Everything you need to know about protecting your funds in the cryptoeconomy

Introduction: Security

Do you feel confident that your cryptocurrency assets are safe from theft? Did you backup your wallet? No? Well, don’t expect your insurance company to cover you, should anything go wrong. If someone steals your private key you are basically screwed. Cryptocurrencies are not regulated in any way by the government, so you cannot turn to anyone for help should something go wrong. You alone are responsible for securing your assets.

In this article, we will walk you through basic security measures and explain how cryptocurrencies and wallets work, so that you can take better care of your assets in a more secure way.

The basics

In this article we will explain everything based on the Bitcoin blockchain. However, many of the cryptographic terms that we use, e.g. ‘private key’ or ‘public key’, is something all cryptocurrencies are based on. You can thus consider these as useful principles for other cryptocurrencies as well.

To spend Bitcoin, you will need a private key to sign the transaction. Buying Bitcoin does not give you ownership of the coins. All you get is access to create transactions with your coins, given that you have the correct private key to sign with. So, by now you probably understand that this private key is important. But what is a private key? For starters, the private key is generated along with a public key. We call this a key pair. The public key is what you will know as your address which is used to receive coins. It is often represented by a string of text or by a QR code. The private key gives you access to spend bitcoins that are stored on the private key (which the key address is paired with).

Thus, security in the cryptoeconomy essentially boils down to securing your keys. The key is to have a good plan for securing and administering your assets. Consider the following principles:

1. Accessibility: You can spend your bitcoins
2. Security: Nobody else can spend your bitcoins
3. It is practical and user friendly

#1 The simplest (and most vulnerable) solution:

Store your private key in a file on your device (PC, phone, tablet):

+ Very practical and user friendly

+/÷ As accessible as your device, but

÷ If you lose your device, or if it is wiped, you lose all access to spend your bitcoins

❔ Only as secure as your device

÷ Should your device be compromised by an attacker, your private key will be compromised as well, and the attacker can spend your bitcoins.

Even if this is the easiest and most practical way to store a private key, it is also the most vulnerable. It is a little bit like walking around with your wallet loaded with lots of cash in your pocket. When you use this method, be sure that you only store small amounts of value which you are comfortable with the risk of losing. A good rule of thumb is to never store more Bitcoin than you would store in your actual wallet.

Let’s look at the vulnerabilities. By this method, you will lose your bitcoins if:

• Your device crashes and you lose all your files
• Someone steals your device
• You lose your device somewhere
• Your device breaks and you lose access

You will also lose your bitcoins if:

• Your device is compromised by malware/virus which leaks the key to the attacker
• You are connected to a network where the internet router is compromised, which leaks the key to the attacker
• Someone gains access to your device when you are not watching (perhaps an unfaithful friend), they key is stolen and you lose your bitcoins

#2 Wallets

A digital wallet, as opposed to your pocket wallet, is a written software or a program that gives you a simple user interface to help you keep track of your keys, your addresses and your bitcoins.

A wallet gives you the tools to create multiple addresses so that you can store your bitcoins in multiple places. Now why would you want to do such a thing? Why not keep everything on one address? Because when you spread your bitcoins onto multiple addresses it will look like multiple ownerships to an outsider. Thus, it essentially increases your anonymity. Wallets also keep records of all transactions and act like a kind of accounting software.

A central element of wallet security is based on encryption by a chain of words. It is common to use 12 words, but many use 24 words as well. Some wallets let you choose the words, and other wallets will randomly generate the words for you. If you know the right combination of words, you can recreate the wallet with its private and public keys should something happen to it.

This is your backup plan, a fail-safe, should the device the wallet is stored on fail or get lost. Most wallets support this, so always create a backup of your wallet, and write down these words. DO NOT write them down on the same device you store your wallet, but somewhere else, e.g. on a piece of paper. Then secure the paper somewhere safe. You could even split the paper in smaller pieces to separate the words and hide them in multiple places, so that even if someone finds a piece, they will not be able to gain access to your wallet.

Lastly, if you are really confident in your long term memory, you could even consider not writing down the words, but memorize them instead. This will be easier if you can choose the words yourself. You could pick a poem that you like, a phrase from a book etc. that will help you remember the words more easily. If you are slightly less confident, you could also just write down the first 2 or 3 letters of the word, as long as you are sure you will be able to remember the rest of the letters at some point in the future.

Hot and cold storage

“Hot” wallets are characterized by being online and connected to a network. Thus, they become easily accessible, but with a high level of risk in case you get hacked.

“Cold” wallets are characterized by being offline and not connected to the Internet. They can be regarded as an archive, and they are not as accessible as a hot wallet, but on the flipside, they are significantly safer.

A good strategy is to use a combination of both. Use a cold wallet for storing large amounts of value, and use hot wallets for transferring smaller amounts and daily use.

How does hot and cold storage work?

First, you need separate private keys for cold and hot wallets. If you had stored a cold private key in a hot wallet, the whole purpose would be gone. Then, you need addresses. In the cold wallet you need the addresses to the hot wallet and vice versa.

Even if the cold wallet is offline, you can transfer Bitcoin from the hot wallet to the address of the cold wallet. The amount is transferred immediately from the hot wallet to the address of the cold wallet, and this gets stored on the blockchain. When/if the cold wallet is connected to the Internet, it will update the account balance after having read the information from the blockchain. The cold wallet is now ready to spend the funds that have been transferred from the hot wallet.

Hierarchical key generation

How does the hot wallet know the addresses of the cold wallet? And how does the hot wallet come to know about new addresses that the cold wallet stores? You could have generated several sets of keys in advance, but when they are spent, you are back where you started. A better method is to use a cryptographic technique called hierarchical key generation. Briefly, what this technique entails is that, instead of generating an entire set of keys, you create a set of keys that can generate new sets of keys.

For instance, we can initially create a “mother key”. The mother key is used to make two “sibling keys”: one “brother key” and one “sister key”. Let’s say the brother key is the private key, whereas the sister key is the public key, i.e. the address. What the sibling keys are able to do, is they can generate new sibling keys. All new sibling keys will still have a relation with the mother key. Together, they comprise a big family.

What’s useful with the hierarchical model, is that when, say, sister key #10 is generated, she will match brother key #10. The reason this works, is that the brother and sister stem from the same mother. Sister keys can thus be generated independent of brother keys. In this way, you can create as many keys as you want on both sides and be safe that they will match one another, WITHOUT them ever having to communicate with one another!

With a hierarchical wallet, the mother and brother keys will remain on the cold side, and the sister keys on the hot side. Wallets that use this technique typically use “HD” (Hierarchical Deterministic) in their name, such as Mycelium HD or MultiBit HD.

How to store information in a cold wallet

There are different methods you can use to store information in a cold wallet.

1. Store the information on a unit, e.g. a memory stick or a switched off computer/mobile phone, and lock it in a safe.
2. Encrypt information with a password that only you remember.
3. Store the information on a piece of paper and lock it in a safe, or laminate the paper and bury it in the ground.
4. Use a tamper evident unit, such as Trezor (www.trezor.io), which signs transactions for you, but will not leak the key.

This guy is digging a hole for his bitcoins, but he needs to be cautious so as to not forget the location, especially if he digs several holes. He does not want to be a squirrel that forgets where he has put all of his nuts. He may need a treasure map to remember. And if something happens to him, he would presumably want his loved ones to find it and understand it.

Clearly, there are pros and cons associated with all the methods. If you use a password, the information is only as secure as the strength of the password, provided that the owner is not forced to give away the password in any way. If the information is stored in a safe, the information is only as secure as the safe and its location. If the building in which the safe is located is subject to a fire, earthquake etc, you are also at risk of losing all of your funds. If somebody manages to break into the safe and steal the information, it may take a while before you find out. If you are using a Trezor, however, you will be notified immediately.

Examples of cold storage

The first thing you need to do to store your wallet offline, is to find a medium that you are comfortable with as a medium of storage. For example, you can use paper wallets, or a PC without connection to the Internet. There are also gadgets that solve all of this for you, such as Trezor or Ledger Nano. These are also known as “hardware wallets”. These are very practical, but are somewhat expensive. Either way, the scope of the security measures should be proportional to the values they protect.

Another option is to set up a paper wallet. You can do this here: //tools.bitcoin.com/paper-wallet

It is recommended that you save the website locally on your computer and then disconnect from the Internet. Once you are offline, you open the saved website in a web browser. Move the mouse around and insert a symbol in the text box to create a randomly generated key. You receive a private key that can be used to sign transactions, as well as a public key to receive Bitcoin in the form of QR codes. Then print the page, but do make sure that the printer is not connected to the Internet. Store your private key in a safe and fireproof place.

You can now receive Bitcoin by sending to the public key. To spend Bitcoin, you must import the private key to an online wallet that supports the import of private keys. When the key is imported, you can sign the transaction from your preferred online wallet. Keep in mind that paper wallets are for one-time use. Once you have imported the private key to an online wallet, it is no longer cold, and you should therefore create a new cold paper wallet.

If you have a computer that you are comfortable being offline, you can for instance use Bitcoin Armory to store your wallet offline. Download Bitcoin Armory, put it on a memory stick and install it on a computer that is offline. When Bitcoin Armory is installed, create your wallet. Then you make a copy that only attends to the wallet (“watching-only copy”), and store it on the memory stick.

Install Armory on an online computer and import the wallet you just saved from the memory stick. Confirm that the wallet belongs to you. You are now able to use the wallet as a regular wallet except that you may not send Bitcoin (you can only receive).

To send Bitcoin, use an online PC and choose “offline transactions” in Bitcoin Armory. This function lets you create an unsigned transaction that you can export and store on your memory stick. Then, import the transaction on an offline computer, choose “offline transactions” and sign the transaction. Export the signed transaction and save it on the memory stick. Go back to the online computer and import the signed transaction. You may now broadcast the signed transaction on the blockchain.

This may sound like a hassle, and surely it is so. Consequently, most people choose to buy a hardware wallet for 100-200 dollars. However, if you are only dealing with small amounts, this may not be a necessary option. Another strategy is to store your values on multiple locations, so that in case something happens at one place, it will only be a small loss. We will have a closer look at this in the next section.

Splitting and sharing keys

The problem with storing all of your values in one location is obviously that if anything goes wrong at that one place, that would be disastrous. It is not a good strategy putting all your eggs in one basket.

Secret sharing

Cryptography enables splitting a key into smaller parts. If an attacker gets hold of one part of the key, he will not get access to anything at all. In order to reconstruct the key, he would need access to x amount of parts where x is determined by the cryptographic method that was used to split the key.

For instance, you can split a key into 5 parts and determine that in order to put it back together, you need at least 4 of the parts. The parts can then be distributed to people you trust, or store the parts in different locations. The good thing about this is that if one of the parts gets lost, the key can still be reconstructed with the remaining parts. Additionally, it will be extremely hard for an attacker to obtain all the parts.

The disadvantage is of course that you have to gather all the parts in order to put the key back together, which can be unpractical. Another weakness could arise once all the parts have been re-gathered, namely if an attacker obtains knowledge of the time and place the parts are being re-gathered. In that case, the attacker may be able to steal all the parts simultaneously. At this point, all the eggs are essentially put back in the same basket.

Multisignature (multisig)

Multisignature is a method which uses secret sharing without having to reconstruct the key every time it is shared, and is supported by most cryptocurrencies.

For example: Andrew, Brad, Carl and David work in a company that owns plenty of Bitcoin. They all own a pair of keys and each store the key in a safe cold wallet.

The company’s cold wallet uses multisignature, which means that three out of four keys must sign the transaction in order to spend Bitcoin.

In this example:

• The company’s bitcoins will still be safe even if Andrew and Brad conspire to steal all of it. They will still only have two out of four signatures, and thus they will not get access.
• Brad, Carl and David will still have access to the funds even if Andrew dies in a car accident.
• Andrew, Brad and Carl will still have access to the bitcoins even if David loses his key.
• Andrew, Brad and Carl will still have access to the bitcoins even if somebody steals David’s key.
• The bitcoins will still be safe even if somebody steals Brad’s and Carl’s keys.

Multisignature is a way to spread risk by avoiding having one central point that can be attacked. The same goes for the Bitcoin blockchain. One of the reasons it is so secure, is that it is a decentralized network without any central point. The network is run by a series of nodes, and an attacker would have to attack all of the nodes simultaneously, which is practically impossible.

Online wallets and exchanges

So far, we have gone through how to store cryptocurrencies on your own. However, there are also companies that offer to protect cryptocurrencies for you, in so-called online wallets. An online wallet is exactly like a regular wallet, except it is stored in the “cloud”.

The wallet can be opened in your browser or in an app. There are many different providers of wallets. Some reputable ones are Copay, MultiBit HD, Bitcoin Core etc. You must log in to get access to your wallet. The provider stores your keys and sends code that executes all operations to your web browser/app.

Your keys are encrypted with a password of your choosing, and you have to trust that the provider does not steal your key or gives it to somebody else.

The advantage of online wallets is clearly that they are highly practical. You do not need to install anything at all, and it works on all devices.

The disadvantage is obviously that not only do you have to trust the provider; you also have to trust the security of the provider. Should anyone hack the provider’s service and steal all of the keys, you will lose all the funds you had in your online wallet.

Using online wallets, therefore, is a little bit like putting all of your eggs in a honey jar. A provider of wallets is in a way a money bin with thousands of wallets – in other words, a fairly attractive target for attackers. Thus, it may be a good idea to do some research on how the provider operates prior to choosing the online wallet. Ideally, the provider should have a solid team of security experts, even though that in and of itself does not guarantee that your funds are safe. An online wallet can be regarded as a hot wallet. Therefore, store small amounts that you would be comfortable having in cash in a physical wallet.

Common wallets

Hardware:
The Trezor is designed to enable signing of online transactions and to function as a cold storage device at the same time. This makes the Trezor a highly practical unit that gives you the best from both worlds: high security and good usability.

Mobile:
Copay was originally developed for BitPay. It supports personal and shared wallets, and it also has its own testnet. Copay has Bitcoin Wallet Service, which supports multisignature. It also has a simple and user-friendly user interface. The weakness is that you have to trust that Copay actually shows you real transactions and not simulated ones.

Desktop:
MultBit is a simple wallet that quickly synchronizes against the network and thus can “get to work” quickly. It has an easy user interface and supports multiple languages. It is ideal for the not-so-technical user. It is vulnerable if the PC on which you are storing your wallet is compromised by malware or becomes compromised in the future.

Web based:
Coinbase focuses on user-friendliness and is web based, which means they are also easily accessible. They also have an Android app as well as integration with several American banks. Be aware that by using this service, you are handing your private keys to Coinbase.

Online Exchanges

Exchanges let you trade Bitcoin with fiat currency (USD, GBP, EUR etc) and in many ways function as banks. They accept Bitcoin deposits against a promise that you will get them back when you ask for it, also called IOU (I owe you).

On an exchange, you can:

• Send and receive Bitcoin
• Buy and sell Bitcoin for fiat currency
  • The exchange matches people who wish to buy Bitcoin for fiat with people who wish to sell Bitcoin for fiat.
  • The quality of price is determined by how big the spread is between buy and sell orders. A good exchange has good liquidity and a low spread.

Buy orders and sell orders. The current price is always where these two meet.

So, what happens when you buy Bitcoin on an online exchange?

Let’s say you have an account on a Bitcoin exchange and you have 10,000 USD and 20 BTC. You then place an order to buy 2 BTC for 2,500 dollars each = 5,000 dollars in total.

Your buy order will now hopefully be matched with a corresponding sell order, and if everything works out, your new balance will be displayed as 22 BTC and 5,000 USD.

Notice that at this point there have been no changes taking place on the blockchain. The only thing that has changed is that the promise to give you 10,000 dollars and 20 BTC is changed to 5,000 dollars and 22 BTC.

One advantage of using an exchange is that you can easily exchange from fiat to crypto currency and vice versa. The disadvantage is the same as with any bank, but primarily is comes down to the following three layers of risk:

1. Bank run: When everyone runs to the bank to take out their money at the same time, the bank does not have enough liquidity to cover all the withdrawals. You thereby risk not getting back your bitcoins when you ask for it. In such cases, it is also a risk of a panic outbreak and that a snowball effect makes the situation worse. Worst case, the bank goes bankrupt and you lose all of your values.
2. It is a scam or a Ponzi scheme. The owners could potentially be dishonest and are only trying to build a good reputation in the short term, so as to acquire a solid base of customers. When they reach a certain point and have enough money, it may become worth it to try and run away with all of it in the right moment. The owners may also have good intentions to begin with, but become corrupted by the allure of big money right in front of their noses.
3. A hacker attack from external or unfaithful people: Attackers could break into the systems and steal the keys and all the bitcoins. Now, even though you are promised to receive 22 BTC upon request, the bank has 0 BTC and cannot hand BTC to anyone. It is often these incidents that are referred to as “Bitcoin has been hacked” in newspapers and so on. It is not the Bitcoin protocol that has been hacked, but a Bitcoin exchange that has been hit by a hacker attack and lost all of its bitcoins when the hackers got access to the keys.

All of these things have already happened to one or more exchanges, and it will happen again. Therefore, be careful how much you store on an exchange. Remember that Bitcoin exchanges are not regulated and insured the same way as a bank. For instance, the authorities will often give support to banks who become insolvent and even guarantee to cover large chunks of the depositors’ money. This is not the case for Bitcoin exchanges!

One piece of advice, therefore, is to look at the exchange in question and find out if they can prove that they have the fraction in reserve that should function as a guarantee for your deposits, as well as how big this reserve is. Stay away if the fraction is too low, or if the exchange does not want to declare such information. By using the blockchain, a Bitcoin exchange can easily prove what its fraction reserve is, completely voluntarily and without any form of third party regulator,

Having said that, it comes with enormous risk to lend out cryptocurrencies due to its volatile nature. Most crypto exchanges thus have 100 % in reserve, but this is likely to change as the volatility becomes more stable.

Decentralized exchange (DEX)

BitShares, the technology behind BitGate, offers a decentralized exchange, which has big advantages compared to the traditional centralized version. A centralized exchange issues IOU tokens. Thus, you do not buy actual bitcoins; you buy a representation of bitcoins that the exchange promises to pay you when you request it.

The main tasks of a centralized exchange are as follows:

1. Receive cryptocurrency and issue IOUs
2. Receive fiat currency and issue IOUs
3. Redeem IOUs
4. Process the order book

The first thing that characterizes a decentralized exchange, is that the order book is moved to the blockchain, so that everyone can read it and update it. The purpose is to separate the issuer of IOUs from responsibility for the order book, as the combination of the two often leads to centralization and increased vulnerability. It usually comes with a lot of friction to move funds from one exchange to another, and what we see with Bitcoin exchanges is that “the herd” gathers where the order books have the lowest spread and the most depth.

When we separate the two, everyone will trade on the same order book, whereas issuers can operate through a so-called gateway. A gateway handles bullet points 1 – 3 in the list above, whereas the order book is handled by the protocol. As opposed to a centralized exchange, the IOU is transferred directly to the customer’s wallet. Thus, through different issuers/gateways, you may trade PoloniexBTC against KrakenBTC or PoloniexUSDT against KrakenBTC. Now how does one prevent the market from centralizing around a few IOU tokens? And how does one “translate” value from two tokens that have different regulatory considerations and trust profiles?

BitShares has so-called smartcoins, which are locked to the market price of a certain asset, e.g. a currency or a commodity such as oil or gold. For instance, bitUSD has a 1:1 relationship with USD and is secured by BitShares’ own currency BTS, in so-called credit for difference (CFD) smart contracts. Smartcoins are dependent on governments and centrally governed entities and are thus the link that can comprise a universal order book that everybody can use, without having to expose oneself to a counterparty risk.

Since there can only be one blockchain, there can only exist one global order book for a selected market. A global order book enables streamlining through a smaller spread as well as maximum liquidity, responsibility and revision. Coincidentally, BitShares is open 24/7 365 days a year.

On the BitShares platform most assets can be represented as a value. If someone wants to trade gold against truffles, the person who wants this market, can set it up without asking for permission from a centralized exchange. BitShares also supports stocks, funds and indices. A company can in fact issue their own shares if they wish to do so.

You can trade whatever you want, when you want, and as much as you want without withdrawal restrictions, as opposed to centralized exchanges where you often have to submit more and more documentation in order to increase the withdrawal limit.

However, the even bigger advantage is the security. When a centralized exchange gets hacked, this affects all users, and tokens worth millions get lost. If one succeeds with an attack on the decentralized exchange, only one user will be affected. Having said this, the user is the one mainly responsible for the security. You still need to protect your keys, but you can be assured that it is not going to happen due to bad data security on the part of the exchange.

BitShares smartcoins are secured 100 %, as opposed to banks and centralized exchanges, which only operate with one fraction in reserve as collateral. Every smartcoin is secured with BTS in smart contracts on the blockchain. Thus, there are no private keys that can be stolen or hacked. All orders are executed with the same speed. Therefore, it is not possible to prioritize some orders over others. This creates equal terms for all.

Conclusion

Blockchain is still a very young technology. Therefore, you have to be very cautious as to how much money you invest. Never invest money you cannot afford to lose!

Many blockchain projects sound very promising, and the developers can guarantee that all is safe and secure. However, the reality is that blockchain projects are a little bit like Space X projects. We are attempting to send rockets to space and get them to safely land on earth again. Many of these rockets will explode on the ground, and some will crash before they end up succeeding.

It takes time for a technology to mature and integrate into society. The Internet has been in development for several decades, and we are now reaping greater and greater benefits from it. Blockchain is still a technology in an early phase, and is perhaps where the Internet was in the early ’90s. Vi have just gotten email (Bitcoin), but it is still not quite intuitive … not until “Hotmail of blockchain” arrives in a few weeks/months/years!

There is a lot of room for innovation when it comes to user friendliness, bank services and insurance. One of the problems with Bitcoin and cryptocurrency in general is slow adoption of mainstream users. Before this happens, it must become easier to access cryptocurrency at the same time as the level of security is maintained. Purchasing a wallet for 150 dollars or learning techniques for moving transactions from an offline PC to an online PC, is not exactly enticing to the average Joe. However, we can be sure that this will be solved in the future. There are plenty of people working in the blockchain sector, and many exciting and promising projects are under development.

Internet was not user friendly in its early days either, but then came the web browsers, and then applications such as Hotmail, Amazon, Google and Facebook. For blockchain we predict a similar progression, and that companies equivalent to the ones mentioned above will emerge and revolutionize the industry.

 

By Pål Taule Bentebråten
Edited and translated by Ola Haukland
For BitSpace AS