Register Login Checkout

Shopping Cart

0 item(s) RM0.00
Your shopping cart is empty!
TR Decentralization Sdn. Bhd.
Menu
  • Home
  • Products
    • CAPSULE SOLO - STAINLESS STEEL FIREPROOF YOUR 24 RECOVERY PHASES
    • TREZOR MODEL ONE
    • TREZOR MODEL T
    • LEDGER NANO X
    • LEDGER NANO S - MATTE BLACK READY STOCK
    • WHOLESALE / RESELLER
  • Supported Altcoins & Tokens
  • Payment Methods
    • FPX / eWallet / Bank Transfer
    • Credit & Debit Card Payment (Visa & Mastercard)
    • Cash On Delivery
  • Ledger 101
    • Firmware 1.4.2 Update - Step To Step
    • How Cold/Hardware Wallet can safeguard your cryptocurrency
    • Introduction of Ledger SAS (company behind Ledger Nano S)
    • Tamper Proof Seal
    • Basic Security Principle (Must Read)
    • How to configure your Ledger Nano S ? Step by step tutorial
    • What If I Lose My Ledger Wallet
    • Are My Coin Stored On My Ledger ?
    • Must My Ledger Be Connected When Receiving Coins ?
    • My Bitcoin address changes: HD Wallet
    • How Ledger Wallet improve your pin security ?
    • MyEtherWallet - Behind The Scene
  • Contact Form
  • Useful Articles
Home » Basic security principles (must read)
Google Translate

Basic security principles (must read)

The role of a hardware wallet is to protect your private keys from compromission. However, it is still necessary to observe some basic security principles in order to avoid any loss or hacks.

 

 

Security of the recovery phrase (24 words)

When initializing for the first time a hardware wallet, you will be prompted to write down 24 words on a paper. The 24 words are a human readable version of your seed (from which all your private keys are derived), and can be used to restore access to your crypto assets on another Ledger device (or a compatible one).

Anyone getting access to these 24 words would get immediate access to your assets (the PIN code is a protection related only to your device, and has nothing to do with your recovery phrase).

Therefore, it is of the upmost importance that you secure correctly these 24 words.

  • never take a picture of your recovery sheet (as it would go in the cloud and could be accessible to hackers)
  • never enter your 24 words on any computer or smartphone
  • keep your recovery sheet in a safe place, protected from light, humidity and fire

Additionally, it is critical to make sure that you have generated yourself the 24 words. Never, ever, use a preconfigured device. Never, ever, use a set of 24 words which has been given to you by a third party. The basic principle is that you must be the only one in the world to have knowledge of your 24 words.

 

 

Security steps to verify your receiving address

Your hardware wallet requires a software interface on your computer to interact with you and access the internet (so it can computer your balance, get your transactions history, etc). It is very difficult to verify the integrity of the software or your computer, and therefore you must act on the principles that what you see on your screen could be compromised.

When you need to see your receiving address (so you can be the recipient of a payment), you must take extra steps to ensure you are not victim of a man of the middle attack. An attacker could be in control of your computer screen and show you a wrong address which would make him the beneficiairy of any transaction sent to it.

You must verify the receive address by displaying it on your device.

On the bottom right of the receive window, you have a "monitor button" which will show the recipient address on your hardware wallet. You must make sure it is the same than displayed, and also make sure this is the address you will ultimately send/paste/scan on the target application/service. MEW also propose this function.

If you are using a software wallet which doesn't propose this feature, we recommend to send a small amount first, and make sure that you have properly received it (verify that your balance has been credited). This test should ideally be done on another computer. It is ok to reuse the address that you have just verified (you will see a new address on the receive windows, this is the normal way HW wallets are working).

 

 

Security steps to verify the beneficiary address

When you wish to send a payment to a third party, you will usually get the recipient address on a web page or through an email/messenger service. A trivial attack for a malware would be to replace the address by one of its own. Some malwares are simply monitoring the clipboard to replace an address you have just copied by a compromised one.

Always verify the beneficiary address on the device (this is enforced by pressing a confirmation button), but also always double check it using a second channel. For instance, request the address to be sent by SMS, or another messenging app. If you are depositing on an exchange, send first a small amount and check that it arrived properly.

 

 

Final thoughts

A hardware wallet ensures the protection of your private keys by providing you with a full isolation against the internet (the keys are never "hot", i.e. online, that's why it's often refered as "cold storage"). However, this is not a silver bullet against all possible attacks and you must always verify and double check everything as explained above.

With great powers comes great responsibilities. Being your own bank is not trivial and requires discipline. Using a hardware wallet doesn't make you invincible. Use common sense. Don't trust, verify.

 

 

Continue
Featured
More >>
TREZOR ONE
TREZOR ONE
RM380.00
Based on 0 reviews.
32% off
Capsule Solo - Give your sensitive data the security of solid steel.
Capsule Solo - Give your sensitive data the security of solid steel.
RM590.00 RM400.00
Based on 0 reviews.
Days Hour Mins Secs

22:13:54:28

TR Decentralization Sdn. Bhd.
 

Information

  • About Us
  • Terms & Conditions
  • Return & Refund Policy
  • Privacy Policy

Customer Service

  • Order Guide
  • My Account
  • Receipt Upload
  • Order History

Extras

  • Affiliate
  • Special Promotions
  • Tell A Friend

Newsletter

We Accept:

 

 

   

Powered by,                                      

                      

Copyright © 2022 TR Decentralization Sdn. Bhd.. All rights reserved.eCommerce by SiteGiant