Nope.... you are making assumptions which I already refuted. I keep multiple devices that are air gaped (sneakerware tech(TM )) that allows me to import small amounts of cold storage into hardware that hasn't touched the network and cannot touch the network until needed.

You are suggesting that one should secure their life savings on the same PC they browse porn on ?


Sounds good , I am always open to new ideas and criticisms... look forward to your guide.

GREAT! the airgap provides actual tangible security. That is what is giving you the security, not the paper wallets. You could store electrum on that and it would be just as secure as the paper wallets.

I haven't suggested anything yet, but to setup a pretty secure cold storage, all you need to do is type this into a linux terminal:

git clone https://github.com/spesmilo/electrum
gpg --recv-keys 0x2BD5824B7F9470E6
git tag -v 2.0.4 (check it says good signature, if so, your download has not been tampered with)
git checkout 2.0.4
chmod +x electrum
./electrum

This will download electrum from source, verify its signature to prevent tampering.
If it runs copy the folder onto your cold PC and run git tag -v 2.0.4 and git checkout 2.0.4 again in case it was tampered by your main PC.

select standard wallet
write down seed on paper
set strong password
wallet > MPK and scan QR code with online PC.
Connect audio cable between online PC and cold PC.

Done. Like your example this could be a lot better, but its pretty good.

A centralized repository to secure multiple accounts is insecure by design and why I typically tell users to avoid bitcoin banks or exchanges for storing their savings.


They cannot retroactively insert malware into existing and audited linux images. Yes, there could have been a unknown vulnerability that was missed initially (I.E..heartbleed) but this doesn't necessarily mean you are compromised and that your bitcoins will be stolen when you import part of your savings.


You are making an assumption that the Live CD is what should be used to create the paper wallets and not merely spend them. I agree that  online generators are more vulnerable.



Yes , there are some extra security steps that must be checked and followed that most users will never do. This is why there are hardware wallets and devices like entropy... because they allow easy and good enough security for the average person.

I completely agree, and what you just explained is one security method I originally did for myself before I created a more elaborate method with paper wallets.

We may simply be talking past each other.... If what you are suggesting is that you can take separate computer with a clean linux install and only use it to secure your bitcoins and than disable the networking on it (possibly temporarily enabling for periodic updates and patches that are audited)... and while it might be slightly weaker security than what I suggested it still is good enough security for most.

This is very difficult to pull off , and creating enough entropy if you are aware of this attack is fairly easy to do. blockchain.info was an easy target because it was a central point of failure as well.


Sounds good, I look forward to adding your guide to my list of recommendations. I haven't listed my security arrangement yet because it is too complicated for the average user and I don't feel like writing it all out.

Mostly agreed, and there is a whole "social" layer of security that must be considered as well. The fact that I am discussing this with you, the fact that I am in IT, the fact that I have certain political opinions, the fact that I have a bitcointalk account, ect... all make me a much larger target than someone without those traits. I am cognizant of these weaknesses and this is why I took paranoid steps to secure my cold storage... short of doing a 100% audit on every line of code.

Good security is very complicated and even the best security experts occasionally make some mistakes(and thus why you should never have a single point of failure) for securing all your wealth.

 One great thing about Bitcoin is its forcing the users and society to adapt and develop better security and auditing. Most traditional fiat banks have abysmal security but its losses are ignored and amortized.


 

You are exposing yourself to all kinds of risks by using blockchain.info. Yes, I know they are trustworthy, but they CAN access your funds despite what people say as they can modify the code at anytime, or a hacker whos broken in can modify the code, or they could mess up again and introduce another bug like last time where they almost lost 1,000's of BTC. It's an unnecessary risk. In the past, lots of people were hacked when they accessed blockchain.info over Tor. This is due to man-in-the-middle attacks, which happen all over the internet, not just on the Tor network although they are more common there due to the way the Tor network is designed.

Malware CAN jump from your main OS onto your live CD, I explained a few ways this can happen in this thread. This is not something the happens a lot, but it is trivial for a hacker to do some of the techniques I described, and I'm sure eventually hackers will start looking into these kinds of techniques if people are using live CD's to protect their coins.

Not reusing the paper wallet is a good idea. You should definitely do that.

What you can do is you can create a custom version of Ubuntu that contains an SPV client like multibit or electrum and burn that to a CD and use that. Though creating a custom version of Ubuntu is annoying to do. You could also install a copy of electrum on the live cd, to do that simply type "sudo apt-get install electrum" into a terminal when running the live CD, though you'll have to do this each time you boot the live CD.

After you do that make a throwaway wallet and import the private key into that and sweep the funds off to a new address.

That is somewhat better.  The ideal solution would be to use a separate cold storage PC, and if you are doing that you may as well just use a normal encrypted wallet.

On printers-
https://www.reddit.com/r/Bitcoin/comments/2aodta/on_printer_memory_for_the_security_of_printed/

PRINTERS WITH HARD-DRIVE:

Pretty much any home/personal printer will not have a hard drive, but most will have some kind of memory installed. Depending on the type of printer, as well as the model, will determine how much, if any, memory is installed.

Most memory that is in home/personal printers only hold the data for the current print job from anywhere from a few lines to a few pages, as the job is being printed. Once the job is complete or the printer is turned off, any data that was in memory is erased & unrecoverable. Printers commonly use basic RAM memory, which is commonly referred to as volatile memory since it cannot store data once power is removed.

NOTES ON PRINTERS WITH HARD-DRIVES:

    If the printer allows you to bypass its internal hard drive and print directly from RAM, select this setting for better security, and ensure that print jobs are not stored on the printer hard-drive.

    If you do choose to store print jobs on the drive, ensure that it is encrypted with a strong encryption method, such as AES.

    If the printer allows you to overwrite the data immediately after printing (or scanning or faxing, if it’s an all-in-one device), select that option.

    Almost all new models include a wipe disk function for decommissioning the printer, and most include disk encryption, so if you take the disk out of the printer you won't be able to read the information stored on it.

NOTE: Even old printers (laser, dot matrix, inkjet, etc....) had some kind of memory that they used for some data storage for printing.

NOTES ON PRINTER MEMORY:

    Most current printers have a couple megabytes of memory

    In some cases the printer may be using volatile memory with a battery backup, If it is, this should be mentioned in the user guide. In that case, leave it unplugged for however long the user guide says is too long.

MISC. NOTES FOR CREATING COLD STORAGE WALLETS:

    ALWAYS ASSUME YOUR DEVICES HAVE BEEN COMPROMISED BY BAD ACTORS (Criminals)
    Use a dedicated computer & printer for purposes of creating Cold-storage wallets.
    Keep both dedicated computer and printer off the internet, keep wireless options deactivated or physically removed if possible.

MOST POPULAR PRINTERS: Most Popular Printers with examples of on-board memory

Amazon top 13 Printers (Best Sellers)
#    Brand    Model    Memory Capacity    Notes
1    Canon    PIXMA MX922    Approx. 250 Pages12    FAX
2    Epson    XP-310 Wireless    NL    Not Listed
3    Brother    HL-2270DW Compact Laser    32MB    Standard
4    Epson    XP-410 Small-inkjet    NL    Not Listed
5    Canon    PIXMA PRO-100 Color    250 Pages    
6    HP    Envy 4500 Wireless    NL    Not Listed
7    Brother    MFCJ450DW    170 Page Fax Memory    
8    Epson    WF-3520 Wireless    NL    Not Listed
9    Epson    WF-2540 Wireless    NL    Not Listed
10    Epson    WF-3620 Wireless    Up to 180 pages    Fax Memory
12    Canon    LBP6000    2MB    buffer memory
13    Hewlett Packard    1102W Wireless    8 MB    Standard