1

I want to use bitaddress.org to create a wallet. Can you please verify my approach?

  1. Change the password of my router and wifi and unplug all devices from the network except my notebook.

  2. Go to https://github.com/pointbiz/bitaddress.org and download the project as a .zip file.

  3. Go to https://www.bitaddress.org and download the project as a .zip file.

  4. Unzip both files and confirm that both resulting folders are identical with meld.

  5. Keep one of the folders and delete the remaining files.

  6. Download pointbiz_bitaddress.org.asc from (at least) three trustworthy sources.

  7. Disconnect my notebook from the internet.

  8. Confirm that all downloaded signatures are equal with meld. Keep one of them.

  9. gpg --import pointbiz_bitaddress.org.asc and confirm the ouput matches:

    gpg: key 63974F5A: public key "pointbiz [email protected]"

    imported gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1)

  10. gpg --verify bitaddress.org.html.sig. Make sure the output matches the following:

    gpg: Signature made Mon 22 Aug 2016 00:56:51 BST using RSA key ID 63974F5A

    gpg: Good signature from "pointbiz [email protected]"

    gpg: aka "ninja [email protected]"

    gpg: WARNING: This key is not certified with a trusted signature!

    gpg: There is no indication that the signature belongs to the owner.

    Primary key fingerprint: 527B 5C82 B1F6 B2DB 72A0 ECBF 8749 7B91 6397 4F5A

  11. Use bitaddress.org.html.

I decided to not compute any hash sums as gpg --verify should do this already, right? Is this approach safe to be used?

3
  • If you looked at the exit scams(ftx for example) there is always a risk of using a third party for a crypto wallet, thus the safest and best way is to have a hardware wallet
    – Turdie
    Commented Feb 19 at 20:36
  • Welcome to the community. Why not just use one of the secure btc wallets?.. What's wrong with that? Commented Feb 19 at 21:03
  • I think there is nothing wrong with them. I am just interested in the approach mentioned above.
    – Ohumeronen
    Commented Feb 19 at 21:43

1 Answer 1

2

I'm not sure you need to go to all the trouble of changing the password on your router, and disconnecting all the devices from your network, etc. Also, the bitaddress web page is designed to be run offline, so all of the code needed is self contained in a single file, which you can download at https://github.com/pointbiz/bitaddress.org/raw/master/bitaddress.org.html. Being that just this one file is needed, there is no need to download an entire project or zip file, compare sets of files with meld, etc.

So, one way to generate an offline (or 'cold') bitcoin wallet safely is to:

  1. Use an online computer to download https://github.com/pointbiz/bitaddress.org/raw/master/bitaddress.org.html.

  2. Copy bitaddress.org.html to a USB drive.

  3. Use a Linux live boot USB to boot an offline computer into Linux. Do not connect this computer to the network - this will be an air-gapped computer for creating the wallet.

  4. Connect the USB drive containing bitaddress.org.html to the air-gapped computer.

  5. Verify the authenticity of the bitaddress.org.html file, by using the command below to verify that the SHA256 checksum of the file is dec17c07685e1870960903d8f58090475b25af946fe95a734f88408cef4aa194:

    sha256sum bitaddress.org.html

  6. If the verification is successful, open bitaddress.org.html in the browser, and proceed to create your wallet. Copy the bitcoin private key and corresponding address to the USB drive, disconnect the USB drive, and store in a safe place.

By using this method, the bitcoin private key is generated on an air-gapped computer, and is never within the reach of a connected computer, and is never stored on any persistent storage device other than the USB drive.

*With regard to step 5 above - the SHA256 checksum above is well-known to be the authentic checksum for this file (as you'll see if you enter this checksum into Google). You can also verify the GPG signature as well, on the air-gapped computer, with respect to the known trusted public key, to be sure.

9
  • 1
    Thank you very much for this response. So basically I could also replace the SHA256 checksum calculation with the verification I mentioned in step 10? gpg calculates a hash sum while on the fly while generating certificates, am I correct?
    – Ohumeronen
    Commented Feb 19 at 22:15
  • 1
    You're welcome, and yes that is correct, and yes what you suggested should work. In that case, you would need both bitaddress.org.html and bitaddress.org.html.sig and the command to verify would be something like: gpg --verify bitaddress.org.html.sig bitaddress.org.html.
    – mti2935
    Commented Feb 19 at 22:22
  • 1
    @mti2936 : Maybe somehow related. Would you mind giving my your opinion here as well? security.stackexchange.com/questions/275752/… I set up a bounty on that question.
    – Ohumeronen
    Commented Feb 28 at 17:33
  • 1
    @Ohumeronen I don't know much about Electrum, I'm more familiar with Bitcoin. But, regardless of the type of cryptocurrency, I would suggest that you make sure your private key never touches a connected computer or computer with persitant storage - i.e. store your private key on a USB drive, and only connect that USB drive to a disconnected live-boot computer without any persistent storage.
    – mti2935
    Commented Feb 28 at 17:59
  • 1
    So, to create a transaction, the general idea is: boot a disconnected computer without any storage devices using the live boot USB, install a lightweight wallet program from another USB, import the private key (from USB), create the transaction, and save the transaction to a USB. Then, using a connected computer, upload the transaction from the USB to the blockchain.
    – mti2935
    Commented Feb 28 at 17:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .