Yi Collection: A collection of tips and tricks for the protection of encrypted assets

Nine encrypted asset security protection kits are given to Lianwen readers.

Written by: Yang Xiaohou

Recently, the hardware wallet Ledger leaked the information of 270,000 users, and then Hugh Karp, the founder of the insurance agreement Nexus Mutual, was attacked by hackers and 370,000 NXM tokens were stolen.

Security is an important aspect of our digital life. Chain Wen published ” Teach You Hand in Hand Practical Techniques of DeFi Privacy Protection ” before. As a supplement to this article, I recommend more guidelines for the safe operation of encrypted assets suitable for ordinary users to help you prevent problems before they happen.

Nine encrypted asset security protection tips for readers of Lianwen:

Tip 1: Do a good job of password management

• Use a password manager . Most people cannot remember a large number of irregular passwords. In order to avoid the use of repeated passwords, simple passwords, and regular passwords, and strengthen the password strength, it is recommended to use a password manager.

• Online password managers, in addition to the old 1Password and LastPas, Bitwarden is popular with users for its easy-to-use and simple interface. Bitwarden is open source and has various mainstream browser plug-ins.
• KeePassXC is another cross-platform password manager. Open source, three operating systems are available, and there is currently no mobile phone application. Because there is no online cloud storage and local data storage, compared with other password managers, multi-device synchronization is not very convenient. But local data can more guarantee data security.

KeepPassXC user interface

• For important accounts, do not use the browser’s built-in password manager. Although the browser’s built-in password manager is also an online password manager, it is relatively less secure than professional applications.
• According to the account security level, create different password libraries to store different types of passwords in the password manager. Remember the master password of the password vault, or keep the password vault key in a safe place.

Tip 2: Use 2FA two-step verification

Two-step authentication is the second barrier to protect accounts and assets. When it comes to funds or important accounts, you need to set up.

• Avoid using two-step verification over the phone . Phone information is particularly easy to leak or even be stolen.
• Avoid using email two-step verification . In many cases, email access rights will be lost due to attacks, theft of recovery codes, and repeated use of passwords.
• Use a two-step verification application. Both Microsoft Authenticator and Google Authenticator are available. On Android devices, Google Authenticator can be backed up between different devices.
• Use a hardware key . The hardware key device stores the authentication key of a specific online account on specific hardware. You need to connect the hardware and the device through the USB interface and confirm on the device. Since hardware is required, this will reduce the risk of remote attacks. The hardware key products currently on the market include Yubikey , Only Key and Google Titan .

Tip 3: Keep your phone number safe

• If possible, cancel the phone number verification method for all accounts, including email. ” SMS sniffing ” and ” SIM card replacement ” are common attacks against SMS verification.
• If you must use a phone number, you can choose VoIP. Internet phone attacks are more difficult. Google Voice, Twilio , Skype can choose. To ensure the security of the Internet phone login account.
• If VoIP is not available, use an alternate phone number. In addition to purchasing a new phone number, you can choose e-sim card, Google Fi or other regional mobile phone cards.
• The Internet phone number or backup phone number is not publicly available, and is only used for exchange registration, wallet or other purposes. And change regularly.

Tip 4: Ensure identity security

• Online shopping or registration on common websites to protect personal information. Do not use your own ID name or common name. Such reserved phone and email addresses are isolated from wallets or important accounts. This time Ledger leaked user information mainly related to this type of information.
• If possible, reduce the use of credit or debit cards . For most online credit card payments, you only need to fill in the correct card number and security code.

Tip 5: Summary of web browsing skills

• Use JavaScript blocking tools . Blocking JavaScript may restrict website usage, but it can prevent malicious programs. NoScript and Ublock Origin are good web blocking plugins.
• Verify that the website uses HTTPS encrypted channels . The browser plug-in HTTPS Everywhere can ensure the secure connection of web pages.
• Some websites and apps can associate multiple email addresses, check and unlink email addresses that are not frequently used. These uncommon addresses may be used for attacks.
• Avoid using unknown public WiFi. WiFi in public places is easy to disguise and easy to phishing attacks.
• Use a virtual private network (VPN) to avoid network traffic monitoring. Choose a VPN service provider to do your research. Be sure to ensure that the VPN service provider does not record user information, and search for bad records or security incidents before purchasing. Make sure to provide minimal personal information when registering for related services. Generally, registration only requires an email address. If you require a phone number or other relevant personal information, please choose carefully. Try to avoid online banking or credit card payments. Some service providers can choose cryptocurrency.

Some VPN service providers claim that they do not record user usage information, but they also need to investigate before use

• Before opening links in emails or links from unknown sources, carefully check the link addresses to prevent phishing websites.

Tip 6: Precautions for using electronic equipment

• Important trading accounts use dedicated computer/smart phone equipment . This special device is encrypted, so it’s safe to keep it and it’s not needed for other purposes. Do not install redundant software or applications. The more software installed, the more potential vulnerabilities.
• If the software on general-purpose equipment has not been used for a long time, uninstall it first and install the latest version when it is used.
• Verify software source. For example, verify the PGP signature or SHA-256 hash value of the installation file.
• Antivirus software scans unknown files. VIRUSTOTAL online anti-virus software scanning service is recommended.

Tip 7: Software and operating system security recommendations

• Ensure software updates. Software updates may contain the latest security vulnerability patches. If the software is not updated in time, the vulnerabilities may be exploited by hackers.
• Hardcore advanced users can choose a safe operating system. It is best to reduce the use of Windows for important wallets. Windows is most vulnerable to malware and hacker attacks. Tails is the first safe operating system, and Edward Snowden used this operating system back then. The Tails operating system occupies a small space and can be installed and run using USB storage devices. Built-in security components and encrypted communication protocol, and good compatibility. It is the first choice for keeping important passwords and wallets. Other similar products include Qubes OS , OpenBSD, etc. To use it, you need to master certain command line skills.

Tip 8: Security Suggestions for Wallet Use

• Keep the wallet key or mnemonic properly. Write it down on paper or use a special mnemonic tablet. Do not store in electronic devices connected to the Internet. Or use a dedicated mobile phone to take photos and store, and the mobile phone is not connected to the Internet for other purposes.
• Connect to the wallet only after confirming that the software is safe to use.
• Use a multi-signature wallet . Gnosis Safe is an online multi-signature wallet that can choose to use multi-signature transactions.
• Before confirming the transaction, verify the recipient’s information and transaction address. This is very important. Don’t take it lightly, regardless of the amount. Be sure to check. If Hugh Karp, the founder of Nexus Mutual, had sent the transaction information earlier than before, he would have avoided this major loss and could detect potential hacker attacks early.
• “Associated websites” or “associated accounts” that are no longer used or rarely used on wallets such as Metamask, should be disconnected in time. After the hardware wallet is connected to Debank, the unused associated contract can be cancelled.

Tip 9: Other skills and precautions

• Important backup files or data encryption. Commonly used encryption software PGP .
• Reserve two or more backup methods. Don’t rely on memory or wearable materials.
• The wallet mnemonic or private key backup device remains offline and not connected to the Internet. The device is locked with a password, PIN code or pattern code, and is not unlocked with biometric identification such as fingerprints.