Backups for the paranoid
Image: When your confidential data has to get onto your computer and stay there for a long time, you better know how to hide it.
Secure backup solutions – digital and non-digital – are a big theme. It is usually avoided - as someone pointed out in the r/IOTA, people like to write up creative hacking solutions for all kinds of things but they will typically skip backups. It’s seen as the necessary evil – it’s not fun.
With cryptocurrencies though you should remember you literally are your own bank. There’s a lot of things to consider. Because of this, whenever I find a new and better solution to something I will update this post to have everything in one place rather than writing a new one.
The best way is to make us of multiple backup systems so it is a bit meaningless to separate them, but if you want to skip ahead to a particular backup solution you are looking for, here’s a table of contents:
1/ Digital Backups
- How to back up your wallet seed (digital)
- Hiding your wallet files
- Cryptocurrency wallet backups for the paranoid
2/ Non-Digital Backups
When your confidential data has to get onto your computer and stay there for a long time, you better know how to hide it. In the first layer it’s not even about encryption - it’s about not making it obvious that there is something to hide. To access well hidden data, one should need to know not only a passphrase but also where exactly to look for.
However, if you have multiple coins at multiple locations stored for the long run, you could also use elaborate digital backups to store hints as to where to find them and you could do the same for your password reminders. That gives you an additional layer of security: You are not backing up the actual access data but information that will help you recall how to access your coins after a long time of hodling. Jump to the section
How to back up your wallet seed (digital)
With Bitcoin and Bitcoin-based altcoins you typically don’t store your seed on a computer. With Electrum, one of the best and most tried and tested BTC wallet software with forks for some altcoins, your seed gets generated for you when you’re setting up a new wallet. Electrum shows you the seed, you are supposed to write it down on a piece of paper and store it securely.
With coins like IOTA you need to generate your own seed, which you usually do on a computer - for more info read “How to secure IOTA wallet”. As a result of this you are left with a file on your hard drive. The sensitive data is safely encrypted but you still need to back it up if it’s a random string of characters that you cannot remember.
Option 1: Paper Wallet
If you are on a clean, offline device you can simply display the seed and write it down with a pencil and a paper. Then choose a receiving address and write it down too, into your regular notebook or into whatever app you are using on your laptop to make notes, so that money can be sent into that wallet and so that you’ll be able to check your balance with an online block or ledger explorer.
Another way is to get a paper wallet generator. A paper wallet generator will print your seed or private key along with your public address and a QR code that you will be able to scan with your smartphone. Do not use anything that is hosted online. You should use a package that you downloaded from Github, ideally from a release page of your coin’s developer team or from a link that was recommended on the dev’s website, and you should have read the code before using it. Always use a paper wallet generator offline and to print it out it is safer to connect to a printer via a cable instead of wifi. Also use your own printer, not a public one because the data sent to print are in some cases retrievable from printers. (You see how much easier it is to just write things down with a pencil.)
Paper wallet generators for some popular cryptocurrencies:
Option 2: Encrypted file
This comes handy especially with IOTA where most users want to have the seed safely accessible digitally - read about the safe file generation here.
Before you back it up you can also make use of this idea.
How to back it up though? You can use a Raspberry Pi accessible only from your “core” (home) network or via a USB stick. An additional backup can be done on a USB stick, if you have a good one that won’t break very likely and that you aren’t using for anything. The same can be done with an external hard drive. Ideally you can use all of those methods to limit single points of failure.
Backups to a Raspberry Pi on your home network:
Raspberry Pi is a great solution - it is not expensive, it can be customized into anything from backup to media device and there’s been a lot of tutorials written about all of it.
An ideal setup for your pi as a backup device should take into account your device and network security and the hardware of the pi. You want your Raspberry Pi to be available from your home network only - it won’t have a web server and a public IP but it will have SSH open which means you will be able to get in from another device in the same network but it will not be accessible from the outer world.
If you don’t want to connect your devices to the internet, have a dedicated USB stick for transfers. To move files in and out you can use
scp if your devices are online. SCP is secure copy via ssh - this way not even your ISP will see what kind of stuff you are moving. (If you are using a router provided by your ISP you also might want to read this.)
A big disadvantage of a Pi is you rely on the longevity of the SD card or a USB stick. If you’ve ever used them outside of a Pi you will know how easily they break. Here’s the deal: the hard drives on devices without their own power source most often break when you pull them out in the middle of writing which creates corrupt data, but even if you are careful about this the hard drives wear more quickly just by having them start up and shut down so often. If you are going to have your Raspberry Pi plugged in all the time it helps the longevity of whatever you are using as a hard drive. It’s not all about handling in this case though, a fundamental difference in SD cards is how the data writing is done – better SD cards don’t keep pounding new data into the same spot on the hard drive until it gets worn, they will spread the writing activity across the disk which prolongs the card’s lifespan. Because of this, don’t go with a default “saver pack” Raspberry Pi – look for Pi-compatible SD cards from Sandisk or Panasonic in the price range of 30-150 USD.
- Here are some steps to take on your Pi to make an SD card last even longer.
- A recommendation to use SD card as a read-only and switch to a USB stick for the writing in case your Pi could realistically be losing power unexpectedly which causes the corruptions of SD cards.
For the setup:
- If you want to keep your Pi offline, you can use a “warm” device (a clean online laptop that is not used for daily browsing) to download verified OS and verified .deb files (or whatever you are using) that you need and install all that on the offline Pi from a USB stick with
dpkg -i. It’s quite a common security practice to have this kind of device just for downloading updates from the internet, verifying the file integrity and then installing the checked file on the device that has to stay safe.
- If you want to set up SSH access to your Pi follow this guide - your device will be connected to the internet but invisible outside of your home network. This is a very convenient solution because you have your data accessible at anytime and it can also be automated if you are using SSH keys, but it is not a “cold” solution. For pure backup of a kind of file that isn’t updated at all (= your wallet’s seed) you should not need this solution because you will not need to access your backup regularly, neither to retrieve the data nor to update it.
- Tails, the Linux distro built for privacy, will not work on a Raspberry Pi.
Hiding your wallet files
Some wallets might generate a file called something like
wallet.dat when you are generating a new wallet. That is well known and the number of people who know what a
wallet.dat is keeps growing.
With Bitcoin Electrum, wallet file encryption is activated by default since version 2.8. Your wallet seed is encrypted once again inside of the encrypted wallet file.
Your seed and private keys are encrypted using AES-256-CBC. The private keys are decrypted only briefly, when you need to sign a transaction; for this you need to enter your password. This is done in order to minimize the amount of time during which sensitive information is unencrypted in your computer’s memory.
In addition, your wallet file may be encrypted on disk. Note that the wallet information will remain unencrypted in the memory of your computer for the duration of your session. If a wallet is encrypted, then its password will be required in order to open it. Note that the password will not be kept in memory; Electrum does not need it in order to save the wallet on disk, because it uses asymmetric encryption (ECIES).
It is very similar for Electrum forks - encryption might not be the default option though, so you should make it a point to check you are opting for it.
However, if you go with the default wallet name during your wallet creation, the file will still be called
default_wallet. On Linux and Mac it is located in
~/.electrum, on Windows in
\Users\YourUserName\AppData\Roaming\Electrum\wallets. You should always give your wallets random names so that is not immediately obvious what kind of file it is.
The wallet file and wallet password are enough to access your coins. With Bitcoin-based cryptocurrencies you don’t need to back up the wallet file if you are backing up your seed, your balance and transaction history is always recoverable from the seed even if you’ve forgotten your wallet password. Seed recovery won’t recover your labels though, so you will need to back up the wallet file if, say, you are using specific addresses within one wallet for specific incomes and wouldn’t want to mix up these routes.
Last but not least, you might choose to secure the wallet files maybe before crossing a country border if you don’t want to take the chance someone will search your hard drive for cryptocurrencies.
How to backup your Electrum wallets (Linux, Mac):
- Always make sure you have the seed to your wallet before playing with the wallet files.
- In the Electrum app, with the use of
File > Save Copysave a copy of your wallet file from
~/.electrumto a new directory in your home folder, call it something like
- Pack the directory into an encrypted archive:
tar -cvf YOURDIR.tar YOURDIRPATH | openssl enc -aes-256-cbc -salt -out YOURDIR.tar.bak
- Move the encrypted archive to your cloud backup or wherever you are normally dumping your random files.
- Optional - if you are worried before crossing borders: Uninstall the Electrum app.
- Optional - make use of use something like this.
Decrypting and extracting the archive:
openssl enc -d -aes-256-cbc -in YOURDIR.tar.bak -out YOURDIR.tar tar -xvf YOURDIR.tar
About this method:
- This is the basic backup version. For a more elaborate scheme skip to this section.
- The openssl command will ask you for password - choose something strong and store it safely on a paper.
bakfile extention is just a random extension that is used to signify “backup” – it can be anything.
Byteball wallet backup
With Byteball, the IOTA-esque altcoin that everyone has thanks to the airdrops, the situation is a little more complex. Your GBYTEs can be recovered from seedphrase only, your Blackbytes cannot though. If you own both Bytes and Blackbytes and want to backup both you will need to do full backup with export of the encrypted wallet file. You can do that all from the wallet app: Under “Settings” click on “Full backup” and opt for the compression. Also choose a safe password.
You will get a warning that you shouldn’t clone wallets unless they are multisig - you cannot not use the same standard wallet on multiple devices.
Apart from the export, write down your wallet seed on paper and do the same with both your backup password and transaction password (these should be different!).
Cryptocurrency backups for the paranoid
Like Mr Novogratz said, if you have a crypto wallet access data hidden under your kitchen sink and the wallet has hundred million dollars on it, you want a guy sitting there watching your kitchen sink, right? It has one flaw though: If you have that guy sitting there watching, you are giving away the information that there is something very valuable that you are hiding.
Here comes the juicy part. There is a lovely and very old technique called steganography. Steganography in the broad sense is science of hiding information. In the digital age, it means appending hidden data to a file that can be used after that without anyone suspecting anything.
One good way to do it could be appending your sensitive data (or hints to sensitive data access) to some inconspicuous kind of file that everyone has on their computer - maybe to a family photo on your normal laptop or to a screenshot of man page or some tutorial on a Raspberry Pi.
Yes - by using a terminal window you can hide any file into an image. On Linux and Mac you don’t need any extra packages to pull it off which makes it an even more attractive (and “colder”) solution.
How to hide your sensitive files into an image:
Let’s use an Electrum wallet export. Create a directory with the wallet file and a photo. Here the encrypted wallet file is disguised as
Now for the heavy lifting: We will use a standard
cat command that is most often used for displaying text in the terminal but with
> also for file manipulation.
zip FbBackup102017.zip FbBackup102017 cat FbBackup102017.zip > tony-joe-white.jpg
The terminal should just eat the command, not showing any changes other than the image file size:
# before -rw-r--r-- 1 USER staff 295002 Oct 14 13:57 FbBackup102017.zip -rw-r--r--@ 1 USER staff 62306 Sep 10 06:08 tony-joe-white.jpg # after -rw-r--r-- 1 USER staff 295002 Oct 14 13:57 FbBackup102017.zip -rw-r--r--@ 1 USER staff 295002 Oct 14 13:57 tony-joe-white.jpg
Suddenly, the image file get’s as big as the zip file – it won’t be striking once you’ve removed the wallet zip file though. Also, the image thumb stays the same too, but on Mac Preview.app won’t open the image file anymore.
Now go ahead and remove the sensitive files, retrieving the original wallet file from the image is this simple:
If you want to only test an image file to see if there’s something in it, use
$ unzip -t tony-joe-white.jpg Archive: tony-joe-white.jpg testing: FbBackup102017 OK No errors detected in compressed data of tony-joe-white.jpg.
What to do with the images?
If you are cheeky enough you could try to upload your picture online somewhere (nobody knows whats in it anyway, right?). Well, don’t do it - most upload systems process the image to save space and check for any bizarre data that could be a security threat. This will strip your extra data you appended to your image.
A more reasonable system is to have maybe a directory with your most favorite family photos (or photos of your favorite artworks or memes or whatever - it is so common to do this), each of them having some encrypted data appended. The directory would then be made a regular archive.
A photo archive like that can be backed up on an external hard drive or on your cold/warm device. If you think you could sleep well like that, data packed the way described above plus encrypted should survive a cloud backup too.
How to back up your wallet seed (non-digital)
The ultimately best way is a piece of paper and regular pencil. No pen, ink, gel – just a regular pencil. Nothing beats its longevity.
Keep your wallet seed in a trezor (meaning an actual safety deposit box). If you worry about your coins being lost in case something happened to you, you can split your seed and give each part to a person you trust and instructions to a lawyer. You should not give the whole seed AND instructions to a single person.