Quote from: HCP on July 07, 2019, 07:23:36 AM

Well, if you'd bothered to read it, then you would know that it didn't have anything to do with change addresses, paper burning or water damage or other "blah blah blah".

It was a very real "bug" that was discovered in a relatively popular Paper Wallet Generator that seemed to result in the same keys being generated for "different" users etc.

Covered already. Don't trust crappy sources of entropy. Again, not a paper wallet vulnerability.

Quote from: o_e_l_e_o on July 07, 2019, 07:47:32 PM

What is being described here it not an airgapped device.

I know. The idea was that somehow wifi would unwittingly be connected on an air-gapped computer. If I don't have a wifi card and I don't have an ethernet cable the chance of any of my info leaking onto the web is zero unless someone is extremely close by, looking over my shoulder or picking up radio waves etc.

Quote from: o_e_l_e_o on July 07, 2019, 07:47:32 PM

Disconnecting a computer in this way, even if booting from a live USB/CD, does not guarantee safety by any means.

What do you mean by that? The only real vulnerabilities that I'm aware of would be radio waves, someone filming me/shoulder surfing and a cold boot attack. A farady tent and some hot ram would solve all of these issues. Is there anything else that I'm missing?

Quote from: bitmover on July 07, 2019, 11:58:43 PM

The computer could get infected while online.

Air... Wait for it... Gapped. There is no "while online" on my air-gapped machine. It simply does not have the capability to connect to the internet. I also use a fresh live usb for each boot. Please read through my posts instead of clinging onto what you misunderstood in one of my posts.

Quote from: PrimeNumber7 on July 09, 2019, 06:45:55 AM

Your private keys will be in your RAM, and may be on your HDD, depending on your specific method of generating your private keys.

They're in your RAM for a few minutes tops just FYI. Less if you apply heat. See https://www.semanticscholar.org/paper/On-the-Practicability-of-Cold-Boot-Attacks-Gruhn-M%C3%BCller/b02403d3239a6d6e78911192f4f82ce987a78944

If you cool your ram down (cold boot attack) you can hang onto this info longer. It's difficult to pull off in the best situation, and you have a very short window of opportunity. Take a hairdryer to your ram after you do a shutdown and you're good to go.

My air-gapped machine doesn't have a HDD. There's no reason to have internal storage.

Quote from: PrimeNumber7 on July 09, 2019, 06:45:55 AM

If you take a paper wallet out of your safe to spend some of your coin, someone could take a picture of your paper wallet to compromise the seed, minus your passphrase.

This should never ever ever be done. Sweep everything. Newbs do this and their change is sent to a change address that they don't have private keys to. Yet another way user error is going to screw you over if you don't know what you're doing.

Quote from: Chris! on July 07, 2019, 12:21:08 AM

Again, user error is not a vulnerability.

Quote from: PrimeNumber7 on July 09, 2019, 06:45:55 AM

I am going to disagree with this ~~statement~~ fact. If a process is so complex that the average user is going to make a mistake, this is a ~~vulnerability~~ user "mistake".

FYFY.

Sorry, you're right. Not user error. "User mistake". You're totally right.

If I take 4 random chemicals in a janitor's closet, mix them together and make mustard gas is that:

A. User "mistake"
Or
B. A vulnerability and these chemicals should never be used by anyone ever again?

Wait, an even better scenerio:

A doctor goes into a complicated heart surgery. They screw up, cut through an artery and the patient dies.

Do they:

A. Go to court because of user error/gross negligence

Or

B. That surgery is never performed again because it's "too dangerous for normal people to do".?

Quote from: bitmover on July 07, 2019, 04:00:57 PM

You could learn a lot from this conversation.

I 100% disagree. All I see is a ton of misinformation and FUD (mainly user error = vulnerability).

You're telling my that I'm on wifi, the private keys are stored in my RAM, HDD etc. You don't even know what an air-gapped system is so what exactly am I supposed to be learning from you?

So far I've learned that you blindly trust a hardware wallet manufacturer instead yourself to generate your own private keys. That's not a lesson in my books. That's a step backwards from being your own bank.

Updated OP and moved the topic for less biased exposure.