2017.12.18 Minimum Password Requirements - GlenKPeterson/One-off_Examples GitHub Wiki

Many people are "investing" in crypto-currencies without adequate protections. I would encourage more people to invest, but most people lose their keys. It's not because they were hacked or trusted the wrong person (though those are real dangers). They simply lost or forgot their key.

With cryptocurrency, there is no friendly police officer to jimmy the door on your car when you lose your key. No locksmith. No FDIC insurance. No-one to sue. No recourse whatsoever. The key is the money.

To invest or bet on Cryptocurrency you need to meet a minimum requirement for personal digital security. Here's what I think that looks like. I can’t stress the importance of good password management enough.

  1. Use a password manager. If you don’t have good password practices, don’t use bitcoin or digital currency. I’m a huge fan of https://www.keepassx.org/ which runs on Linux/Mac/Windows. I sync it across machines using Dropbox, but if you don't need it on your phone (you probably don't), SpiderOak would work just as well. Some closed-source or cloud solutions are easier to use, but you can't beat the security combination of open-source code and your own system. See also: https://glenpeterson.blogspot.com/2011/01/top-10-things-password-manager-must.html

  2. Print your passwords once a year, write your master password on top, with instructions on how to find your password database. Store the paper in a tamper-evident envelope in your safe deposit box, and immediately burn last year's envelope. If you die, your next of kin can get to that.

  3. Generate random passwords. Don't make them up yourself. Don't try to remember them. That's what KeePass is for. When generating random passwords, select the options to "avoid look-alike characters" so that your next of kin can read them from your backup. I don't entirely trust such random generation, so I change at least one letter of each suggested password.

  4. Use a long enough password. 8 characters used to be enough to protect you against a rainbow table attack on a compromised database, but with the continued advances in computing power, each additional character will probably protect you for an additional decade. I'm currently using 12 characters as a minimum, but 16 is probably better, especially for younger people.

  5. Follow other basic security precautions:

    • Make good decisions about what you click on.
    • Keep your software up to date.
    • Destroy hard drives before parting with them.
    • When you sign up for anything important (like a bitcoin wallet or bank account) use a secure email account (I recommend Gmail) that does not forward to any other account. Use 2-factor authentication on that email account.
    • Use a firewall.
    • Be slow to install new software (trust the source, try out on another machine, use a virtual machine, etc.)
    • Use Anti-virus/Anti-malware if running Windows.

Additional Coin Security

  1. If you store crypto-currency on your own hardware, you have to check on it every 6 months or year because people find security holes and software becomes obsolete. If you have to transfer to another wallet, you want to know about it while there is still a path for you to upgrade and/or transfer.

  2. Splitting your coins between multiple types of storage so that if one fails, you don't lose everything.