Hacker News new | ask | show | jobs
by jamesmehaffey 2009 days ago
I have always been advised that it is prudent not to use any browser-based wallet generators, especially while you are online. There are quite a few app-based wallets that will allow you to generate an address before wiping it from your phone. That is a well spotted security issue though.
2 comments

Browser-based paperwallet generators are not necessarily a bad thing. App-based is not necessarily a good thing (apps can leak data too). Best approach would be: disconnect LAN -> boot you computer from a live-CD -> don't connect the computer to the internet -> get the browser or app based generator via usb-stick -> generate the paper wallet and print it -> shut down the computer, don't save anything. Here you go, not even this is safe if the app generate predictable addresses (this already happend by accident). Maybe put 0,0001btc on the wallet and wait a few weeks and look if they vanish? I think at some point you have to read and inform yourself. Maybe you find someone you can trust. A 15 second internet search and a quick printout of a paperwallet is not the best way to deal with your money.
It seems like it would be much easier to check for shenanigans in a browser based walled generator than on a mobile app. In the browser I can just got F12 to determine what's up.
In addition to network access you need to audit all code downloaded and check local storage, indexdb and cookie usage and any other unknown unknowns.
That all seems rather trivial by spinning up, then deleting a disposable VM without network access.