Comment by Geee | Hacker News Reader

Comment by Geee | Hacker News Reader

Parent Full thread

Use a hardware wallet to securely generate keys and sign transactions. Hardware wallet is meant for secure use of cryptocurrency, but it is not optimal for long term storage. It's important to buy devices only from trusted vendors, and to make sure they're not been tampered with (never buy them from a third party).

For long term storage, you need indestructible and physically secured backup of your keys. Basically, you just need to write down the 12 or 24 seed words generated by your hardware wallet and try to keep the words safe from destruction and theft. It's recommended to use a indestructible material such as steel for these, and then store or hide them safely. For more advanced security, seed words can be split in multiple parts using the SLIP39 seed format.

For hardware wallets, e.g.:

- https://coldcardwallet.com

- https://trezor.io

- https://www.ledger.com

For long term storage, e.g.:

- https://cryptosteel.com

- https://cryptotag.io/

- http://bitcoinseedbackup.com

Looking at the cryptosteel - am I missing something or do you need to securely store or destroy all the engraved letters you don't use? Otherwise someone who obtains the remaining letters surely knows exactly which ones are in your secure word store...

Just throw a few away each time you take out the trash.

> Basically, you just need to write down the 12 or 24 seed words generated by your hardware wallet

Why is that in any way more secure than writing down the private key itself? (inb4 "need to find both the hardware and the written seed words" that's equivalent to writing down the private key and then cutting the paper in half)

Much easier to remember and to transcribe compared to writing down a string that looks like random garbage.

how much BTC are you willing to bet that you'll remember 24 randomly generated seed words? probably not much.. that's why parent was advocating "you just need to *write down* the 12 or 24 seed words generated by your hardware wallet"

How much are you willing to bet that you transcribed a string of gibberish correctly (including case variations). Isn't a sequence of real words more fault tolerant?

BIP39 seed words are used to deterministically generate all of your private keys in your wallet. You don't have to store the private keys themselves. Remember that each address has its own private/public key pair, and addresses shouldn't be reused. BIP39 has been the standard for many years.

Hardware wallet is assumed to generate BIP39 seed words securely. If you don't trust the RNG, some hardware wallets also support adding your own entropy with dice rolls. [0]

[0] https://coldcardwallet.com/docs/verifying-dice-roll-math

In some ways it's less secure, because seed phrases are usually master private keys, versus a single private key.

The point is that you can decide what to do with it... be your own bank. You can also add a password to a seed phrase backup if that makes more sense for your threat model.

Would storing a wallet's private key in an encrypted password manager be insecure in some way?

If that password manager has a zero-day (unlikely but not impossible) you could be in trouble.

Reply on news.ycombinator.com