The explosiveness and high dollar value of nonfungible tokens (NFTs) seem to either distract investors from upping their operational security to avoid exploits, or hackers are simply following the money and using very complex strategies to exploit collectors’ wallets.
At least, this was the case for me way back when after I fell for a classic message sent to me over Discord that caused me to slowly but all too quickly lose my most valuable assets.
Most of the scams on Discord occur in a very similar fashion where a hacker takes a roster of members on the server and then sends direct messages to them in hopes they will bite at the bait.
🚨 BEWARE: Several scams happening on Discord tonight. QUESTION EVERYTHING. Before clicking on links, quadruple check who it’s from and if it’s legitimate. Then check 12 more times on Twitter via trusted sources. 🚨
— Farokh (@farokh) October 27, 2021
“It happens to the best of us,” are not the words you want to hear in relation to a hack. Here are the top three things I learned from my experience on how to double-up on security, starting with minimizing the use of a hot wallet and simply ignoring DM’d links
A quick crash course in hardware wallets
After my hack, I was immediately reminded and I cannot reiterate it enough, never share your seed phrase. No one should be asking for it. I also learned that I could no longer forego security at the privilege of convenience.
Yes, hot wallets are much more seamless and quicker to trade with, but they do not have the added security of a pin and a passphrase like they do on a hardware, or cold, wallet.
Hot wallets like MetaMask and Coinbase are plugged into the internet, which makes them more vulnerable and susceptible to hacks.
Contrary to hot wallets, cold wallets are applications or devices whereby the user’s private keys are offline and do not connect to the internet. Since they operate offline, hardware wallets prevent unauthorized access, hacks and typical vulnerabilities by systems, something which are susceptible to when they are online.
4/ USE A HARDWARE WALLET
A hardware based wallet stores the keys off of your main device. Your device that could have malware, key loggers, screen capture devices, file inspectors, that could also be snooping for your keys.
I recommend a Ledger Nano Shttps://t.co/LoT5lbZc0L
— richerd.eth (マ,マ) gm NFT.NYC (@richerd) February 2, 2022
Moreso, hardware wallets allow users to set up a personal pin to unlock their hardware wallet and create a secret passphrase as a bonus layer of security. Now, a hacker not only needs to know one’s recovery phrase and pin but also a passphrase to confirm a transaction.
Pass-phrases are not as spoken about as seed phrases since most users may not use a hardware wallet or be familiar with the mysterious passphrase.
Access to a seed phrase will unlock a set of wallets that corresponds with it, but a passphrase also has the power to do the same.
How do pass-phrases work?
Passphrases are in many ways an extension of one’s seed phrase since it mixes the randomness of the given seed phrase with the personal input of the user to compute a whole different set of addresses.
Think of passphrases as an ability to unlock a whole set of hidden wallets on top of the ones already generated by the device. There is no such thing as an incorrect passphrase and an infinite amount can be created. In this way, users can go the extra mile and create decoy wallets as plausible deniability to diffuse any potential hack from targeting one main wallet.
Recovery seed/passphrase diagram. Source: Trezor
This feature is beneficial when separating one’s digital assets between accounts but terrible if forgotten. The only way for a user to access the hidden wallets repeatedly is by inputting the exact passphrase, character by character.
Similar to one’s seed phrase, a passphrase should not come in contact with any mobile or online device. Instead, it should be kept on paper and stored somewhere secure.
How to set up a passphrase on Trezor
Once a hardware wallet is installed, connected and unlocked, users who want to enable the feature can do so in two ways. If the user is in their Trezor wallet, they will press the “Advanced settings” tab, where they will find a box to check off to enable the passphrase feature.
Trezor wallet landing page. Source: Trezor
Similarly, users can enable the feature if they are in the Trezor suite, where they can also see if their firmware is up-to-date and their pin installed.
Trezor wallet landing page. Source: Trezor
There are two different Trezor models, Trezor One and Trezor Model T, both of which enable users to activate passphrases just in different ways.
The Trezor Model One only offers users the option to type in their passphrase on a web browser which isn’t the most ideal in the event the computer is infected. However, the Trezor Model T allows users the option to use the device’s touch screen pad to type out the passphrase or type it within the web browser.
Trezor Model T / Trezor wallet interface. Source: Trezor
On both models, after the passphrase is entered, it will appear on the device’s screen, awaiting confirmation.
The flip side to security
There are risks to security, although it sounds counterintuitive. What makes the passphrase so strong as a second step of authentication to the seed phrase is exactly what makes it vulnerable. If forgotten or lost, the assets are as good as gone.
Sure, these extra layers of security take time and the extra precaution and may seem a bit over the top, but my experience was a hard lesson in taking responsibility to ensure each asset was safe and secure.
Source: Cointelegraph
