43
22
The standard Bitcoin client does not encrypt wallet files, so any malicious user that gains access to this file will be able to transfer all the coins to their own wallet. Furthermore, if I lose the wallet file then I lose access to those coins. What steps must I take to prevent loss of coins like this?
16
The "offline wallet" method described by David Perry is a good way to securely generate a bitcoin address/wallet.dat but in order to be secure from both loss and theft the first thing you will want to do is encrypt that wallet, and then make many different copies of it.
One easy way to do this is using the program TrueCrypt as explained here. To summarise the contents of the link, you will use the default options in the software to create an encrypted volume, then move your "wallet.dat" file into it as soon as you create it on the trusted, offline computer. This will create an encrypted copy that can be placed on a thumbdrive and then saved in multiple locations such as gmail, dropbox, a physical safe, etc.
I would also highly recommend testing the file once with a small amount before copying any substantial sum of bitcoins to your newly created address. If you are satisfied with both the test and all the precautions you have taken, then transfer the rest. You can keep your wallet secure by not accessing it frequently, so this should be used as a savings wallet and not for regular transactions. Hope this helps! Also, you can find an excellent overview of good wallet practices and security methods at https://en.bitcoin.it/wiki/Securing_your_wallet
That is not secure for me, because I would forgot/lost the password after several years. – Tomas Kubes – 2013-12-02T21:57:55.687
update: TrueCrypt is deprecated. BitLocker is also broken according to https://ieeexplore.ieee.org/document/7467359 and other sources. I recommend https://cryptomator.org/ or PGP
19
One method commonly in use is an "offline wallet."
To generate an offline wallet, launch a bitcoin client on a known clean computer, virtual machine, or use a bootable Linux distribution like LinuxCoin. Make sure this system is NOT connected to the internet for this process. When the bitcoin client is first launched, it generates a brand new wallet.dat file with one address. Save that wallet.dat file to a thumb drive along with a text file containing your new bitcoin address. Delete the wallet.dat from the machine once you've copied it.
Any coins sent to that address are only accessible to someone holding the wallet.dat file on your thumb drive and since the computer which generated that thumb drive has never seen the internet so it's a pretty fair bet that your copy is the only copy. Send any coins you want to secure to your "offline" wallet's address and use your thumb drive to recover the coins when needed. Remember that once you've used the wallet on the thumb drive, it is now "burned" and a new one must be generated.
Edit: There is an excellent resource for wallet-securing techniques available on the Bitcoin wiki which also covers backup methods, encryption and many other topics at far too great a length to cover in a single answer.
1Done and done sir. – David Perry – 2011-09-01T20:55:34.277
Can you please add to your answer the link to the wiki entry? https://en.bitcoin.it/wiki/Securing_your_wallet
5
The upcoming Bitcoin client v0.4 will have encryption on wallet.dat if you choose to set password on wallet.
1v0.4 has been released now. Voted up. – Highly Irregular – 2011-10-05T06:10:50.717
3
This is an involved topic and the answer will change as bitcoin clients improve. Here is what works for me...use a drive encryption solution (i.e. truecrypt) and keep your wallet.dat file on it (you'll need to read the docs about how to relocate the wallet.dat file to a different location). I recommend using aes256 encryption. Make sure you remember your password used to encrypt the drive.
After creating a wallet on the encrypted drive, shut down bitcoin and unmount the encrypted drive (important to avoid data corruption). For backup, just copy the encrypted drive to other devices both inside and outside your home (i.e. online storage provider). Since the volume is encrypted with strong encryption, it will be unusable for anyone that obtains a copy and you will have multiple copies in case your hard drive crashes (just don't lose your password!). Anytime you spend coins out of your wallet or generate new addresses, you should update your backups.
Note, this solution may not protect you from viruses...you should never handle your unencrypted wallet.dat file on a computer you suspect may be infected with viruses. There are wallet stealing viruses in the wild. There are more advanced measures that can be taken that further mitigate the threat posed by viruses.
3
I use virtual machine with encrypted home folder. It's a bit geeky, but is very secure and I am able to send money with no hassle of repeating the process (David Perry's advice). Don't forget to encrypt and backup your wallet.dat regularly.
With time there will be many reputable online wallet services available, though I would recommend diversifying your bitcoins in multiple places, just in case.
2
To avoid heavy coin losses I advise you not to keep all your money in one place. You can, for example, create one wallet for everyday payments and another wallet for savings.
The savings wallet is rarely used and usually contains more coins, so you should enforce its security by keeping it offline most of the time. You can save this wallet inside an encrypted USB stick, write its private key in a piece of paper or use any other method that you feel comfortable with.
The everyday wallet should contain less money (enough for day to day transactions) and be more accessible. You can keep it encrypted in your computer/phone or take an USB stick with you everywhere. Usability and security come hand in hand here so you should choose a solution that fits your needs.
You can obviously spread your money through many other places (multiple offline/online wallets, ewallets, exchange sites, etc.). This will reduce the probability of loosing a lot of money.
2
There are a few options available. Here are a couple:
Encryption with Winrar is secure if you use a long password with no dictionary words, both upper case and lower case letters, numbers and special characters in it.
Truecrypt is more secure but most people don't have it already installed, so it's little more time to get it setup.
Whatever password you use to encrypt, make sure to record it on paper, and physically store it in a couple of easy to remember and secure locations that you will not forget. Without it, you won't be able to decrypt and access your bitcoin wallet.
1
The paper is most secure, because it will be readable after 20 years. If you need long time secure, I suggest following
If you do mistake, you will loose all your bitcoins!
Before you do this, try this with empty wallet. And ensure yourself that you are able to recover the wallet from the private keys from the printed and cut paper on another computer.
This will work, even if all clouds, email, computers, dropboxes and hardisks vanish/destroy and your house burn.
1
https://bitcointalk.org/index.php?topic=17240.0
This link will show you how to create a secure wallet.
3@tysat You should include the relevant section from the forum to make your answer more resilient to loss of the link – Gary Rowe – 2011-08-31T08:30:46.560
5posting back to the forum is no good. – Buckhead_Comp_Ser_Co – 2011-08-30T21:49:29.573
0
The best advise is to back up your wallet account and have the seed phrase securely saved somewhere. Make sure not to disclose this seed phrase bc who ever has it can steal your money within minutes. Encrypt your wallet also, just be patient enough to find the best encryption platform.
1Note that the latest version of the client does encrypt wallet files now (v0.4 at the time of writing) – Highly Irregular – 2011-10-05T06:15:52.847
5
Any answer to this question should include this link: https://en.bitcoin.it/wiki/Securing_your_wallet
– ripper234 – 2011-08-30T22:50:04.020