How to set up a secure offline savings wallet
Why set up an offline savings wallet?
Modern operating systems are getting more and more complex. The flip side of all this complexity is that they generally have a large attack surface and constantly leak information without the user’s knowledge or consent. No matter how many precautions you take, your wallets will never be 100% safe on a computer that is connected to the internet.
Because bitcoins are stored directly on your computer and because they are real money, the motivation for sophisticated and targeted attacks against your system is higher than in the pre-bitcoin era, when only large organizations normally had to worry about such attacks.
This guide will instruct you on how to create an offline wallet, a wallet that never even touches the internet in its plaintext form. Another term for this is cold storage. This security measure is also referred to as being an air gap. For all practical purposes, this wallet is safe from all online threats, such as viruses and hackers. It is however still exposed to offline threats, such as hardware keyloggers, extortion, or people looking over your shoulder. A best practice is to keep the majority of your bitcoins in the offline wallet and only to use the online wallet for everyday expenses/earnings.
The below procedure may seem tedious, but remember that security almost always comes at the cost of convenience. When you deposit money at a bank, you let them worry about security. Bitcoins, however, are stored on your computer and that means you are fully responsible for securing them. The bitcoin ecosystem is still very young and unfortunately no user friendly tools for creating highly secure wallets have been developed yet (though some members of the Bitcoin community are working hard at this).
How to deposit funds
- Set up a Wuala account, or other cloud backup service of your choice.
- Create a strong and unique password offline (manually). This password should be at least 20 characters long; it should contain numbers, upper and lower case letters, and symbols. It should be as random as possible, ie it should look something like this: Zr%8qL03&cvwS9@05AatdP71. Never use this password elsewhere.
- Do not forget this password. Recite it several times a day. It is easy to overestimate your ability to remember a password several months in the future. To be on the safe side, write it down and store the piece of paper in a safety deposit box.
- Download Bitcoin Linux binary and save it on a USB drive.
- Shut down your computer, and boot Ubuntu (or Linux distribution of you choice) from a liveCD. This will not affect your current operating system.
- Disconnect machine from the internet. Unplug any network cables and disable wireless. Verify that wireless is disabled in the icon on the upper right corner (Ubuntu). Double check that machine is disconnected by opening the web browser.
- Run bitcoin while disconnected to the internet. The client will show 0 connections and 0 blocks, but it will still generate a wallet.dat file and a bitcoin address.
- Encrypt your wallet using the strong and unique password from step 2 above. (Bitcoin Client > Settings > Encrypt wallet)
- Copy wallet.dat (found in hidden folder .bitcoin in your home directory) to USB drive.
- Save bitcoin address to a text file and copy it to USB drive.
- Shut down system and turn off computer. Before switching your computer on again, remove all power sources for about 1 minute. Physically remove battery from laptop.
- Backup encrypted wallet.dat file in several places:
- Send it to your 5 best friends by email attachment and ask them to save it for you.
- Save it on your Wuala account created in step 1.
- Save it on several USB drives and CDs and store them in different geographic locations.
- Send bitcoins to the address saved on the USB drive. Double check in the block explorer that they have been sent.
How to retrieve funds
- Boot from Ubuntu liveCD, as in step 5 above.
- Insert USB drive.
- Run bitcoin client and close it again.
- Replace wallet.dat in ~/.bitcoin directory with wallet.dat from USB drive.
- Connect to the internet.
- Restart bitcoin client.
- Wait for blocks to download (optional).
- Send bitcoins.
Notes
- This procedure is only secure if you perform steps 1-13 in this exact order.
- Perform one or two trial runs of the above procedure with a few bitcents, and make sure that you know how to successfully retrieve them, before making a bulk transfer.
- Every time you retrieve bitcoins from your savings wallet, create a fresh savings wallet by repeating the above procedure, and send all your remaining savings balance there.
- There is more than one way to do it. Similar procedures have been suggested on the forums here and here.
- Beware that even savings wallets have limited lifetimes. New, backwards incompatible versions of bitcoin might come out in future, AES might be broken, bit rot might destroy your wallets, etc. Update to fresh savings wallets every couple of years, or as needed.
- See How to import private keys for an alternative way of retrieve your coins.