Mike asks, "Hi Andreas. I store my crypto on a Ledger [hardware wallet]."
"Listening to Trace Mayer this week has me concerned that this is not safe enough."
"Trace says that you need Bitcoin Core for network validation, Armory for managing the private keys,
the Glacier Protocol for standard operating procedures, and a Purism laptop for hardware."
"What is the gold standard for storing crypto, for non- technical people? Is a hardware wallet good enough?"
"If my crypto has been on my hardware wallet for a year, is it more or less likely to be hacked over time?"
Here's the thing:
Different groups of people will have different risk models and tolerance for technical complexity.
The important thing to realize here is, technical complexity is part of the risk model.
If [the security procedure you are trying to follow] is more technically complex than your level of skill,
you introduce a serious risk that you will lose your crypto.
Not because it is stolen, but because your ambition for technical excellence exceeds your current skill level,
and you messed up [on the execution].
This applies to every level of technical expertise. There is always a 'higher level' of security to achieve,
by adding a bit more complexity.
Security is not an on / off thing, "it is secure" vs. "it is not secure."
There is no gold standard that applies for everyone.
But there is a sweet spot where the risks that you face in an adversarial model, where you have identified...
and understand who might be after your crypto and under what circumstances they might access it...
The risk model you have for resilient, long-term storage.
You should also be thinking about inheritance and how your loved ones will deal with [accessing your crypto],
if something happens to you.
The risk models for simple loss, [which everyone has], includes environmental disasters like fire and flood,
a problem with your home or the areas where you store keys, such as termites eating your paper back-ups.
Whatever else the risk model might [include], then you must balance that against your technical skills.
Find which of these risks you can eliminate, in a way that you and anyone designated to help your loved ones...
recover your crypto if something happens to you, can execute flawlessly.
That is the sweet spot.
So, Trace's sweet spot is: Bitcoin Core for network validation, Armory for managing keys,
Glacier Protocol for operating procedures, and a Purism laptop for hardware.
Other people have a higher sweet spot. For example, Coinbase uses a Faraday cage for cold storage.
They have a room lined with an electromagnetic shield so that it won't leak radio frequencies (RF).
Other people use nothing [to shield their storage room]. So there is a range here.
Trace is identifying his sweet-spot based on his level of technical expertise and the people around him,
who would be able to assist him and others if the need comes.
He is balancing against his lifestyle, where he lives, and access to secure locations for storage, etc.
None of this [might] be the same for you. You need to figure out what is right for you.
For 99% of users, this is not right, because 99% of crypto users do not have the technical expertise to execute...
on a plan of this complexity.
As a result, what they will do is over-extend and underachieve on technical execution,
standing a much bigger risk of losing their crypto due to key loss than having it stolen by an external adversary.
Your own lack of technical expertise, your over-ambition in execution, can cause you to lose your crypto.
Not some nefarious hacker.
Having said that, what can you do that is practical?
If you have your crypto on a hardware wallet, that is a [relatively] high level of security.
The important question then becomes, where is that hardware wallet backed up?
Where are those backups stored? How are those backups stored?
Do you have additional layers of security on it?
For example, if you have a hardware wallet with a PIN, then the [keys on the] hardware device itself is secure,
though it is still vulnerable to physical attacks, meaning you must secure the location of the hardware wallet.
A wall safe, floor safe, or hidden compartment, is often enough security if people don't know you have crypto.
If people know that you have crypto and they know where you live, then you have a higher degree of risk.
You need to account for that.
Now, about the [seed] backups.
Writing the twenty-four English words on a piece of paper with your own handwriting...
is probably the most resilient way you can backup your hardware wallet.
You must protect that seed.
While most people are very worried that someone will break in, identify what the twenty-four words are for,
and steal their money, that is not the biggest risk.
The biggest risks are: you lose it, you forget where you put it, you didn't make a back-up in the first place,
or it was damaged by moisture, which is a real problem.
When paper gets wet, the ink bleeds and it is destroyed.
If you have a fire, termites, or some natural disaster, it could destroy your only backup.
But you can protect against many of these risks. Step one: Create another layer of protection.
Make a passphrase on top of the seed so you have this additional layer of security.
You still need to backup your passphrase. If you pass or are involved in an accident,
and you are the only one who knows the passphrase, that is a point of failure and your crypto could be lost.
It would be very difficult to brute-force.
A simple [set] of four to six random English words is a sufficient [passphrase],
if you physically protect your seed against disclosure.
I would also add these important measures: make two or more copies of your seed,
and store them geographically distant locations.
The seed on its own, without the passphrase, is [probably] not sufficient to break it.
Take that paper seed and laminate it, to protect it from moisture, which is the one of the [primary] risks.
Then put it in a tamper-evident sealed envelope. You can buy these by the hundreds from retailers.
They are often used for cash donations in religious institutions, things like that.
This will allow you to ensure, with easy [future] inspection, whether anyone has peeked at your seed.
It will give you peace of mind that no one has accessed that particular copy of the seed.
Create more than two copies of it, and put each in a standard fireproof safe in two different locations.
They should be unlikely to burn down at the same time.
With these measures in place, you have protected yourself from the biggest risks:
accidental damage, environmental damage, and loss due to insufficient backups.
You must also backup the four to six word passphrase.
Write those down on paper, laminate them, put them in a tamper-evident envelope, and store two or more copies..
in two or more different locations from where [your] seed [backups] are.
Finally, write a letter and coordinate with your family so that [the right] people know these things exist,
but can't easily access them and take away your crypto.
For most people, the simple technology of paper and pencil, with a modern addition of laminated sheet...
to [prevent] moisture damage,
and a cheap plastic envelope that makes it obvious if someone has peeked at your seed, is sufficient.
You do not need to go to the technical complexity of the Glacier Protocol.
Here is the problem when people give advice like this.
They say, 'If you don't achieve this level that I feel confident at, you are not secure!'
What they are doing is not [necessarily] encouraging more people to achieve better security, but rather...
either pushing people to overextend their technical skill..
and be at risk of losing their crypto due to a variety of technical problems,
or pushing people toward custodial exchanges [and wallets].
The vast majority of people, having read things like the Glacier Protocol, will think, 'I don't know about this.'
They will try to do it, without understanding it and [feeling] very uncomfortable with their knowledge,
and probably lose their crypto because they messed it up.
Or they will give up on the first page, move their crypto into custodial storage,
and let someone else take care of the security.
We have an intermediate level that people can use: hardware wallets, with paper backups,
and properly secured with a passphrase, are very effective.
They are easy to use for most people.
Follow the instructions, and don't try to improvise.
Do not cut up your seed into groups of words and sprinkle them in different locations.
Do not try to use an overly complex passphrase, type the words into a [text] file, encrypt the file with PGP,
and store it on Dropbox. None of that.
Old fashioned, low-tech paper and pencil, and protection from water or fire damage,
with multiple redundant copies, and a second-factor passphrase.
That is achievable by most people.
Mike, your crypto is fine on the hardware wallet.
It is not more likely to be hacked now than it was at any time in the past.
99% of the attacks against hardware wallets that...
you read about in academic papers or see at security conferences require physical access to the device.
Even then, they [probably] won't work if you have updated your firmware correctly.
More importantly, the biggest risk you face is losing your crypto because you didn't properly back-up your [keys].
Or because you tried to follow a set of instructions that started with, 'Obtain the Unobtanium Linux distribution;
install it on an air-gapped, Faraday cage protected supercomputer in an underground bunker.'
You probably put your hands up and sent your money to Coinbase instead.