How vulnerable are offline users of bitaddress.org, who don’t use Ubuntu?

By not installing Ubuntu and not removing the hard drive, I suppose I am vulnerable when I open bitaddress.org offline and enter the 64 random hexadecimal characters I have generated without a computer to find corresponding public address.

Yes, I clear the browser before re-connecting to the net. I never use the mouse to copy the private address (or indeed keep any computer record of it) but, if malware can pick up the 64 random hexadecimal characters which I typed in or if it can take a screenshot of the private WIF address I am screwed.

Peter

Posted 2014-09-01T12:05:22.813

Reputation: 421

2I don't really know how one would quantify "how vulnerable". It depends mainly on your general computer security practices. In general, if there is any kind of malware on your computer, it could certainly pick up the private key and you would be screwed. On the other hand, this is true whether you use bitaddress.org or some other software. Clearing the browser cache and avoiding the clipboard don't really help. – Nate Eldredge – 2014-09-01T12:25:24.947

It mostly depends on if you do this using a computer which has a chance to get infected by malware. If you are doing this using your everyday Windows laptop then maybe there is a chance. – Mikko Ohtamaa – 2014-09-01T12:26:46.150

Also you can boot to Ubuntu from USB stick - no need to unscrew harddrives or anything like that – Mikko Ohtamaa – 2014-09-01T12:34:50.957

1I suggest you re-ask your question "what is a safe way to use bitaddress.org, when my purpose is X and I am using tools Y" – Mikko Ohtamaa – 2014-09-01T12:40:52.997

No, I am using either my computer at work or home which I use for everything. I suppose if I wish to transfer larger sums to cold storage I will have to start thinking about booting with Ubuntu. I’ve seen the tutorial videos, but I have never done it.

Why can’t there be a small cheap calculator-like device with no internet capabilities into which you put a random number and it gave you a public address on the screen? Any fool (like me) could store cold then. – Peter – 2014-09-01T14:01:57.723

Such devices exist; they are called hardware wallets. You can read about some of the ones on the market at https://en.bitcoin.it/wiki/Hardware_wallet. I'm not sure that any one of them has caught on at a large scale, so far.

– Nate Eldredge – 2014-09-01T19:24:56.570

1Incidentally, there is not really anything magical about using Ubuntu for this purpose rather than some other operating system. Ubuntu happens to be a free and reasonably secure OS that is relatively easy to boot from a USB stick or other removable media (and by no means the only such OS). But any other OS running with no Internet connection would work just as well for this purpose. – Nate Eldredge – 2014-09-01T22:52:18.407

Answers

Depends on what you are going to do with your address. As for me there are three main cases to consider:

Will you store so huge amouts of bitcoin to fear attackers who are targeting yourself directly?
Are your computer as unsecure as most of non-technical people computers (and therefore: is it possible that it is already infected by some virus)?
Or last but not least: are you doing some controversial business and fear being spyed by government or someone else who may want to know either your private keys or just that certain address belongs to you?

In fact in everyday life situations there is no need for security better than just keeping your antivirus up to date and avoiding storing generated keys on disk (which could lead to a leak if your computer gets compromised in the future). Unless you've put all your savings in BTC.

jaboja

Posted 2014-09-01T12:05:22.813

Reputation: 139

That really depends.

If you are a type of person that, although not using ubuntu , but you buy a fresh new cheap laptop and transfer the offline version of bitaddress.org to it , you are already quite safe.

Many people use ubuntu for offline as they are really safe.

user19180

Posted 2014-09-01T12:05:22.813

Reputation:

Thanks, but buying a cheap laptop - however cheap - just for making Bitcoin keys and addresses is not really an economical proposition. As I said above, why can’t there be a small cheap calculator-like device with no internet capabilities into which you put a random number and it gave you a public address on the screen? – Peter – 2014-09-01T14:29:40.337

Perhaps use a Raspberry Pi. Never connect it to the net and use either the standard Raspbian OS or there is a bitcoin-centric one (I forget the name).

PS: I'm not sure why you single out Ubuntu.. I assume you mean Linux rather than Ubuntu specifically.. I my personal opinion Ubuntu is too commercial - if you're really paranoid and really trying to keep your keys secure then use a "proper" 100% open-source non-commercial Linux OS such as Debian.

George

Posted 2014-09-01T12:05:22.813

Reputation: 586