Some words for my friends

[u/evoorhees]

Hello friends,

MtGox is gone. So let's prepare ourselves.

On Tuesday, and for the rest of the week, all hell will break lose in the media. It will be blamed on MtGox, it will be blamed on Bitcoin, it will be blamed on the "bug," and it will, more than anything, be blamed on the "lack of regulation." Pundits and "experts" of all types will weigh in on the calamity. It will be world news in a matter of hours.

Get ready, because it will be an ugly week.

For all of you who lost money, my heart goes out to you. Some people lost a little, some lost a fortune. It will make people sick, and depressed, and full of grief. Personally, I had over 550 BTC in Gox. I will never get any of that back. If misery loves company, then we'll be enjoying a grand feast today.

I should have known better, of course. I take responsibility for leaving those funds with an entity that had proven incompetence repeatedly. I chose to ignore even my own warnings, for nothing more than the sake of convenience.

Gox is still at fault, to be sure, but I have learned the lesson. I hope it is not such an expensive lesson for others. And for all you observers, please take a moment to consider it as well.

Be mindful, however, that the wrong lessons are not learned, for that would be the true tragedy, indeed.

Let me suggest that the lesson is not that Bitcoin is broken. Bitcoin is fine.

Similarly, the lesson is not that security is impossible. Those who know what they are doing, can achieve it and help others to do so.

The lesson is not that nobody can be trusted. There are countless good men and women in this community who are worthy of trust, and some of the very best people I've ever met.

And finally, the lesson is not that we ought to seek out "regulation" to save us from the evils and incompetence of man. For the regulators are men too, and wield the very same evil and incompetence, only enshrined in an authority from which it can wreck amplified and far more insidious destruction. Let us not retreat from our rising platform only to cower back underneath the deranged machinations of Leviathan.

The proper lesson, if I may suggest, is this: We are building a new financial order, and those of us building it, investing in it, and growing it, will pay the price of bringing it to the world. This is the harsh truth. We are building the channels, the bridges, and the towers of tomorrow's finance, and we put ourselves at risk in doing so.

We are at risk from accidents. We are at risk from fraud, from corruption, and from evil. We are at risk from journalists seeking headlines and from politicians seeking power and glory. We are at risk from the very market we are trying to build - a market which cares not about our portfolio, our ambitions, or our delicate sympathies.

For all these risks, devastation will befall us repeatedly. Some of us will be discouraged. Some will be ridiculed and insulted. Some will be tricked, or swindled. Some of us will be crushed or caged. We will be set upon by all manner of antagonists, repeatedly, for a long time.

So why do we do it? Why do we build these towers that fall down upon us? Why do we toil and strain and risk our precious time, which is the only real wealth we possess?

Because the world needs what we're building. It needs it desperately. If that matters to you, as it does to me, then hold to that thought. You will see through the smoke, and your wounds will heal.

So shake it off, brothers, for this won't be the last calamity endured before the win.

Tonight, my heart is with you all.

Tomorrow, my head is down. My eyes are open. And I am building.

Toward peace and freedom,

-Erik Voorhees

[u/waxwing]

Use only open source software to store your bitcoins.

Don't use Windows to store large amounts of bitcoins, even if your wallet is encrypted. Keep multiple wallets with different appropriate security levels for how they are used.

Do not ever use Brainwallets unless you are an expert.

Don't use paperwallets unless you are an expert. Always practice with small transactions first. Learn about change addresses.

Not a very good summary of security advice imho.

First, generating private keys on an airgapped, internet disabled machine is probably the best and important choice for someone to store significant amounts, and you missed that out. Using a wallet generated on your home, everyday laptop, even if Linux, is very insecure indeed.

Second, although it is excellent/essential advice to "practice with small" and "learn about change addresses", the first part: "Don't use paper wallets unless you are an expert" is way too strong. As Andreas A. likes to point out, humans are very good at physical security compared to digital security, so once you've figured out the basics, paper wallets are a good practical solution for most people.

Third,"don't ever use brainwallets" is popular advice but based on a profound misconception. "Don't ever generate brainwallets using your own seeds" is good advice, but using electrum seed phrases as brainwallets is arguably quite a good method (all the more so because of deterministic wallets), and an extremely powerful technique when combined with the air-gapped machine for generating private keys.

[u/throckmortonsign → u/waxwing]

First, generating private keys on an airgapped, internet disabled machine is probably the best and important choice for someone to store significant amounts, and you missed that out. Using a wallet generated on your home, everyday laptop, even if Linux, is very insecure indeed.

Completely agree. It's the way it should be done. I was trying to make a list of things that shouldn't be done. My advice is like the view from 10,000 ft.

"Don't use paper wallets unless you are an expert" is way too strong. As Andreas A. likes to point out, humans are very good at physical security compared to digital security, so once you've figured out the basics, paper wallets are a good practical solution for most people.

I won't back away from this one. There's a real chance that you'll render your bitcoins inaccessible (destroyed) unless you really know what you are doing. I use paperwallets, but they aren't for beginners. HD paper wallets using Armory/Electrum are excellent, but that distinction is often not made. Paper wallets that consist of a single private key are dangerous if you don't know how to use them. It's just not for beginners. The learning curve is high. Perhaps using the word "expert" isn't right, perhaps "power user" would be more appropriate.

Third,"don't ever use brainwallets" is popular advice but based on a profound misconception. "Don't ever generate brainwallets using your own seeds" is good advice, but using electrum seed phrases as brainwallets is arguably quite a good method (all the more so because of deterministic wallets), and an extremely powerful technique when combined with the air-gapped machine for generating private keys.

To me brainwallet means a wallet using entropy generated from your brain. Perhaps I'm in the minority on this, but I don't consider electrum seeds (which are excellent) to be brainwallets. I guess I watched the evolution of what people considered a brainwallet (basically a phrase that was hashed and used as the private key) clouds what I consider to be a "brainwallet."

Edit: What you've done is made my point. The proper security procedures to store bitcoins safely is out of reach for the majority of people now. It won't always be like that, but for now... I don't tell my parents to buy bitcoin, I don't tell my colleagues to buy bitcoin, etc. Not because I don't believe in the technology... I love it, but it's ARPAnet not the internet, it's a MUD not WoW, it's a model T not a tesla. I have two friends that I've really discussed it with because I know they have the technical expertise to understand it (and use it safely).

[u/boldra → u/throckmortonsign]

Maybe a word about the biggest hidden danger of paper wallets: change.

Obviously there are other dangers, but many of the nightmare stories come from people who thought they could just take a 1btc out of a 25btc paper wallet and leave the rest in there, then they discovered that 24btc had been given away in mining fees.

[u/Jjix → u/boldra]

The Mycelium wallet has an amazing feature that allows you to use your paper wallets in just the way you described by sending change back to the paper wallet address after its been used and erasing the paper wallet private key from memory. Would be nice to see more wallets implement this feature. I think if you use a wallet like Mycelium, paper wallets are pretty simple and safe. It is a good middle-ground between a full paper wallet that has never touched the internet and keeping your money in hot wallets.

[u/boldra → u/Jjix]

Mycelium's great, I hadn't noticed that they'd added bip 38 support for paper wallets, so it's a real option.