How to protect against wallet theft?

Question

Let's say I run a Bitcoin client on a computer (Windows, but the question can apply to other O.S.es too), and I want to make sure nobody steals it. I'm especially concerned about situations where someone gets full access to the computer:

• The computer is in a company network where domain admins can do anything they want to it.
• The computer is a laptop and gets stolen.
• The computer has a problem and I need to bring it to a computer shop (or call in a technician) to fix it.
• A trojan gets on the computer and instead of popping up random ads starts doing something much more useful and stealthy like looking for Bitcoin wallets to steal (somebody is going to create one of these sooner or later).

I'm assuming here that whoever gets access to the computer has full access to everything, even as my own user account, in the case of a technician or a trojan; no built-in O.S. security is to be trusted.

How can I be absolutely sure that nobody simply copies my wallet files, loads them somewhere else and steals all my Bitcoins?

Answer 1

Physical access:

Minimise your risk by using a deterministic wallet with Armory, and enabling extreme encryption and key stretching. The program will let you configure your wallets settings, and you can make it sting to the point of being completely ridiculous, seconds to open is enough to stop any attack on the password.

Malware

There is no protection against malware on a computer with a wallet. These exist already as pre-made tools, so it's hardly a stretch to think you might be infected.

Use a hardware wallet like the Bitcoin Trezor or a split-wallet with an offline portion with Armory.

In a split-wallet a computer is kept air-gapped and stores the private keys, and a separate one is used to manage the wallet. Transactions are ferried by USB drive between the machines, so the offline wallet is never at risk of compromise. This is the best option for storing large amounts of funds safely.