What makes a hardware wallet so secure?

I've seen this question raised on Reddit quite a few times lately. It seems that a lot of new people coming into the cryptocurrency sphere are aware of hardware wallets but are not sure why they are secure. Well, I hope to explain the entirety of it here in an easy to understand manner.

When you create a wallet for any cryptocurrency, there are almost always two main things that make up the wallet. Those are the private key and the public key. The logic behind the naming of these keys is quite simple, the public key can be known by anyone because it's public, so it's safe to share. The private key however is like the literal key to the door of your wallet. Anyone who has your private key has full access to your wallet. You need your private key to be able to send crypto from your wallet to someone else.

This essentially means that as the owner of a cryptocurrency, you are in charge of the security of the key to your own vault. This has both upsides and downsides. The major upside to this is that you are in control of the risk of having your coins stolen, i.e not relying on a third party like a cryptocurrency exchange to secure and store your coins. These exchanges get hacked frequently and depositers commonly lose all of their deposits. So what's the major downside? Well, the major downside is that you are in control of the risk of having your coins stolen.

Yes, you heard that right, the major upsides and downsides are the both the exact same. The reason this is also a downside is because you need to put some extra effort in to learn and understand how to secure your cryptocurrency. It also means that if you have your wallet on your computer, you run the risk of having your private key stolen by a virus that you contract on your computer. When your private key is seen by someone else, that's it, your coins are gone. There is no way and no hope of ever recovering them, ever.

This lead people in the early days to start creating what is called a "paper wallet". A paper wallet is what it sounds like, a wallet that is printed on paper, that is to say, the private key is on a piece of paper and has never been exposed to a computer. This means that the only way to steal that person's crypto is to quite literally steal the piece of paper off of them.

But how does someone using a paper wallet send money to someone else? Well, that's called "offline transaction signing". What this involves is getting a computer that has never and will never be connected to the internet and "signing" the transaction on it using your private key. So your private key will have to be exposed to this computer but there is no risk of the key ever being stolen since the idea is that you never connect that computer to the internet. Further measures can be taken such as using temporary OS installations like Linux Tails on which everything you do is wiped when you restart the machine. The problem with paper wallets is that while they are extremely secure, they are very time consuming and not very practical if you want to transfer your funds frequently for trading purposes and such. So this lead to the invention of the hardware wallet.

The hardware wallet is essentially the culmination of the paper wallet, offline signing and offline machine all in one tiny little mini-computer, essentially just a USB stick. When you get your hardware wallet, it will randomly generate your private key and reveal it to you on a screen on the wallet itself. You can then back up this private key how you see fit. You are then asked to provide a PIN code to secure your hardware wallet. This PIN is then used to encrypt your hardware wallet so that only someone with your PIN can use it.

When you want to end a transaction with a hardware wallet, you plug it into your computer of choice and then unlock your wallet using your PIN. Then you load the software of your choice to interact with the wallet and send the transaction. You fill out the transaction details in your software wallet and then hit send, then your hardware wallet will display the details of this transaction on its screen. Once you have verified the details of the transaction on the screen of your hardware wallet, you can click a button to either accept or deny the transaction. If you accept the transaction, the hardware wallet will use the private key stored on the hardware wallet to sign the transaction and then send the signed transaction to the software wallet on the computer, which will then broadcast the transaction onto the network and wholla, your crypto is sent.

During this entire process, your private key never leaves your hardware wallet. The only thing that leaves your hardware wallet is the transaction signed by the wallet, confirming it as a legitimate transaciton signed by your unique private key. The signed version of the transaction is totally safe to share with anyone, there is no way for someone to determine your private key from it. This means that the computer you connected your hardware wallet to can have all of the viruses in the world but it can never steal your crypto because the signing of the transaction is done on your hardware wallet and the computer only sees the signed transaction. The one attack vector that is possible is that an infected computer replaces the address that you are sending your crypto to with another address without your knowledge, this is why the address that you are signing a transaction for is shown on the screen of the hardware wallet, you are meant to look at this and confirm it visually before accepting.

This makes hardware wallets extremely secure as well as providing ease of use and quick access to your funds should you want to. If someone steals your hardware wallet physically, then they need your PIN to decrypt and use it. It is impossible to get the private key off of it without the PIN. Could they run a bruteforce attack on it and try every possible PIN combination? Yes, however most hardware wallets will self destruct if the PIN is entered wrong more than 3 times in a row.

The hardware wallet I recommend is the Ledger Nano S. It is currently in high demand so expect a waiting time after you buy it. It's well worth the money though if you are holding a decent amount of cryptocurrency or plan to.

I hope this post has been informative. Feedback in all forms is really appreciated.

Originally posted on cracklord.com.