How to make totally secure Bitcoin transactions?

Question

So, I'm wondering if my system of protecting my bitcoin is totally secure.

If I have an old laptop, and I boot into tails linux from a flash drive, and download electrum on there, and only ever connect to the internet at my home WiFi, and only ever visit Coinbase (GDAX) and Gmail, are their opportunities to steal my bitcoin?

Is there hardware risk? Would I need to wipe the drive completely, or can I purchase a hardware wallet that transacts without connecting to a laptop?

Is there WiFi risk, or are Electrum, Coinbase, and Gmail all encrypted connections so it wouldn't even matter if there were a man in the middle? (am I confusing things here?)

Is there risk with Electrum? Should I download the core Bitcoin client instead?

Obviously no cameras or microphones in the room when you use the dedicated laptop, right?

Answer 1

The primary concern with Bitcoin security is where your private keys are stored.

In your scenario the private keys are stored on a Linux laptop which is not unreasonable if you follow good internet hygiene and security practices.

The next best approach is to purchase a hardware wallet from the likes of Trezor or Ledger. These wallets have High Security Module (HSM) chips inside them that are highly resistant to being compromised. By highly resistant it means the private keys are stored on a tamper-proof chip and NEVER leave it. The HSM chip in the Ledger Blue is ST31. Google for ways to compromise the ST31 versus ways to compromise Linux and you'll get the idea.

With a hardware wallet it works in conjunction with a client on your PC but the crucial factor is the transaction (tx) is signed in the HSM chip and the only thing an attacker could do is try and replace the Bitcoin address in your tx. Most hardware wallets safeguard against this by displaying the recipient address on the screen when requesting verification of the signature operation.

And finally you could write your private key down on a piece of paper and hand-sign all your Bitcoin tx's. No electronic compromises to worry about.

Answer 2

If your machine connects to the internet at all, it should be considered potentially compromised. Consider what happens to it if you visit GMail, which happens to deliver an ad with compromised JavaScript, for instance.

Secure storage of a bitcoin wallet can only be really considered "mostly secure" if the machine is never connected to any network, and only you have physical access to it. Make sure all connectivity to the machine is disabled, such as USB, serial ports, WiFi, etc.

Sending a transaction over the bitcoin network for an offline, or cold wallet, consists of generating the transaction offline, then manually copying the transaction's hex representation to a node that is connected, and having it broadcast the transaction. That is essentially what the Trezor and Ledger hardware wallets do - they generate the transaction internally in such a way that your private key never leaves the confines of the hardware wallet. It then sends only the resulting transaction details to the bitcoin network, with the signature including your public key which proves you signed it with the corresponding private key.

Search "bitcoin cold storage" if you want to go down the rabbit hole.

Answer 3

Nobody else has made much of a mention of physical security, yet. You may also like to consider the possibility of:

1. Fire; do you have another copy of your private keys if your building burns down? Of course, storing additional copies adds additional risk of compromise.
2. Natural disasters; depending on location, you may also need to consider the possibility of flood, tsunami, tornado, volcano. Also consider unnatural disasters such as war.
3. Theft while unattended; if someone knew you had cryptocurrency of substantial value, might they just steal your computer hardware and read the contents of the hard disk? Is your password on a sticky note under your keyboard? (or on your monitor!)
4. Theft while attended; ie if a thief held a gun to your head...
5. Hardware failure; storage media gets corrupted sometimes, or just stops working.
6. Advising next-of-kin how to access the funds, without compromising them in the meantime.
7. Getting out of sync; if your backup copy is missing some of the most recent private keys, they are at risk. Using a deterministic wallet helps solve this one.

I know this isn't a complete answer, but each case will depend on individual circumstances and this may still be useful.

Answer 4

Look into the Glacier Protocol, which is a very expensive but extremely secure (although nothing is ever 100% secure) solution.

Answer 5

Nothing is totally secure.

That being said, the scenario you just proposed is "damn well secure" (whatever that means. This is just an opinion). Malware and hackers do not target those scenarios usually, they go for easier ones.

It depends on how much money you're planning on having in your wallet. That's safe enough for a couple thousand, but probably not enough for 100k+. Again, this is totally opinion-based.