Question about protecting Electreum wallet data file

[Gideon99]

Hello. Greetings to everyone.
On the occasion of the opening of the technical Section, I had a question that I would like to raise here for discussion

Some time ago, my laptop was hacked and the hacker was able to steal the Electreum wallet data file, and after that he was able to open the wallet. I do not know how, but he was able to open the wallet and steal the balance.

Several questions come to mind:
1 - How was the hacker able to open the wallet file even though I was using a very strong password?

2 - Are there other ways to encrypt the wallet file other than the password so that it makes things more difficult for the hacker to open the file?

3- Is it possible to access the private key in such a case? I mean, can a hacker access the private key through the wallet's data file?

4 - The last question is hypothetical: I know that there is a possibility of creating an Electreum wallet with two-factor authentication 2FA. In such a case, if I enable two-factor authentication, can a hacker access the wallet even if he manages to obtain the password?

Electrum wallet data file contain your private key, which is used to access your crypto. Very necessary for you to protect your file from unauthorized access.the way to do this is to encrypt file with a strong password. You can also keep the file on a highly protect device like hardware wallet.Most important notice Keep your software and operating system up to date to prevent malware from accessing your wallet.

[Lucius]

~snip~
I tried to find a way to buy the original software through Crypto, but I could not find it. I tried the free, open source software, but it was not as efficient as the paid software, so I was forced to download cracked software.

I use only original software, and I mostly buy licenses on the BTT forum (Digital goods), and they are mostly very affordable. I believe you are also a member there, so I suggest you look at that board, but always be careful who you trade with because there are a lot of scammers.

I think that considering the situation in your country, cryptocurrencies offer the only possible solution to use legal software.

Maybe you can find something on this page -> https://spending-bitcoin.com

[yhiaali3]

I use only original software, and I mostly buy licenses on the BTT forum (Digital goods), and they are mostly very affordable. I believe you are also a member there, so I suggest you look at that board, but always be careful who you trade with because there are a lot of scammers.

I think that considering the situation in your country, cryptocurrencies offer the only possible solution to use legal software.

Maybe you can find something on this page -> https://spending-bitcoin.com

Thanks for the advice
Of course, I am a member of the BTT forum and I once searched in the (Digital Goods) section to buy a Microsoft Office license and found a discounted license, but I was skeptical because the price is cheap and the member providing the service is Newbie.

As you mentioned, there are a lot of scammers, so I will search again, and if I find a reliable member with reasonable prices, I will buy immediately, especially a Windows and Office license.

Maybe you can find something on this page -> https://spending-bitcoin.com

I will try this site if I can find something that interests me

[Lucius]

~snip~
As you mentioned, there are a lot of scammers, so I will search again, and if I find a reliable member with reasonable prices, I will buy immediately, especially a Windows and Office license.

I think you will find licenses for these products without any problems, just avoid new accounts and check trust feedbacks. There are members who have been selling for a long time and it is certainly not in their interest to scam someone for $5.

[bitmover]

~snip~
I tried to find a way to buy the original software through Crypto, but I could not find it. I tried the free, open source software, but it was not as efficient as the paid software, so I was forced to download cracked software.

I use only original software, and I mostly buy licenses on the BTT forum (Digital goods), and they are mostly very affordable. I believe you are also a member there, so I suggest you look at that board, but always be careful who you trade with because there are a lot of scammers.

I think that considering the situation in your country, cryptocurrencies offer the only possible solution to use legal software.

Maybe you can find something on this page -> https://spending-bitcoin.com

Have you tried bitrefil?

You can buy some amazon gift cards there and use legal software
https://www.bitrefill.com/

[Husna QA]

-snip-
2 - Are there other ways to encrypt the wallet file other than the password so that it makes things more difficult for the hacker to open the file?
-snip-

Electrum wallet data file contain your private key, which is used to access your crypto. Very necessary for you to protect your file from unauthorized access.the way to do this is to encrypt file with a strong password. You can also keep the file on a highly protect device like hardware wallet.Most important notice Keep your software and operating system up to date to prevent malware from accessing your wallet.

The Electrum wallet can be stored in a non-default Electrum folder directory, for example, on a separate hard drive, which is only used when making transactions.
Another alternative is that if the goal is only to back up the wallet, the wallet file can also be encrypted using PGP.

Electrum itself has two separate levels of encryption:
https://electrum.readthedocs.io/en/latest/faq.html#how-is-the-wallet-encrypted

~snip~
I tried to find a way to buy the original software through Crypto, but I could not find it. I tried the free, open source software, but it was not as efficient as the paid software, so I was forced to download cracked software.

I use only original software, and I mostly buy licenses on the BTT forum (Digital goods), and they are mostly very affordable. I believe you are also a member there, so I suggest you look at that board, but always be careful who you trade with because there are a lot of scammers.

I think that considering the situation in your country, cryptocurrencies offer the only possible solution to use legal software.

Maybe you can find something on this page -> https://spending-bitcoin.com

Have you tried bitrefil?

You can buy some amazon gift cards there and use legal software
https://www.bitrefill.com/

In my opinion, further discussion about this could make the discussion go off-topic.

[yhiaali3]

The Electrum wallet can be stored in a non-default Electrum folder directory, for example, on a separate hard drive, which is only used when making transactions.
Another alternative is that if the goal is only to back up the wallet, the wallet file can also be encrypted using PGP.

Thank you, I liked this method.
I created a new wallet and saved the file on an external flash drive, so I can use it only when I want to open the wallet.
Also, in order to increase security, I extended the seed by adding a custom word to the seed:



In this case, even if the hacker is able to obtain the private key, he will not be able to open the wallet without this custom word.

[Z-tight]

In this case, even if the hacker is able to obtain the private key, he will not be able to open the wallet without this custom word.

Adding a passphrase is a very good layer of security, and you are right that even if the wallet gets compromised, the attacker would only be able to steal from the base wallet, as long as they do not know what the passphrase is. It can also be used for plausible deniability, in cases of a $5 wrench attack.

[joniboini]

Make sure you store your seeds and extended words in a secure place. I've seen some posts from people who lost access to their wallets because they forgot to store the extended words, seeds, or both. Sometimes they use a complicated backup method that they eventually forget because it is a one-time use and they never try to recall it again, so I'd suggest using something that is easy to access but not that obvious anyone can know it is your backup.

[bitmover]

In this case, even if the hacker is able to obtain the private key, he will not be able to open the wallet without this custom word.

Adding a passphrase is a very good layer of security, and you are right that even if the wallet gets compromised, the attacker would only be able to steal from the base wallet, as long as they do not know what the passphrase is. It can also be used for plausible deniability, in cases of a $5 wrench attack.

Plausible deniability only works if you have a lower amount wallet without the passphrase. So you can give your secondary wallet (without the passprahse) to the attacker... Then, you can save your main wallet funds that are secured under the passphrase

[NotATether]

Adding a passphrase is a very good layer of security, and you are right that even if the wallet gets compromised, the attacker would only be able to steal from the base wallet, as long as they do not know what the passphrase is. It can also be used for plausible deniability, in cases of a $5 wrench attack.

Plausible deniability only works if you have a lower amount wallet without the passphrase. So you can give your secondary wallet (without the passprahse) to the attacker... Then, you can save your main wallet funds that are secured under the passphrase

I would argue that none of this works at all if your computer is hacked. In that case, all of your wallets will be broken into, unless they are hardware wallets.

[examplens]

I would argue that none of this works at all if your computer is hacked. In that case, all of your wallets will be broken into, unless they are hardware wallets.

When this happened to me, the first thing I did was buy a new SSD and start from scratch. Changing passwords, wallets, etc...

[bitmover]

Adding a passphrase is a very good layer of security, and you are right that even if the wallet gets compromised, the attacker would only be able to steal from the base wallet, as long as they do not know what the passphrase is. It can also be used for plausible deniability, in cases of a $5 wrench attack.

Plausible deniability only works if you have a lower amount wallet without the passphrase. So you can give your secondary wallet (without the passprahse) to the attacker... Then, you can save your main wallet funds that are secured under the passphrase

I would argue that none of this works at all if your computer is hacked. In that case, all of your wallets will be broken into, unless they are hardware wallets.

Yeah  but if someone gets into your house and say " I will smash your head unless you give me your bitcoin"  a secondary wallet will work. A hardware wallet with a single wallet won't.

[Husna QA]

-snip-

-snip-
In this case, even if the hacker is able to obtain the private key, he will not be able to open the wallet without this custom word.

Maybe you mean the seed phrase.
Because even if the hacker doesn't get the custom word but manages to get the private key, then he will still have access to transact Bitcoin at the address associated with the private key.

There are many ways to secure the seed phrase. At least pay attention to the basic warnings listed on Electrum when generating the seed phrase.

[yhiaali3]

Maybe you mean the seed phrase.
Because even if the hacker doesn't get the custom word but manages to get the private key, then he will still have access to transact Bitcoin at the address associated with the private key.

There are many ways to secure the seed phrase. At least pay attention to the basic warnings listed on Electrum when generating the seed phrase.

Sorry, yes of course I mean the seed phrase, because as you mentioned if hacker gets the private key he won't need anything else to access the wallet.

I would argue that none of this works at all if your computer is hacked. In that case, all of your wallets will be broken into, unless they are hardware wallets.

Why if the wallet file is stored on an external SSD or flash drive? I mean, if the wallet file is stored on a medium that is not connected to the computer, how will the hacker be able to access it even if he hacks the computer?