Post
Topic
Board Development & Technical Discussion
Merits 17 from 7 users
Re: NEWS FLASH! Hardware wallets still aren't secure, and they never will be.
by
PrimeNumber7
on 06/07/2019, 22:52:36 UTC
⭐ Merited by Welsh (6) ,dbshck (4) ,bones261 (2) ,bitmover (2) ,LoyceV (1) ,ETFbitcoin (1) ,vapourminer (1)


Anyway, paper wallets cannot have issues if you use your own entropy and proper security.
This is insane. Paper wallets have additional security vulnerabilities that HW wallets do not have.

When using a paper wallet:
  • You must use a(n) (offline) computer to generate the private key to a paper wallet, and the portions of the private key may remain on the computer long after the fact. This is not a risk with HW wallets
  • You must use a printer to print the private key for a paper wallet, and portions of this image may remain on the printer long after the fact. This is not a risk with HW wallets
  • You must transfer the private key of your paper wallet onto a(n) (offline) computer to spend any of your coin, risking the private key remains on your computer long after the fact, and risking that someone will take a picture of your private key/paper wallet. Neither of these are a risk with a HW wallet
  • An attacker may be able to compromise your paper wallet by being in possession of it temporarily for only a few seconds via taking a picture of your paper wallet. For a HW wallet to be compromised, the attacker must be in continuous possession of your HW wallet for a longer time, and must be in proximity of special electronic equipment. An attacker could stumble across a paper wallet, and compromise it without your knowledge, while a HW wallet being compromised without your knowledge would require a more targeted attack.



With a HW wallet, you can use multiple passphrases, including a passphrase that is easy to crack with nominal amounts of coin. You can monitor the coin in the easy to crack passphrase, and if coins are moved from addresses associated with that passphrase, you will know you need to quickly move the coin in addresses associated with a more complex passphrase. An attacker will also not know how much coin you have secured by your HW wallet, so if they find a single passphrase that can be used to generate private keys to spend coin, it may not be a good use of resources to look for additional passphrases that can be used to spend additional coin.