Quote from: Ulysses1994XF04 on December 05, 2013, 11:16:15 PM

Quote from: MAbtc on December 05, 2013, 11:06:39 PM

At this point, I would say that wallet security is definitely still beyond the average person. Hopefully, sooner than later, options will emerge that make securing your coins less technical.

Check out this link for some information: http://bitcoin.org/en/secure-your-wallet

The best way to secure your coins is to keep them offline. So, ideally you would have an offline machine or storage medium (flash drive, or paper, for instance) that cannot be reached through the internet.

When I decided to get serious about security, I bought a cheap Ubuntu notebook to keep strictly offline. I verified the PGP signature of my wallet download and transferred the install to the notebook. Offline, it can still generate a wallet and address -- I use this address on my online machine to send coins to cold storage.

If you keep coins on an online machine, make sure you encrypt your wallet with a strong password, set firewall to deny incoming connections, and ensure that your antivirus software is adequate/operational and fully updated. And don't keep your passwords saved on your machine. (All of this is still true with an offline machine)

You may look into running Linux/Ubuntu as a LiveCD on your Windows machine (disable networking/unplug all cables upon mounting), so you can simulate an offline machine without affecting your Windows OS.
https://en.bitcoin.it/wiki/How_to_set_up_a_secure_offline_savings_wallet

Also, take a look into PGP/other encryption. I prefer to keep the directory that houses my wallets/backups encrypted as an extra layer of security. It's complicated, though, and may take some time to get the hang of using it. You can encrypt single files using terminal commands (http://askubuntu.com/questions/98443/encrypting-files-and-folder-through-terminal) or look into something like TrueCrypt.

Damn it. I made this sound even more complicated. The fact is, it may take some time and frustration to understand everything. I still feel lost, myself, much of the time.

I have no idea what encryption actually is; if it's just assigning a password, I've already done that. I'm fairly confident in my password; long, mixed-case letters, numbers and symbols. If you're asking me to do some actual programming, that's beyond my skill set. I really don't want to risk screwing up this computer.

Sorry in advance for the book. As I thought about it, it felt easier just to go through the motions of thinking about why this is important and how it works.

OK, on PGP. Yes, it is complicated, but I doubt it is beyond your skill set. Simply a new process to learn. Before thinking about encryption, it would be good practice now to consider learning how to ensure that what you think you are downloading is what you are actually downloading. This is especially important when dealing with software that could potentially target your wallet(s).

This is a taste of what it means to verify the integrity of and to authenticate certificates for files downloaded. In turn, that will necessitate creating a PGP keypair, and may prime you for working with PGP keys to encrypt your files.

So, a Windows user would go to http://gpg4win.org/ and download the full version. You can google the site for its web reputation. You can verify the integrity of the download using Microsoft's fciv utility found here: http://support.microsoft.com/kb/841290

When you unzip fciv, drop fciv.exe into C:\Windows. That way you can pull up Command Prompt (Accessories) and run fciv.exe from any location. So to verify the integrity of your gpg4win download, pull up Command Prompt, and enter "fciv [____.exe] -sha1" where [] = the exact file location of the gpg4win binary. This should produce a sha1 checksum that you can compare with the checksum found here: http://gpg4win.org/package-integrity.html

If your binary downloaded properly, these sums should match. That is about the extent of due diligence you can do prior to using encryption/decryption. Now that you have verified the integrity of the download, install gpg4win and run Kleopatra. You can now authenticate the download from gpg4win. You would create a new certificate, select PGP keypair, and input your desired user information and password. Once the certificate has been created, back it up and keep your information safe. You can now use this certificate to certify the earlier download.

You do this by downloading (and subsequently verifying) the release signature of the download, found next to the file you downloaded, here: http://gpg4win.org/package-integrity.html Download the corresponding .sig file into the same folder as the original download.

As stated, the signatures have been created with the following OpenPGP certificate:
Intevation File Distribution Key (Key ID: EC70B1B8) -- if you go to that source, you can scroll down to "Intevation-Distribution-Key" and download it (it is an .asc file). Then you "import certificate" and select that file. Verify that the fingeprints match, then you can certify it with your own key.

Now, you can go to File | Decrypt/Verify. Select the .sig file that you downloaded (you'll see that it corresponds to the .exe file in the same folder) and verify. You should now be able to validate the certificate -- giving you confidence that you have the original and unmodified file and not some malicious replacement.

......So now you know how to verify the integrity of your downloads and create a PGP certificate to authenticate those downloads.

Now, encrypting files with PGP is very easy and only one step away. But before encrypting anything -- make sure that your keypair is backed up and your password is SAFE and will not be lost. (It would be tragic to encrypt the directory housing your wallet without realizing the importance your PGP password in decrypting it later on.) Also, when encrypting, remember to encrypt to your own certificate -- otherwise your private key is useless to decrypt it.

Here is a straight-forward tutorial on signing and encrypting files in Kleopatra: http://www.gpg4win.org/doc/en/gpg4win-compendium_24.html

Again, I know it is a lot to take in. But if you are going to be holding an amount of money significant to you on your machine, another layer of encryption can provide great peace of mind.

Quote

I already have a blockchain.info wallet (albeit an empty one). I had asked on another thread if it's possible to set up a wallet on a 2.0 GB USB drive; didn't get any answers. Could I set up an "offline" Wallet on that?

Could I try buying a few mBTC, put it on a USB Wallet and bounce it back and forth between the USB Wallet and my blockchain.info Wallet, just to get a feel for how BTC transactions work? Is that a good idea?

You can set up cold storage on a USB drive, sure. With QT, for instance, just back up the wallet.dat file on the USB -- preferably, the wallet should be generated initially offline, the wallet should be encrypted before stored, and all files on the drive encrypted.

Yes, I would recommend playing around with this a bit. Don't risk much when playing around with cold storage for the first time -- make sure that you are confident in your ability to retrieve your coins from storage before sending much.

Once you have transacted back and forth a few times and feel more confident, I would start over with a newly generated cold storage wallet that has never made outputs before.