversify.

>>13954952
So is this a safe storage solution for BTC?

>Electrum BTC multisig 2-of-2 wallet with 1 cosigner being a Ledger hardware wallet and 1 cosigner being a Trezor hardware wallet
>Both hardware wallets use passphrases
>Also use the same hardware wallets with the same seeds without passphrases for singlesig BTC wallets
>Limited technical skills so rely on Electrum server node instead of being able to run my own server node

>>13954993
well if the attacker knows the private key is part of a group actually he could have easier job to find other private keys of the group. this is the sort of math level i'm not entirely comfortable with yet. but i believe the general rule is you should never under any circumstances expose a private key of a bip32 wallet.

>>13955003
no like i said don't use the same seed for two wallets of course if your passphrase is strong enough like 6-8 words strong it's pretty academic.

>>13954187
>I've never used the ledger with any usb cable other than the one it came with

It's useless since your private keys never travel through the cable.

holy christ what a load of brainlets in this thread. There is nothing wrong with a ledger. You dont need special usb cords. You dont have to protect it against physical access. Keep your seed words safe. They are much safer than a paper wallet.

>>13955055
>no like i said don't use the same seed for two wallets
What do you mean?

>>13954187
As long as your seed phrases secured, funds are safu.

>>13955070
maybe i misunderstood something
>Both hardware wallets use passphrases
>Also use the same hardware wallets with the same seeds without passphrases for singlesig BTC wallets

>>13955101
i get it you guys want some defense from the $5 wrench thing, but 1 word is not security. a passphrase of 25+ chars or 6-8 words is security.

I have my bitcoin price locked in at 18k on my trezor. Can you do the same on your nano ledger?

>>13955101
Yes, so what I am saying is this. When you use a hardware wallet it generates a list of seed words for you. You then have the option to add a passphrase to it. I thought the whole point of this was so you could use both as separate wallets? So then I would use the hardware wallet with a passphrase as 1 cosigner in BTC multisig. And then I would also use the same hardware wallet without a passphrase as a BTC singlesig wallet. You are saying this is not secure? I thought that was the whole point of the passphrase, so you could use the same hardware wallet for multiple BTC wallets.

>>13955133
You'd see my ETH at $1200.

>>13955153
Yes, that will be just fine.
A lot people don't understand how ledgers work so you're gonna get strange answers.

>>13955153
>When you use a hardware wallet it generates a list of seed words for you. You then have the option to add a passphrase to it. I thought the whole point of this was so you could use both as separate wallets?
you can, but i think you shouldn't unless you expect torture or some other duress.
>You are saying this is not secure?
depends on the extra passphrase really.

maybe i'm just too paranoid. i also imagine most people pick words like moon and hodl and think they are clever.

>>13955153
The only goal of the passphrase is to get back your funds if you lose the ledger or forgot the pin.
If you use this passphrase on another wallet it defeats all the ledger's purpose since your private keys are on the internet or on your computer

>>13955188
>depends on the extra passphrase really.
>maybe i'm just too paranoid. i also imagine most people pick words like moon and hodl and think they are clever.
Yes, but wouldn't that still be more secure than NOT using a passphrase at all?

Anon, ledger isn't safe at all because it's not fully open source. So there definitely are backdoors.
Better buy Trezor.

>>13954380
You call that safe? I have mine split to 12 different locations across two countries and 3 mediums (paper, usb and rocks). My usb is encrypted with decryption key written on two parts on three different papers. For other papers some of them have parts of my private key written in code I invented and only I understand hopefully, others just have key written in plain text. Good luck guessing which one is which, and in which order they go. For my parts number 7 and 9 i use rocks (plain rocks) on 2 different physical locations. Number of rocks, as well as their shape, color and weight combined with a mnemonic I created based on my second pet's name when I was a child tell me the exact private key part. What If I lose one/some parts, you ask? I have the same thing in a different country, but the code is all different, I'm not stupid lol. Any suggestions how to further increase security? My exgf found one of my papers in my closet when she suspected I was cheating on her for being on my phone all the time (I was checking crypto prices) so I had to dump her and do the whole thing from scratch again because I couldn't deal with such security risk.

>>13954362
thank you sir you seem like a respectable authority figure

>>13955212
I know it's hard to do with it being closed source, but has there ever been any kind of independent audit of the ledger's code?
And wouldn't closed source make it less vulnerable to malicious actors and make the only real risk from ledger themselves?

>>13954406

based

>>13955206
marginally maybe i'm looking at it from theoretical and time angles.

>>13955286
>You call that safe?
it's much better than nothing (ie keeping all 24 at one place or having multiple copies of it)

also kek i have no further suggestions for you anon you have surpassed the mundane world

>>13955314
i think the software you can use for recovery is actually open source... if not do not fucking use it!

>>13954187
Bull run 2017 when I still had crypto and used hardwsre wallets, I split my funds between 3 ledgers and 2 trezors.

Can never be too safe anon

>>13955342
What about CasaHODL?

>>13955314
>And wouldn't closed source make it less vulnerable to malicious actors and make the only real risk from ledger themselves?
that's boomer thinking i would say no altho it might make it more difficult as in time consuming in certain cases that again is snake oil security. just like the secure element chip.

>using hardware wallets

do people do this?

like unironically?

this is all the newfags cuz bullrun rite???!

>>13955546
i will personally wait until all phones have one built in. and don't actually like that it removes focus from understanding shit to trusting manufacturers and trinkets which is the boomer way. then again this comes with adoption so maybe it's a good sign. can't tell.

>>13955479
What hardware wallet would you recommend?
>>13955614
What would be the difference between trusting your phone manufacturers and traditional hardware manufactures?

>>13955614
>phone
you;re joking right?
you know those things are backdoored up the wazoo.

is this some pleb zoomer/millenial party thread rite now?? jesus.

>>13955546
>he spends the hassle to create air-gapped, unconnected machines
>his keys are just as vulnerable to backdoors embedded in the hardware

>>13954187
If one of the little smd capacitors inside die or lose enough capacitance which all capacitors do youre toast.

>>13956180
> He thinks if the hardware dies your coins are lost

>>13956046
heh you are funny.

>>13955749
>What would be the difference between trusting your phone manufacturers and traditional hardware manufactures?
nothing it's just i'm gonna buy a new phone anyhow in 2 years.

>>13956180
exactly nobody should rely on his device working next day be it a pc a phone or a hardware wallet.
before you send crypto to a wallet it should already have been backed up in a secure way.

I think the consensus is that as long as your recovery phrase is kept hidden in at least two locations, and nobody has access to your hardware wallet, you're probably good to go.

>>13957722
so you didn't read anything

>>13955286
lol

>>13954187
le hodl

>>13954380
>create 3 groups of the 24 words and store them at 3 separate locations.
You would do good writing quests for blizzerd

>>13958386
it's not my idea i'm just passing it on because i think it's actually better than nothing.

if i were to secure something at 3 locations without compromising the security i would randomly generate a function (a matrix really) that is it's own inverse (like xor) f(a,b) = f(b,a) and create 2 random strings and use them on my secret phrase c=s+a+b and write down the result.

to get the secret you would need the function and all 3 of the strings a,b,c and store them on different locations.

so far it's not that difficult and it actually because of the random strings have the theoretical unbreakablity of one time pad.

what's with all the seed splitting memes
realistically what's the odds of :
1) someone finding your your seed
2) someone finding your hardware wallet

>>13958639
realistically the same as someone breaking into your home and taking all your valuables.
and you may even get the stuff they steal from you back but you will never get the crypto back and no insurance will cover it either.

it's very little effort for decent enough security.

Trezor or ledger?

>>13958690
whichever you like the looks of better

>>13958707
Do I need to be concerned about open-source (Trezor) vs closed-source (Ledger)?

>>13954187
>Is that truly enough to secure my funds?

If you're that worried about securing your seed phrase, watch this.

https://www.youtube.com/watch?v=U6PoUg7jXsA

>>13958729
it probably doesn't matter as much so long you can recover the funds with an open source bip39 software from the seed. (like this https://github.com/Multibit-Legacy/multibit-hd)) i'm not saying opensource should not be preferred as much as possible. but the way hardware wallets work may not be a big issue at all.

>>13958994
to put this in a different light, you have an app running on your computer which needs to be open source since it connects to the network and is an obvious trojan horse if it's not peer reviewed.

this app uses a hardware device that is not really normally capable of giving out the private keys but it can sign with them. the app creates the transaction, sends it over to get signed, the wallet signs them (if you press a button) the app checks the transaction for not being altered and broadcasts it.

basically the hardware wallet protects from a purely cyber attack and the opensource app protects you from any nasty surprises in the hardware os like sending your coins to their address after 2020 april 1 for example.

>>13959165
hmm on that note i don't really see this verification of the unaltered transaction in ledgers source. maybe you should check with their team about that...

>>13955614
Guess what, it's already here:
https://www.coindesk.com/samsung-unveils-cryptocurrency-wallet-dapps-for-galaxy-s10-phone

>>13955286
Very based and redpilled.

i leave my shit on binance

>>13961834
all good until they Mt. Gox
also anything you hold there is held in fractional reserve so you're cucking the price of your coin in a very small way.