News for hackers. Stuff that matters.
Re:Binance banned from doing business in UK by rchaud on Sunday June 27, 2021 @12:06PM (#27652683)
Is there an ELI5 guide to keeping coins secure when they're off-exchange? I heard terms like 'cold wallet', 'cold storage', but surely there's work that goes into creating a secure USB stick?
Re:Binance banned from doing business in UK by Geee on Sunday June 27, 2021 @01:48PM (#27653571)
Use a hardware wallet to securely generate keys and sign transactions. Hardware wallet is meant for secure use of cryptocurrency, but it is not optimal for long term storage. It's important to buy devices only from trusted vendors, and to make sure they're not been tampered with (never buy them from a third party).

For long term storage, you need indestructible and physically secured backup of your keys. Basically, you just need to write down the 12 or 24 seed words generated by your hardware wallet and try to keep the words safe from destruction and theft. It's recommended to use a indestructible material such as steel for these, and then store or hide them safely. For more advanced security, seed words can be split in multiple parts using the SLIP39 seed format.

For hardware wallets, e.g.:

- https://coldcardwallet.com

- https://trezor.io

- https://www.ledger.com

For long term storage, e.g.:

- https://cryptosteel.com

- https://cryptotag.io/

- http://bitcoinseedbackup.com

Re:Binance banned from doing business in UK by jameshart on Sunday June 27, 2021 @02:25PM (#27653899)
Looking at the cryptosteel - am I missing something or do you need to securely store or destroy all the engraved letters you don't use? Otherwise someone who obtains the remaining letters surely knows exactly which ones are in your secure word store...
Re:Binance banned from doing business in UK by ozi on Sunday June 27, 2021 @02:29PM (#27653933)
Just throw a few away each time you take out the trash.
Re:Binance banned from doing business in UK by tomp on Sunday June 27, 2021 @02:05PM (#27653723)
> Basically, you just need to write down the 12 or 24 seed words generated by your hardware wallet

Why is that in any way more secure than writing down the private key itself? (inb4 "need to find both the hardware and the written seed words" that's equivalent to writing down the private key and then cutting the paper in half)

Re:Binance banned from doing business in UK by Geee on Sunday June 27, 2021 @02:26PM (#27653911)
BIP39 seed words are used to deterministically generate all of your private keys in your wallet. You don't have to store the private keys themselves. Remember that each address has its own private/public key pair, and addresses shouldn't be reused. BIP39 has been the standard for many years.

Hardware wallet is assumed to generate BIP39 seed words securely. If you don't trust the RNG, some hardware wallets also support adding your own entropy with dice rolls. [0]

[0] https://coldcardwallet.com/docs/verifying-dice-roll-math

Re:Binance banned from doing business in UK by mhluongo on Sunday June 27, 2021 @02:52PM (#27654146)
In some ways it's less secure, because seed phrases are usually master private keys, versus a single private key.

The point is that you can decide what to do with it... be your own bank. You can also add a password to a seed phrase backup if that makes more sense for your threat model.

Re:Binance banned from doing business in UK by rawtxapp on Sunday June 27, 2021 @02:12PM (#27653782)
Much easier to remember and to transcribe compared to writing down a string that looks like random garbage.
Re:Binance banned from doing business in UK by tomp on Sunday June 27, 2021 @02:25PM (#27653902)
how much BTC are you willing to bet that you'll remember 24 randomly generated seed words? probably not much.. that's why parent was advocating "you just need to *write down* the 12 or 24 seed words generated by your hardware wallet"
Re:Binance banned from doing business in UK by lmm on Monday June 28, 2021 @02:02AM (#27658589)
How much are you willing to bet that you transcribed a string of gibberish correctly (including case variations). Isn't a sequence of real words more fault tolerant?
Re:Binance banned from doing business in UK by dhd415 on Monday June 28, 2021 @07:42AM (#27660556)
Would storing a wallet's private key in an encrypted password manager be insecure in some way?
Re:Binance banned from doing business in UK by thehappypm on Monday June 28, 2021 @09:44AM (#27661867)
If that password manager has a zero-day (unlikely but not impossible) you could be in trouble.
Re:Binance banned from doing business in UK by jasdine817 on Sunday June 27, 2021 @12:42PM (#27653026)
I just used a tool called BIP39 generator on and offline machine which you can feed entropy and it will generate a bitcoin private key. then sent funds to that address.

Then just keep those details safe.

Re:Binance banned from doing business in UK by xvector on Sunday June 27, 2021 @08:58PM (#27656987)
I wouldn't do that, the tool RNG could be backdoored. Did you read the source and compile it?
Re:Binance banned from doing business in UK by tonfa on Sunday June 27, 2021 @01:15PM (#27653297)
How do you handle giving access to your keys to your next of kin?
Re:Binance banned from doing business in UK by Paradigma11 on Sunday June 27, 2021 @02:38PM (#27654028)
And how do you prevent access for your next of kin if there is a breakup/fallout?
Re:Binance banned from doing business in UK by puranjay on Sunday June 27, 2021 @02:33PM (#27653975)
Important question - I hope OP can answer.

Too many people I know haven’t instructed their dependents how to access their crypto.

Re:Binance banned from doing business in UK by rand49an on Sunday June 27, 2021 @03:29PM (#27654491)
Just let them know where those details are and how to access them if they need to.
Re:Binance banned from doing business in UK by whoisjohnkid on Sunday June 27, 2021 @03:33PM (#27654526)
you can use multi sig wallets. Which are synonymous to Shamir’s Secret Sharing Algo; tldr you can generate say 5 keys and you need 3 of the 5 to unlock.

As for if you die … you could use one of those services that will send an email out to your significant others if you don’t log in for X amount of time.

Re:Binance banned from doing business in UK by lmm on Monday June 28, 2021 @02:03AM (#27658599)
> As for if you die … you could use one of those services that will send an email out to your significant others if you don’t log in for X amount of time.

And put your bitcoin private key in there? Surely whoever runs those services would take all your money.

Re:Binance banned from doing business in UK by whoisjohnkid on Monday June 28, 2021 @06:46AM (#27660142)
If you use multiple services each with a piece of Shamir’s secret you are more protected. You can get more sophisticated with this if you want e.g each piece can be xored or encrypted with a value only that person would know e.g their birthday or their fav food.

Being your own secure bank isn’t a trivial task. Hopefully this can get easier in the future

Re:Binance banned from doing business in UK by knownjorbist on Sunday June 27, 2021 @12:16PM (#27652771)
Consider a hardware wallet like Ledger or Trezor, both are pretty easy to use and have extensive documentation. I'm sure there are OSS/hardware solutions you can roll yourself, too.
Re:Binance banned from doing business in UK by rawtxapp on Sunday June 27, 2021 @12:16PM (#27652774)
You can buy something like Ledger Nano which is a hardware wallet. Essentially, the private keys never leave the device, you can instead just sign messages directly with it.

You can also have normal software wallets (don't recommend it for larger amounts) or paper wallets.

Re:Binance banned from doing business in UK by mrgordon on Sunday June 27, 2021 @12:14PM (#27652751)
In the extreme case people will set up a paper wallet using a computer that’s disconnected from the internet. Once they have the keys, they can typically keep them non-digitally and transfer coins to that address as safe cold storage
Re:Binance banned from doing business in UK by eingaeKaiy8ujie on Sunday June 27, 2021 @12:57PM (#27653151)
Use a separate computer with a minimal Linux system (maybe even without GUI) and only open-source software to manage your crypto. Your key should be password-protected. Make multiple backups of the key and remember your password. You can also write your password down on paper and hide it somewhere.
Re:Binance banned from doing business in UK by SkyMarshal on Sunday June 27, 2021 @01:15PM (#27653301)
Also a good idea to use ECC Memory with the ZFS filesystem. That combination can correct any single-bit error, and detect and warn about any double-bit error, significantly reducing the chance of losing data to bitrot.

And if you’re backing up your keys on USB drives, use high-endurance SLC NAND industrial drives. They provide the highest reliability and endurance available.

https://www.embeddedarm.com/blog/slc-nand-secrets-exposed/

Re:Binance banned from doing business in UK by Grazester on Sunday June 27, 2021 @01:32PM (#27653419)
"There's nothing special about ZFS that requires/encourages the use of ECC RAM more so than any other filesystem."-Matthew Ahrens
Re:Binance banned from doing business in UK by SkyMarshal on Sunday June 27, 2021 @01:52PM (#27653607)
His full quote, from the actual source (2003):

"There's nothing special about ZFS that requires/encourages the use of ECC RAM more so than any other filesystem. If you use UFS, EXT, NTFS, btrfs, etc without ECC RAM, you are just as much at risk as if you used ZFS without ECC RAM. Actually, ZFS can mitigate this risk to some degree if you enable the unsupported ZFS_DEBUG_MODIFY flag (zfs_flags=0x10). This will checksum the data while at rest in memory, and verify it before writing to disk, thus reducing the window of vulnerability from a memory error.

I would simply say: if you love your data, use ECC RAM. Additionally, use a filesystem that checksums your data, such as ZFS."

https://arstechnica.com/civis/viewtopic.php?f=2&t=1235679&p=...

Re:Binance banned from doing business in UK by Grazester on Sunday June 27, 2021 @02:08PM (#27653746)
Exactly. You are at no greater risk of data loss if you use ZFS as appose to another file system.

You stated "Also a good idea to use ECC Memory with the ZFS filesystem".

You should have probably stated its a good idea to use ECC memory, period. Instead you tied ECC to ZFS.

Re:Binance banned from doing business in UK by SkyMarshal on Sunday June 27, 2021 @02:54PM (#27654167)
I would simply say: if you love your data, use ECC RAM. Additionally, use a filesystem that checksums your data, such as ZFS.

Both are better than either, and either is better than neither. Especially if you're storing cryptocurrencies on it.

Re:Binance banned from doing business in UK by pjc50 on Sunday June 27, 2021 @01:58PM (#27653670)
Note that you can secure the coins but not the purchasing power of the coins. 10k bitcoins may be worth a billion dollars or they may be worth a pizza in ten years time.
Re:Binance banned from doing business in UK by onethingatatime on Monday June 28, 2021 @07:11AM (#27660332)
To me this is the crux problem impeding crypto. Read all of these solutions: will any of my non-techie friends do those things? No.