0

By not installing Ubuntu and not removing the hard drive, I suppose I am vulnerable when I open bitaddress.org offline and enter the 64 random hexadecimal characters I have generated without a computer to find corresponding public address.

Yes, I clear the browser before re-connecting to the net. I never use the mouse to copy the private address (or indeed keep any computer record of it) but, if malware can pick up the 64 random hexadecimal characters which I typed in or if it can take a screenshot of the private WIF address I am screwed.

Improve this question
7
  • 2
    I don't really know how one would quantify "how vulnerable". It depends mainly on your general computer security practices. In general, if there is any kind of malware on your computer, it could certainly pick up the private key and you would be screwed. On the other hand, this is true whether you use bitaddress.org or some other software. Clearing the browser cache and avoiding the clipboard don't really help.
    – Nate Eldredge
    Sep 1, 2014 at 12:25
  • It mostly depends on if you do this using a computer which has a chance to get infected by malware. If you are doing this using your everyday Windows laptop then maybe there is a chance.
    – Mikko Ohtamaa
    Sep 1, 2014 at 12:26
  • Also you can boot to Ubuntu from USB stick - no need to unscrew harddrives or anything like that
    – Mikko Ohtamaa
    Sep 1, 2014 at 12:34
  • 1
    I suggest you re-ask your question "what is a safe way to use bitaddress.org, when my purpose is X and I am using tools Y"
    – Mikko Ohtamaa
    Sep 1, 2014 at 12:40
  • 1
    Incidentally, there is not really anything magical about using Ubuntu for this purpose rather than some other operating system. Ubuntu happens to be a free and reasonably secure OS that is relatively easy to boot from a USB stick or other removable media (and by no means the only such OS). But any other OS running with no Internet connection would work just as well for this purpose.
    – Nate Eldredge
    Sep 1, 2014 at 22:52

3 Answers 3

Reset to default
1

Depends on what you are going to do with your address. As for me there are three main cases to consider:

  • Will you store so huge amouts of bitcoin to fear attackers who are targeting yourself directly?
  • Are your computer as unsecure as most of non-technical people computers (and therefore: is it possible that it is already infected by some virus)?
  • Or last but not least: are you doing some controversial business and fear being spyed by government or someone else who may want to know either your private keys or just that certain address belongs to you?

In fact in everyday life situations there is no need for security better than just keeping your antivirus up to date and avoiding storing generated keys on disk (which could lead to a leak if your computer gets compromised in the future). Unless you've put all your savings in BTC.

Improve this answer
0

That really depends.

If you are a type of person that, although not using ubuntu , but you buy a fresh new cheap laptop and transfer the offline version of bitaddress.org to it , you are already quite safe.

Many people use ubuntu for offline as they are really safe.

Improve this answer
1
  • Thanks, but buying a cheap laptop - however cheap - just for making Bitcoin keys and addresses is not really an economical proposition. As I said above, why can’t there be a small cheap calculator-like device with no internet capabilities into which you put a random number and it gave you a public address on the screen?
    – Peter
    Sep 1, 2014 at 14:29
0

Perhaps use a Raspberry Pi. Never connect it to the net and use either the standard Raspbian OS or there is a bitcoin-centric one (I forget the name).

PS: I'm not sure why you single out Ubuntu.. I assume you mean Linux rather than Ubuntu specifically.. I my personal opinion Ubuntu is too commercial - if you're really paranoid and really trying to keep your keys secure then use a "proper" 100% open-source non-commercial Linux OS such as Debian.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.