My goal here is to setup a system that is sufficiently convenient that I will actually utilize it without having to jump through too many hoops to get the job done, but also reasonably secure from hacking & theft.

Scenario - Transfer money from wallet to exchange.


  1. Full disk encryption, PC - Windows 10
  2. Private keys are stored in an encrypted offline password manager (keepass)
  3. Windows 10 has an Ubuntu VM installed on it (within the host system so it is encompassed by the full disk encryption).
  4. The Ubuntu has access to a copy of the offline password manager (keepass)
  5. Once we've received the address to which we'll want to send our coins we'll have to copy this address, open up the Ubuntu VM and paste it there (requires shared clipboard)
  6. After having pasted the address to which we wish to send the coins, we'll turn off the shared clipboard (not sure if possible without rebooting VM), open up the copy of the password manager database and launch wallet software (Electrum for BTC, myetherwallet for ETH, etc) and then access wallet using the private keys in the database.
  7. We'll send the payment and then exit the VM.

So, I'm not sure if this is the best most convenient way (pretend that the wallets contain significant values in a relative to the individual sense), I'm also not sure if this in anyway actually protects us from keyloggers (the keystrokes are probably going to be logged by both systems regardless - but perhaps the clipboard will not be logged by the host system if we can turn it off or just use it directionally; since the ubuntu system is much less likely to have been exposed as it is a fresh install and rarely accessed - and doesn't actually need to visit any outside servers aside from connecting to the electrum / myetherwallet servs).

How could I optimize this setup without making it unbearably inconvenient to use for transacting (be it small or large)?


The only way to secure your transactions is to make them offline.

For this kind of work use Tails on the machine with physically removed wireless adapters.

  • I don't think this will fit the bill as it seems to require that one boots into the OS, which means we'll not have access to the addresses (can't copy & paste from the original host system) or say acquire the addresses by accessing the necessary websites (doing anything while on TOR is almost impossible since the majority of nodes are blacklisted and you get stuck in captcha hell). – gloomyfit Aug 4 '19 at 6:53
  • That's right. You must not have the access to anything except the trusted media. – eugene-bright Aug 4 '19 at 18:48
  • Use air-gapped offline system and trusted media you are able to inspect well (such as QR codes). – eugene-bright Aug 4 '19 at 18:56
  • Security is orthogonal to convenience. – eugene-bright Aug 4 '19 at 19:00
  • There are hardware crypto wallets that can mimic air-gapped scheme in a convenient way. Look at this one ledger.com – eugene-bright Aug 4 '19 at 19:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.