6

Very new to crypto-currency. From what I understand the only way to gain access to my wallet funds is:

  1. get my mnemonic seed.

  2. get my key file + password.

lets say my password is a huge strong password I keep in a safe spot, Why is that 'not enough' ? ( I see lots of posts encouraging cold wallets)

Thanks and sorry if this is very basic...

2 Answers 2

4

You're right in your understanding: 1. and 2. hold true. What makes a wallet "cold" is the way it was generated. The wallet file + password, which you describe, could be made cold as well.

If you boot-up from a LiveCD (entire operating system, usually linux, bootable from a CD and containing all the tools necessary) with networking disabled, create a new wallet, save the seed and save the encrypted .keys file to some USB, and then reboot, there should be no record of your wallet or the process used to create it left anywhere except on the piece of paper and/or the wallet file on the USB drive. By doing this, you just created what we call a cold wallet. The only way it could be compromised is at the moment of creation, if the random number generator on the LiveCD was compromised to generate a predictable sequence of wallets. For extra paranoid mode, you'd roll the physical dice yourself to get the random seed.

The moment you open your wallet on an online PC, or restore from keys on an online PC, you can't consider it "cold" anymore, because there's always that slight risk that you leaked something. In fact, I'd say that opening the wallet file would be more safe than restoring from keys, because of what you pointed out already - if someone gets your password, he will need the .keys file as well, while the mnemonic would be enough by itself.

lets say my password is a huge strong password I keep in a safe spot, Why is that 'not enough' ? ( I see lots of posts encouraging cold wallets)

If you generate the wallet like above, you just created cold storage, so it is "enough". It's all about managing risk, really. Think of cold storage as savings account, online wallet as your debit card with access to your current account, and web-wallets as cash in your pocket.

8

Used correctly simplewallet (named monero-wallet-cli in the new release) is relatively safe compared to an exchange or web wallet, but it will never be as safe as cold storage.

lets say my password is a huge strong password I keep in a safe spot

As soon as you enter your strong password (or mnemonic seed) on your computer to use your wallet, it could potentially be exposed to a keylogger.

Properly created cold storage wallets by definition never have their passwords or mnemonic keys exposed to an internet connected device.

2
  • So how can I access (restore) my wallet (a cold generated 1) for active usage online without exposing it to a keylogger ? I mean I have to restore the wallet with the seed..
    – Yishko
    Sep 24, 2016 at 9:58
  • 1
    It could be done by air-gapping. You would have a watch-only online wallet, and full offline wallet. Then, you would generate a transaction, copy it (by portable drive or something) to the offline PC, have it signed there, copy it back to online PC and broadcast to blockchain. Note that this functionality is still in the works. Also, that little device called "Trezor" is designed to be the "offline PC" while being convenient to use. Monero support coming soon^tm. So for now, you just have to trust that your PC from where you're spending the cold storage is clean.
    – JollyMort
    Sep 25, 2016 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.