Staying Secure While Using Crypto Wallets
Hot and Cold are two classifications for all sorts of crypto wallets. The Hot wallet is one that stays online or is connected to the Internet. Whereas a Cold wallet is one that is offline or isn’t connected to the Internet.
For keeping excessive amounts of crypto coins, Cold wallets are the best option and are also the most secure ones. Hot wallets are just good for regular use. So if you are looking forward to a wallet for frequent use opt for a Hot wallet or opt for a Cold wallet if you want one for storing funds for longer spans securely.
It is even harder to understand and use if the wallet is even Colder, despite the fact that the colder the wallet is the more secure it will be. On the other hand, hotter wallets are comparatively easy to understand and use but have quite weak security, and in most cases, the majority of compromised wallets consist of Hot wallets.
Online Web Wallets
These wallets are supplied or served by third-party wallet provider organizations over the cloud and these wallets could only be accessed using an Internet connection. Some examples of such wallets are Bitgo, Coinbase, Blockchain, etc. Every one of these has their advantages and disadvantages over others and all of them vary for their services other than the basic ones. Services/features served by these include 2FA (Two Factor Authentication), Multi-Sag, more than one crypto wallet, easy and direct purchasing and selling of Crypto Coins, and the capability to carry/store all sorts of coins.
Advantages of these include – quickest method to execute transactions, efficient for lower amounts of crypto, supports transactions from all computers, using TOR or VPN will double the anonymity, and a few of them are even capable of managing different cryptocurrencies and transactions amounts that take place among them.
A few of the disadvantages of these wallets include – vulnerable to brute force attacks, phishing campaigns, cracking techniques, and web-based attacks. Funds of these wallets aren’t in your hands and if the responsible ones bail, you are lost. The use of such wallets makes your computer open and vulnerable to viruses, malwares, and keyloggers.
Desktop Wallets
These wallets are designed and developed in such a way that they can be downloaded/installed and used on any computers that use Windows, Ubuntu, and MacOS operating systems. In addition, these wallets are easily accessible and one can use them even when offline.
Advantages of these wallets include – quite easy to set up and use, are more secure, can be used staying offline, passwords or private keys aren’t stored elsewhere, you are in complete control of your funds, and are free from the risk of your wallet being hacked.
Disadvantages of these wallets include – are not at all portable, i.e., you can only access them with your computer, anyone that has access to your computer can easily steal your funds and in case if you lose your hard disk, forget about your money, there is no possible recovery.
Mobile Wallets
These wallets support portability and are designed for smartphones to be very efficient.
You can easily perform transactions from anywhere and at any point of time, lets you increase anonymity using VPN or TOR, and the incorporated feature of scanning QR makes transaction fast easy, eliminating the risks of mistakes such as wrong wallet address or wrong amount. These are some of the advantages of these wallets.
Whereas disadvantages include – since the smartphones lack security, an installation of malicious or shady applications can result in loss of your funds, charging smartphones can be an issue at times and your phone always stays vulnerable to malwares, keyloggers, and viruses.
Physical Wallets
Bitcoins aren’t just digital, they can even be stored in paper wallets and you can actually print your crypto on paper.
It has some of the most obvious advantages, such as – hack-proof method of storing crypto, since they aren’t on computers, it eliminates the risks of your funds being stolen due to authorized access, and you are in actual control of your funds, without worrying of being bailed or being hacked.
Disadvantages include – can be a headache for one with regular use as moving crypto needs to be done physically and in addition, more efforts are needed for both understandings transferring the funds.
Hardware Wallets
These wallets are far more secure than hot wallets and also easy to manage in comparison to physical ones. These wallets are, however, a little less user-friendly than other crypto wallets but can be the best choice for gaining more control over funds and holding heavy amounts of funds for a longer period of time.
Advantages of these wallets include – are the most secure than any other wallet, you have complete control and don’t need to worry about wallet getting hacked or breached or any other person snooping into your system and at last, if it had a screen, it would have been the perfect choice for holding funds for longer spans.
Disadvantages of these wallets include – requires more technical understanding for use, needs heavy efforts to move funds around, and can be a headache for a regular user and for beginners, it is unmanageable.
Security
Security for crypto wallets is generally of 3 types – Online security, Offline Security, Personal security. Online and Offline are the most commonly used ones whereas Personal security is quite unknown and is rarely used.
Online Security
This security is not the easy and simple one and at times stays out of control. It is mainly implemented on the server level. HTTPS redirections and SSL certificates are online web-based security measures that interact with the user indirectly. Password setup and 2FA are instances of interaction with users directly. User and server, both have an important role in password security as it is an essential one. The worst-case here can be, passwords being stored in plain text, which some websites actually do. Some websites prefer storing passwords in encrypted form and it should be kept in mind that encryption isn’t hard. However, most of the websites, nowadays, store passwords in MD5, which is most difficult to crack. There are websites that store passwords, in a manner that’s almost impossible to crack, as Blowfish. It always doesn’t mean that shorter passwords can be cracked easily. It needs to be balanced between the server and the user.
For instance, if you set up your password as “JjMnik2bTB8cHGFDury%p%WsSx9^”, but the responsible server stores your password in MD5/plaintext, it would be the same as using “Hello123” as a password. But if you set up your password as “JjMnik2bTB8cHGFDury%p%WsSx9^”, and the responsible server stores it in Bcypt/SHA256, it would be much complicated than the previous instance and it would take a huge amount of time to decrypt it, ranging from months to years. In 2019, over 540 million records of users of Facebook were leaked and the reason was the publicly accessible Amazon S3 bucket which was utilized by third-party apps to store user passwords in plain text.
In the case of web-servers, they can be easily hacked or breached if the owner of the server does not implement an effective security service or does not keep the server fully updated. The most basic and common attack is SQL Injection, being so easy that anyone can do it. More than 37,000 websites are hacked on an every-day basis. There are several other vulnerabilities including common attacks (for instance – rooting, shelling, RFI, LFI, Ect) or even zero-days. Brute force is another type of attack that web-servers are vulnerable to. The IP of any website is known to an attacker or hacker and as all servers have a master account called root, the attacker is only required to crack its password and then can control the complete server. In a different manner, a brute force script can be utilized to get into every single account.
Offline Security
Offline security is the type of security that relates to the PC use itself. Phishing is the most common type of attack and the majority of users fall victim to them. Antiviruses protects you from issues of computer level like Rats, Keyloggers, and Malware but not from phishing. Phishing is done quite easily by attackers, simply by setting up a duplicate website that mirrors the original one and then tricks users into visiting the website that may look real but isn’t. Then manipulating you through a website to enter credentials or payment details, thus, resulting in a successful attempt. However, such incidents can be easily avoided if users double-check the website URL they are visiting. For instance, if you are visiting Coinbase.com, make sure it doesn’t spell like c0inbase.com.
Man-In-The-Middle attack is another instance of an Offline attack. Such attacks are done by directing you to a phishing, similar-looking fake, website or by sniffing packets and are done by someone who is on the same network on which you are. It has a very easy solution, which is adding an SSL certificate to the web-server which would encrypt the data which is being transmitted, avoiding the intervention of the attacker. In case you have been directed to a fake website, you must check the green SSL certification. In such cases, the URL will be exactly the same as the original one but the website will be the phishing link. The best manner to avoid being victims of such events, you must avoid using public connections and never use any account on public networks or Internet cafes.
Personal Security
This is the most significant sort of security. Attacks that are protected by this security include Identity theft and frauds. If an attacker or hacker is able to know that you have a specific amount of funds stored on Blockchain, then they can get you at ease. Such attacks are much easier than you can imagine. The most significant mechanism utilized by attackers is the human nature of bragging and socializing. If you are being targeted by an attacker or hacker, they can easily gather your previously used password and through websites, you were registered on. If, as seen in many cases, you don’t change your password, you will prove yourself to be an easy target.
Let’s assume you were enlisted on LinkedIn and you utilized a similar password for your email, on LinkedIn. It’s already known that LinkedIn was hacked. The assailant essentially finds your username in the database which was unveiled, decodes your password which requires a few seconds, and signs-in your email. Presently the assailant gets command over the entirety of your web accounts, getting into your Facebook, your private notes, put away documents, photographs, and everything else. Odds are, you’re additionally utilizing that email as a reinforcement/2FA for your Crypto Wallet. Much the same as that, the assailant took all your CryptoCurrency. This might have been kept away from had you not made yourself an objective in any case by talking about the amount of Crypto you have. Or then again by basically changing your passwords or utilizing a safe password manager.
Notwithstanding, This isn’t its finish. A typical assault done is Brute forcing assaults is the longest and entirely doubtful approach to hack somebody, yet it actually works and is not difficult to arrange. A client just requires an email list and it is possible by hacking BTC-related websites for mailing records or utilizing recently hacked sites, for example, BTC-E. At that point utilizing a word rundown of basic passwords and attempting to brute force their way into all the records simultaneously.
The other strategy is called Cracking, This has a much higher achievement rate. Since the vast majority utilize similar passwords on other platforms as well or a variety of the first, which makes hacking you a lot simpler. An Attacker can hack numerous destinations utilizing SQLi or basically utilize recently dumped sites such as Bitcoin/CryptoCurrency related sites. For instance, let’s take BitcoinTalk which was hacked in May 2015, Revealing 500k Accounts. The attacker just uses HashCat or a comparative device to decode all the passwords which will require a couple of days to half a month. After this, the attacker has a “combo list” of 500k records. The attacker just brute forces the records against Coinbase for instance, this would require a matter of hours. Following 4 or so hours, the attacker grabs a great many Coinbase accounts signing into everyone exclusively and moving the funds.
This can be preventable in the event that you utilize 2FA, yet even that can be beaten. On the off chance that this was a focused assault, the attacker can do as much data gathering on you as possible. They can discover your name, age, address, phone number, and social security number. This is possible through numerous administrations offered on the DarkNet. The assailant can undoubtedly address your security questions, for example, “What was your moms original last name” can without much of a stretch be replied with a Whitepages search, “What is your number one tone” can be handily replied with a straightforward Instagram following meeting, “What is your #1 games group” can be effortlessly replied with a basic Facebook following meeting, etc.
The less data you post about yourself, the safer you are. Regardless of whether you don’t enthusiastically present this data on people in general, it can in any case be found on sites which you have joined and unveiled this secretly. On the off chance that the site was hacked and you utilized a similar security question, odds are the appropriate responses are as of now open on some obscure underground gathering.
Alright, So you utilize a Password Manager with 2FA, you change every one of your passwords to 16 randomly created characters, you’re utilizing the best antivirus software for your PC, your PC is encoded, you erased all your web-based media accounts, you’re utilizing force HTTPS plugins to guarantee you’re generally on HTTPS, and you’re on a private WiFi. Then you’re protected.
Actually, that’s not true. On the off chance that the attacker has sufficient data on you as of now, they can without much of a stretch do things, for example, Sim Swapping. This assault is finished by data gathering beforehand, acquiring your SSN through obscure sites, and calling your Carrier. The attacker claims to be you, with enough data, for example, your name, dob, address, SSN, and versatile number, the attacker continues to request a substitution Sim card because of your being faulty. The Carrier gives them a sim card duplicate that has a place with you. Presently they can reset all your 2FA.
The most ideal approach to remain safe is to guarantee you don’t turn into an objective in any case, and in the event that you do anticipate putting yourself out there, ensure you are protected. Ensure attackers don’t have data on you, in the event that you truly can’t survive without it, make your web-based media accounts private. Eliminate posts on the web that have individual data. Request your data to be taken out from administrations like Whitepages, Spokeo, Etc. Change every one of your passwords, Use 2FA, If conceivable utilize an Offline Wallet, If not, Ensure 2FA is enabled and utilize a protected new email, Ensure 2FA is enabled on all Websites. Utilize a password manager with 2FA. Password managers automatically create long and secure passwords, at that point save them and consequently log you in at whatever point you visit the site. Run continuous infection examinations, guarantee you’re on the correct site continually, Do not utilize public associations. Consider your carrier and arrange a support pin, making it incomprehensible for an attacker to sim trade you.
If you like this article, follow us on Twitter, Facebook, Instagram, and LinkedIn.
