Cyber Security & Bitcoin - Unpopular opinion and some suggestions

basic IT hygiene is enough to keep the malware, viruses and therefore, the cyber criminals away

Jan 07, 2025

The FUD injection

Many cyber security advisors and CEOs of companies that offer security products will tell you that the battle is lost, that, for example, if you don't buy an air gap device your private keys are not secure.... That, if you used your computer instead to write the seed words in a piece of paper and then put them in a piece of metal, you will be hacked and most probably you are doomed....

IMO and experience, it is an exaggeration...

If all the fear mongering being pedaled by the cyber security enthusiasts and experts was true, oh well, with very few exceptions, we all will be drained of our funds in banks (most neither have a decent 2FA nor a strong password policy - still working with SMS for crying out-loud...), self custody wallets, your CEX accounts, etc... Even the Bitcoin blockchain encryption will be broken by "quantum computers"... oh and AI will be used by hackers to hack you as well... Just ignore the noise...

The unpopular opinion

IMO, basic IT hygiene is enough to keep the malware, viruses and therefore, the cyber criminals away.

And the tools they tell you that are not enough and therefore, you are powerless, actually are quite helpful, keep using them, firewalls and VPNs, TOR (not with your bank accounts, yes with your decentralized finance for added privacy and security), etc.

Remember, if the service is free and is not FOSS (free and open source) software), in 99% of the cases you are the product and your metadata is being shared and used and therefore it is not a good practice to use those tools since your network operational security is compromised.

Suggestions

Do your homework, acquiring cyber security skills needs reading, get on it, few tips:

Learn how to verify a software security key as the SHA256 before running it in your laptop or mobile if an apk. If on Microsoft, if the software you want to install does not have a .msi version (already signed by Microsoft), the .exe extension file needs to be verified, learn how, this is paramount, no matter the application, same with Linux. If the app does not offer a security key to verify it, do not install it, contact the developer and demand it, if no dice, forget it, look for an alternative.
Use a VPN on your home router, yes, even if you acquire cyber security knowledge and apply it to your mobile and laptop, if you do not live alone, every other member of your family is a weak link that can affect you. Acquire a router that supports a VPN that does not require to know your identity to pay for the service and accepts anonymous way of payment (otherwise do not use it, no matter how good you think it is, if free avoid, you are the product and therefore, you are better without one that with one free). As an additional measure, keep your laptop, PC and mobile with another VPN, a different service, you will be with a double VPN while at home and with one while in the road. In the past the throughput will be considerably reduced to a point of being too slow, nowadays, you will be fine.
Use a router with a decent firewall and advertising guard like features, Adguard or Pi-Hole (learn to configure and to add community supported lists) , that will keep your home browsing experience safer and faster.
If you do banking and Bitcoin with your mobile phone, consider having two mobiles, one left at home secured. Carry with you a mobile for your social needs and small payments in fiat or Bitcoin, if you loose your phone or you get robbed, you will sleep better.
If you insist on using debit cards instead of credit cards do it right, keep the funds in the account linked to the debit card limited to your needs when you go out. A bit of a pain but do not use your savings account, if you lose the wallet you are screwed if used before you block it and there is no recourse with a debit card.... (or use credit cards and you have the option to recover the funds in case is needed)
If you have stacked a considerable amount in Bitcoin and want to be sufficiently safe, consider an air gap seed signer (known as a hardware wallet)), if you do not trust yourself, consider a service with no KYC, contrary to what most believe, there are some; CASA is one of them; probably there are others, do your homework. You keep one or two private keys and the company keeps another one, to remove the funds you need 2 of 3 and it has built in time locks you can set up plus recovery options and additional features convenient in emergency cases to protect you and your family.
Avoid Microsoft and Google and Apple clouds, those are honey pots often targeted, if they get hacked the companies most probably will neither inform the clients or if they do it would be much after the incident, use other private services highly encrypted end to end, preferably FOSS, and do not upload your data unencrypted, yes, encrypt it before uploading if it is valuable information, it is a backup of data and you want it safe, if it is not in your hands, best to encrypt it, even if the company claim it is E2E encrypted, you can't be sure, lawsuits of most known tech companies have shown us that they lie constantly, do your own research...

Final thoughts

Each person is different, you need to sleep good at night knowing your cyber security is sufficient and therefore your data and funds are safe. Do the homework, read, study, acquire the skills and tools and use them properly, cyber security is not convenient, but in the age of information, it is a must to protect your family and your wealth.

You liked the article? Make my day brighter!

Like, subscribe and share!

Last but not least, the following link is an unstoppable domain, it will open a page in which you can perform an anonymous contribution to support my work:

https://rodswallet.unstoppable/
- The link didn’t open?
  - To open the link you need to use a best in class browser that supports web3, two are recommended: Brave Browser and Opera Browser
Are you a member of the decentralized social network #Nostr ecosystem? If so, consider zapping me anonymously using an eCash or LN wallet supporting BOLT11:
- rod@npub.cash
If you are not part of #Nostr, consider joining a vibrant decentralized and uncensorable social network (it is like twitter or telegram), consider the app Amethyst (best in class with excellent operational security from the get go) if on Android and Damus if on iOS

Rod’s Substack