@sid_nirvana_fi
@sid_nirvana_fi

I left a little gift for you. Do not open til Christmas 40,000,027 AD. -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNjcnlwdCAxZkFiRzhPU24vU0pnQy8x YWlBY1R3IDE4CnN6UFFTcVg0VTF4K0xDZTlpYVNZUnJQQmpQZWxySUNQMkdlYXhu Z2MyNHcKLS0tIDBvTjQwbFE4bTgydTVwV1VZUWg5dG5OQXVNWTVHdFE4RzZrR2xT eUt4aHcKLevHi4k80grNqdAU103UrMNX5h++THwl+ReCwzOfDHMwj4AuCW2R5qGz xpNdWWX1eodU309FXoNCgw== -----END AGE ENCRYPTED FILE----- This is what "paper keys" should look like. And this is how you can store them. The zen of key management is: there is no "key" to steal or to lose. Just encrypt, and exhale. Otherwise: If you try to lock down a plaintext key, you're in a double bind: 1. If the only copy of your key is in the fire-proof safe that got washed away in a flood, game over. 2. If the key gets stolen, game over. What a constant-anxiety cocktail. But if the key is encrypted? Well, it's pretty hard for me to lose it now that I put it on Twitter. And those would-be key thieves can have at it all they want. Whenever I need to use this key, I'll just type in the password, and be back to slinging my stack of CryptoKitties NFTs. Oh - did I just give away the surprise? But where is the "actual" key? No where. Not in a safe. Not in a password manager. Not etched in platinum. There is nothing to leak, and nothing to misplace. -- If you got yourself a Ledger "hardware wallet", you'll see they ship it with a little piece of paper that has the plaintext key written on it. (Just typing that last sentence makes me want to pull my hair out) Now, my brother, what do you do with this paper? Hide it? If the Ledger bricks (which I've seen happen) and the paper gets lost/stolen (which everyone has seen happen), you're done for. The fragility of that method is nerve wracking to the extreme. Here is how to reduce your key management anxiety dramatically: 1. Create an encryption key. This is your Master Key, and new best friend. 2. Encrypt that encryption key with a strong password. 3. Shred all remnants of the plaintext Master Key. 4. Now use your encrypted Master Key to encrypt all your "wallet private keys". It's easy: type in the password to decrypt the Master Key, and use that to encrypt all your "private keys." 5. Shred all remnants of your plaintext private keys. 6. Whenever you need to use your private key to sign something, reverse the process: decrypt the Master Key to decrypt the private key, and sign the thing. Diversify and make redundant to taste. Store copies of your encrypted private keys. Store copies of your encrypted Master Key. However much or little you want. As long as you have a good password, it doesn't really matter if it leaks. In one line: The key to storing keys is encrypt them with an encrypted key.

x.com
by mishaderidder.eth12645 🥝 • 2mo • firefly.social
Recommended by 1 curator
avatar
but where to store your password 😅 to encrypt the master key lol … but interesting, fyi this is done with age file encryption https://github.com/FiloSottile/age
avatar
Age encryption seems to have become a new standard. The master key should be -- or protected by -- a hardware/software key combination, so eg a password + fido stick. (At least two sticks, they seem to "age" too.)


avatar
But so why is this better than just keeping a secret seed phrase? Also wouldn't the master key password at least have to be 6 words from a Diceware word list? Have you tried this?
avatar
I haven’t tried (yet), but the benefit could be you only have one password (which obviously has to be very secure and preferably only in your mind) which protects all of the seeds you might have. And more importantly you can subsequently store all your seeds on plain paper in encrypted form just anywhere, also the master key doesn’t matter. Even post them on X :). But smart way to go is to combine the master key with a yubikey, that is possible. So you can use the yubikey for normal use and the master key as a backup. If you forget or lose the master key or password, you have the yubikey and the other way around.
avatar
For a while I used Nitrokeys as the primary and the password as a backup, but providers changed to passkeys or phones instead 😖 and made that problematic.

For really significant stuff, I sometimes used LUKS with key and password/pin.
Characters remaining: 10,000

comment guidelines
HomeNewSubmit