Carlo Parisi (Blackie) - OPSEC 101: Everything that you NEED to do to keep your wallet safe

Uh it's a pleasure for me to introduce our time panel. Uh we are going to talking about exactly uh everything you need to know to keep your work safe. Carlo here and Carlo is a co-arketer of mastering Ethereum. Yeah.

Second edition. So big close for I've never arrived with a less prepared speech than this time because I know this this topic very well. I've been in crypto for 12 years. So I I do know a thing or two about how to keep your blog same. Um so I'll start with introducing myself.

right now smart contract. not directly related with um the security of your secret but it's still security I've been a developer as I said earlier and I'm also a content creator so um the topic of um self custo oh closer okay perfect the topic of selfcasting is a bit complicated uh because most people either don't know about it or don't don't want to talk about it. They don't want to disclose their own um security, how they keep their seat phrase uh safe. And so it's a topic that it doesn't get discussed as much. It gets discussed when the uh the way that the seat phrase is kept is very bad.

Like I almost only errored very bad ways of keeping your seat phrase safe. So today we will see uh yeah it's here uh we will see how to keep it safe the best practices uh how to conduct self regular sheets uh how to plan for your inheritance this very shortly and practical step to protect your asset which is uh from the best practices. Um so the first thing is that asset race is not for everyone. If my mother wanted to get into crypto, I will not tell her to do uh self custody. I will tell her to go on Binance, on buy bit, on BitGet, on whatever and just keep the money there because she's more of a danger to herself than an exchange being insolvent.

So the first step is to understand that self custody is not for everyone. You don't need self custody unless you can handle self custody. So most people here probably do self custody. So do you have ledger treasor metamask? Raise your hand if you do have selfcast.

You do. Okay. Um so um the south custo actually requires a lot of due diligence which we will arrive to probably no next slides. Uh so there is two con concept in the security of the seat phrase. There is the security itself and the ease of recovery.

Um you can think of a seat phrase in two ways. There is one seat phrase that can never be recovered by anyone because the backup is lost. Nobody saved the seat phrase and that's technically the safest one like nobody can ever access it and can never access the money on a seat phrase that nobody has a backup for. So um you do have a spectrum where one seat phrase is uh not recoverable and one seat phrase is uh like you have a two of your seat phrase so everybody can see it. So you have a spectrum where everybody can hear your seat rates and nobody can see it.

You need to find your right balance in the spectrum um and you balance it by doing either security or improving the ease of recovery. So whatever you do in uh your ops system will either improve the security or the ease of recovery for your seat phrase in general. This will make much more sense when we're writing the problem. Um, so oh this is exactly what I said. Now let's see the next slide.

Okay. So this is the not like the contrary of a best practice. So this is what I see most commonly. So it's the um mechanism to keep your seat phrase safe by complexity which should be yeah the first one. So I've heard a lot of system that involves something like um putting your seed phrase into images with software that software that is not yours.

So you don't know if you will be able to recover it from the I think it's stography the the way of putting text into an image into the metadata uh or splitting your seed phrase or staving it um in a encrypted way on a piece of paper. uh complexity should not be a way to keep your seat press safe. You should not utilize uh additional complexity to keep you your seat seat safe. Uh because professional will probably be able to still get your seat trace. Uh and if even professional cannot recover it when you need it, you are you will not be able to to recover it yourself.

So complexity is not a way to actually keep your your C3 safe. Um you should do best practices which is for example uh utilize a ledger instead of util utilizing a a multisc if you're not technical. Um you should not create your own code for u create the entropy of your uh seed phrase. You should utilize things that already exist. And in this way you are trusting software that is written by some someone else.

But if you're not extremely technical the best practices to actually trust someone else uh because enough money has been protected by for example ledger treasure or other wallets. So the first step will be to absolutely avoid complexity at all costs. The simpler the system the better it is. Uh the second rule is something that uh is not really followed. Uh I could here tell you almost everything in my system to keep my seed phrase safe and that should not um lower the security of my seat.

So offusation should not be a best practice to um actually prevent someone from stealing your seat phrase. Uh one secret for example is the seat phrase itself. So there is something that is a secret but the old system in general should not be a secret. I could be here and tell you almost everything in my system and should not be a problem. So if you have a system in which uh telling uh most of how you keep your secret safe is a problem then you should change it.

Um it's offiscation should not be a best practice. Uh as I said ear do not sp your seed phrase. Um, most people when they have a 21 probably. Yeah. Okay, I need to come closer.

Um, most people when they have a 24word uh seat phrase, they um they think if I split it in 12 word and 12 word, the security is al which is completely wrong. like the security from 24 words and 12 is not half. like getting um the the seat phrase with 12 words is much much much easier, exponentially easier than getting the 24 words. Which means that if you have a 12word seat phrase and you split it into two, so six words and six words, then the if somebody ever finds six of the words, they can actually brute force the other six. So if you are splitting a seat phrase, you're not uh splitting the security, you are reducing it it like a lot.

So you should never uh split your seat phrase and think that that's a viable solution. Uh also because for your own sake you need to recover also the other part. So it makes it harder for you. As I said earlier there is two phase of the coin for uh security. there is the security itself and there there is the easy easy ease of recovery.

So when you actually uh have a seat phrase you should worry about other people uh either um getting robbed by other people or someone else trying your finding your your seat phrase or you yourself not being able to find it. So you are very much a threat for your seat phrase as are other people. So you should be careful of what you do because most people they just lose the citrus. Nobody comes, nobody steals their money. It's just them that they have a bad system and they lose it.

So you should never split it because this makes it harder for you to actually find it and easier for that for other people to find it. So you take the worst of both both ways. And again, avoid multisig unless you're technical. Um this is kind of self explanatory. For example, in Ethereum, they are not native.

We don't do not have native uh multisig. So the problem is that number one, you're again trusting the code of someone else, which if you're doing it for example with safe, it's kind of okay because it's more tested, but there is other multisig that might not be audited or safe. Um and in general, it's a bit harder to use. uh there might not be complete compat compatibility uh with everything. So it's better to not use the the multisig unless you you know how to use it.

Um so to go against the not best practice you should keep it simple. So you should uh as a base for system you should have something like an hardware wallet. Um so you can have other devices there. There are other devices similar to other wallets, but in general for compatibility and everything, I would suggest another wallet. Um, the brand doesn't really matter.

I mean, they all have risks. Uh, ledger as risk, treasurous risk, but just go with some of the most famous one, which are the two that I just mentioned, and you should be fine. Um, just be careful when you buy another wallet that they have the compatibility with what you want. Uh, they have B be B be B be B be B B B B B B B B B B B B B 44, B 39, so all the Bitcoin improvement proposal that you actually need for the chain that you want to use. Um after that, you need a backup.

So you need uh at least a piece of paper where you save your seed phrase. Um usually a piece of paper is not great because on the piece of paper you have to write it with a pen which in like 10 years it could uh go away. So you could not have your seat anymore in your backup. So usually you will use something like let's see if I have a picture. No this is okay.

There is something like the keep metal from treasor also ledger has other one but there is a lot of uh different um way of setting saving your seed phrase on on metal instead of paper which is the preferred form. So you should have another wallet, a backup, possibly more than one uh in possibly metal form. So you you engrave your secrets instead of writing it with pen. Um other than this, you will need a temper proof bag like this one. So you put your metal chip inside of here so you know if someone has ever opened that and has had access to your seat phrase.

Um and Other than this, you basically need to um move your backup away from your other wallet. So this will be the simple system. You have another wallet, a temper proof bag, a keep metal and two geographical location where in one you have the other wallet, one you have the the keep metal in the temp bag. So this this is the simplest system and then you have to adapt adapt it to yourself. For example, I've been traveling for the past three years.

Uh so my system has had to adapt to me because I'm not in the same geographical location uh at all times. Uh so that made it a bit harder to actually keep the ledger and the treasure and the other wallets completely safe. Um especially if I need if for example a ledger broke and I needed to recover it. Um so the the system the simplest system is the one that I illustrated and then you have to adapt it to yourself to your lifestyle to your needs. Um some system might require you uh to pay I don't know like 500 600 a year.

So maybe you don't want to pay the money to to have it. So uh there is different tradeoff but you should keep it simple and not diverse too much from from what I told you right now. Uh again you should back up your scene that should be on um not possibly not on paper. So something that can withstand um natural disaster. So if there is a flood, if there is fire, if there is um something uh your your the metal is much better than paper to actually uh save your seed.

They should be in different um locations and again in a in a temperroof bag. uh you should also consider a passphrase um which is something that you can uh save also online. So normally uh the base advice for seed phrases is that you should never save it online. Um which is true like never save your seat phrase in a digital forum. If you ever done that, change it completely.

Create another one and send all the the the tokens there because the only thing that uh the outdoor wallet does for you for your seat phrase um is that it actually keeps your seat offline. So uh if you ever put your seat online, you should change it completely. It it makes no sense to have the ledger anymore. Um so for the seat phrase, you can actually Do you know what the seat phrase is? Is like everybody knows what the seat phrase is?

Okay. Uh so don't know it. So the when you actually um create um a wallet with the seed race, the seed phrase can be considered as the master key. So to derive all of your um private key from bit 4 to4 what you do with your seat brace is you take your seat brace. So 12 or 24 words and you utilize a ash function 2,000 times and with your seed phrase you utilize the word pneummonic.

So essentially uh what what happens is that your seed phrase is utilizing a function with the word pneummonic. The 25th word is essentially removing the word pneummonic from this process and they are something that you p personally decided. So uh if you want to have your 20 25th word as valanti uh you can have it. So you can decide that instead of minimum your security now it's connected to the word balandi instead of as it is standardly. So the seed phrase is essentially a personal word that gets inserted in in as a 20 50 word or passphrase uh and it changes the security.

You can have multiple passphrase on the same other wallet. Uh but you need to remember it. The point is that the the 25th word the passphrase alone doesn't do anything. So if you only have the passphrase is like having the password for a computer without having the computer. So it doesn't matter if you save it online, you can save it for example in bit warden in like you can have it online also because um if you have a puzzle phrase um uh so you have a 25th word for your seed.

So let's say that on your keep metal on your backup you have 24 words. So to recover your other wallet you have 24 words. If somebody ever got your 24 words, they could brute force your 25th. So when they take your 24 words, you're not safe anymore. So even if you have a passphrase, you should move your funds as soon as possible because the passphrase is brute forceable.

Uh the maximum amount of um character I think is 100. So they can just brute force your uh 25th word. So it it is an extra security step because when um for example in ledger itself you can have multiple pin. So when you actually have a passphrase for example if somebody enters your own they know that you have crypto you could enter a pin for the wallet without a passphrase uh where you have a little bit of funds so you send that to them instead of utilizing your main wallet. Uh so there there is um utility in having a pass rates.

Uh but it is very much brute forceable. So uh if somebody never got your 24 words, you should change uh the seed as soon as possible. Um as I said earlier, but I will repeat it because this is the thing that people don't understand it the most. Well, they understand it when I say it, but then they say, "Oh, the system is too slow to put in place. I don't want to test everything.

I don't want to buy new uh like endproof bag or the metal keep uh because the system is not that cheap like imagine that you have three other wallets because you want to um um you you have the three other wallets because you want to decentralize the risk. Uh maybe you don't trust that ledger as a great uh entropy algorithm. So you you decentralize you use three different other wallets. You should do this increments. So you should have uh multiple geographical locations.

Um so possibly at least four. So one for one backup, one for backup two, one for backup three and one for your other wallets which are safe. And in this case you can use banks actually like banks have the vault. Uh banks are not safe to keep your money because they might not give it back but they are very safe when it comes to vault. Like if you actually go and you get the what do you call this?

Yeah, exactly. The safety deposit box. Um uh if you have that, it's actually very safe. So, you can keep the 24word in a tempered proof bag with the 25th uh passphrase because um as I said earlier, if you have a passphrase and somebody gets your 24word, you need to change them as soon as possible. But if somebody robs a bank, that's a very big news.

So, you you're going to know and you got to know that you actually have to update your wallets. So you can actually use as geographically separated locations you can use banks uh which is what I personally use for example um as I said earlier you should have something that can resist natural events. So if fire is a threat to your old security system maybe the security system is not great because fires do happen. If uh building getting flooded is a threat to your whole security system is not a great security system because floods do happen. So you should reduce the risk that something like a natural events can really put your backup in danger.

Uh again uh secure location and temper back. And the last step is something that I've actually never heard anybody do um unless you are under some troubles which is the guy from which I talk with this um is the cell phonics. So you should try to recover your seat phrase at least once a year. So at least once a year you fake like having lost your seat phrase like you you you don't have your art other wallet anymore. you buy another one and you say okay now I will try what if I actually um my other wallet actually broke like what are the steps that I need to take so you go in your safe deposit in the in the bank uh you open your temper proof bag and you buy another one because you need to exchange it uh you open your keep metal and you actually test if you can recover your wallet uh because most people just do a bad system and keep it like this for years without ever testing it, without ever trying if they can actually recover this phrase.

And um as I said earlier, I'm a content creator in Italy and I receive a lot of requests of people saying, can you help me recover the seed phrase, which I say no because I don't want to know their seed phrase, but their their system is so bad that it will be impossible for me even if I wanted to to help them. So uh what you need to do is you need to create a seat uh on like imagine that you just for the first time that you need to do the o so you just bought and you order the wallet you create a seat you save your address you accept the wallet which has no money on it because you're still testing it so it might be not like you might have saved the seat phrase wrongfully and then you try to recover it and see if the address that you receive on the reseted uh other wallet is the same as before. And you should repeat the process at least once a year. So at least once a year, just open the temperroof bag, open the metal key, try to find your seat phrase again because it might not might be wrong. You might have saved it wrong.

You might have no access to the backup. You might something might have happened. So you should test it multiple times. See? Okay.

So then there is uh crypto inert inheritance planning uh which this book explains it much better. We don't really have a perfect system this uh it's still very hard because crypto does not really allow for simple way to do it. There is a few ways um for example if you really want uh with a multisig you could do it. Um the problem is that most of the ways of getting the inheritance on chain so without any notary or any external person requires technical ability from most of the participants which uh for example if your mother is included in this if your 2-year-old son is included in this might not be ideal. So there is for example other services like the letter to the loved ones uh that include having a letter given to a notary that will send it to people when you actually die.

Um and there could be the seed phrase but there is a risk because you're putting your seed phrase in a paper and giving it to someone. So we don't really have a perfect system for inheritance yet. Uh probably they will come because we we do have systems but they are fairly technical for now. So uh for now we don't have easy uh and available inert systems. So uh let me repeat everything before we we go to questions.

Uh you should have uh trusted uh is the simplest and easiest solution. So going with our wallet is what you most likely want to do. uh if you don't have one and you only have all wallets, please make the switch because if you are if you at least have 300 bucks, it should be enough for you to say, "Okay, I I need to start uh improving my security and I need to start to learn how to actually protect my crypto because wallets like the normal wallet of MetaMask can easily be stolen with a lot of malware that go around. So if you have hot wallets, you could lose everything very uh you should have a secure backup. So you should have something that is not paper is geographically dislocated.

Um it's in a temper proof bag. And bonus you can have uh the seat phrase that is not saved with the backup but it's saved online like on bit warden or any password manager that you want. Uh you can consider an inheritance plan. Uh because if you don't like for for me I might say it's I'm too young to think about it but it's different from money in your bank if you actually never thought about this. Uh if you die your crypto are gone.

So uh it's never too early to think about this especially because I do extreme sports. So I actually need to think about that. Uh and then you should do regular testing. So you should try to recover your seed phrase once a year. And for to some this system might seem a little bit boring because there is no cryptography behind images.

There is no I think I u met a guy that liquefied plastic into a tube and wanted to delqueify his seat. I don't even remember but it was something like this. Like I was thinking this guy is crazy. um he never tested it so he didn't know if it was possible to actually get his citrus back but he was convinced that that was the safest way to give his citrus. So this might seem boring compared to that because you don't do anything like that but this is the best practice the best way in general to keep your seat race.

Then again you need to consider your own uh necessities um your own funds like uh for example when I started um being a content creator in Italy I my operational security obsite changed so uh for example I cannot most of my funds right now are behind um uh seat rate that I I need multiple signature to reach and at least three business days uh because it's kind of the bank and I cannot access it alone. So if someone ever comes to my home and points again at me, I cannot give them this like don't in any way. So this is because I decided to become a public figure. So I thought okay crypto might get bigger and if it does get bigger they know that they will know that I have crypto and uh since they don't know how much they might try to arm me to get my crypto. So this is something this is a system that uh fits my need of uh well my my want of becoming a content creator.

So you should change your offset when your own situation in real life change. Uh but this is the base system like you should not change anything from this or if you need to change something you should not change much. Uh this is a bit optional but you should think about it. The rest should actually stay like this and then fit your own needs. And now we have a question.

Uh does anybody that total beg?

So for a a total be is it okay no I can't hear myself. Um from a total beginner uh first thing will be again do not trust yourself. So if you have funds for example on a centralized exchange as like as a start as you're learning keep them there like bring like 2% of it to start testing and see if you actually uh get the gist of it because being on chain is not that easy. uh like yesterday before I took a boat to come here uh there was a friend of mine that told me I sent XRP without the memo and now I lost it. So even when you don't lose your seed phrase you might send your like your your funds to a wrong address.

So the first thing will be uh don't move everything on chain first. Secondly will be uh the side of wallet which probably Robbie is the easiest for a VM chain uh for beginners.

Rabbit uh R A B Y

uh yeah with two like rabbits but with a Y instead of um is the easiest one. Um there is also metamas which should be considered safer. The problem is that it really sucks. Like it it has a lot of bugs and it not like with Rabbi you have a lot of alerts which are great if you're a beginner like they make you think like sometimes you cannot execute a transaction unless you say that you know what you're doing like the if you interact with a new wallet uh if you're sending them money and you never send money to this wallet they will ask you to waste this. So you you actually need to take time to read everything and see if you actually want to whitelist it while MetaMask will just allow you to send money to the new address.

Um so yeah I will say Ravi has a wallet which has compatibility with um Ledger Treasure is a bit bad. So if you if you're using EDM I I don't know like I prefer Ledger. I've heard different feedbacks. I don't love to do for example DeFi on the treasure. Um but it that's just an opinion.

So I if I do download Rabi on an EBM wallet, I will go with Ledger. Um the essentially the trade-off between the two is that one is more famous, has more money on it, so we assume that it's safer. The other one is open source, so it's easier to attack. So the we we don't know which one is safer. We assume that both are safe enough uh but we cannot know for sure like you never know for sure that something is 100% safe.

So I will say rabi ledger and don't put don't put money that you cannot lose in a d mistake on it the first few weeks the first few transactions. So last question. Okay, someone else question. big. So, uh like the system would include to buy like you should buy at least other wallet like a keep metal from le from treasure or something similar and a temper proof bag.

So, it's like 20 bucks under 20 bucks and 60 around 200. So if you have double like if you have like 400 bucks you should start to think about because it's something that you don't pick up very easily like you need to learn it. So, uh, if you have at least $400. Thank you.