I am afraid of keyloggers or other malware on my computer.
What is a secure way to copy and paste the Seed from my password manager into the desktop wallet?
Add a comment
|
3 Answers
Depending on how thorough the malware is, following could work:
- don't save the last/first/middle part of your seed in your pw (=password) manager, memorize it and just manually put it in
- save the encrypted seed in your pw manager and recode the lightwallet so that it decrypts the seed
!!! Although the above solutions could work, "well programmed" malware would be able to still get your seed
Of course: the only valid answer to a question like this is one, that works for the most thorough and best of all malwares out there.
And to be honest, there is no solution to your problem.
Just try to not get malware on your PC.
If you think that you already have malware on your PC, backup your all of your important data and reinstall your operating system.
If you can't do that for some reason: Create a bootable USB-Stick (or other medium) and only use your seed on there.
In the (hopefully near) future you won't have to worry about things like this because hardware wallets like Trezor or Ledger will be compatible with IOTA. For more information check out this post.
Use Keepass, and activate two channel obfuscation, then change "Override the defaut sequence" to {PASSWORD} only. Then use CRTL + V to use the auto-type function of Keepass.
This will make it harder for Keyloggers to guess where which characters was pasted.
A hardware wallet that signs transactions offline would be even better, I'm sure it will come sooner or later.
Add a specific number of extra characters into your seed, a specific number of places from the end while it's on the manager. Then after pasting into the wallet, move the cursor over the specific number of characters from the same end, then delete the number of extra characters. When the proper checksum appears, you're golden.
-
2
-
No it wouldn't. Any decent password manager would generate a random 81 character seed, bypassing the the keyboard buffer. A keystroke logger wouldn't be able to determine 'where' within the seed you started your extra character insertion as explained below.– tilCommented Nov 30, 2017 at 10:07
-
A keystroke logger would also not be able to ascertain where within your seed you started the delete process -- because it is extremely difficult to determine where on the screen the wallet's input screen is located, and where within that sub-window the mouse cursor is positioned; thus at which character position the cursor is located, unless the malware is running within either the manager or wallet program.– tilCommented Nov 30, 2017 at 10:08
-
If the malware is that sophisticated, you're being attacked by a State entity, and THEY could use your cell phone camera or some kind of Stuxnet type worm, which would probably only be used by THEM if the prize were several billions in value.– tilCommented Nov 30, 2017 at 10:08
-
For most users my method would work fine, show me where I'm wrong.– tilCommented Nov 30, 2017 at 10:10