Security ain't pretty - Originally posted May 5, 2018

During the 1980s, a fellow in Orlando, Florida named Sam Behr hosted a series of fantastic commercials for tires with the catch-phrase “tires ain’t pretty”. Fantastic tire commercials? Yes, see an example of a tires ain’t pretty commercial below.

And, then, there's this classic…

The premise was that tires aren’t sexy, that it’s hard to sell tires simply because they’re just ugly things no one thinks about until they go flat, and yet, everybody regularly needs tires. Behr stated that his company would offer folks a fair deal for new tires. They were great, classic commercials, off-the-chart entertaining for a tire commercial, and dog-gone truthful.

Securing one’s cryptocurrency is very similar—security ain’t pretty. Security is boring, meticulous business, and it’s often clunky and frustrating. Protocol and procedure is not exactly synonymous with flash and glam.

What’s more, the question of how to, securely, store one’s crypto can be perplexing. There are many tales of horror. There are many angles of possible attack. There are many, many theories as to best-practices.

Some say it’s best to make a paper wallet. Others scoff at paper wallets—they’ll burn in a fire, you know? Some say to plant your private keys in a safe deposit box in the bank. But, then there’s the hassle of relying on a third-party (crypto high heresy) and inconvenience of access only during banking hours. Some say to stick-it-to-the-banks and forget relying on them, but rather, to disperse your private keys among trusted family or friends. Some say screw that! and trust no family or friend because they’ll just rob you blind when your crypto moons. Some say to write things down on paper, stick it in a mayonnaise jar, then bury it in your backyard. Some say it’s best to etch keys into fire-proof metal and then hide it away in that mayonnaise jar first. The ordeal or crypto security can indeed be perplexing.

Security ain’t pretty.

There are programs such as Electrum and Exodus that can be downloaded onto your laptop. These are great programs, and you have control of your private keys. But, a drawback is that the computer they're on is likely connected to the internet. The fear then is that a hacker may tap into your computer via your network then either be able to take over your laptop or be able to see your screen and see your keys.

Despite the noise, a fundamental truth that seems to underlie all of these “best-practice” techniques is…

Get your crypto offline!

More precisely, get your private keys offline. This mantra is no doubt correct. But, even this truth brings disagreement.
So-called “air vacuum cold storage” is often purported as the fool-proof, hack-proof solution to crypto security. By air vacuum, I mean any solution that insulates your crypto from connection to the internet. An example might be holding one’s crypto on a dedicated laptop that is never, ever connected to the internet.

A cold storage gold star seems to currently be awarded to offline physical wallets such as the products offered by Ledger and Trezor. The idea is that these devices are, in essence, like that air vacuum never-online laptop, only smaller. It’s common to hear those in the crypto space advocate to others that devices like these are critically essential for anyone with any amount of crypto.

These devices are no doubt handy and worthwhile, but, are they any better than any other air-vac strategy? Hardware storage aficionados will likely disagree, but other ways are just as secure. When someone says their crypto is "stored on my Ledger Nano S" or "on my Trezor", that's actually not correct. Your coins are "stored" on the blockchain, which is 100% public. It is your private keys that are stored on your hardware wallet (or on your laptop, or USB, or tattooed on your buttocks-not wise-hard to read, or that lowly piece of paper).

One of the most basic and secure ways to store crypto is to simply write, by hand, one’s private key or keys onto paper.

By hand? Printing a private key may mean running it over a wifi network—not wise. Or, inkjet printers, the kind many people have in their homes for personal use, are susceptible to fading over time. An illegible private key is a useless key, and means one’s crypto lost.
Yes, hand copying a private key poses risks—one mistake and the key is useless. It’s up to the individual to be careful, then double and triple check for accuracy. This comes back to a fundamental premise of crypto—the crypto owner holds his or her own responsibility when it comes to his or her funds. In this case, you are responsible for correctly copying the key, just as you are responsible for storing it in a safe place. If you don’t want that responsibility, then keep your money in a bank.

Originally published on http://satoshitimes.wikidot.com
DATE YEAR
LINK:

Although dated, this is being posted here on the Hive blockchain so that it's archived.