Crypto for Adventurers. Part 1: Access

This guide is meant as a companion to your adventure in crypto. It follows the first article in the series which covered the promises and excitement of blockchain technologies in the context of its evolution over the past decade . If you’ve already delved into the space, I’m hopeful these articles will fill in some hidden gaps. My journey in crypto has not been straightforward. I’ve been in tech the last few decades and yet I found the maze of services, offerings, platforms and tokens in blockchain frankly overwhelming. I needed to build up a mental model of the entire puzzle, but I struggled to know where to start. Over time I learned about the evolution of the various blockchain generations enough to understand what they had in common and where they distinguished themselves. Yet I still had to infer within the crypto world and interpret articles from the context of that author’s perspective. 🤯 the various camps As a learn-by-tinkering kind of person, I found this incredibly daunting in the backdrop of the 2017-18 crypto craze. Over time I started to build up a mental model that, while patchy, had shape and texture. Here’s my attempt to short-circuit this mental model for you, fellow adventurer. The first thing I needed was In crypto that means owning a to send & receive cryptocurrency along with other blockchain actions. access. wallet Next was a way to crypto — either as a gift, earnings or purchasing directly using regular old fiat currency. acquire Then I had to understand the various of cryptocurrencies on offer. Bitcoin (BTC) was the currency of the Bitcoin blockchain and ether (ETH) of Ethereum but what about these “ERC20” tokens? Or Tether (USDT) on Omni? How were they useful and what could I do with them? flavors Fourth was the of using crypto. How safe was it? What best practices should I be following? What contingency plans did I have to follow? implications And finally were the day to day . I’d have to pay every time I wanted to transact on the blockchain? What are the different prices I can pay? How can I make a transaction get processed faster? How can I see what I’ve transacted? Can I see what others have done? Why do I need to keep “signing” actions? transactions So, let’s start at the first hurdle — wallets. Most wallet applications are set up for experienced users, and leave newbies scratching their heads (if they even stick around that long). Forget convincing my parents to create a wallet — even I needed to wrap my head around it first. via RangeLeather Wallets are perhaps the most important — and most confusing — aspect of crypto. They are a huge obstacle to attracting more people to the space. Without them you can’t do anything — not even receive tokens — so getting users familiar with their workings is paramount. Sadly most wallet applications are set up for experienced users, and leave newbies scratching their heads (if they even stick around that long). Forget convincing my parents to create a wallet — even I needed to wrap my head around it first. The user interfaces of wallets are confusing, because they can actually do a lot of things on your behalf. First though — we need to discuss keys. For most blockchains, your wallet will contain a hidden secret — a basically a very long password that you keep secure_._ These wallet applications will either allow you to import an existing private key, or create a new one for you. They’ll strongly urge you to save a backup copy of it somewhere, either written on a piece of paper and stored securely or in a password vault (though as you can see below Electrum warns strongly against storing it digitally at all!). Where are my keys? private key — Typically instead of a random collection of letters and numbers, the application will ask you to remember an ordered set of 12–24 words — a seed phrase or mnemonic — from which it can generate the private key. Creating a new Bitcoin wallet using a seed phrase. This is the desktop wallet application . Electrum Using the private key, the wallet will provide you with an effectively a string of characters — that is also referred to as your That’s what you share with others when you want to receive tokens. You can think of your public key as a PO Box, and the private key your tool to open it. address — public key. As the backing of a wallet is simply public/private key encryption, there are a plethora of websites that can generate these pairs for you. — who knows if the site administrators aren’t tracking the private keys they generate. (Recall from the that all a malicious actor needs is your private key to transfer all of your funds to an address of their choosing.) I would advise against using them for anything other than demo purposes previous article For sake of this article, I went to to create a new Bitcoin public/private pair: walletgenerator.net An example public Bitcoin address (a public key) that is backed by a longer password (private key). (Example only, do not use this with real funds). You can see the public address of the above wallet is 12XUgG5jsEH5pyYU1vwbQ3cY8eQbfVY1f which was generated from the longer private key of 5J4Q1mc41vBt7qVuecBJm4r5s2ZoQujSyLwUSEFGKn1SJJeo3AL I did the same for Ethereum, using to generate the following: vanity-eth.tk An example public Ethereum address, backed by a private key. (Example only, do not use this with real funds). You can see the address and private key is (0–9 & A-F) in Ethereum, where in Bitcoin it is (0–9 & A-Z). In both cases, the private key could have been created from a 12–24 word seed phrase, but these websites didn’t provide that functionality. hexadecimal alphanumeric Additionally, here’s an example of an EOS public/private pair from . EOS keys are also alphanumeric: nadejde.github.io/eos-token-sale An EOS public/private pair, EOS also uses alphanumeric keys. (Example only, do not use this with real funds). Most blockchains use public/private key encryption. You share your public key with the sender when you want to receive funds. — you use it only with wallet applications in order to sign transactions. Putting the crypt in crypto Your private key is never shared All blockchains employ some kind of encryption (hence the abbreviation “crypto” from cryptography) to ensure the actions processed are indeed submitted by those who requested it¹. ¹ A fun rabbit hole is public/private key encryption, if you’re that way inclined. here’s a start The application you use to manage your wallet is super confusingly, also referred to as your wallet. Effectively it’s just software that can perform transactions on the blockchain on your behalf; most popular ones are largely interchangeable. What’s imperative however is how secure it is against That is, how well does it stand up to malicious software designed to capture private keys and transmit them whenever you are online? malware. Regardless of how secure your wallet is, there are still ways you can be vulnerable to attack. Last year there was that would mutate your clipboard contents on paste whenever it detected a high-value Bitcoin address; it would effectively replace your clipboard contents with an address that looked similar yet controlled by the author of the malware, thereby tricking you into sending them funds! 😲 We’ll discuss these more in the upcoming part of this series. a famous piece of malware on Windows implications The private key is what your wallet application uses to sign transactions² — basically it encrypts each action you perform (such as sending someone some tokens) in a with your private key**.** It then publishes this along with your address (your public key) to some blockchain node (any one of the thousands online around the world) that ensures that it was indeed encrypted with the private key pair of the wallet address you provided it with. Assuming all is good the node then propagates to its peers, one of which includes it in the next block (through ), and processes your transaction. Phew. Don’t worry if you didn’t get all that — we’ll also cover this in more detail later in the series. transaction eventually mining ² OK so technically with a HD wallet your private key just generates many public/private pairs. More on that in a bit. This is what a common Ethereum wallet looks like — it’s a Chrome extension called . Here I’m accessing the Ethereum dApp (decentralized application) and it wants to interact with my wallet. As Ethereum dApps run on the web (a la “web 3.0”), having a browser extension or desktop application to interface with provides a level of ease. The dApp asks my wallet to sign actions via JavaScript, and my wallet will check with me before encrypting the transaction with my private key, never sharing the actual key with the app. dApp that wallet MetaMask synthetix.exchange Using (an Ethereum wallet provided as a Chrome extension) in a browser-based Ethereum dApp. Here I am simply allowing the dApp to communicate with the wallet, not transacting. MetaMask And here’s a similar action performed on the EOS blockchain, using — the popular EOS wallet desktop application — to connect to the dApp. Scatter eostoolkit.io Using (an EOS wallet provided as a desktop application) in a browser-based EOS dApp. Here I am simply allowing the dApp to communicate with the wallet, not transacting. Scatter **Disaster recovery**What’s really powerful about your private key is that it’s enough to restore an entire modern wallet. Let’s say you lose your laptop, with Electrum or MetaMask on it. When you eventually run the wallet application again on a new computer, both will offer you the option to an existing wallet. You can do this either by adding in the private key or the seed phrase you either stored on paper somewhere or in a private password vault. import From your private key, the public key is deterministically generated³ — so you don’t even have to remember it. In fact, modern wallets allow you to create virtually limitless number of addresses based off the one private key. In fact, due to the way it is encrypted, no one can determine that any of these addresses are related the other. Under the hood, what’s actually happening is that for every new address you create, that is based off a set formula (so if recreated from scratch the same keys will be generated in order). a new private key is created ³ How you say? (HD) wallets to the rescue. Here’s a for the morbidly curious. Hierarchical Deterministic really thorough deep dive Creating a new MetaMask wallet. I install with a new phrase, create a second account (or public key), remove the wallet, then restore from the seed phrase and create a second account again. Note how the public keys are exactly the same in both instances. So, from your private key alone you have all the public keys you’ve ever used. And, since every transaction that has ever occurred is stored on the blockchain, your wallet can load up the history easily by querying the blockchain for all activity related to your addresses. When you use an application like MetaMask (a browser extension) or a desktop app like Scatter, you are storing the private key on your machine. If your machine is ever connected to the internet, then the wallet is referred to as . If you’d prefer to keep your private key blocked from the internet entirely, you would use a . These range from simply writing down your seed phrase on paper to a USB device that can sign transactions on you behalf but has no way to reveal the private key. The latter are referred to as wallets. Keeping it cool hot storage wallet cold hardware A — one type of cold storage wallet. Trezor A cold storage hardware wallet is more secure than a hot wallet like MetaMask by virtue of the fact that the device is prevented from ever sharing the keys to the kingdom. The device itself, along with a PIN and optional passphrase, is what you’ll need to sign transactions. The host computer that you plug your device into will still connect to the internet to broadcast transactions to the target blockchain (say when you want to send someone some bitcoin or ether), but the wallet is still considered cold as by design as no one, not even malicious software, can get the private key off the device. When you first use a cold storage wallet, you’ll be given a seed phrase to write down and store somewhere physically secure. If you ever lose the actual device, you’ll need to use that seed phrase — either when setting up a new cold storage wallet, or using a hot wallet. As you can imagine, your seed phrase is precious — more precious than your hardware wallet; if you lose your hardware wallet it’s at least secured by a PIN and passphrase — your seed phrase on the other hand is fair game. Be very careful where and how you store it. Unlike MetaMask and Electrum which are targeted to the Ethereum and Bitcoin blockchains respectively, most hardware wallets like and support multiple blockchains — so the one device can hold cryptocurrencies from a number of different chains. Particularly useful so you don’t need to walk around with a keychain full of different devices. Trezor Ledger An example dashboard from Ledger. Note the different cryptocurrencies in the bottom left. Finally, one last item to mention are ( ) wallets. In short, a private key can be split into pieces and distributed to others for added security — think about a safe deposit box accessed with three keys, each controlled by a different person. This is obviously a pretty severe restriction to day-to-day transactions, yet it’s a precaution you’d consider if you take your security very seriously. It could also potentially mitigate from ever happening — creating a succession plan for your funds when one day you’re unable to. multisignature multisig something like this Creating a 3-of-5 multi-signature Bitcoin wallet in Electrum. Takeaways Most blockchains use . Think of it as PO Box address you share and a key to keep it private. public/private key encryption A wallet can refer to a that both stores your private key securely, and signs transactions on your behalf with that key. public/private key pair or an application , and hence can create any number of addresses from the one private key. Without your private key, no one can tell that these addresses are associated together (for all intents and purposes they are completely unrelated). Most modern wallets are deterministic (HD) All you need to is either your private key or seed phrase. From that all of your public addresses can be regenerated and transaction history loaded from the blockchain. recover a modern wallet are those wallets not connected to the internet. They are considered safer than hot wallets as the attack vector does not include malware. Cold storage wallets A is typically a USB-powered cold storage wallet that can sign transactions but has no way of recovering the private key. It is typically connected to a host computer that is online, but the device itself provides an impenetrable barrier to malware. hardware wallet allow you to split a wallet’s single key into numerous parts and set a minimum number of parts required to transact. They provide even more security at the cost of convenience. Multisig wallets That’s it for now, in Part 2 we’ll cover how to acquire your crypto. Please follow me for updates.