Sophos Cloud Optix
First there was online banking. Then PayPal. Now, there’s Bitcoin. It’s a brave new world, but with Bitcoin exchange rates so high those coins are too precious to lose.
That’s where a Bitcoin wallet comes in. A wallet is a program, app or service that holds coins, keeps them safe and makes it simple to backup, spend or accept.
With Bitcoin, a wallet doesn’t just offer security. It offers bookkeeping, portability and simple ways to give and receive cash.
What is a Bitcoin wallet?
It’s rather like an online bank account, but even simpler to use.
Each Bitcoin is a unique solution to a mathematical problem, consisting of a short string of text which represents a figure. Let’s say you give someone a coin or fractional coin – the text string changes as it enters their wallet, and once a global network validates the transaction, your original coin is invalidated and the new coin becomes theirs.
To someone who is sending money, your wallet is just an address. All they need to know is where to send their coins. The QR code on the right of this image is another way to represent the address on the left. When you make a face-to-face transaction, the sender simply snaps the QR code rather than exchanging emails.
Since coins are just characters, you could store them in a text file. But that wouldn’t be smart.
They could be viewed by anyone with access to your device and without the benefits of a wallet, they would be hard to spend.
NB. It’s a good idea to make sure you are really clued up on the world of Bitcoins if you are holding significant sums. The reason the real world has banks is that we recognise it’s quite risky, as an amateur, to try to secure your house enough to hold your life savings. Securing your own computer is hard but in the Bitcoin world you don’t have a bank as a buffer to rely on.
Types of wallets
- Local – Installed on your own device
- Online – Provided with your account at a store or Bitcoin exchange
Installing your wallet on a smartphone or PC allows you to send and receive Bitcoins as easily as exchanging emails – you only need the address of another wallet. But if you want to buy Bitcoins with local currency, or ‘cash out’, you need to do that via an online currency exchange, which will include an online wallet with the subscription.
Either way, security is enhanced by having both local and online wallets and learning to move money between them.
Local wallet
A wallet installed on your portable device makes for quick transactions, but phones can get lost and laptops can be hacked.
It’s a good idea to transfer any incoming coins promptly to an offline device, an encrypted cloud service, or into cash.
There is a difference between transferring coins and backing up your wallet – always do both! With an app tied to your NAS (network-attached storage) or online service, backup is a no-brainer.
Online wallet
Online wallets hold subscribers’ money at their servers, and accounts are backed up and instantly available from anywhere in the world.
However, online Bitcoin exchanges are still immature and many have suffered outages or breaches. In a study of 40 exchanges, 18 of them had failed, leaving clients penniless!
Choosing a Bitcoin exchange
Bitcoin exchanges collect sensitive personal data, even demanding access to bank accounts and credit reports. Carefully scrutinize their reputation, focusing on these things:
- Highly regarded with few complaints
- Infrequent downtime or delayed transactions
- Do they (a) offer a private key under subscriber control OR (b) are funds exposed to the internet small compared to offline reserves
Note that (a) and (b) are mutually exclusive. That is, if you control the keys, the contents of an online wallet will be exposed to the internet. Neither method presents a big risk if you sweep assets into your offline wallet or encrypted cloud storage after each transaction.
7 Bitcoin wallet security tips
- Never store your wallet identifier with your password.
- Initiate major transactions (including cash exchange) from your own PC – not one that is shared – or one that boots as a dedicated virtual machine
- Use your phone wallet for small transactions when traveling. Just as with a real wallet, carry only the cash required for anticipated transactions. By their very nature mobile devices are continuously exposed to outside threats.
- If you must engage in a large transaction away from home, use your phone to access an online wallet. It can be unsafe to access an online wallet from a PC that you do not own.
- Limit internet-connected wallets to the minimum reserve that you absolutely must leave online for ready access.
- Backup your wallet after every transaction to encrypted storage or an offline device, and then sweep to another wallet. (Do this even for transactions with your primary wallet – it adds a layer of protection by recreating the coin and shifting it to a wallet that is not shared with the buyer or seller.)
- There is a difference between user authentication and encryption. It is not sufficient that your backup device or service requires a login – it must be encrypted too. If you use a cloud backup service, find out whether they encrypt from end-to-end. In this way, your data cannot be viewed by the backup service itself, by anyone in between, or by others sharing your WiFi or mobile data service, so your cash is sealed from the moment it leaves your device until you restore the data at some point in the future
Image of Bitcoins courtesy of Shutterstock.
Excellent article on Bitcoin.
Either way, security is enhanced by having both local and online wallets and learning to move money between them. ==> ¡NO!
Philip,
Thanks for explaining the ins and outs of BitCoin wallet security. I don’t trust online wallet providers. Too many of them have been hacked or gone out of business. I don’t even know if the providers are honest and not grifters intent on stealing their customers’ balances. The reported hacks may actually have been incidents of internal theft that were misrepresented as external hacks. Did anyone see the current movie “American Hustle”? Do I really need an online wallet?
I plan to simply backup my BitCoin wallet on multiple USB thumb drives and SD Memory cards from different manufacturers and then store them offsite at a bank safe deposit bank. I could keep a small balance for occasional shopping in separate thumb drives hidden at home. Is this a viable BitCoin wallet security plan?
The best thing to do is to create an offline wallet on a computer that never gets connected to the Internet. It is a fairly easy process to create an online transaction on a USB drive and use the offline computer to sign the transaction with the private keys. The Armory wallet is “deterministic” so you only need to back up the original keys to reproduce the entire wallet. Those should be backed up via offline and offsite backups such as paper backups.
I run the “Official” bitcoin-qt client, which is in a way also a server in that it acts as a node (AFAIK?). Is it possible to link a mobile app to your “node” so you can transfer funds to/from them?
There is good reason to be wary of services with online wallets. The market is young, there is no oversight, and most services are unlikely to be held to any geopolitical jurisdiction. In fact, we have already seen a litany of glitches and financial loss.
But here are two simple realities:
* Today, most users need an exchange to buy their first Bitcoin. They deliver coins to a hosted wallet, which is part of your account setup.
* You can (and should) move your cash away from the online wallet promptly. That’s what my article is all about.
Your suggested practice of backing up a wallet onto physical media and hiding it at a bank or around your home is certainly valid. Some users even print out their wallets as text or 2D inidicia. (This is actually a third type of wallet. We call it a “paper wallet”). These can be stored like any other valuable documents – in a safe, in the mattress, etc.
But backups and not live wallets. The distinction is noteworthy, because backups are typically are superseded rather than synchronized. And backups can be tricky if you subsequently spend a fraction of your holdings and have received change.
I think that you are on the right track. But I respectfully leave you with two points:
1. The risk in using the online wallet of a major exchange is small, if transactions are small and the money is moved promptly.
2. Physical storage devices tucked away at a bank are backups. They are part of any good security practice. But they do not address the issue of maintaining a wallet. To do this, I suggest offline wealth and “nearline” access to funds that may be needed for any imminent transaction.
Philip Raymond,
Boston MA (USA)
One of the best ways to store your bitcoins long term is to use a “paper wallet” or write down your private key. There are a lot of sites that make it easy to do this which generate the private keys inside the browser using Javascript.
To make it secure I would recommend saving the HTML from that website and booting your machine from a live CD such as Ubuntu and open the HTML. Print out your wallets and you can send bitcoins to your address by scanning the QR code or writing down the BTC address. When you need to send them again scan in your QR code or enter your private key into your favorite bitcoin client.
Oh well, let me add my 2 cents:
Following atma.es , since january you should also keep an eye on your SOHO router, smart TV, set-top box… or fridge. They found a new malware infecting embedded devices with bitcoin-mining tools.
Not clear from the article what you mean by ‘sweep to another wallet’. Do you mean backup from one wallet and restore to another? For each transaction??
If that is required we need some simpler ways to make that happen or BTC will never be mainstream.
Ya this is bull. I was just about to buy some but now it sounds so difficult to keep it safe it can never be a main stream thing. Its only for computer nerds.
I think bitcoin will continue to go down. I was going to buy some but after reading all this on the security of it sounds to difficult.We want a easy way to put it on our computer. I rather just buy some gold and silver now. People don’t like all these computer terminology when it comes to keeping money safe.
I want to start using Bitcoin, but after extensive research I am lost in where to start. I would like to have a wallet that I can use on my mobile plus on my desktop. It should also have a credit card (not in the physical form). Is there an app that provides all of this at once? Mobile for addresses with small amounts + desktop for higher security. I value my privacy as well, so I want to take this into account when choosing where to go.
I don’t like the formulation of the question. Using blockchain technology implies safety and security, doesn’t it?
I don’t know about bitcoin actually. But I’m dealing with other cryptocurrencies – ETH or MGO, for example. Offline wallet is what I choose (it’s on my computer).
Easiest crypto to deal with is MGO. After the collaboration between MobileGo (the provider of MGO) and Xsolla this cryptocurrency has great perspectives for development. That’s why I’m mentioning it.
And as for the security tips they’re absolutely right. Thank you!