As more people get into this crazy pyramid scheme called Bitcoin, it is important to understand the safety measures. Many people spread a lot of FUD about speculative bubble, government intervention, potential backdoors in code and scalability issues in the future. But they never talk about real and immediate security threats that can leave you with nothing in an instant even if Bitcoin flourishes. In this post I’ll explain how I’d recommend storing and handling bitcoins. Don’t take my recommendation for granted, I’m also learning and can make mistakes and will change my opinion later. Do not trust anyone and think twice (and then think twice again) before doing anything.
The rule is to split, diversify and brace for impact. Make yourself comfortable with an idea that your money will be stolen. Not a matter of “if”, but “when” and “how much”. You can only limit the damage, not to avoid it completely. Looking for a perfect solution leads to denial and irrational behavior. You should understand the layers of security and how they reduce, but not eliminate the risk. You should also understand how to split your money in independent parts.
Trusting 3rd parties
When you purchase some BTC on an exchange and keep them there, you are fully trusting the exchange operator. If they get hacked or simply steal your coins, you will have a very hard time recovering them (chances are almost zero). Also, attacks are more probable where the payoff is the biggest. People will continue attacking wallet services and exchanges because it is where the most of money is concentrated. When you purchase some BTC, you should move most of them out of the exchange to a private wallet immediately. You may keep some amount on the exchange in case you’d want to sell quickly (beware of panic sells when someone runs a DDoS attack) or in case your main wallet is lost or stolen.
Beware of market volatility
Some people sell at some unusually high price moving it a little bit down, and then organize a huge DDoS attack on exchanges and popular Bitcoin websites. This creates panic in newcomers who suspect that the bubble is going to blow up and they give up their money to those who know better. I myself have no experience, nor desire to play on price changes, so I don’t recommend at all trying to play this game. Invest only the money you can lose and save it for a long run. Maybe, if it gets 10x more than you invested, you can sell back 10% to cover your expenses and then be a relaxed spectator without risking a heart attack. This is never-done-before technology, no one knows what price is fair, opinions differ from $0 to $1000000. It can go quickly up, then quickly down. Or be stable for a while before unexpected jump or drop. If you are in for a long run, temporary changes do not matter. If Bitcoin succeeds, it will be big and shiny. If it fails, it will fail so quickly, you will not be there to dump it. Just accept the wild swings and limit your investments in the first place.
Your personal computer should be secure. Without viruses, trojans, keyloggers, corporate monitoring software, add-ons, kernel extensions etc. My recommendation: do not use Windows at all. Buy yourself a modern MacBook Air, turn on FileVault2 to encrypt the whole disk (even if your password is weak, disk encryption reduces the risk of private keys being leaked when the system swaps RAM). Allow only Mac App Store apps and DeveloperID-signed apps (it is on by default). Never install any generic UI extensions, never enable access to assistive devices (unless you really use them yourself), never install any entertainment apps or games except Google Chrome. Never install Flash, or Java or any other kind of runtime plugin to your browser or the whole system. Never ever install kernel extensions: sorry, VMWare and Parallels require them and I wouldn’t trust them messing with the OS kernel just to be extra safe. Install apps preferably from the Mac App Store — they can be pulled out quickly in case of a problem and most of them are sandboxed (which usually means app cannot mess with any of your files and has many other limitations).
Bitcoin-QT wallet (Windows, Mac, Linux)
I recommend two wallet apps: “official” Bitcoin-QT and Blockchain.info.
Bitcoin-QT is a so-called “full node client”. It downloads all transactions and operates without trust in any single server as advertised. It is the most maintained, most used codebase. It is also not the easiest to use as it syncs slowly, occupies gigabytes of disk space and UI is pretty ugly.
Bitcoin-QT encrypts private keys with a passphrase (by default it doesn’t, you have to turn this on). To use it safely, you need to have a good passphrase and regularly backup the wallet in several safe locations. On OS X the wallet is located in ~/Application Support/Bitcoin/wallet.dat (all other files, especially blocks folder should be ignored by your backup program).
Split your coins in two or more wallets. Bitcoin-QT does not allow you to easily switch between them: you need to shut it down, rename one of your wallets in wallet.dat, start Bitcoin-QT again. Use different passphrases for each wallet. Store them in different locations. Remember: whenever you do something with your wallet, or move money to another one, always keep all backups and first try with smaller amounts. In case you accidentally send to a wrong address, you better have some older backup with the keys.
When the new update of Bitcoin-QT comes out, download the new version from the official website, verify its checksum and keep it on disk for a while. If in a couple or more days there were no reports of a hack on a download server, launch the app, but for a good measure do not enter your passphrase for a bit more.
Blockchain.info wallet (web, iOS, Android)
Blockchain.info is a web service that allows navigating Bitcoin blockchain and provides an online wallet. The wallet is stored encrypted on the server and decrypted only on client side (in JS in your browser or in iOS app “Blockchain”).
As always, if you forget the passphrase, you will not be able to access your funds. Other apps support importing wallet backup (like MultiBit), so you won’t fully depend on their server to do your transactions.
Blockchain.info is still a 3rd party service and one day may steal or leak your wallet password (e.g. if some hackers sneak in and place a honeypot), so do not trust more than 10% of your funds.
I recommend enabling 2-factor authentication via e-mail code (SMS code is also possible, but is less reliable) - in order to sign in on the web site, you would need your alias (username), e-mail code and a password. Also install the iOS/Android app and protect the whole phone with a passcode. If you e-mail authentication stops working, or your e-mail account is stolen, you’ll still be able to make payments from the phone. Also, copy a wallet backup somewhere outside your mailbox (they have some integration with Dropbox, maybe you should try it).
If your funds get really expensive, you may try a good old paper. I’m far from that happy day and haven’t tried this myself yet, it’s only my current thoughts that might be helpful to somebody.
Paper wallet is a private key which was create on a secure computer, printed on a paper and wiped out from any other storage. It may be protected by a password, but usually, it’s just a raw key. It is safe from hackers, but not safe from physical access. You should keep it in a very secret place, or in a vault.
There are different levels of paranoia involved in creating paper wallets: from a web service which does all work for you (but can be compromised on different levels) to a completely new, clean computer never connected to the internet, with a virtual machine where the password is generated and then the disk is burned down.
Blockchain.info provides some helpful material on how to deal with paper wallets:
Paper key has one important aspect: when importing it to a wallet and sending a portion of money, make sure where the change goes. If it goes back to the different address, your paper key may become useless as your money is now on some new address created by your wallet app. Be very careful not to delete the wallet before you make sure where the funds actually are. Some people already lost quite a lot of money because of careless manipulation with paper keys and deleting the wrong thing too early.
Start small and wait
When you try a new application, or a service, or a piece of paper, or a backup, always start with small amounts and see if you can get it back and forth smoothly. Try the whole cycle, enter your pass phrases ten or more times, so it gets boring. Then, wait a week and try again. If it works, and you did not forget where your stuff is stored, how it is encrypted and if it still accessible, then add a bit more funds there. Never put yourself in a situation where you risk half or more of your funds while pressing buttons. Do it in small portions and check each portion that it has arrived where needed and that it is still accessible.
Conclusion: be extra careful, double check everything, play with small amounts first and remember the rule: split, diversify and brace for impact. Bad things will happen, prepare for them.
If it was helpful, you may send some love to this address: 1TipsuQ7CSqfQsjA9KU5jarSB1AnrVLLo