NRE Cost Optimization for Electronics by Jacques Gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
Summary
NRE cost optimization for electronics is a key factor for ensuring the profitability of electronic product development. NRE cost can be reduced by using different levers and tools, such as optimizing the V-cycle, the WBS, and the schedule, and using the TRL scale to assess the maturity of technologies. Freemindtronic is an example of a company that uses these techniques to optimize NRE cost for its electronic products with PCB, which are based on its patented technologies and offered under license and white label services.
NRE Cost Optimization, in the field of electronic product development, plays a central role. This one-time cost, associated with designing, testing, and developing a new product, has a direct impact on the product’s unit cost and the profit margin. Therefore, estimating and optimizing NRE cost are essential for ensuring the project’s viability and profitability.
NRE cost depends on several factors, such as:
The complexity and size of the product
The quantity and frequency of the orders
The technology, tools, and methods used for designing, manufacturing, and testing the product
The software associated with the product
The royalty fee paid to the technology provider
The complexity and size of the product can drive up the costs due to the increase in material and labor costs. On the other hand, larger and repeated orders can reduce the NRE cost per unit, as fixed costs are distributed over more units.
In this article, we will explain how to calculate NRE cost for electronic products with PCB (printed circuit boards), which are the core components of any electronic device. We will also present three main levers to reduce NRE cost for electronic products with PCB: optimizing the V-cycle, optimizing the WBS (work breakdown structure), and accelerating schedule. Finally, we will introduce the TRL scale (technology readiness level scale), a tool that can help you optimize NRE cost for electronic products with PCB by assessing and comparing the maturity of different technologies.
We will also show you how Freemindtronic, an Andorran company specialized in security and cybersecurity of computer systems and information systems, uses the TRL scale to optimize NRE cost for its electronic products with PCB. Freemindtronic also offers its technologies under license, including international patents, and provides white label product creation services.
How to Calculate NRE Cost for Electronic Products with PCB?
To optimize NRE cost for electronic products with PCB, you need to know how to calculate it. NRE cost can be divided into four main categories:
Design cost: this includes the software tools for CAD (computer-aided design), licenses, salaries of designers, etc.
Fabrication cost: this includes the materials, equipment, tools, personnel, etc. for manufacturing the electronic components and assembling them into a product.
Test cost: this includes the measurement devices, test software, salaries of testers, etc. for verifying the functionality and quality of the product.
Software cost: this includes the firmware, drivers, embedded systems, applications, extensions, etc. associated with the product.
Royalty cost: this includes the fee paid to the technology provider for using their technology in the product.
To calculate NRE cost for electronic products with PCB, you need to estimate the time and resources required for each category. You can use historical data from previous projects or industry benchmarks as references. You can also use online calculators or software tools to help you estimate NRE cost.
In addition to these categories, you also need to consider the software associated with the PCB,
which ensure its functionality and interaction with the user or other systems. The software associated with the PCB include:
Firmware: they are embedded in the PCB and control the behavior of the electronic components. They are usually written in low-level (assembler) or intermediate-level (C, C++, etc.) languages. They are specific to the product and must be adapted to the characteristics of the PCB and the electronic components.
Drivers: they are installed on the computer or system that communicates with the PCB. They allow the system to recognize the PCB and transmit data between the PCB and the system. They are usually written in high-level (C#, Java, Python, etc.) languages. They must be compatible with the operating system and communication protocol used.
Embedded systems: they are installed on the PCB or on another support (memory card, hard disk, etc.). They allow to manage the functions of the product and provide a user interface. They are usually written in high-level (C#, Java, Python, etc.) languages. They must be adapted to the capabilities of the PCB and the needs of the product.
Applications: they are installed on the computer or system that communicates with the PCB. They allow the user to access the functionalities of the product and customize its settings. They are usually written in high-level (C#, Java, Python, Go, Type script, elvet etc.) languages. They must be ergonomic and intuitive for the user.
Extensions: they are installed on the computer or system that communicates with the PCB. They allow to add functionalities to the product or connect it to other services or systems. They are usually written in high-level (html, type script, web RTC, Java, java script, etc.) languages. They must be secure and respect compatibility standards.
These software must be designed, developed and tested in parallel with the PCB, in order to guarantee their coherence and performance. They must also be updated regularly to correct any bugs or to bring improvements to the product.
Besides these categories, you also need to consider the tools required for manufacturing and testing the PCB, which depend on the characteristics of the PCB and the requirements of the product. The tools for manufacturing and testing the PCB include:
Soldering machines: they allow to assemble electronic components on the PCB by soldering. There are different types of soldering machines, depending on the process used (wave soldering, reflow soldering, selective soldering, etc.).
Insertion machines: they allow to insert electronic components through holes in the PCB. They are used for through-hole components, which are fixed by soldering on both sides of the PCB.
Placement machines: they allow to place electronic components on the surface of the PCB. They are used for SMD (surface mount device) components, which are fixed by soldering on one side of the PCB.
Cutting machines: they allow to cut the PCB according to the desired shape. They are used to separate the different parts of the PCB or to adjust the size of the PCB.
Drilling machines: they allow to drill holes in the PCB to insert components or connectors. They are used to make connections between the different layers of the PCB or between the PCB and other elements.
Engraving machines: they allow to engrave patterns or inscriptions on the PCB. They are used to identify the PCB or to add technical or aesthetic information to it. For example, you can engrave the serial number, the manufacturer name, or the logo of the product on the PCB.
Measurement devices: they allow to verify the electrical and physical characteristics of the PCB. They include various devices such as multimeters, oscilloscopes, logic analyzers, insulation testers, etc. These devices allow you to measure the electrical and physical characteristics of the PCB, such as voltage, current, resistance, capacitance, frequency, etc.
Test software: they allow to control the functionality of the PCB and electronic components. They include various software such as simulation software, fault injection software, functional analysis software, etc. These software allow you to test the behavior of the PCB and electronic components under different conditions and scenarios.
These tools must be chosen according to the type and complexity of the PCB, as well as the level of quality required for the product. They must also be calibrated and maintained regularly to ensure their reliability and accuracy.
To illustrate how to calculate NRE cost for electronic products with PCB, let’s take an example of a project that involves developing a new product based on a 4-layer PCB with 1000 components (800 SMD and 200 through-hole). The project duration is 12 months and requires two engineers (one for design and one for test) with a salary of $3000 per month each. The project also requires a CAD software license ($5000), a fabrication service ($5000), a test service ($5000), a software development service ($10 000), and a royalty fee (5% of sales).
The following table shows how to calculate NRE cost for this project:
Item
Formula
Cost
Human resources
(3 000 + 2 000) x (1 + 0.5) x 2 x 12
$90 000
Software tools
–
$10 000
Materials
–
$5 000
Equipment
–
$15 000
Software
–
$10 000
Royalty fee
0.05 x 200 000
$10 000
Total NRE cost
Sum of above items
$140 000
As you can see, NRE cost can be quite high for electronic products with PCB, especially if the product is complex or requires specific technologies or tools. Therefore, it is important to optimize NRE cost by using different levers and tools that can improve the efficiency and quality of the product development process.
3 levers
Cost & TIME & Quality
Three Main Levers to Reduce NRE Cost for Electronic Products with PCB
To optimize NRE cost for electronic products with PCB, you need to know how to reduce it. NRE cost can be reduced by using different levers and tools that can improve the efficiency and quality of the product development process. In this section, we will present three main levers to reduce NRE cost for electronic products with PCB:
Optimizing the V-cycle: this is to optimize the design process of the product, which follows a V-shaped model that consists of four main phases: definition, design, verification, and validation. Optimizing the V-cycle relies on the following sub-levers:
Defining clearly and precisely the customer needs and product specifications, which are translated into functional and technical requirements for the product. This helps to avoid ambiguity and misunderstanding, and to align the expectations of all stakeholders. Designing modular and scalable product, which allows reusing existing components or technologies and adapting easily to future changes or improvements. This helps to reduce the design cost and time, and to increase the flexibility and adaptability of the product. Making prototypes and mock-ups, which allow testing the product in real conditions and collecting customer feedback. This helps to validate the feasibility and functionality of the product, and to identify and correct any errors or defects before mass production. Planning rigorously and realistically the project, taking into account technical, financial, and temporal constraints, and anticipating possible contingencies. This helps to optimize the use of resources, to avoid delays and budget overruns, and to manage risks effectively. Monitoring and controlling regularly the project, using performance indicators and appropriate project management tools, which measure the progress of the project and identify deviations from the initial plan. This helps to ensure the quality and efficiency of the project execution, and to take corrective actions if needed. Validating systematically the product at each stage of the V-cycle, using appropriate methods and test criteria, which ensure compliance and quality of the product. This helps to verify that the product meets the customer needs and product specifications, and to obtain certification or approval from relevant authorities.
Optimizing the WBS (work breakdown structure): this is to structure the project into sub-projects, tasks, and activities, which are hierarchized and detailed according to their level of complexity and dependence. Optimizing the WBS relies on the following sub-levers:
Decomposing logically and coherently the project, respecting the principle of sum of parts equal to whole, that is, each element of WBS must contribute to achieving global project. This helps to clarify the scope and objectives of the project, and to avoid duplication or omission of work. Defining clearly and precisely deliverables associated with each element of WBS, specifying expected features, responsibilities, deadlines, and costs. This helps to define the expected outcomes of each element of WBS, and to assign roles and responsibilities to each actor of the project. Assigning resources needed for each element of WBS, taking into account skills, availability, and costs of human, material, and financial resources. This helps to allocate resources efficiently and effectively to each element of WBS, and to optimize the cost and quality of the project. Coordinating and communicating among different actors of project, using collaborative tools and agile methods, which promote information exchange and problem solving. This helps to ensure the coherence and consistency of the project, and to foster the collaboration and innovation among different actors.
Accelerating schedule: this is to reducethe total duration of project by optimizing use of available resources and minimizing idle times. Accelerating schedule relies on following sub-levers:Reducing duration of critical tasks that have direct impact on end date of project. For this, we can use techniques such as crashing (increasing resources assigned to a task) or fast-tracking (performing tasks in parallel instead of sequentially). This helps to shorten the critical path of the project, which determines the minimum time required for completing the project. Increasing parallelism of non-critical tasks that do not affect the end date of project, but can reduce the total duration of project. For this, we can use techniques such as overlapping (starting a task before the previous one is completed) or splitting (dividing a task into smaller subtasks that can be performed in parallel). This helps to increase the concurrency of tasks in the project, which reduces idle times and improves resource utilization. Eliminating or minimizing slack time of tasks that is the difference between the earliest and latest start or finish times of a task. For this, we can use techniques such as resource leveling (balancing the demand and supply of resources over the project duration) or resource smoothing (adjusting the resource allocation to reduce peaks and valleys in resource usage). This helps to optimize the slack time of tasks, which can be used to absorb uncertainties or delays, or to improve quality or performance.
These levers and tools can help you optimize NRE cost for electronic products with PCB by reducing errors, delays, and budget overruns by improving the quality and efficiency of the product development process. They can also increase customer satisfaction and confidence by demonstrating the compliance and quality of the product at each stage of development.
How to Use the TRL Scale to Optimize NRE Cost for Electronic Products with PCB?
Another tool that can help you optimize NRE cost for electronic products with PCB is the TRL scale, or technology readiness level scale. The TRL scale is a tool for measuring or indicating the maturity of a technology. It was originally developed by NASA in the 1990s as a means to manage the technological risk of its programs. The TRL scale can help you optimize NRE cost for electronic products with PCB by providing a common language and framework for assessing and comparing the maturity of different technologies in the context of a specific application, implementation, and operational environment. The TRL scale also helps you identify gaps and risks in your technology development process, and plan appropriate actions and resources to address them.
The TRL scale ranges from 1 to 9, with 9 being ready for commercialization. The TRL scale describes the performance history of a given system, subsystem, or component relative to a set of levels that correspond to different stages of development.
The following table summarizes the main characteristics and criteria of each TRL level:
The following table summarizes the main characteristics and criteria of each TRL level:
TRL
Definition
Description
Criteria
1
Basic principles observed
Scientific research begins and results are translated into future research and development
Publication or report of basic principles
2
Technology concept formulated
Basic principles are applied to practical applications and experimental proof of concept is obtained
Publication or report of applied research
3
Analytical and experimental critical function and/or characteristic proof-of-concept
Active research and design begin and proof-of-concept model is constructed
Analytical studies and laboratory tests
4
Component/subsystem validation in laboratory environment
Component pieces are tested with each other in a simulated environment
Component integration and testing
5
Component/subsystem validation in relevant environment
Breadboard technology is tested in a realistic environment with simulated interfaces
System-level testing in relevant environment
6
System/subsystem model or prototype demonstration in a relevant environment
Fully functional prototype or representational model is demonstrated in a realistic environment with actual interfaces
System-level testing in relevant environment
7
System prototype demonstration in an operational environment
Working model or prototype is demonstrated in an extreme environment with all interfaces
System-level testing in operational environment
8
Actual system completed and qualified through test and demonstration
Technology has been tested and “flight qualified” and is ready for implementation into an existing technology or technology system
System-level testing in operational environment
9
Actual system proven through successful mission operations
Technology has been “flight proven” during a successful mission and meets all performance requirements
System-level testing in operational environment
What are the Benefits of Using the TRL Scale for Freemindtronic?
By using the TRL scale, Freemindtronic was able to achieve the following benefits:
Providing a common language and framework for assessing and comparing the maturity of its technology with other technologies on the market.
Identifying gaps and risks in its technology development process and planning appropriate actions and resources to address them.
Reducing errors, delays, and budget overruns by improving the quality and efficiency of its product development process.
Increasing customer satisfaction and confidence by demonstrating the compliance and quality of its product at each stage of development.
Freemindtronic also offers its technologies under license, including international patents, and provides white label product creation services. This allows its customers to protect their products and services created in their brand and embedding Freemindtronic’s technologies. In addition, they benefit from territorial protection in terms of international intellectual property. Freemindtronic also offers the possibility of negotiating an NRE royalty with its customers, depending on the added value of its technology and market conditions. Moreover, Freemindtronic has designed a mutualized offer of its NRE costs, distributed among all its customers under licenses. This has the effect of reducing the royalty cost attached to the NRE. This also has the effect of making affordable access to the different licenses, especially patented ones, which produce a low impact on the products marketed.
Freemindtronic guarantees an industrial quality of its products,
manufactured with industrial grade electronic components. It also ensures a complete traceability of the manufacture of its offline products and end-to-end cybersecurity from HSMs, from design to end user.
Conclusion and Contact Information
We hope that this article has given you some useful insights on how to optimize NRE cost for electronic products with PCB by using different levers and tools. We also hope that you have learned how to use the TRL scale to optimize NRE cost for electronic products with PCB by assessing and comparing the maturity of different technologies.
We also showed you how Freemindtronic, an Andorran company specialized in security and cybersecurity of computer systems and information systems, uses the TRL scale to optimize NRE cost for its electronic products with PCB. Freemindtronic also offers its technologies under license, including international patents, and provides white label product creation services.
If you have any questions or comments, please feel free to contact us. We will be happy to assist you with your project.
Securing IEO STO ICO IDO and INO by Jacques Gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
Enhancing Security: Securing IEO STO ICO IDO and INO
Cryptocurrencies are digital assets that can be used to buy goods and services, invest in projects, or trade on online platforms. In this article, we will explore the importance of securing IEOs, STOs, ICOs, IDOs, and INOs and how you can protect your investments using EviCore NFC HSM technology.
Securing IEO STO ICO IDO and INO: How to Protect Your Crypto Investments
Cryptocurrencies are digital assets that can be used to purchase goods and services, invest in projects, or trade on online platforms. They are built on blockchain technology, which is a decentralized system that records and verifies transactions without intermediaries. However, to securely and conveniently store your private keys and seed phrases, thus ensuring the security of your funds in Securing IEO STO ICO IDO and INO, you need a wallet that stores your private keys and seed phrases. These pieces of data enable you to access and control your funds on the blockchain
But how can you securely and conveniently store your private keys and seed phrases in Securing IEO STO ICO IDO and INO? How can you prevent losing them or falling victim to hackers or scammers? And how can you participate in various forms of cryptocurrency crowdfunding, such as ICOs, IEOs, STOs, IDOs, and INOs, without risking your funds?
In this article, we will address these questions and explain how to protect your private keys and starter phrases using NFC (Near Field Communication) HSM. We will also compare different cryptocurrency crowdfunding models and show how to store your private keys and starter phrases with EviCore NFC HSM technology for each of these models.
By reading this article, you will learn:
What ICOs, IEOs, and STOs are and how to participate in Securing IEO STO ICO IDO and INO.
The significance of seed phrases and private keys in Securing IEO STO ICO IDO and INO.
The features and functionality of EviCore HSM technology in Securing IEO STO ICO IDO and INO.
How to securely store your seed phrases and private keys using EviCore NFC HSM technology across various use cases in Securing IEO STO ICO IDO and INO.
If you have an interest in cryptocurrencies and want to understand how to secure your funds with EviCore HSM technology in Securing IEO STO ICO IDO and INO, please continue reading!
What are ICOs, IEOs, STOs, IDOs and INOs?
Cryptocurrencies are virtual digital assets that rely on blockchain technology, a decentralized and encrypted ledger that records all transactions conducted on the network. Cryptocurrencies enable their user community to engage in transactions without the use of traditional currencies and also fund innovative projects through cryptocurrency fundraisers.
A cryptocurrency fundraiser involves issuing tokens in exchange for cryptocurrencies. Tokens are digital units that represent a right or value associated with the funded project. There are various types of cryptocurrency fundraisers based on factors such as the nature of the tokens issued, the platform used for transactions, the involvement of trusted third parties, and the level of regulatory oversight. Let’s take a closer look at the main types of cryptocurrency fundraisers in Securing IEO STO ICO IDO and INO:
An ICO is a fundraising operation in which a company issues tokens that investors subscribe to mainly with cryptocurrencies. These tokens can have different functions, depending on the project funded:
Utility tokens, which give access to a service or a platform developed by the company.
Governance tokens, which allow holders to participate in the strategic decisions of the project.
Security tokens, which represent a share of the capital or the revenues of the company.
An ICO usually takes place in several stages:
The presale, where investors can buy the tokens at a discounted price, often with a minimum amount required.
The public sale, where the tokens are made available to the general public, often with a maximum amount to be raised.
The distribution, where the tokens are sent to investors on their wallets..
The advantages of an ICO for investors are:
The possibility to support innovative and promising projects.
The possibility to benefit from a high capital gain if the project succeeds and the value of the tokens increases.
The possibility to diversify your portfolio with digital assets.
The disadvantages of an ICO for investors are:
The risk of losing all or part of your investment if the project fails or if the tokens lose their value.
The risk of falling for a scam or a fraud, as ICOs are poorly regulated and controlled. The risk of not being able to resell your tokens easily, as there is not always a liquid secondary market.Depending on the country where the ICO takes place, there may be rules to follow, especially in terms of investor protection, anti-money laundering or taxation. Therefore, it is advisable to check the legal status and the compliance of the ICO before investing. Some countries have banned or restricted ICOs, while others have issued guidelines or regulations to ensure their transparency and security.
An IEO is a fundraising operation in which a company issues tokens on a cryptocurrency exchange platform. The exchange acts as an intermediary between the company and investors, providing security, liquidity, and visibility for the token sale. Investors can purchase tokens using cryptocurrencies or fiat money, depending on the exchange.
An IEO typically involves a single stage:
Public sale: Tokens are sold on the exchange platform within a limited time frame and at a fixed price.
Advantages of IEOs for investors include:
Enhanced security, liquidity, and visibility compared to ICOs.
Access to vetted and quality projects that have been approved by the exchange.
Ability to trade tokens immediately after the sale on the same exchange.
Disadvantages of IEOs for investors include:
Dependence on a centralized intermediary that controls the token sale process and charges fees.
Need to comply with stricter rules and regulations imposed by the exchange and jurisdiction.
Risk of missing out on opportunities due to high demand and limited token supply.
An STO is a fundraising operation in which a company issues tokens that represent securities, such as shares or bonds. These tokens are backed by real assets, and investors can purchase them using cryptocurrencies or fiat money, depending on the platform.
STOs typically involve one or more stages:
Private sale: Accredited investors can buy tokens at a discounted price, often with a minimum investment requirement.
Public sale: Qualified investors can purchase tokens at a fixed price, often with a maximum fundraising amount.
Advantages of STOs for investors include:
Opportunity to invest in regulated and compliant projects that offer legal protection and transparency.
Potential for real value and returns from the underlying assets of the company.
Access to new markets and opportunities that were previously reserved for institutional investors.
Disadvantages of STOs for investors include:
Need for accreditation or qualification based on strict criteria set by regulators and platforms.
Lack of liquidity and availability compared to utility tokens or cryptocurrencies.
Complexity and cost associated with issuing and managing security tokens on blockchain platforms.
An IDO is a fundraising operation in which a company issues tokens on a decentralized protocol for exchanging cryptocurrencies, known as a DEX (Decentralized Exchange). Investors can purchase tokens directly on the DEX without going through a centralized platform or intermediary.
Advantages of IDOs for investors include:
Speed and simplicity of the process, as it does not require identity verification or prior fund deposits.
Transparency and security of transactions, as they are conducted on the blockchain without reliance on a trusted third party.
Liquidity and accessibility of tokens, which are immediately available on the secondary market and can be exchanged for other cryptocurrencies.
Disadvantages of IDOs for investors include:
Technical and operational risks associated with decentralized protocols that may have vulnerabilities or bugs.
Regulatory and legal risks due to the lack of a clear and harmonized legal framework for cryptocurrency fundraisers.
Volatility and speculation risks arising from high demand and limited token supply.
An INO is a fundraising operation in which a company issues non-fungible tokens, called NFTs (Non-Fungible Tokens). NFTs are unique and indivisible digital assets that can represent works of art, collectibles, virtual or real goods. Investors can purchase NFTs using cryptocurrencies on specialized platforms.
Advantages of INOs for investors include:
Support for creative and original projects that leverage the blockchain’s potential to create value.
Possibility to benefit from exclusive and inalienable ownership rights over NFTs, certified by the blockchain and immune to duplication or falsification.
Opportunity to resell NFTs on a growing and demanding secondary market.
Disadvantages of INOs for investors include:
Risk of overvaluation and speculative bubbles due to the current frenzy around NFTs and their artificial scarcity.
Potential for counterfeiting and plagiarism, as effective legal protection for copyrights and trademarks is lacking.
Environmental and ethical concerns related to the high energy consumption and negative externalities generated by the blockchain.
Comparison Table of Different Cryptocurrency Crowdfunding Models
Below is a comprehensive table comparing different crowdfunding models in cryptocurrency:
Crowdfunding model
Definition
Advantages
Disadvantages
ICO
Fundraising in cryptocurrency by issuing tokens that can have various functions
Support innovative projects, benefit from high potential gain, diversify portfolio
Risk losing investment, fall for scam, not be able to resell tokens easily, face regulatory uncertainty
IEO
Fundraising in cryptocurrency by issuing tokens on an exchange platform that acts as a trusted intermediary
Benefit from better security, liquidity and visibility than ICOs, access a wider pool of investors and projects
Depend on a centralized intermediary, pay higher fees, comply with stricter rules, face platform risk
STO
Fundraising in cryptocurrency by issuing tokens that represent securities such as shares or bonds
Invest in regulated and compliant projects, benefit from real value and returns, access new markets and opportunities, reduce intermediation costs
Be accredited or qualified, face lack of liquidity and availability, deal with complexity and cost, follow different regulations depending on jurisdictions
IDO
Fundraising in cryptocurrency by issuing tokens on a decentralized exchange protocol that eliminates intermediaries
Enjoy speed and simplicity of the process, ensure transparency and security of transactions, access liquidity and accessibility of tokens
Face technical and operational risk, cope with regulatory and legal risk, deal with volatility and speculation
INO
Fundraising in cryptocurrency by issuing non-fungible tokens that represent unique and indivisible digital assets
Support creative and original projects, benefit from exclusive and inalienable ownership of NFTs, resell NFTs on a growing and demanding market
Deal with overvaluation and speculative bubble, encounter counterfeiting and plagiarism issues, consider environmental and ethical impact
Comprehensive Table of Blockchains Supporting ICOs, IEOs, STOs, IDOs, and INOs
Here is a table showcasing the support for ICOs, IEOs, STOs, IDOs, and INOs across different blockchains, focusing on Securing IEO STO ICO IDO and INO:
Blockchain
ICO support
IEO support
STO support
IDO support
INO support
BIP32 support
BIP39 support
BIP44 support
Ethereum
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Binance Smart Chain (BSC)
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Cardano (ADA)
No
No
No
Yes
No
Yes
Yes
Yes
Solana (SOL)
Yes
Yes
No
No
No
Yes
No
Yes
Avalanche (AVAX)
Yes
Yes
Yes
No
No
Yes
Yes
No
Cosmos (ATOM)
Yes
Yes
Yes
Yes
Yes
Yes
Yes
No
Algorand (ALGO)
Yes
Yes
Yes
Yes
Yes
Yes
Yes
No
Stellar (XLM)
Yes
No
Yes
No
No
Yes
Yes
Yes
What are seed phrases and private keys?
Seed phrases and private keys are essential for accessing and controlling your funds in cryptocurrency. If they are lost or stolen, you may permanently lose access to your cryptocurrencies.
Seed phrase
A seed phrase, also known as a secret phrase, is a sequence of words, typically consisting of 12 or 24 words, that allows you to restore your crypto wallet in case of loss or theft. These words are selected in a specific order from a dictionary containing thousands of words. The seed phrase is essentially a more human-readable representation of a private key and can generate an unlimited number of public-private key pairs.
The public key is the address to which you can receive cryptocurrencies on the blockchain, similar to an IBAN for a bank account. The private key enables you to control the funds associated with a public key and initiate transactions from that address. Public and private keys are always generated as pairs.
The seed phrase is crucial for accessing your wallet and funds, and it must be kept secure and confidential. If lost or stolen, there is no way to recover it or block access to your funds.
Private key
A private key is a string of random letters and numbers generated by your wallet when it is created. It is used for encrypting and decrypting data using public-key cryptography. The private key grants access to your funds and enables you to initiate transactions on the blockchain.
A private key looks like this: 5Kb8kLf9zgWQnogidDA76MzPL6TsZZY36hWXMssSzNydYXYB9KF
You should never share your private key with anyone or store it digitally or online. If your private key is lost or stolen, you will lose access to your funds permanently.
How to Secure Your Funds in Securing IEO STO ICO IDO and INO
To participate in an ICO, IEO, STO, IDO, or INO and ensure the security of your funds in Securing IEO STO ICO IDO and INO, you need a wallet that is compatible with the tokens being issued and the accepted cryptocurrency. There are different types of wallets available, each offering varying levels of security and convenience.
Online Wallets (Web Wallets): These wallets are accessible through a web browser. While they are easy to use, they are susceptible to hacking and theft. It is important to choose a reputable and secure online wallet.
Mobile Wallets: These wallets are installed on smartphones and provide convenience for daily transactions. However, they are vulnerable to malware and the risk of losing the phone. Ensure you have proper security measures in place for your mobile wallet, such as enabling device passcodes and biometric authentication.
Software Wallets: These wallets are downloaded and installed on a computer. They offer greater security compared to online or mobile wallets, but their reliability depends on the security of the hardware and software. Keep your computer updated with the latest security patches and use reputable wallet software.
Hardware Wallets: These physical devices are specifically designed for storing private keys. They provide the highest level of security by isolating private keys from the internet. Hardware wallets, such as Ledger or Trezor, are recommended for secure storage of your private keys in Securing IEO STO ICO IDO and INO.
Regardless of the type of wallet you choose, there are some basic rules to follow to secure your funds in Securing IEO STO ICO IDO and INO:
Never share your seed phrase or private key with anyone, and avoid storing them digitally or online.
Make a backup copy of your seed phrase or private key on a physical medium such as paper, metal, or plastic. Store them in secure locations.
Use a strong password and PIN code to protect your wallet from unauthorized access.
Regularly update your wallet software to fix any bugs or vulnerabilities.
Utilize reputable antivirus and firewall software to protect your device from malware and hackers.
By following these security practices, you can significantly reduce the risk of losing your funds and ensure the safety of your investments in Securing IEO STO ICO IDO and INO.
Now, let’s explore how you can enhance the security and simplicity of your cryptocurrency transactions by using EviCore NFC HSM technology.
EviCore NFC HSM is a solution that safeguards your seed phrases and private keys in cryptocurrency using Near Field Communication (NFC) technology. With EviCore NFC HSM, you can store your seed phrases and private keys in an encrypted NFC tag or card, protected by a segmented key. This tag or card allows you to restore your wallet on any NFC-compatible device without exposing your sensitive data to the internet.
EviCore NFC HSM is compatible with major cryptocurrency wallets such as Ledger, Trezor, Metamask, Trust Wallet, and more. It also works seamlessly with popular cryptocurrency exchange platforms like Binance, Coinbase, and Kraken. This ensures optimal security and ease of managing your funds in cryptocurrency.
Here’s a step-by-step guide on how to use EviCore NFC HSM to secure your seed phrases and private keys in cryptocurrency:
Download the application that incorporates the EviCore NFC HSM technology on your NFC-compatible Android smartphone.
Pair the NFC HSM device with your smartphone using the unique pairing key.
Translate to English: Add the seed phrase by simply clicking on the multi-language BIP39 words provided during the creation of your secure cryptocurrency wallet, without typing anything on the keyboard, as EviCore NFC HSM performs real-time checksum verification of the seed phrase before securely encrypting and storing it in the NFC device.
You can also add the private key derived from the seed phrase without entering or scanning its QR code through the Android NFC application, which will automatically encrypt and store it in the NFC device in less than 5 seconds. You just need to indicate beforehand which blockchain your derived key belongs to before the registration pro
By utilizing EviCore NFC HSM, you can secure your seed phrases and private keys with maximum security and unparalleled ease of use. You no longer need to worry about losing or having your sensitive data stolen, as you can store them in a physical device that can be carried with you wherever you go. Additionally, you can securely share your seed phrases and private keys with others using encrypted RSA-4096 public keys or segmented key authentication, making it easier to transmit funds to your heirs.
EviCore NFC HSM technology is the ideal solution for securing your seed phrases and private keys in cryptocurrency, enabling you to fully embrace the opportunities offered by cryptocurrencies while minimizing unnecessary risks. If you’re interested in this innovative solution, visit Freemindtronic’s website or contact them for more information.
Additionally, if you’re seeking an alternative method to secure your crypto fundraising, you may consider EviCore HSM OpenPGP technology. This technology transforms your Android or iPhone into a hardware security module (HSM) for encrypting and storing your crypto keys. It leverages the highly secure OpenPGP standard, known for its reliability and security. To learn more about this technology and how it can help you safely fund your blockchain project, you can refer to this article link
Conclusion
In this article, we have provided insights into participating in various forms of cryptocurrency crowdfunding, including ICOs, IEOs, STOs, IDOs, and INOs. We have emphasized the importance of securing your seed phrases and private keys in Securing IEO STO ICO IDO and INO and introduced EviCore NFC HSM technology as a solution. By adopting EviCore NFC HSM, you can enhance the security and simplicity of your cryptocurrency transactions while mitigating risks. We hope this article has been informative and valuable to you. Should you have any questions or comments, feel free to leave them below.
Thank you for reading, and happy investing in Securing IEO STO ICO IDO and INO!
Remote activation of phones by the police by Jacques Gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
How does remote activation of phones by the police work?
An article of the bill on justice 2023-2027 raises controversy. It allows remote activation of mobile phones and capture of images or sound without the owner’s consent, for cases of organized crime or terrorism. How does this intelligence technique work? What are the conditions to use it? What are its advantages and disadvantages? What is the situation in other countries? We explain everything in this article.
What is the new bill on justice and why is it raising concerns about privacy?
The bill on justice is a legislative project. It aims to modernize and simplify justice in France. It covers civil, criminal, administrative and digital justice. It also strengthens the investigation and prosecution of serious offenses, such as terrorism and organized crime.
This measure raises privacy concerns because it lets the police access personal or professional data in phones without the owners’ or possessors’ consent or knowledge. It also lets the police locate, record or capture sounds and images from phones without notification or justification. This measure may violate fundamental rights and freedoms, such as privacy, confidentiality, dignity, presumption of innocence and right to a fair trial.
What is remote activation of phones and how does it work?
Remote activation of phones by the police is an intelligence technique that allows law enforcement agencies to access data or record sounds and images from phones without the consent or knowledge of the phone users. This technique can be used for criminal investigations or national security purposes.
To remotely activate phones, law enforcement agencies need three factors: compatibility, connectivity, and security of the phones. They need to be compatible with the software or hardware that enables remote activation. They need to be connected to a network or a device that allows remote access. They need to have security flaws or vulnerabilities that can be exploited or bypassed.
Law enforcement agencies can remotely activate phones by three methods: exploiting vulnerabilities, installing malware, or using spyware on phones. Exploiting vulnerabilities means taking advantage of security flaws or weaknesses in the phone’s operating system, applications, or protocols. Installing malware means putting malicious software on the phone that can perform unauthorized actions or functions. Using spyware means employing software or hardware that can monitor or control the phone’s activity or data.
By remotely activating phones, law enforcement agencies can access data such as contacts, messages, photos, videos, location, browsing history, or passwords. They can also record sounds and images such as conversations, ambient noises, or camera shots. They can do this in real time or later by retrieving the data from the phone’s memory or storage.
What is the French bill on remote activation of phones by the police and what are its implications?
The French bill on remote activation of phones by the police is a legislative text that was promulgated on 25 May 2021. It is part of the justice orientation and programming bill for 2023-2027, which aims to modernize the justice system and reinforce its efficiency and independence.
The bill introduces a new article in the code of criminal procedure, which allows the judge of liberties and detention (at the request of the prosecutor) or the examining magistrate to order the remote activation of an electronic device without the knowledge or consent of its owner or possessor for the sole purpose of locating it in real time. This measure can be applied for crimes or misdemeanors punishable by at least five years’ imprisonment, a fairly broad criterion.
The bill also allows the judge of liberties and detention (at the request of the prosecutor) or the examining magistrate to order the remote activation of an electronic device without the knowledge or consent of its owner or possessor for the purpose of recording sounds and images from it. This measure can be applied only for crimes relating to organized crime and terrorism.
These measures cannot concern parliamentarians, journalists, lawyers, magistrates and doctors, nor the defendants when they are in the judge’s office or with their lawyer.
The bill also specifies that the remote activation of an electronic device must be done in a way that does not alter its functioning or data, and that the data collected must be destroyed within six months after their use.
The bill aims to provide law enforcement agencies with more tools and information to prevent, investigate and prosecute crimes, especially in cases where phones are encrypted, hidden or destroyed. It also aims to harmonize the French legislation with other countries that have used or considered this technique, such as the United States, Germany, Italy, Israel, Canada, China, France, and the United Kingdom.
However, the bill also raises ethical and social challenges, as it involves a trade-off between security and privacy, as well as between effectiveness and legitimacy. It may undermine the right to respect for private life and the right to a fair trial, which are guaranteed by the European Convention on Human Rights and the French Constitution. It may also expose law enforcement agencies to legal or technical challenges or dangers, such as encryption technologies that can prevent or hinder remote activation. It may also create distrust or resistance among phone users or providers, who may use encryption technologies or legal remedies to protect their data or communications.
The bill has been criticized by several actors, such as lawyers, human rights defenders, digital rights activists, journalists and academics. They have denounced its lack of proportionality, necessity and oversight. They have also questioned its effectiveness and legitimacy. They have called for its withdrawal or amendment.
The bill is still subject to constitutional review by the Constitutional Council before its final promulgation.
How did the Senate vote on the bill and where to find the official sources?
The Senate adopted this measure on October 20, 2021, with some amendments. The Senate voted in favor of this measure by 214 votes against 121. The Senate also added some safeguards to this measure, such as limiting its duration to four months renewable once and requiring prior authorization from an independent judge.
The National Assembly still has to examine the bill before adopting it definitively. The National Assembly may approve, reject or modify this measure. The final text may differ from the one that the Senate voted.
What are the benefits and risks of remote activation of phones?
This technique can affect citizens’ and suspects’ behavior in different ways.
On one hand, it can deter people from serious offenses. It exposes them to a higher risk of detection and identification. It reduces their incentives for criminal activities.
On the other hand, it can also make people more cautious or paranoid. It increases their uncertainty and fear. It leads them to avoid electronic devices, encrypt their communications, or use countermeasures such as jamming devices.
This technique can also impact public safety and security positively and negatively.
On one hand, it can improve the efficiency and effectiveness of law enforcement agencies. It provides them with more information and evidence. It helps them prevent, investigate and prosecute crimes.
On the other hand, it can also pose risks for human rights and civil liberties. It allows intrusive and covert surveillance. It violates privacy, confidentiality and dignity. It can also be subject to abuse, misuse or error by law enforcement agents or hackers.
Finally, it can create a feeling of insecurity and mistrust towards institutions, which can access personal or professional data in phones. It can also harm respect for presumption of innocence by placing permanent suspicion on people targeted by this technique. It can also infringe on protection of journalistic sources or right to information by discouraging whistleblowers or witnesses from speaking freely. It can finally encourage people concerned to adopt avoidance or circumvention strategies, such as changing phones regularly, using encrypted applications or switching to airplane mode.
These strategies can reduce the actual effectiveness of this technique for preventing terrorism and organized crime.
What are the arguments in favor of remote activation of phones?
Some people support this technique because they think it has several advantages for law enforcement and public security.
How can remote activation of phones violate privacy and data protection?
One of the main arguments against this technique is that it can violate privacy and data protection for individuals and groups. Privacy and data protection are fundamental rights recognized by international standards and laws. They ensure human dignity and autonomy.
Remote activation of phones violates privacy and data protection by letting law enforcement agencies access personal or professional data without the owners’ or possessors’ consent or knowledge. It also lets law enforcement agencies access sensitive or confidential data without notification or justification. It also lets law enforcement agencies access excessive or irrelevant data without limitation or proportionality.
For example, remote activation of phones could let the police access medical records, financial transactions, political opinions, religious beliefs, sexual preferences, or other intimate information on a device or a communication. It could also let the police access information that is not related to the investigation or that is out of scope on a device or a communication. It could also let the police access information that is not necessary or appropriate for the investigation or that is disproportionate to the seriousness of the offense on a device or a communication.
How can remote activation of phones improve access to justice and evidence?
Another argument in favor of this technique is that it can improve access to justice and evidence for law enforcement agencies and victims of crimes. Justice and evidence ensure the rule of law and the protection of rights.
Remote activation of phones improves access to justice and evidence by letting law enforcement agencies obtain information that is otherwise inaccessible or difficult to obtain. It also lets law enforcement agencies obtain information that is more reliable and accurate than other sources. It also lets law enforcement agencies obtain information that is timelier and more relevant than other sources.
For example, remote activation of phones could help the police access data that is encrypted or password-protected on a device or a communication. It could also help the police access data that is authentic and verifiable on a device or a communication. It could also help the police access data that is up-to-date and pertinent on a device or a communication.
What are the arguments against remote activation of phones?
Some people oppose this technique because they think it has several disadvantages for human rights and civil liberties.
How can remote activation of phones violate privacy and data protection?
One of the main arguments against this technique is that it can violate privacy and data protection for individuals and groups. Privacy and data protection are fundamental rights recognized by international standards and laws. They ensure human dignity and autonomy.
Remote activation of phones violates privacy and data protection by letting law enforcement agencies access personal or professional data without the owners’ or possessors’ consent or knowledge. It also lets law enforcement agencies access sensitive or confidential data without notification or justification. It also lets law enforcement agencies access excessive or irrelevant data without limitation or proportionality.
For example, remote activation of phones could let the police access medical records, financial transactions, political opinions, religious beliefs, sexual preferences, or other intimate information on a device or a communication. It could also let the police access information that is not related to the investigation or that is out of scope on a device or a communication. It could also let the police access information that is not necessary or appropriate for the investigation or that is disproportionate to the seriousness of the offense on a device or a communication.
How can remote activation of phones undermine the presumption of innocence and the right to a fair trial?
Another argument against this technique is that it can undermine the presumption of innocence and the right to a fair trial for individuals and groups. The presumption of innocence and the right to a fair trial are fundamental rights recognized by international standards and laws. They ensure justice and accountability.
Remote activation of phones undermines the presumption of innocence and the right to a fair trial by letting law enforcement agencies access data that they can use against individuals or groups without any legal basis or due process. It also lets law enforcement agencies access data that they can manipulate or falsify by law enforcement agents or hackers. It also lets law enforcement agencies access data that individuals or groups can challenge or contest.
For example, remote activation of phones could let the police access data that they can incriminate individuals or groups without any warrant or authorization from a judge. It could also let the police access data that they can alter or corrupt by law enforcement agents or hackers. It could also let the police access data that individuals or groups can dispute or refute.
How can remote activation of phones create a risk of abuse and misuse by the authorities?
Another argument against this technique is that it can create a risk of abuse and misuse by the authorities for individuals and groups. Abuse and misuse are illegal or unethical actions that violate rights and obligations. They damage trust and legitimacy.
Remote activation of phones creates a risk of abuse and misuse by the authorities by letting law enforcement agencies access data that they can use for purposes other than those authorized or intended. It also lets law enforcement agencies access data that they can share or disclose to third parties without any oversight or control. It also lets law enforcement agencies access data that they can retain or store for longer than necessary or permitted.
For example, remote activation of phones could let the police access data that they can use for political, personal, commercial, or other interests on a device or a communication. It could also let the police access data that they can transfer or leak to other agencies, organizations, media, or individuals on a device or a communication. It could also let the police access data that they can keep or archive for indefinite periods on a device or a communication.
What are the alternatives and safeguards for remote activation of phones?
Some people suggest that there are alternatives and safeguards for remote activation of phones that can balance security and privacy.
What are the existing legal tools to access phone data with judicial authorization?
One of the alternatives for remote activation of phones is to use existing legal tools to access phone data with judicial authorization. Judicial authorization is a legal requirement that ensures respect for rights and obligations. An independent and impartial judge grants it after evaluating the necessity and proportionality of the request.
Existing legal tools to access phone data with judicial authorization include search warrants, wiretaps, geolocation orders, data requisitions, and international cooperation agreements. These tools let law enforcement agencies obtain information from phones in a lawful and transparent manner. They also provide legal protection and recourse for individuals and groups.
For example, search warrants let law enforcement agencies physically seize phones and extract data from them with judicial authorization. Wiretaps let law enforcement agencies intercept calls and messages from phones with judicial authorization. Geolocation orders let law enforcement agencies track the location of phones with judicial authorization. Data requisitions let law enforcement agencies request data from phone operators or service providers with judicial authorization. International cooperation agreements let law enforcement agencies exchange data with foreign authorities with judicial authorization.
What are the principles and conditions for remote activation of phones according to the bill?
One of the safeguards for remote activation of phones is to follow the principles and conditions for remote activation of phones according to the bill. The bill on justice sets some rules and limits for this technique to prevent abuse and misuse.
The principles and conditions for remote activation of phones according to the bill include:
The technique can only be used for terrorism and organized crime investigations.
An independent judge who authorizes it must supervise the technique. The technique can only last for four months renewable once.
The technique must respect necessity, proportionality, subsidiarity, and legality.
Parliament and independent authorities must oversee and control the technique.
Experts and stakeholders must evaluate and review the technique.
These principles and conditions aim to ensure a reasonable and accountable use of this technique. They also aim to protect the rights and interests of individuals and groups.
What are the possible ways to limit or challenge remote activation of phones?
Another safeguard for remote activation of phones is to use possible ways to limit or challenge remote activation of phones by individuals or groups. These ways can help protect rights and interests, as well as ensure accountability and transparency.
Some of the possible ways to limit or challenge remote activation of phones are:
Using encryption technologies:
Encryption technologies can make data on phones unreadable or inaccessible to law enforcement agencies, even if they remotely activate them. Encryption technologies can also protect communications from law enforcement agencies’ interception or recording. For example, using end-to-end encryption apps, such as Signal or WhatsApp, can prevent law enforcement agencies from accessing messages or calls on phones.
Using security features:
Security features can prevent law enforcement agencies from installing or activating software or applications on phones that enable remote activation. Security features can also detect or remove software or applications that enable remote activation. For example, using antivirus software, firewalls, passwords, biometrics, or VPNs can prevent law enforcement agencies from accessing phones.
Using legal remedies:
Legal remedies can let individuals or groups contest or oppose remote activation of phones by law enforcement agencies. Legal remedies can also let individuals or groups seek compensation or redress for damages caused by remote activation of phones. For example, using judicial review, administrative appeals, complaints, lawsuits, or human rights mechanisms can challenge law enforcement agencies’ actions or decisions regarding remote activation of phones.
How does this technique compare with other countries?
Law enforcement agencies in other countries, such as the United States, Germany, Italy, Israel, Canada, China, France, and the United Kingdom, have used or considered remote activation of phones by the police. This technique is not new or unique. However, the legal framework, the technical methods, and the ethical and social implications of this technique vary from country to country..
How does remote activation of phones by the police work in different countries?
Remote activation of phones by the police is an intelligence technique that varies from country to country. It depends on the legal framework, the technical methods and the ethical issues of each country. Here are some examples of how it works in different countries.
In the United States, this technique is known as “roving bugs” or “mobile device tracking”. The Foreign Intelligence Surveillance Act (FISA) authorizes it for national security purposes and Title III of the Omnibus Crime Control and Safe Streets Act for criminal investigations. It requires a court order based on probable cause and limited in scope and duration. It can locate or record sounds and images from phones. It can be done by installing malware or exploiting vulnerabilities on phones.
In Germany, this technique is known as “Quellen-TKÜ” or “source telecommunications surveillance”. The Code of Criminal Procedure and the Telecommunications Act regulate it for criminal investigations and the Federal Intelligence Service Act for national security purposes. It requires a court order based on reasonable suspicion and proportionality. It can intercept communications from phones. To do so, it installs software or uses spyware on phones.
In Italy, this technique is known as “Trojan horse” or “spyware”. The Code of Criminal Procedure and the Data Protection Code regulate it for criminal investigations. It requires a court order based on serious indications of guilt and necessity. It can access data or record sounds and images from phones. To do so, it installs software or uses spyware on phones.
In Israel, this technique is known as “IMSI catchers” or “stingrays”. The Wiretapping Law and the Privacy Protection Law regulate it for criminal investigations and the Security Service Law for national security purposes. It requires a court order based on reasonable grounds and proportionality. It can locate or intercept communications from phones. To do so, it uses devices that mimic cell towers and trick phones into connecting to them.
In Canada, this technique is known as “cell site simulators” or “IMSI catchers”. The Criminal Code and the Charter of Rights and Freedoms regulate it for criminal investigations. It requires a court order based on reasonable grounds and proportionality. It can locate or intercept communications from phones. To do so, it uses devices that mimic cell towers and trick phones into connecting to them.
In France, real-time geolocation is regulated by the Criminal Procedure Code and the Intelligence Law for criminal and national security investigations. Article 706-102-1 of the Criminal Procedure Code allows police officers and agents to use a technical device to access, record, store and transmit computer data without the consent of the persons concerned. This requires a court order based on serious reasons and proportionality. Article 230-32 of the Criminal Procedure Code states that “Any technical means for real-time location, throughout the national territory, of a person, without his consent, a vehicle or any other object, without the consent of its owner or possessor, may be used if this operation is required by necessity: “. This also requires a court order based on serious reasons and proportionality.
In the United Kingdom, this technique is known as “equipment interference” or “hacking”. The Investigatory Powers Act regulates it for criminal investigations and national security purposes. It requires a warrant based on necessity and proportionality. It can access data or record sounds and images from phones. To do so, it installs software or uses spyware on phones.
How does remote activation of phones by the police raise ethical and social challenges?
Remote activation of phones by the police raises ethical and social challenges in different contexts and situations because it involves a trade-off between security and privacy, as well as between effectiveness and legitimacy.
Security versus privacy
On one hand, remote activation of phones by the police can enhance security by providing law enforcement agencies with more information and evidence to prevent, investigate, and prosecute crimes. It can also deter criminals from using phones to plan or commit crimes.
On the other hand, remote activation of phones by the police can undermine privacy by letting law enforcement agencies access personal or professional data without consent or knowledge. It can also violate human rights and civil liberties by letting law enforcement agencies monitor or record sounds and images without notification or justification.
Effectiveness versus legitimacy
On one hand, remote activation of phones by the police can be effective by increasing the chances of finding relevant information or evidence on phones that may be encrypted, hidden, or destroyed. It can also be efficient by reducing the costs and risks of physical surveillance or interception.
On the other hand, remote activation of phones by the police can be illegitimate by violating the legal framework, the technical methods, or the oversight and control mechanisms that regulate this technique in each country. It can also be counterproductive by creating distrust or resistance among phone users or providers, who may use encryption technologies or legal remedies to protect their data or communications.
The ethical and social challenges of remote activation of phones by the police depend on the legal framework, the technical methods, and the oversight and control mechanisms that regulate this technique in each country. They also depend on the cultural and political values, the public opinion, and the media coverage that shape the perception and acceptance of this technique in each country.
Some of the ethical and social challenges of remote activation of phones by the police are how to :
balance security and privacy in the use of this technique?
ensure compliance with fundamental rights and freedoms in the use of this technique?
prevent abuse, misuse, or error in the use of this technique?
provide legal protection and recourse for individuals or groups affected by this technique?
ensure accountability and transparency in the use of this technique?
evaluate the effectiveness and legitimacy of this technique?
foster trust and cooperation between law enforcement agencies and phone users in the use of this technique?
What is the impact of encryption technologies on this technique?
Encryption technologies are methods or systems that make data unreadable or inaccessible to unauthorized parties. Encryption technologies can have a significant impact on remote activation of phones by the police, as they can make this technique more difficult, risky, or controversial.
How can encryption technologies make remote activation of phones by the police more difficult or impossible?
Encryption technologies can make remote activation of phones by the police more difficult or impossible by preventing law enforcement agencies from accessing data or communications on phones, even if they remotely activate them. Encryption technologies can also protect phones from malware or spyware that enable remote activation.
For example, end-to-end encryption, which some apps such as Signal or WhatsApp use, can prevent law enforcement agencies from intercepting or reading messages or calls on phones, as only the sender and the receiver have the keys to decrypt them. Device encryption, which some operating systems such as iOS or Android use, can prevent law enforcement agencies from extracting or viewing data on phones, as they require a password or a biometric authentication to unlock them.
How can encryption technologies make remote activation of phones by the police more risky or harmful?
Encryption technologies can make remote activation of phones by the police more risky or harmful by exposing law enforcement agencies to legal or technical challenges or dangers. Encryption technologies can also harm phone users by compromising their security or privacy.
For example, breaking encryption, which law enforcement agencies sometimes do to access data or communications on phones, can expose them to legal challenges, as it may violate laws or regulations that protect encryption or privacy. It can also expose them to technical dangers, as it may weaken the security of phones or networks and create vulnerabilities for hackers or criminals. Hacking encryption, which law enforcement agencies sometimes do to install malware or spyware on phones, can harm phone users by compromising their security or privacy, as it may allow unauthorized access to their data or functions.
How can encryption technologies make remote activation of phones by the police more controversial or unacceptable?
Encryption technologies can make remote activation of phones by the police more controversial or unacceptable by raising ethical and social issues or debates. Encryption technologies can also create conflicts or tensions between law enforcement agencies and phone users or providers.
For example, undermining encryption, which law enforcement agencies sometimes request to facilitate remote activation of phones, can raise ethical and social issues or debates, as it may affect human rights and civil liberties, such as privacy, confidentiality, dignity, presumption of innocence, and right to a fair trial. It can also create conflicts or tensions between law enforcement agencies and phone users or providers. They may have different interests or values regarding encryption and security.
How does EviCore NFC HSM technology developed by Freemindtronic offer a high level of protection for phone users?
Remote activation of phones by the police can be facilitated by exploiting security flaws, installing malware, or requesting backdoors in encryption technologies. However, some encryption technologies may be resistant to these measures and offer a higher level of protection for phone users. One of them is the EviCore NFC HSM technology developed by Freemindtronic.
This technology lets users create their own encryption keys in a random way and store them in a physical device that communicates with the phone via NFC (Near Field Communication). The device also lets users define their own trust criteria that must be met to use the keys or their segments. The encryption is done in post-quantum AES-256 mode from either a device compatible with the EviCore NFC HSM technology or from an encrypted enclave in the phone created in the Key chain (Apple) or the Key store (Android) via the EviCore HSM OpenPGP technology. The encryption keys are segmented and superior to 256 bits. Moreover, they are physically externalized from computer systems. Everything is designed by Freemindtronic to effectively fight against espionage and corruption of telephone, computer, communication and information systems. Finally, without a server, without a database, even in air gap and airplane mode works EviCore NFC HSM or EviCore HSM OpenPGP technology. Everything is designed to work in volatile memory to leave no trace in telephone and computer systems.
This technology offers a high level of security and privacy for phone users who want to protect their data from unauthorized access, including by the police. It also offers a high level of performance and usability for phone users who want to encrypt or over-encrypt all types of messaging in the world, including SMS and MMS. It also works with other applications that use encryption, such as email, cloud storage or blockchain.
Furthermore, this technology is designed to be totally anonymous, autonomous, unconnected, without a database, without collecting any information of any kind on the identity of the user, nor on the hardware, nor on the terminals used. The technology is designed to be totally isolated and totally independent of the security of the terminal used whether it is connected or not. Freemindtronic does not keep the unique pairing keys for each NFC HSM device. And even if it did, the user at installation will automatically generate segmented complementary keys for encryption with administrator and user passwords. Each NFC device has a unique 128-bit signature dedicated to fighting against counterfeiting of NFC devices. It is also used as a key segment. The secret stored in eprom memories or in enclaves of the phone and/or computer can be individually secured by other segmented keys characterized by additional trust criteria such as a geozone, a random hexadecimal code via an existing or generated QR code or Bar Code via EviCore HSM. It is therefore physically impossible for Freemindtronic but under judicial assignment to decrypt data encrypted via EviCore HSM technologies even with a quantum computer.
Conclusion
Remote activation of phones by the police is an intelligence technique. It aims to fight terrorism and crime by accessing data or sounds and images from phones without consent or knowledge. Law enforcement agencies in various countries have used or considered this technique. For example, France, the United States, Germany, Italy, Israel, Canada, China, and the United Kingdom. However, this technique raises technical, legal, ethical, and social challenges. They need to be addressed.
On the technical side, remote activation of phones by the police depends on three factors: compatibility, connectivity, and security of the phones. It can be done by three methods: exploiting vulnerabilities, installing malware, or using spyware on phones.For example, EviCore NFC HSM technology developed by Freemindtronic protects data and communications on phones from remote activation by the police. Encryption technologies can make this technique more difficult or impossible by preventing law enforcement agencies from accessing data or communications on phones, even if they remotely activate them.
On the legal side, remote activation of phones by the police requires a legal framework that regulates its use and scope. Laws or regulations can authorize it and specify the conditions and criteria for its application. Legal remedies can also challenge it and contest or oppose its validity or legality.
On the ethical side, remote activation of phones by the police involves a trade-off between security and privacy, as well as between effectiveness and legitimacy. It can enhance security by providing more information and evidence to law enforcement agencies to prevent, investigate, and prosecute crimes. It can also undermine privacy by letting law enforcement agencies access personal or professional data without notification or justification.
On the social side, remote activation of phones by the police raises issues or debates that affect human rights and civil liberties. For example, privacy, confidentiality, dignity, presumption of innocence, and right to a fair trial. It can also create conflicts or tensions between law enforcement agencies and phone users or providers, as they may have different interests or values regarding encryption and security.
Therefore, remote activation of phones by the police is a complex and controversial technique that requires a careful and balanced approach that respects the rights and interests of all parties involved. The French bill on remote activation of phones by the police and the EviCore NFC HSM Open PGP technology developed by Freemindtronic illustrate the complex and evolving relationship between intelligence and encryption in the digital age. They raise questions about finding a balance. It is between security and privacy, between public interest and individual rights, between innovation and regulation.
Protect Meta Account identity theft by Jacques Gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
How to Spot and Avoid Phishing Attacks on Meta
Have you ever wondered what would happen if someone hacked your Meta account and used it for malicious purposes? Identity theft is a serious threat that affects millions of internet users worldwide. It can harm your reputation, finances, privacy, and even your safety. That’s why it’s essential to protect your Meta account from identity theft.
Articles Crypto Currency Digital Security EviSeed EviVault Technology News
Meta is a family of products that includes Facebook, Instagram, Messenger, WhatsApp, Oculus, and more. These products allow you to connect with people, share content, play games, shop online, and explore new realities. However, they also store a lot of personal information that can be exploited by hackers if you don’t secure your account properly.
Identity theft of online accounts is a growing problem that affects many Meta users. Hackers use various techniques to illegally obtain user credentials and two-factor authentication information. This results in financial, legal, and psychological consequences for the victims, who find themselves deprived of their digital identity. In this article, we explain how to protect your Meta account from identity theft, with a focus on the security of your passwords and your two-factor authentication. We also present real testimonials of identity theft on Meta, which illustrate the seriousness of this problem and the importance of protecting yourself. Finally, we introduce you to an innovative solution that allows you to manage OTP tokens (One Time Password) securely and contactlessly thanks to an NFC device (Near Field Communication).
Creating Strong and Unique Passwords to Safeguard Your Meta Account
To enhance the security of your Meta account, it’s crucial to create strong and unique passwords. A strong password is the first line of defense against identity theft. Use a combination of uppercase and lowercase letters, numbers, and special characters. Avoid using obvious personal information, such as your name or date of birth. Furthermore, avoid reusing the same password on multiple accounts, as this makes it easier for hackers to gain unauthorized access. Consider using a secure password manager such as EviPass, offered by Freemindtronic, to store your passwords securely and regularly check their integrity.
Enhancing Meta Account Security with Two-Factor Authentication (2FA)
Enhancing the security of your Meta account is crucial, and enabling two-factor authentication (2FA) is an effective way to achieve that. In the security and login settings of your Meta account, you have access to a range of 2FA methods. Each method has its own advantages and considerations, empowering you to select the most suitable option for your needs.
Table: Comparison of Different 2FA Methods on Meta
2FA Method
Advantages
Disadvantages
Security Key
Highly secure, doesn’t require internet connection
Expensive, susceptible to loss or forgetfulness, requires USB or NFC port
Authentication App
More secure than SMS, compatible with multiple accounts
Risk of smartphone loss or theft, requires prior installation
SMS
Simple and quick
Risk of phone number hacking, reliance on mobile network
Authentication Applications
Enhanced security, generates secure 2FA codes
Risk of smartphone loss or theft
EviPass
Highly secure, contactless, compatible with multiple accounts, no prior installation required
Requires purchase of EviPass device
The Ultimate Solution – EviPass and EviOTP for Meta Account Protection
EviPass, powered by Freemindtronic’s EviOTP technology, offers the best of both worlds with its PassCypher product. PassCypher combines two technologies: EviPass Hardware and/or Digital Manager, compatible with Freemindtronic’s NFC HSM devices. It also incorporates the EviOTP technology, a secret key manager for OTP and HOTP, enabling the generation of OTP codes. With PassCypher, you can experience highly secure and contactless 2FA. It eliminates the need for prior installation and provides a seamless user experience. By securely storing and generating OTP secret keys using EviOTP technology, PassCypher ensures end-to-end authentication. Please note that the PassCypher device, which includes EviPass and EviOTP technologies, needs to be purchased to utilize this comprehensive solution.
Being Vigilant Against Phishing Attacks to Secure Your Meta Account
Hackers often use phishing techniques to trick you into disclosing your credentials. Be vigilant about suspicious emails or messages asking for your credentials or personal information. Do not click on dubious links and always check the website address before entering your information. If you receive a suspicious message claiming to be from Meta, report it immediately.
Regularly Updating Security Information for Meta Account Protection
To maintain optimal security, it is important to update your security information regularly, such as your recovery email address and phone number. This information will allow you to regain access to your account in case of identity theft or password forgetfulness. Make sure you choose secure and easily accessible recovery information that only you have access to.
Implementing EviOTP for Enhanced Meta Account Security against Identity Theft
One innovative solution for securing your Meta account is EviOTP by Freemindtronic. EviOTP utilizes contactless technology and NFC devices to securely manage OTP tokens (One Time Passwords). By enabling two-factor authentication with EviOTP, you are required to provide an additional code along with your password when logging into your Meta account. This method offers optimal protection against phishing attacks and identity theft, as your OTP tokens are stored and encrypted within the NFC device, physically isolated from your computer and phone systems.
Table: Advantages and disadvantages 2FA
2FA Method
Pros
Cons
SMS
Simple and fast
Risk of hacking your phone number, dependence on mobile network
Authentication App
More secure than SMS, compatible with multiple accounts
Risk of losing or stealing your smartphone, requires prior installation
Security Key
Very secure, does not require internet connection
Expensive, easy to lose or forget, requires USB or NFC port
EviOTP
Very secure, contactless, compatible with multiple accounts, does not require prior installation
Requires purchasing the EviOTP device
Considering the different options available, each 2FA method offers unique benefits and drawbacks. Security keys provide a high level of security but may be costly and prone to loss. Authentication apps offer increased security and compatibility, but the risk of smartphone theft exists. SMS codes are simple and fast but carry the risk of phone number hacking. Authentication applications like Google Authenticator or Microsoft Authenticator generate secure codes but are still susceptible to smartphone loss. Finally, EviOTP stands out as a highly secure, contactless option compatible with multiple accounts, although it requires purchasing the EviOTP device.
EviOTP – The Ultimate 2FA Solution
For the ultimate 2FA solution, EviOTP by Freemindtronic offers unmatched security and convenience. EviOTP combines contactless technology, compatibility with multiple accounts, and a seamless user experience. It eliminates the need for prior installation and configuration, making it ready to use right out of the box. By securely storing and generating OTP secret keys, EviOTP ensures end-to-end authentication. To benefit from EviOTP, please note that the EviOTP device must be purchased.
To enable two-factor authentication with Contactless OTP Manager, you must follow these steps:
Download and install the PassCypher application embedding the EviPass technology and especially EviOTP on your NFC-compatible Android mobile device from the Google Play Store.
Log in to your Meta account on a computer or mobile browser.
Go to the security and login settings of your Meta account and click on “Use two-factor authentication”.
Choose the option “Authentication application” and follow the instructions on the screen.
Open the PassCypher application on your mobile device and bring your Contactless OTP Manager device close to the phone to scan the QR code displayed by Meta.
Enter the six-digit code generated by Contactless OTP Manager in the “Security Code” field on Meta and click on “Next”.
Save the recovery codes provided by Meta in case of loss or theft in your Contactless OTP Manager device that you also use to generate codes to authenticate yourself.
Beware of phishing attacks
Hackers often use phishing techniques to trick you into disclosing your credentials. Be vigilant about suspicious emails or messages asking for your credentials or personal information. Do not click on dubious links and always check the website address before entering your information. If you receive a suspicious message claiming to be from Meta, report it immediately.
Update your security information regularly
To maintain optimal security, it is important to update your security information regularly, such as your recovery email address and phone number. This information will allow you to regain access to your account in case of identity theft or password forgetfulness. Make sure you choose secure and easily accessible recovery information only by you.
Real Testimonials of Meta Account Identity Theft and Steps to Protect Yourself
Identity theft is a phenomenon that affects more and more internet users worldwide. According to a study by the Federal Trade Commission, consumers reported losing more than $5.8 billion to fraud in 2021, an increase of more than 70% over the previous year. Among the most common types of fraud are identity theft scams, which aim to steal the login information of users on various Meta products, such as Instagram, Facebook, Messenger, WhatsApp or Oculus. These information can then be used to harm the reputation, finances or privacy of the victims.
Finding real testimonials of identity theft on Meta is not always easy. Indeed, victims may feel ashamed of being fooled, afraid of the consequences or simply not know who to turn to report the problem or ask for help. That’s why we have gathered in this section some true and verified stories that illustrate the different possible scenarios of identity theft on Meta. These stories are presented in the form of small short paragraphs that are easy to read and explain how the victims discovered the hacking, how they reacted and what were the consequences.
We hope that these testimonials will help you to become aware of the risks associated with identity theft on Meta and to adopt good practices to protect your personal data online. If you are a victim or witness of identity theft, do not hesitate to report the problem to the competent authorities and ask for help from specialized services.
Marie found June 6, 2021 Marie’s Instagram account was hacked by scammers. They tricked her into giving them her login information. They used her account to ask her followers for money. Marie reported the hack to Instagram and warned her contacts. She finally got her account and her 2,000 followers back. She learned to be more careful online.
A woman from France had her Instagram account hacked by scammers who tried to extort money from her followers. She contacted Meta, but received no response. She then contacted a cybersecurity expert who helped her recover her account and her 6,000 followers.
Muriel, a regular user of Meta, was a victim of identity theft on her personal account as well as on her Meta Business Manager account. Despite activating two-factor authentication, hackers managed to bypass security measures, leaving Muriel in a difficult situation. Unable to receive the necessary help from Meta, she shared her experience on social networks, hoping to find a contact within Meta who could help her solve this frustrating problem.
In December 2021, Meta filed a lawsuit against the bad actors who allegedly created over 39,000 websites that resembled the login pages of Instagram, Facebook, Messenger, and WhatsApp. The defendants used these websites to deceive users and collect their login information. They also infringed Meta’s trademarks by using its logos and names on their fake pages.
In October 2022, a woman discovered that her Instagram account had been hacked and that a scammer had used her identity to blackmail her followers. He sent them messages pretending to be her and asking for nude photos or money. He threatened to expose their private conversations or photos if they did not comply. The victim reported the hack to Instagram and warned her contacts about the scam.
In October 2021, a man was sentenced to 18 months in prison with a suspended sentence for having impersonated several personalities on social networks, including the president of the French Republic Emmanuel Macron. He created fake META (ex-Facebook) accounts and sent private messages to internet users asking them for money or services. He also tried to extort personal information from journalists and politicians by pretending to be their relatives or collaborators.
In February 2020, a woman discovered that her META account had been hacked and that a scammer had used her identity to trick her friends. He sent them messages pretending to be her and asking them for financial help for an emergency. He then asked them to send him PCS recharge codes (prepaid cards) that he could use to buy goods or services online. The victim filed a complaint and alerted her contacts about the hack.
French case of Loïc: Loïc suffered identity theft on Meta for a grueling period of 17 years. Hackers opened numerous bank accounts in his name, took out consumer loans and used his information to benefit from social and tax benefits. Loïc recounted his ordeal during an interview with Olivier Delacroix on Europe 1 on January 15th, 2019. For years, he had to provide proof of identity and fight with administrations, banks and bailiffs to restore the truth and regain control of his digital identity.
Case of Julie: Julie was a victim of identity theft on her Meta account by her ex-partner. He managed to access her account by cloning her SIM card, changing her security information and posting defamatory messages in her name. Julie quickly became aware of the situation and immediately filed a complaint with the competent authorities. She also contacted the Cybermalveillance.gouv.fr service to get help in the process of recovering her account and protecting her online reputation.
Thomas’s Instagram account was hacked by a hacker who impersonated him and sent rude messages to his contacts. He managed to recover his account with the help of a cybersecurity expert.
Benoît fell victim to a scam on WhatsApp. He received a message from a friend who asked him to lend him money urgently. He agreed and sent 500 euros by bank transfer. He realized too late that it was an impostor who had hacked his friend’s account.
Clara was a victim of identity theft on her Facebook account. She received a notification that told her she had won a free trip and asked her to click on a link to claim it. She followed the link and entered her Facebook credentials. She realized too late that it was a trap to steal her data and use it to create fake profiles in her name.
David was a victim of identity theft on his Oculus account. He received an email that told him he had been selected to test a new virtual reality game and asked him to download an app on his smartphone. He downloaded the app and scanned a QR code with his Oculus headset. He realized too late that it was a malicious software that had stolen his login information and used his account to buy games without his permission.
Emma was a victim of identity theft on her Meta Workplace account. She received a message from a colleague who asked her to send him confidential documents related to an ongoing project. She trusted him and sent the documents by email. She realized too late that it was an impostor who had hacked her colleague’s account and used the documents to harm the company.
Another real case of identity theft on Meta is that of Aaron Elekes. This film and TV producer had his Facebook account hacked by scammers who impersonated him and his contacts. Despite his efforts to recover his account, he did not receive the necessary help from Meta. He had to create several new accounts under his name, which caused him a lot of stress and frustration. This testimonial shows how important it is to protect your Meta account from identity theft.
A company called Meta that accuses Meta (formerly Facebook) of unlawfully seizing its mark, name and identity.
The risks associated with identity theft on Meta, such as the loss of personal data, the spread of false information, the contact scam or the infringement of copyright.
These real testimonials of identity theft on Meta illustrate the severity of the problem and highlight the importance of taking adequate security measures to protect your account. By following the tips mentioned above, such as creating strong passwords, enabling two-factor authentication and using innovative solutions like EviPass and EviOTP, you can enhance the security of your Meta account and significantly reduce the risks of identity theft.
Conclusion: Safeguard Your Meta Account from Identity Theft
Protecting your Meta account from identity theft is essential to preserve your online security. By following the recommended security measures, such as creating strong and unique passwords, enabling two-factor authentication and using innovative solutions like EviPass and EviOTP from Freemindtronic, you enhance the security of your account and reduce the risks of identity theft. Also be vigilant about phishing attempts and make sure to update your security information regularly. Use the tools and technologies at your disposal to enhance the security of your Meta account. By following these tips, you will be able to fully enjoy your experience on Meta with peace of mind.
Protect your digital identity and take the necessary steps to secure your Meta account now. Don’t let hackers steal your online identity. Be proactive in your approach to security and make protecting your account a top priority.
By adopting strong security measures and staying informed about the latest techniques used by hackers, you can minimize the risks of identity theft and protect your digital life on Meta. Make sure you implement the recommendations presented in this article and don’t hesitate to explore more advanced security solutions to further enhance the protection of your account. Your online security is in your hands, so act now to protect your Meta account from identity theft.
Protect your digital identity and take the necessary steps to secure your Meta account now. Don’t let hackers steal your online identity. Be proactive in your approach to security and make protecting your account a top priority.
By adopting strong security measures and staying informed about the latest techniques used by hackers, you can minimize the risks of identity theft and protect your digital life on Meta. Make sure you implement the recommendations presented in this article and don’t hesitate to explore more advanced security solutions to further enhance the protection of your account. Your online security is in your hands, so act now to protect your Meta account from identity theft.
Remember that securing your Meta account is not limited to these measures. Stay vigilant, educate yourself on the latest security practices and be proactive in protecting your digital identity. By taking these precautions, you can fully enjoy your experience on Meta safely and peacefully.
About Freemindtronic
Freemindtronic is a company specialized in digital security solutions based on NFC technology (Near Field Communication). Founded in 2017 by Jean-Marc Zanni, an expert in embedded systems engineering, Freemindtronic offers innovative products such as EviPass and EviOTP that allow users to manage their passwords and OTP tokens securely and contactlessly. Freemindtronic’s solutions are designed for individuals and professionals who want to protect their digital identity from cyberattacks and identity theft.
BIP39 by Jacques gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
BIP39: how to create and restore your Bitcoin wallets securely
Do you want to know how BIP39 helps you manage your cryptographic keys with a simple mnemonic phrase? Find out in this article how this standard works and how to use it to protect your bitcoins.
How BIP39 helps you create and restore your Bitcoin wallets
Do you struggle to manage your cryptocurrency wallets? Are you looking for a simple and secure solution to create and restore your wallets? You are not alone. According to a study, more than 20% of cryptocurrency users have lost access to their funds because of a forgotten or stolen private key. Fortunately, there is an innovative solution to avoid this problem: BIP39 and mnemonic phrases. In this article, we will explain what BIP39 is, how it works, what are its advantages and disadvantages, and which wallets support it.
What is BIP39 and how does it work?
BIP39, also known as Bitcoin Improvement Proposal 39, proposes a novel method to simplify the creation and recovery of cryptocurrency wallets. It relies on the use of mnemonic phrases, which are sequences of words easy to remember generated from a predefined list of words. These mnemonic phrases serve to derive the private keys that allow you to access your funds. The use of this method greatly simplifies the management and backup of wallets, avoiding the need to memorize complex private keys.
BIP39 is part of the many BIPs (Bitcoin Improvement Proposals) that aim to improve the Bitcoin protocol. It was proposed in 2013 by Marek Palatinus, Pavol Rusnak, Aaron Voisine and Sean Bowe. It was implemented on Bitcoin in 2014 and has been adopted by many other cryptocurrency projects since then. You can consult the official document of BIP39 here (link to https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki).
The benefits of BIP39
BIP39 has many benefits for cryptocurrency users. First of all, it simplifies considerably the process of creating and recovering wallets. Thanks to mnemonic phrases, it becomes easier to backup and restore your wallets in case of need. Moreover, these mnemonic phrases are generally more user-friendly, as they are composed of words in natural language, which makes them easier to remember.
Another important benefit is compatibility. Many hardware and software wallets support BIP39, which offers great flexibility in choosing the wallet suitable for your needs. Whether you prefer a physical wallet or a software solution, there is a high chance that you can find a wallet compatible with BIP39.
The drawbacks of BIP39
Despite its many benefits, BIP39 also has some drawbacks. The main drawback lies in the security of the mnemonic phrase. Given that the mnemonic phrase is the key to access your funds, its loss or theft can result in the total loss of your cryptocurrencies. It is therefore crucial to take appropriate security measures to protect your mnemonic phrase, such as secure backup in an offline location.
Another drawback is the dependence on wallet software compatible with BIP39. It is important to verify that the wallet you use supports BIP39 before generating your mnemonic phrase. Otherwise, you may not be able to access your funds with another wallet that uses the same protocol.
Cold wallet vs hardware wallet: what’s the difference?
If you own cryptocurrencies, you need a wallet to store and manage them. But not all wallets are the same. In this article, we will explain the difference between a cold wallet and a hardware wallet, and how to choose the best one for your needs.
What is a cold wallet?
A cold wallet is a type of hardware wallet that is very secure: it never interacts with any smart contract or external source; it only stores assets and executes transfers between your other wallets. For example, a hardware wallet that is not used to explore Web3 can be considered a cold wallet.
What is a hardware wallet?
A hardware wallet is a physical device that stores your private keys in an isolated environment from an internet connection. This is important, because anyone who has access to your private keys has access to your crypto. A hardware wallet also allows you to sign transactions; enabling you to interact with different blockchain networks.
What is the difference between a cold wallet and a hardware wallet?
The main difference between a cold wallet and a hardware wallet is the level of interaction with smart contracts and external sources. A cold wallet is safer than a hardware wallet active online, because it does not face any threat from interactions with smart contracts.
Here is a summary table of the advantages and disadvantages of each type of wallet:
Cold Wallet
Hardware Wallet
+ Very secure
+ Secure
+ Ideal for long-term storage
+ Ideal for Web3 exploration
– Not convenient for frequent transactions
– Less secure than a cold wallet
– Can be lost or damaged
– Can be hacked by malicious smart contracts
What standard is used to generate the mnemonic phrase or mnemonic code?
Another important aspect to consider when choosing a wallet is the standard used to generate the mnemonic phrase or mnemonic code. This is a group of easy-to-remember words that serves as a backup for your wallet in case of loss or destruction. The most common standard is BIP39, which is used by many deterministic (HD) wallets and not only by Bitcoin wallets. It has also been adopted for use in many other cryptocurrency projects.
Cold wallets and hardware wallets generally use BIP39 for master key generation. Some hardware wallets also use other BIPs to improve the security and functionality of their wallets. For example:
The Trezor Model T uses BIP32, BIP39, BIP44 and SLIP39. SLIP39 is an improvement of BIP39 that allows creating split backups (Shamir Backup) for increased security.
The Coldcard uses BIP32, BIP39 and BIP174. BIP174 is a standardized format for partially signed transactions (PSBT) that allows signing transactions offline.
What are the different types of cold wallets and hardware wallets?
There are different types of cold wallets and hardware wallets, and some can belong to both categories. For example, the Keepser is an NFC cold wallet that uses BIP39 to save seed phrases generated by other wallets or blockchains. It is therefore a type of hardware wallet that comes in the form of a contactless card that communicates with an application on your smartphone. The Keepser only protects cryptocurrency private keys, and not other types of private keys. It also allows printing private keys and seed phrases in the form of encrypted QR codes, which can be scanned by the Keepser application to restore wallets. The Keepser uses EviVault and EviSeed technology developed by Freemindtronic, a company specialized in cybersecurity and custom product design.
It is therefore important to check what standards are supported by the wallet you choose and how they affect the security and compatibility of your wallet.
How to choose a BIP39-compatible wallet
Update 29/05/2023
To fully enjoy the benefits of BIP39, it is essential to choose a wallet compatible with this feature. Many hardware and software wallets support BIP39, offering a simplified and secure experience. To help you in your choice, we have created a comprehensive table that compares the best wallets compatible with BIP39:
Any blockchain that supports BIP39 mnemonic phrases
Yes
Hong Kong
7
Crypto Seed Phrase Storage
Shieldfolio Stonebook
N/A
N/A
N/A
8
Crypto Seed Phrase Storage
Blockplate
N/A
N/A
N/A
9
Crypto Seed Phrase Storage
Cryptosteel Cassette
N/A
N/A
N/A
10
Crypto Seed Phrase Storage
Billfodl
N/A
N/A
N/A
11
Crypto Seed Phrase Storage
Crypto Key Stack
N/A
N/A
N/A
12
Crypto Seed Phrase Storage
CryptoSteel HEX Backup
N/A
N/A
N/A
13
Crypto Seed Phrase Storage
Cobo Tablet
N/A
N/A
China
14
Crypto Seed Phrase Storage
NGRAVE Graphene
N/A
N/A
Belgium
15
Crypto Seed Phrase Storage
Osmosis Trezor Wallet
N/A
N/A
N/A
16
Crypto Seed Phrase Storage
Safepal S1 Pro
N/A
N/A
N/A
Mobile Wallets
No
Type of product
Product Name
Compatible blockchains
BIP39 supported
Country of origin
1
Mobile Wallet
Trust Wallet
Bitcoin, Ethereum, etc.
Yes
Unknown
2
Mobile Wallet
Coinomi Wallet
Bitcoin, Ethereum, etc.
Yes
Unknown
3
Mobile Wallet
Edge Wallet
Bitcoin, Ethereum, etc.
Yes
United States
4
Mobile Wallet
BRD Wallet
Bitcoin, Ethereum, etc.
Yes
Unknown
5
Mobile Wallet
Mycelium Wallet
Bitcoin
Yes
Austria
6
Mobile Wallet
Infinito Wallet
Multiple
Yes
Unknown
7
Mobile Wallet
Jaxx Liberty
Bitcoin, Ethereum, etc.
Yes
Unknown
8
Mobile Wallet
Coin98 Wallet
Ethereum, Binance Smart Chain, etc.
Yes
Unknown
9
Mobile Wallet
Trustee Wallet
Bitcoin, Ethereum, etc.
Yes
Unknown
10
Mobile Wallet
Enjin Wallet
Ethereum, ERC-20 tokens
Yes
Unknown
11
Mobile Wallet
Abra Wallet
Bitcoin, Ethereum, etc.
Yes
United States
12
Mobile Wallet
Lumi Wallet
Bitcoin, Ethereum, etc.
Yes
Unknown
13
Mobile Wallet
Samourai Wallet
Bitcoin
Yes
Unknown
14
Mobile Wallet
Wasabi Wallet
Bitcoin
Yes
Unknown
15
Mobile Wallet
GreenAddress Wallet
Bitcoin
Yes
Unknown
16
Mobile Wallet
Coin.Space Wallet
Bitcoin, Ethereum, etc.
Yes
Unknown
17
Mobile Wallet
Electrum Wallet
Bitcoin
Yes
Unknown
Paper Wallets
No
Type of product
Product Name
Compatible blockchains
BIP39 supported
Country of origin
1
Paper Wallet
Bitaddress.org
Bitcoin
Yes
Unknown
2
Paper Wallet
WalletGenerator.net
Bitcoin, Ethereum, etc.
Yes
Unknown
3
Paper Wallet
MyEtherWallet
Ethereum
Yes
Unknown
4
Paper Wallet
MoneroAddress.org
Monero
Yes
Unknown
5
Paper Wallet
Liteaddress.org
Litecoin
Yes
Unknown
6
Paper Wallet
WalletGenerator.net
Multiple
Yes
Unknown
7
Paper Wallet
Bitcoin Paper Wallet
Bitcoin
No
Unknown
8
Paper Wallet
Liteaddress.org
Litecoin
Yes
Unknown
9
Paper Wallet
MoneroAddress.org
Monero
Yes
Unknown
10
Paper Wallet
Card Wallet
Multiple
No
Unknown
11
Paper Wallet
Ethaddress.org
Ethereum
Yes
Unknown
12
Paper Wallet
Stellar Paper Wallet
Stellar
No
Unknown
Other Wallets
No
Type of product
Product Name
Compatible blockchains
BIP39 supported
Country of origin
1
Other Wallet
Web Wallets
Bitcoin, Ethereum, etc.
Yes
Unknown
2
Other Wallet
Exchange Wallets
Bitcoin, Ethereum, etc.
Yes
Unknown
3
Other Wallet
Custodial Wallets
Bitcoin, Ethereum, etc.
Yes
Unknown
4
Other Wallet
Vault Wallets
Bitcoin, Ethereum, etc.
Yes
Unknown
5
Other Wallet
Multisig Wallets
Bitcoin, Ethereum, etc.
Yes
Unknown
6
Other Wallet
Software Wallets
Bitcoin, Ethereum, etc.
Yes
Unknown
7
Other Wallet
Multicurrency Wallet
Multiple
Yes
Unknown
8
Other Wallet
Multi-Asset Wallet
Multiple
Yes
Unknown
9
Other Wallett
Mobile Wallets
Multiple
Yes
Unknown
10
Other Wallet
Desktop Wallets
Multiple
Yes
Unknown
11
Other Wallet
Web3 Wallets
Ethereum
Yes
Unknown
12
Other Wallet
DApp Wallets
Ethereum
Yes
Unknown
How to secure your mnemonic phrase with EviSeed?
If you use a BIP39-compatible wallet, you must imperatively protect your mnemonic phrase against any loss or theft. An innovative solution for this is EviSeed, developed by Freemindtronic. EviSeed is an electronic device that allows you to store your mnemonic phrase in a secure and resistant NFC card against physical or logical attacks.
EviSeed offers several advantages over traditional backup methods on paper or metal:
It is easy to use: just approach your NFC card from a compatible smartphone to display your mnemonic phrase.
It is secure: it uses a patented algorithm that encrypts your mnemonic phrase with a personal PIN code.
It is durable: it resists shocks, water, fire and magnetic fields.
EviSeed is compatible with all wallets that support BIP39, such as Ledger, Trezor or Metamask. You can order your EviSeed on Freemindtronic’s official website (link to https://freemindtronic.com/eviseed/en/).
Some real-life examples of people who lost their keys
You may think that losing your mnemonic phrase is a rare or unlikely case. Think again! Many people have already experienced this misadventure, sometimes with dramatic consequences. Here are some real-life examples taken from the media:
Stefan Thomas, a programmer living in San Francisco, owns 7 002 Bitcoin that he cannot recover because he lost the password of his IronKey hard drive, which contains the private keys of his wallet1. He only has two attempts left before his hard drive locks permanently.
James Howells, a British computer scientist, accidentally threw away his hard drive containing 7 500 Bitcoin in 20132. He tried unsuccessfully to find his hard drive in a municipal landfill.
Brad Yasar, an entrepreneur living in Los Angeles, mined thousands of Bitcoin at the beginning of the project3. But he forgot his passwords and failed to access his wallets despite hundreds of hours spent trying.
Luke Dashjr, one of the original developers of Bitcoin Core, said he lost more than 200 Bitcoin after his PGP key was compromised on December 31, 20224. He claimed he did not know how hackers were able to access his key.
These examples show well the importance of using a reliable and secure method to backup your mnemonic phrase. With EviSeed, you can avoid this kind of situation and enjoy your cryptocurrencies peacefully.
Other standards related to BIP39
BIP39 is not the only standard that concerns the generation and management of cryptocurrency wallets. There are other standards that are related to BIP39 or that propose alternatives to it. Here are some examples:
The BIP32 is another standard that describes how to generate deterministic wallets from a master key. The BIP32 allows creating a hierarchy of derived keys from a single master key, which facilitates the organization and backup of wallets. The BIP32 uses a hash function to derive keys, which ensures that keys are unpredictable and independent from each other. The BIP39 is a method to create a master key from a mnemonic phrase. The two standards are often used together to create deterministic wallets from mnemonic phrases.
The BIP44 is an extension of the BIP32 that defines a hierarchical structure for deterministic wallets. It allows managing multiple accounts and multiple currencies with a single mnemonic phrase. The BIP44 defines five levels of derivation: purpose, currency, account, address type, and address index. The purpose is fixed at 44’ to indicate that the wallet follows the BIP44. The currency is a numerical code that identifies the currency used (for example, 0’ for Bitcoin, 60’ for Ethereum). The account is a number that allows separating funds according to personal criteria (for example, 0’ for the main account, 1’ for the secondary account). The address type is a bit that indicates if the wallet uses external addresses (0) or internal addresses (1). External addresses are those that are used to receive payments, while internal addresses are those that are used to send changes. The address index is a number that identifies each address within the address type. For example, the address m/44’/0’/0’/0/0 corresponds to the first external address of the first Bitcoin account of the wallet.
The SLIP39 (Shamir’s Secret-Sharing for Mnemonic Codes) is an alternative to BIP39 that allows splitting a mnemonic phrase into several parts that must be combined to restore the master key. The SLIP39 uses Shamir’s secret-sharing scheme, a cryptographic algorithm that allows distributing a secret into several pieces, called shares, such that a minimum number of shares is required to reconstruct the secret. For example, one can split a mnemonic phrase into five shares, of which three are required to restore it. This allows increasing security and redundancy of the wallet, by avoiding that one single share is enough to access funds or that one single share lost makes the wallet irrecoverable.
The Electrum Seed Version System is a system used by Electrum wallet to generate and verify mnemonic phrases. It differs from BIP39by several aspects: it uses a different word list, it does not use a checksum but a version code, it allows generating mnemonic phrases of variable lengths (12, 18 or 24 words), it allows deriving keys and addresses from a hash of the mnemonic phrase without depending on a fixed word list, it supports different types of mnemonic phrases according to the type of wallet (standard, multisig or segwit).
The Monero Seed Format is a format used by Monero wallet to generate and verify mnemonic phrases. It differs from BIP39 by several aspects: it uses a different word list, it uses a different checksum based on CRC32, it allows generating mnemonic phrases of 13 or 25 words depending on the seed length (128 or 256 bits), it allows deriving keys and addresses from the seed without depending on a fixed word list.
The segmented key authentication technology
Another innovative technology that allows to protect sensitive data such as mnemonic phrases by using encryption keys that are stored on different supports is the segmented key authentication technology. This technology was invented by Jacques Gascuel, a Frenchman living in Andorra, founder of the Andorran company Freemindtronic, is also patented in the USA under number US11281759B2 in 2020.
According to the invention, the encryption keys of the mnemonic phrases are segmented into several parts, which allows to store them on different supports such as contactless devices, phones, computers or a paper print with a QR code. Each mnemonic phrase is associated with an NFC HSM device and/or an EviCore OpenPGP HSM from Freemindtronic, which contains a part of the encryption key, which can be a pairing key. This part allows to decrypt the mnemonic phrase when the other parts are gathered. The other parts can be validated in different ways, such as a password, a fingerprint, a geofence or an identifier of the phone or network, etc. The technology allows to create different segmentation combinations for each mnemonic phrase. To reconstruct the encryption key and access the mnemonic phrase, one must approach the NFC HSM device from the phone and validate the other parts according to the order chosen by the user or automatically if all conditions are met.
According to one of the implementations of the invention, the key segments chosen by the user to constitute the decryption key can be of physical or digital origin. For example, the user can choose a key segment that corresponds to a geofence, thus allowing to decrypt the mnemonic phrase without requiring any other action, apart from being physically in the right geographical area. Of course, this key segment is associated with at least another key segment, such as the identifier of the user’s phone. This greatly improves user experience without compromising security level, as there are other default authentication factors integrated into NFC devices, such as also segmented pairing key, NFC identifier, unique 128-bit key, administrator and/or user password, as well as phone fingerprint.
Finally, an advantage of this technology is that key segments can be entrusted to various third parties without any risk. For example, a third party can hold a key segment without knowing what type of segment he owns, whether it is a BSSID, a geofence or a phone identifier that will receive a donation. There is virtually no limit to this. It is an effective solution for donations and inheritances, where the notary or lawyer can have a geofence key segment that he can only use in a specific place defined in a will or under the supervision of a bailiff.
Conclusion
In summary, BIP39 is a major improvement proposal to simplify the management of cryptocurrency wallets. Thanks to the use of mnemonic phrases, it offers a user-friendly and secure solution to create and recover your wallets. However, it is crucial to protect your mnemonic phrase against any loss or theft, and to choose a reliable and compatible wallet with BIP39.
We hope that this article has helped you understand better the functioning and benefits of BIP39. If you have any questions or comments, we would love to help you in the section below. Simplify your cryptocurrency management experience with BIP39!
Segmented key authentication by Jacques gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
Segmented key authentication: an innovation by Jacques Gascuel to secure sensitive data
What is segmented key authentication?
Segmented key authentication is a technology that allows to protect sensitive data by using encryption keys that are stored on different supports. This technology was invented by Jacques Gascuel, a French inventor living in Andorra, and patented under the number FR3063365 in 05.04.2019.
The principle of segmented key authentication is to divide an encryption key into several segments that are distributed on physical or virtual supports. These supports can be smart cards, USB keys, smartphones, computers or cloud services. To access the encrypted data, it is necessary to gather all the segments of the key and combine them according to a specific algorithm.
The advantage of this technology is that it makes it very difficult to steal or compromise sensitive data, because it would require accessing all the supports that contain the segments of the key. Moreover, this technology allows to control the access to data according to the context, the location. For example, it is possible to define that some segments of the key are only available in a certain geographical area.
How does segmented key authentication work?
Segmented key authentication relies on a system composed of three main elements: a contactless device, an NFC device and a software.
The contactless device is a physical support that contains one or more segments of the encryption key. It can be a smart card, a USB key or another object with an electronic chip. This device is designed to work without battery, without maintenance and without cloud. It can be reset for the second-hand market.
The NFC device is a device that allows to communicate with the contactless device by radiofrequency. It can be a smartphone, a tablet or a computer equipped with an NFC antenna. This device provides the energy necessary for the operation of the contactless device and retrieves the segments of the key that it contains.
The software is an application that runs on the NFC device and that manages the segmented key authentication process. It allows to configure the parameters of the encryption key, such as the number and size of the segments, the combination algorithm, the access conditions or the actions to perform in case of failure. It also allows to encrypt and decrypt data using the key reconstituted from the segments.
What are the possible applications of segmented key authentication?
Segmented key authentication can be used to secure any type of sensitive data, whether personal, professional or confidential. It can also be used to protect access to systems or services that require strong authentication.
Among the possible applications, we can mention:
Electronic safes: these are systems that allow to store sensitive data in a secure and encrypted space. Segmented key authentication can enhance the security of these systems by making it impossible to access data without having all the segments of the key.
Alarm systems: these are systems that allow to detect and report an intrusion or an anomaly in a protected place. Segmented key authentication can improve the reliability of these systems by preventing disarming or hacking without having all the segments of the key.
Financial transactions: these are operations that involve the transfer of money or goods between parties. Segmented key authentication can ensure security and traceability of these operations by requiring physical and simultaneous presence of parties to validate transaction.
The patents of segmented key authentication
The invention of segmented key authentication has been subject to several patent applications in different countries. The first patent granted is FR patent FR3063365, published in 2018. This patent describes segmented key authentication system, its elements, its functioning and its applications.
Other patent applications are pending or awaiting in other countries, including:
French patent FR3063365, granted in 2019,
European patent EP3586258 A1, published in 2020, which repeats same claims as US patent. It is under examination.
Korean patent KR1020190120317 , published in 2019, which repeats same claims as US patent. It was granted in 2021.
Chinese patent CN110402440, published in 2019, which repeats same claims as US patent. It is awaiting examination.
Japanese patent JP2020508533 , published in 2019, which repeats same claims as US patent. It was granted in 2020.
Algerian application 190460 , filed in 2019 with National Algerian Institute for Industrial Property (INAPI). It is not yet published or granted.
These patent applications are derived from international patent WO2018153274 A1, published in 2018, which is priority application for invention. This international patent was filed by Jacques Gascuel with World Intellectual Property Organization (WIPO) according to Patent Cooperation Treaty (PCT). It allows protecting invention in more than 150 countries members of PCT.
The differentiation of invention from prior art
The invention of segmented key authentication differs from other inventions in field of computer security by several aspects.
Firstly, it relies on original concept of segmenting an encryption key into several segments that are stored on different supports. This concept allows increasing security level of sensitive data by making it more difficult to steal or compromise complete key. Indeed, it would require accessing all supports that contain segments of key, which implies more material and software effort than with single key. For example, if key is segmented into four parts, one on smart card, one on USB key, one on smartphone and one on computer, it would require stealing or hacking these four supports to reconstitute key and access data. This scenario is much more complex and unlikely than with single key stored on single support.
Secondly, it allows controlling access to data according to context, location. Indeed, it is possible to define access conditions for each segment of key, such as geographical location, number of attempts etc. Thus, one can limit access to data certain situations or circumstances, which strengthens protection of data. For example, one can define that segment of key stored on smartphone is only available in radius of 10 km around owner’s home, or that segment of key stored on computer is only available between 9 am and 5 pm from Monday to Friday. These access conditions allow reducing risks of unauthorized access to data.
Thirdly, it uses a contactless device and an NFC device to communicate with main token that contains authentication datum. This contactless device is designed to work without battery, without maintenance and without cloud. It can be reset for second-hand market. The NFC device provides energy necessary for operation of contactless device and retrieves segments of key that it contains. The software that runs on NFC device manages segmented key authentication process. This configuration allows avoiding problems related to wear or loss of contactless device, as well as risks related to connection to cloud or wireless network.
The invention of segmented key authentication therefore presents several advantages over prior art, especially in terms of security, flexibility and ecology. These advantages have justified granting US patent US20210136579 B2 and derived patents in other countries.
To illustrate these advantages, one can compare invention of segmented key authentication with other similar inventions in field of computer security.
For example, US patent US8112066 B2 describes system for providing encrypted authentication datum from first device to second device. This system uses NFC device for transmitting encrypted authentication datum from first device to second device. However, this system does not segment encrypted authentication datum into several segments stored on different supports. Thus, if first device is stolen or hacked, encrypted authentication datum can be compromised.
For example, US patent US9942750B2 describes system for performing security operations on wireless devices based on proximity with another device. This system uses NFC device for establishing secure communication between two devices and for performing operations such as locking or unlocking first device. However, this system does not control access to data according to context, location. Thus, if two devices are close each other but in insecure environment, security operations may be ineffective or undesirable.
For example, CN patent CN110838917B describes system for authenticating user from QR code generated by server and displayed on screen. This system uses smartphone for scanning QR code and sending request to server for verifying user’s identity. However, this system uses connection to cloud or wireless network for communicating with server. Thus, if connection is interrupted or compromised, system may not work properly or be vulnerable attacks.
One can see that invention of segmented key authentication brings innovative and efficient solutions problems encountered by other inventions in field computer security.
A implementation of segmented key authentication based on trust criteria
Segmented key authentication can be implemented using trust criteria as segments encryption key. These trust criteria are data that characterize context location access sensitive data They can be stored on NFC device or external supports
For example one can use following trust criteria:
Geolocation: this GPS coordinates NFC device main token One can define geographical area 50 cm 1110 km² which segment available
BSSID: this identifier wireless network which NFC device main token connected One can define one more wireless networks authorized access segment
Phone ID: this identification number mobile phone serves NFC device One can define one more mobile phones authorized access segment
Password: this secret code user must enter access segment Password can be stored external support such smart card USB
Barcode QR code: this graphic symbol contains coded information User must scan barcode QR code with camera phone access segment Barcode QR code can be printed external support such paper sticker
User can freely choose trust criteria he wants use constitute encryption key He can combine up nine trust criteria which can be cumulative horizontally or vertically
For example he can choose use:
Part or whole segments first line (geolocation) and/or second line (BSSID) and all lines 3 4 5 (phone ID password barcode QR code) In this case segments are cumulative horizontally
Part or whole segments first column (geolocation) and/or second column (BSSID) and all columns 3 4 5 (phone ID password barcode QR code) In this case segments are cumulative vertically
In both cases it necessary gather all chosen segments reconstitute encryption key access sensitive data If segment missing decryption not possible
According another implementation trust criteria are integrated encryption secret non modifiable Secret can be shared with other people who must respect same trust criteria access it
This implementation allows using segmented key authentication effective customizable way secure sensitive data according context location
Recovery Phrase Backup by Jacques Gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
Recovery Phrase Backup: a beginner’s guide
If you own a crypto wallet, you probably have heard of a recovery phrase backup. This is a series of words that allows you to access your crypto funds in case you lose or damage your wallet. It is one of the most important things you need to know and protect when dealing with cryptocurrencies. What is a seed phrase and how does it work? How to create and store it securely? What are the risks and challenges? And what are the best practices and tools to safeguard it?
Articles Crypto Currency Digital Security EviSeed EviVault Technology News
This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
How to make a physical backup of your secret phrase
The Mnemonic Phrase is the ultimate key to access your crypto assets. If you lose it or share it, you risk losing control of your funds. That’s why it’s essential to physically backup your seed phrase and store it in a safe and secret place. Here’s how to do it.
Recovery Phrase Backup vs Private Key
Before explaining what to do if you lose your seed phrase, let’s understand the difference between a seed phrase and a private key.
A private key is a secret code that allows you to control your crypto-assets on the blockchain. It is generated from your seed phrase, which is a list of words that stores all the information needed to recover cryptographic funds on the blockchain. It consists of 12 to 24 randomly generated words that allow you to access or restore your wallet on another device. You must keep it in a safe place and never share it with anyone.
What to do if you lose your Recovery Phrase? The solutions to recover your crypto-assets safely.
If you lose your seed phrase, you risk losing permanent access to your crypto-assets. It is used to create your private keys. You don’t need it to access your cryptocurrencies on a daily basis, but it is mainly a backup method. You can restore your crypto-assets in case of a problem with your device or wallet. However, if you lose your hardware wallets (cold wallets) and access to your online wallets (hot wallets), you will not be able to recover your cryptocurrencies without your seed phrase.In case you have correctly noted down your seed phrase, there are some possible recovery solutions:
• If you can still log in to your wallet with your password, you can find or export your seed phrase via the wallet.
• If you have lost your wallet but have your seed phrase, you can restore your wallet on a new hardware or software wallet. Enter the 12 to 24 words at startup.
• If you have forgotten or lost your seed phrase and have no other way to access your wallet, there are specialized services that can try to find it. They use a part of the words or other clues, but they are expensive and not always reliable.
Can you avoid using a Recovery Phrase?
You may wonder if there is a way to avoid using a seed phrase to secure your crypto-assets. The answer is no. The mnemonic Phrase is the only way to guarantee that you can always access your funds. Even if you lose or damage your device or wallet. Without a seed phrase, you depend entirely on the service or provider that you use to store your cryptocurrencies. If the service is hacked, closed or inaccessible for any reason, you also risk losing your assets. The seed phrase is an essential element to protect your financial independence and digital sovereignty.
Introduction: What is a recovery phrase and why is it important?
If you are new to the world of cryptocurrencies, you may have heard of the term “seed phrase” or “mnemonic phrase” or “backup phrase” or “seed recovery phrase” or “recovery phrase”. This is a set of words that allows you to access your crypto wallet and funds. It is one of the most important things you need to know and protect when dealing with cryptocurrencies.
How does a recovery phrase work and what are its formats?
But what exactly is a seed recovery phrasehrase and how does it work? How can you create and store it securely? What are the risks and challenges involved? And what are the best practices and tools to help you safeguard your recovery phrase backup?
This article answers these questions and more. It covers what a seed recovery phrase is, its importance, how it functions, and the steps to back it up and restore it. Additionally, it discusses the methods and materials to create and store physical backups (e.g., paper, metal, plastic, wood, or NFC devices). Furthermore, it explores the pros and cons of each option, along with some tips and tricks to make your backup easier and safer.
How to create a recovery phrase?
When you create a crypto wallet, a seed phrase is automatically generated for you. You do not need to choose or invent the words yourself. You just need to write them down and store them safely.
To create a recovery phrase backup, you can use any crypto wallet that supports the BIP39 standard, such as BitPay, Coinbase Wallet, Ledger, Trezor, or Trust Wallet. These wallets will generate a random sequence of 12 or 24 words for you, depending on the level of security you want.
You can also use an online tool like https://iancoleman.io/bip39/ to generate a seed phrase manually. However, this method is not recommended as it exposes your seed phrase to potential hackers or malware. You should only use this tool offline and on a trusted device.
What does a recovery phrase look like?
A recovery phrase backup looks like a list of simple words, such as:
The order of the words matters, as it determines the private keys that are derived from the seed phrase. You should never change or shuffle the words in your seed phrase.
The number of words in your seed phrase also matters, as it determines the level of security and entropy of your wallet. A 12-word seed phrase offers 128 bits of security, while a 24-word seed phrase offers 256 bits of security. The more words, the more secure.
What is the most common term for a recovery phrase?
A recovery phrase can also be called by different names, such as:
recovery phrase
mnemonic phrase
backup phrase
seed recovery phrase
These terms are interchangeable and mean the same thing. However, according to web search results, the most common term used for a seed phrase in the world is Recovery Phrase. This term emphasizes the fact that you can use your seed phrase to recover your wallet and your funds in case of loss or damage.
How to physically save your mnemonic Phrase
The Mnemonic Phrase is the ultimate key to accessing your crypto assets. If you lose it or share it, you risk losing control of your funds. That’s why it’s essential to physically back up your seed phrase and store it somewhere safe and secret. Here’s how
The role and mechanism of a secret phrase
Your cryptocurrency wallet generates a set of 12 or 24 words, also known as a seed phrase, using a cryptographic algorithm. A seed phrase is a series of words generated by your crypto wallet that gives you access to the crypto associated with that wallet. For example, if you use the BitPay wallet, you will receive a 12-word seed phrase when you create your wallet. These words are drawn from a list of 2,048 English words called the BIP39 standard1, which offers 128-bit encryption.The seed phrase can derive all the private keys that are associated with your crypto addresses and acts as a master key. You can send or spend your crypto from your wallet with a secret code called a private key.
A standard format such as BIP39 or SLIP39, which uses a predefined list of words that are easy to spell and recognize, forms the basis of the seed phrase. The words have a unique and random order and combination, and they represent a very large number that is virtually impossible to guess or crack. The seed phrase can have different representations, such as QR codes or NFC tags, but it usually appears in a human-readable form, such as “army energy fabric lucky opera stereo trash void”.
This phrase is the ultimate backup for your crypto wallet. If you have your seed phrase, you can restore your wallet and access your funds on any compatible device or platform. You can also migrate your wallet from one service or device to another, or create multiple copies of your wallet for redundancy or convenience with your seed phrase.
However, the seed phrase also comes with great responsibility. Only you know your seed phrase and can access your funds with it. If you forget lose or share your seed phrase with someone else you will lose control over your crypto assets and no one can help you recover them. That’s why backing up your seed phrase physically and storing it safely is necessary.
How to test your recovery phrase backup
After you physically backup your seed phrase, you should test it to make sure it works and you can restore your wallet with it. To test your recovery phrase backup, you can use a different device or platform than the one you used to create your wallet. For example, if you created your wallet with a hardware wallet, you can test your Mnemonic phrase with a software wallet or another hardware wallet. You should also test your backup phrase periodically, especially if you use a paper or metal backup that can degrade over time.
To test your recovery phrase backup, follow these steps:
Install or launch a compatible wallet on a different device or platform than the one you used to create your wallet.
Choose the option to restore or import a wallet from a seed phrase.
Enter your seed phrase exactly as you wrote it down, including the order and spelling of the words.
Verify that the wallet shows the same balance and addresses as your original wallet.
If everything matches, your recovery phrase backup works and you can safely delete or close the test wallet.
If something doesn’t match, check for errors in your recovery phrase backup and try again.
Why you need a physical backup of your seed phrase
A digital backup has several disadvantages compared to a physical backup of your seed phrase. An electronic device such as a computer, smartphone or USB drive stores a copy of your seed phrase as a digital backup. A digital backup can be convenient and easy to access, but it also comes with some risks.
Hackers, malware or phishing attacks can access your device and steal your seed phrase by compromising your digital backup. Fire, water, power surge or hardware failure can also render your device unusable by losing or damaging your digital backup. Authorities or third parties can also access your device and demand your seed phrase by confiscating or seizing your digital backup.
Being offline and disconnected from any network or device helps a physical backup avoid these risks. Hacking, destroying or confiscating a physical backup is harder than a digital backup. You have more control and ownership over your seed phrase with a physical backup than with a digital backup.
However, you need to be aware of some drawbacks that a physical backup also has. Failing to store it in a safe and secret place can result in losing, stealing, or forgetting your physical backup. Additionally, without using a durable material or protecting it from environmental factors, your physical backup can be damaged by fire, water, corrosion, or wear and tear. Furthermore, not writing it down clearly or using a standard format can make your physical backup illegible or unreadable.
Following some best practices and using some tools is necessary when creating and storing your physical backup.
How to Divide Your recovery phrase backup for Enhanced Security
To protect your crypto assets, safeguard your recovery phrase backup. Secure it by splitting and storing it in different locations. This lowers the risk of losing or exposing the backup and boosts the recovery chances in emergencies. However, splitting the backup also has risks and challenges, like choosing the number, distribution and combination of parts.
You can split the backup using different methods, like paper or metal cards, QR codes, or NFC modules (e.g. EviSeed technology). You can also use cryptographic techniques like SSSS, a mathematical algorithm that divides the backup into shares that can be combined with a threshold number. For instance, you can split your backup phrase into 5 shares and require 3 shares to reconstruct it.
Using SSSS adds security and flexibility to your backup, as you do not need all the shares to recover it. You can also create share combinations for different scenarios or purposes (e.g. for yourself, your family or your lawyer). EviSeed technology also achieves this by sharing trust criteria among people in segments.
However, SSSS also has drawbacks, like more complexity and errors in your backup process. You need to use a compatible wallet that supports SSSS, such as Spectre or Unchained Capital. You should also regularly test your actions and ensure that you remember the threshold number and the location of the shares. By following these best practices, you can divide your recovery phrase backup for enhanced security and peace of mind.
How to cipher your secret phrase
To physically secure it and protect your privacy, encrypt your backup with a code or cipher. However, encryption also has risks and challenges, like choosing a secure and memorable code or cipher, following the method correctly, and avoiding errors.
You can encrypt your backup using various methods, like numbers, symbols, colors, or images. Cryptographic techniques such as BIP38 or BIP39 secret phrase encryption also work. They encrypt your private keys or seed phrase with a password. For example, BIP38 encrypts your private keys with a password and stores them on a paper wallet. Or BIP39 secret phrase encryption adds a password to your seed phrase and generates a different wallet.
Encryption adds privacy and security to your backup, as you need the encrypted seed phrase and password to access your funds. You can also create passwords for different scenarios or purposes (e.g. for yourself, your family or your lawyer). Freemindtronic’s EviSeed technology makes this possible.
However, encryption also has drawbacks, like more complexity and errors in your backup process. You also need a compatible wallet that supports encryption and regular tests of your encrypted backup, as well as the password and method. Freemindtronic’s EviSeed technology avoids these inconveniences by using NFC devices that natively feature two AES-256 encryption systems with keys over 256 bits and manage RSA-4096 keys.
How to Choose a Secure Wallet for Your Seed Phrase
Choose a secure wallet that generates and manages your starting phrase to physically safeguard it. A wallet is software or hardware that lets you create, store, and use your addresses and keys. You can choose from many types of wallets, such as online, mobile, desktop, or hardware wallets and hot wallets. Each wallet type has its pros and cons for security, convenience, and functionality.
A hardware wallet is the most secure type. It is a device that stores your keys offline and protects them from threats. It physical device also have features like PIN codes, secret phrases, recovery phrases, and some add trust criteria through segmented key systems for more security.
However, virtual and hardware wallets are not perfect and can have problems. That is why backing up your starting phrase physically and storing it safely is important. You should also pick a reputable and compatible hardware wallet that supports standard formats like BIP39 or SLIP39.Storage devices like the NFC module with Freemindtronic’s EviSeed technology also do this. They are secure for several reasons. Mainly, they are offline. They ensure end-to-end encryption of seed phrases from the module using AES 256 contactless and post-quantum encryption. Additionally, trust criteria can be added for each backup starting phrase, along with individual security measures. A user-defined multi-factor authentication system is also available to access the module.
In conclusion, pick a secure wallet to store your backups and protect your starting phrase.
How to Choose the Best Material for Your recovery phrase backup
You can use various materials to back up your seed phrase. Paper, metal, plastic, and wood are common. Now, hardened and waterproof NFC devices also exist. Each material has its pros and cons for cost, availability, quality, and security. Paper is cheap and easy to use, but easily damaged. Metal is strong and durable, but expensive and hard to write on. Plastic is lightweight and waterproof, but degrades over time. Wood is natural and biodegradable, but rots or burns.
However, hardened NFC devices (e.g. Freemindtronic’s IP89K NFC modules) are great. These devices resist many environmental factors and are durable. They don’t need a battery and preserve data for 40 years. The modules have EviSeed technology that controls errors through checksums when writing, reading, sharing or using. They are also affordable, available and secure (hardware and digital).
You can encrypt your backups in AES-256 by cloning or copying them between NFC modules (nearby or remotely via RSA-4096 encryption from the module) if you use NFC modules. You can also back up your seed phrases through RSA-4096 from the device in the cloud (via email USB key or other digital media) or on paper (by printing the encrypted QR Code in RSA-4096). The Freemindtronic Android NFC phone app scans the encrypted QR Code backup seed phrase easily.
An encrypted QR Code backup seed phrase is advantageous as it protects from prying eyes and brute force decryption. Your preferences budget and storage conditions determine the best material for your backup. You should also consider using multiple materials for redundancy and diversity. For example, you can use paper for a quick and easy backup, metal or NFC modules for secure and long-term backup, and plastic, wood, or NFC Tag for a backup that you can hide or disguise as an RFID door opening tag.
The best technique to backup the recovery phrase
Secret phrases, also known as recovery phrases or seed phrases, are key elements to use a physical wallet for cryptocurrencies. They consist of a set of 24 words randomly chosen, which serve as a backup for all the crypto-assets managed by the wallet. In case of loss or theft of the wallet, it is possible to restore access to the private keys by using the secret phrase.
There are different techniques to backup your secret phrase and protect it from risks related to loss, theft or deterioration. Here is an overview of the main options available:
Write down the secret phrase on a sheet of paper
This technique consists of writing the words of the secret phrase on a sheet of paper and keeping it in a safe place. You need to make sure that the phrase is correctly spelled, numbered and readable. You also need to avoid making a digital copy of the phrase, sharing it with anyone or entering it into a computer or smartphone.
Advantages and disadvantages
Advantages: this technique is simple, free and does not require any specific equipment. It allows you to keep full control over your secret phrase and your crypto-assets.
Disadvantages: this technique is vulnerable to physical hazards (fire, water, wear, etc.) and human errors (loss, theft, bad writing, etc.). It does not allow you to easily verify if the secret phrase is correct or compatible with the wallet.
Risks related to cyber security and cyber espionage
Risks related to cyber security: this technique does not involve exposure to networks or computer systems, so the risk of cyber security is low.
Risks related to cyber espionage: this technique involves physical exposure to malicious or indiscreet third parties, so the risk of cyber espionage is high.
The legal aspect and protection of sensitive data
Legal aspect: this technique does not pose any particular legal problem, unless the possession or use of crypto-assets is prohibited or regulated in the country concerned.
Protection of sensitive data: this technique does not guarantee optimal protection of sensitive data, as the secret phrase can be seen, copied or stolen by unauthorized third parties.
Another aspect that you need to consider when backing up your secret phrase is the legal aspect and protection of sensitive data. Depending on where you live and where you store your secret phrase, you may be subject to different laws and regulations regarding data privacy and security.
Data privacy refers to the right of individuals to control how their personal information is collected, used and shared by others. Data security refers to the technical measures taken to protect data from unauthorized access or disclosure.
Some examples of laws and regulations that may affect how you backup your secret phrase are:
GDPR (General Data Protection Regulation): A European Union law that aims to protect the personal data of EU citizens and residents by imposing strict rules on how data controllers and processors handle their data.
CCPA (California Consumer Privacy Act): A California state law that gives California consumers more control over their personal information by granting them rights such as access, deletion and opt-out.
HIPAA (Health Insurance Portability and Accountability Act): A US federal law that protects the privacy and security of health information by setting standards for how health care providers and other entities handle their data.
To comply with these laws and regulations, you need to be aware of:
The type of data that you backup: Is it personal data (such as name, email address or phone number) or sensitive data (such as health records, biometric data or financial information)?
The location where you backup your data: Is it within your country or jurisdiction, or is it in another country or region that may have different laws or standards?
The purpose for which you backup your data: Is it for personal use only, or is it for business or professional purposes?
The consent that you obtain from others: If you backup data that belongs to someone else (such as a client or a partner), do you have their permission and agreement on how you will use and protect their data?
To ensure that you respect the legal aspect and protection of sensitive data when backing up your secret phrase, you need to:
Choose a technique that suits your needs and preferences in terms of privacy and security.
Check the laws and regulations that apply to your situation and follow their requirements.
Inform yourself about the risks and responsibilities involved in backing up your secret phrase.
Respect the rights and interests of others whose data may be affected by your backup.
Use a metal device resistant to fire, water and corrosion
This technique consists of using a metal device resistant to fire, water and corrosion, such as a capsule or a plate, to engrave or insert the words of the secret phrase. This device can then be hidden or sealed in a safe place.
Advantages and disadvantages
Advantages: this technique offers better protection against natural elements, but it requires a higher financial investment and can attract the attention of malicious people.
Disadvantages: this technique requires a higher financial investment and can attract the attention of malicious people.
Risks related to cyber security and cyber espionage
Risks related to cyber security: this technique does not involve exposure to networks or computer systems, so the risk of cyber security is low.
Risks related to cyber espionage: this technique involves physical exposure to malicious or indiscreet third parties, so the risk of cyber espionage is high.
The legal aspect and protection of sensitive data
Legal aspect: this technique does not pose any particular legal problem, unless the possession or use of crypto-assets is prohibited or regulated in the country concerned.
Protection of sensitive data: this technique offers better protection of sensitive data than paper, as the metal device is more durable and less visible.
Another aspect that you need to consider when backing up your secret phrase is the legal aspect and protection of sensitive data. Depending on where you live and where you store your secret phrase, you may be subject to different laws and regulations regarding data privacy and security.
Data privacy refers to the right of individuals to control how their personal information is collected, used and shared by others. Data security refers to the technical measures taken to protect data from unauthorized access or disclosure.
Some examples of laws and regulations that may affect how you backup your secret phrase are:
GDPR (General Data Protection Regulation): A European Union law that aims to protect the personal data of EU citizens and residents by imposing strict rules on how data controllers and processors handle their data.
CCPA (California Consumer Privacy Act): A California state law that gives California consumers more control over their personal information by granting them rights such as access, deletion and opt-out.
HIPAA (Health Insurance Portability and Accountability Act): A US federal law that protects the privacy and security of health information by setting standards for how health care providers and other entities handle their data.
To comply with these laws and regulations, you need to be aware of:
The type of data that you backup: Is it personal data (such as name, email address or phone number) or sensitive data (such as health records, biometric data or financial information)?
The location where you backup your data: Is it within your country or jurisdiction, or is it in another country or region that may have different laws or standards?
The purpose for which you backup your data: Is it for personal use only, or is it for business or professional purposes?
The consent that you obtain from others: If you backup data that belongs to someone else (such as a client or a partner), do you have their permission and agreement on how you will use and protect their data?
To ensure that you respect the legal aspect and protection of sensitive data when backing up your secret phrase, you need to:
Choose a technique that suits your needs and preferences in terms of privacy and security.
Check the laws and regulations that apply to your situation and follow their requirements.
Inform yourself about the risks and responsibilities involved in backing up your secret phrase.
Respect the rights and interests of others whose data may be affected by your backup.
Use an online service to backup your seed phrase
One of the techniques to backup your seed phrase is to use an online service that connects it to your verified identity. This way, you can recover your keys with your ID and a selfie, and still keep control of your money. In this article, we will explore the advantages and disadvantages of this technique, as well as the risks and legal aspects involved.
Advantages and disadvantages of online seed phrase backup
Advantages: online seed phrase backup is easy and convenient. You don’t need to worry about storing or protecting a physical device or a paper backup. You can access your backup from anywhere with an internet connection and a compatible device. You can also benefit from the encryption and security features of the online service provider.
Disadvantages: online seed phrase backup exposes your secret phrase to risks of hacking, censorship or confiscation by third parties who can access the servers or the identification process. You need to trust that the online service provider and its servers are reliable, honest and secure. You also need to trust that your identity information is safe and not misused. You may face legal or regulatory issues depending on where you live and where the servers are located. You may also have to pay fees or subscriptions for using the online service.
Risks related to cyber security and cyber spying in online seed phrase backup
Risks related to cyber security: online seed phrase backup makes you use networks and computers, so the risk of cyber attacks is high. You need to trust that the online service and its servers protect your secret phrase and data well. You may face hackers, malware, ransomware, denial-of-service attacks or other threats that could compromise your backup or access to it. You may also face human errors, technical glitches or natural disasters that could damage or destroy the servers or your device.
Risks related to cyber spying: online seed phrase backup makes you use networks and computers, so the risk of cyber spying is high. You need to trust that the online service and its servers keep your secret phrase and data private. You may face spies, snoops, trackers, advertisers or other parties that could monitor, collect, analyze or share your backup or activity data. You may also face government agencies, law enforcement or courts that could request, subpoena or seize your backup or data for legal or national security reasons.
Risks related to phishing: online seed phrase backup makes you face fake messages and tricks that may make you give up your secret phrase or other information. Phishing is when someone pretends to be someone else, such as the online service or your wallet, to trick you into giving them your data or money. For example, you may receive an email that looks like it comes from the online service provider, asking you to verify your account or update your payment details by clicking on a link that leads to a fake website.
Risks related to bitb: online seed phrase backup makes you face bad browser add-ons that may change or see your web activity and take your secret phrase or other data. Bitb is when someone adds malicious code to a browser extension that can spy on or modify what you do online. For example, you may install an extension that claims to enhance your browsing experience, but actually records your keystrokes, screenshots your screen or redirects you to malicious websites.
Risks related to typosquatting: online seed phrase backup makes you face bad websites that look like the online service or your wallet, but have different spellings. Typosquatting is when someone registers a domain name that is similar to a legitimate one, but with a typo, to trick you into visiting their fake website. For example, you may type in www.onlineservice.com but end up on www.onlineservlce.com (with an L instead of an I), which looks identical but steals your login credentials or infects your device with malware.
The legal aspect and protection of sensitive data in online seed phrase backup
Online seed phrase backup may cause legal problems depending on the rules of the online service and its servers. You also need to think about the data privacy and security laws that affect you and follow them. Data privacy means the right of people to choose how their information is collected, used and shared by others. Data security means the ways to protect data from being seen or used by others who should not.
Some examples of laws and rules that may change how you backup your secret phrase are:
GDPR (General Data Protection Regulation): A European Union law that protects the information of EU people by making strict rules on how data controllers and processors handle their data.
CCPA (California Consumer Privacy Act): A California state law that gives California people more power over their information by giving them rights such as access, deletion and opt-out.
HIPAA (Health Insurance Portability and Accountability Act): A US federal law that protects the privacy and security of health information by making standards for how health care providers and other groups handle their data.
To follow these laws and rules, you need to know:
The kind of data that you backup: Is it personal data (such as name, email or phone) or sensitive data (such as health records, biometric data or money information)?
The place where you backup your data: Is it in your country or area, or is it in another country or area that may have different laws or standards?
The reason why you backup your data: Is it for yourself only, or is it for work or business purposes?
The permission that you get from others: If you backup data that belongs to someone else (such as a client or a partner), do you have their OK and agreement on how you will use and protect their data?
To make sure that you respect the legal aspect and protection of sensitive data when backing up your secret phrase, you need to:
Pick an online service that fits your needs and likes in terms of privacy and security.
Learn about the risks and duties involved in backing up your secret phrase.
Respect the rights and interests of others whose data may be affected by your backup.
Use a hybrid solution of cold wallet and online service
Another technique to backup your seed phrase is to use a hybrid solution of a cold wallet and an online service. A cold wallet is a device that stores your keys offline, such as a hardware wallet or a smart card. An online service is a platform that links your cold wallet to your verified identity and provides additional features, such as recovery, insurance or monitoring. This way, you can combine the security of a cold wallet with the convenience of an online service.
Advantages and disadvantages of hybrid seed phrase backup
Advantages: hybrid seed phrase backup is secure and flexible. You can store your keys on a cold wallet that is resistant to hacking, malware or network attacks. You can also access your backup from an online service that offers recovery options, identity verification or other benefits. You can choose the level of security and convenience that suits your needs and preferences.
Disadvantages: hybrid seed phrase backup is complex and costly. You need to buy and maintain a cold wallet device that is compatible with the online service. You also need to trust that the online service provider and its servers are reliable, honest and secure. You may face legal or regulatory issues depending on where you live and where the servers are located. You may also have to pay fees or subscriptions for using the online service or the cold wallet device. Some online services may also require you to renew your subscription annually or risk losing access to your backup. Some online services may also have access to your backup or keys, which could make them vulnerable to identity theft, fraud or coercion. Some online services may also split your backup into multiple servers or devices, which could increase the security but also the complexity of your backup.
Shamir’s Secret Sharing (SSS) method
Some online services use a technique called Shamir’s Secret Sharing (SSS) to split your seed phrase into multiple parts, called shares, that can be recombined to recover the original seed phrase. This technique allows you to distribute your backup across different locations, devices or people, and to set a threshold number of shares that are needed to restore your backup.
For example, you can split your seed phrase into 5 shares and store them on 5 different servers or devices. You can then set the threshold to 3, meaning that you need at least 3 out of 5 shares to recover your seed phrase. This way, you can protect your backup from being lost or stolen by one or two parties, but still be able to access it if you have 3 or more shares.
Some cold wallets use this technique to backup seed phrases in a secure way. They encrypt the parts of the seed phrase in a secure element in the device and send them to partners through a secure channel. When restoring, the parts are sent back by the partners and the seed phrase can be generated in the new device.
Advantages and disadvantages of SSS method
Advantages: SSS method is secure and resilient. You can increase the security of your backup by splitting it into multiple parts that are stored separately. You can also increase the resilience of your backup by setting a lower threshold that allows you to recover it even if some parts are lost or damaged.
Disadvantages: SSS method is complex and risky. You need to manage multiple parts of your backup and keep track of where they are stored and how they can be accessed. You also need to trust that the parties who hold the parts of your backup are reliable, honest and secure. You may face legal or regulatory issues depending on where the parts of your backup are located. You may also face technical or human errors that could compromise the integrity or availability of your backup.
Risks related to SSS method
Risks related to cyber security: SSS method makes you use networks and computers, so the risk of cyber attacks is moderate. You need to trust that the parties who hold the parts of your backup protect them well. You may face hackers, malware, ransomware, denial-of-service attacks or other threats that could compromise one or more parts of your backup or access to them. You may also face human errors, technical glitches or natural disasters that could damage or destroy one or more parts of your backup.
Risks related to cyber spying: SSS method makes you use networks and computers, so the risk of cyber spying is moderate. You need to trust that the parties who hold the parts of your backup keep them private. You may face spies, snoops, trackers, advertisers or other parties that could monitor, collect, analyze or share one or more parts of your backup or activity data. You may also face government agencies, law enforcement or courts that could request, subpoena or seize one or more parts of your backup for legal or national security reasons.
Risks related to collusion: SSS method makes you rely on multiple parties who hold the parts of your backup, so the risk of collusion is moderate. You need to trust that the parties who hold the parts of your backup do not cooperate with each other or with other parties to steal or misuse your backup. For example, if you split your seed phrase into 5 shares and set the threshold to 3, you need to trust that no 3 parties will collude to recover your seed phrase without your consent or knowledge.
Risks related to fragmentation: SSS method makes you split your seed phrase into multiple parts, so the risk of fragmentation is moderate. You need to ensure that the parts of your backup are compatible and consistent with each other and with the original seed phrase. You may face errors in splitting or recombining the parts of your backup that could result in an invalid or corrupted seed phrase. You may also face changes in formats or standards that could make some parts of your backup obsolete or incompatible.
The legal aspect and protection of sensitive data in hybrid seed phrase backup
Hybrid seed phrase backup may cause legal problems depending on the rules of the online service and its servers. You also need to think about the data privacy and security laws that affect you and follow them. Data privacy means the right of people to choose how their information is collected, used and shared by others. Data security means the ways to protect data from being seen or used by others who should not.
Some examples of laws and rules that may change how you backup your secret phrase are:
GDPR (General Data Protection Regulation): A European Union law that protects the information of EU people by making strict rules on how data controllers and processors handle their data.
CCPA (California Consumer Privacy Act): A California state law that gives California people more power over their information by giving them rights such as access, deletion and opt-out.
HIPAA (Health Insurance Portability and Accountability Act): A US federal law that protects the privacy and security of health information by making standards for how health care providers and other groups handle their data.
To follow these laws and rules, you need to know:
The kind of data that you backup: Is it personal data (such as name, email or phone) or sensitive data (such as health records, biometric data or money information)?
The place where you backup your data: Is it in your country or area, or is it in another country or area that may have different laws or standards?
The reason why you backup your data: Is it for yourself only, or is it for work or business purposes?
The permission that you get from others: If you backup data that belongs to someone else (such as a client or a partner), do you have their OK and agreement on how you will use and protect their data?
To make sure that you respect the legal aspect and protection of sensitive data when backing up your secret phrase, you need to:
Pick an online service that fits your needs and likes in terms of privacy and security.
Learn about the risks and duties involved in backing up your secret phrase.
Respect the rights and interests of others whose data may be affected by your backup.
Use a contactless technology
This technique consists of using a contactless technology that allows you to store your secret phrase in an electronic device, such as a card or a keychain, that works with NFC (Near Field Communication) technology. This device can be used with a compatible smartphone to backup and share your private keys, passwords or secret phrases.
Advantages and disadvantages
Advantages: this technique offers ease of transport and resistance to shocks. It also allows you to verify and restore your secret phrase at any time with your smartphone.
Disadvantages: this technique requires a compatible smartphone and a dedicated app. It also exposes you to the risks of loss or theft of your device. This can be dangerous if the NFC Cold Wallet does not have a digital backup system encrypted that can allow restoration in another device and/or a cloning or copying system between NFC devices, such as the EviSeed technology.
Risks related to cybersecurity and cyberespionage
Risks related to cybersecurity: this technique is not connected to networks, computer systems or servers in principle and has no database with the same properties as an HSM, so the cybersecurity risk is almost nil. You must ensure that your device and your smartphone are protected by PIN codes or passwords or a multi-authentication system, and that you use a reliable and secure app of origin.
Risks related to cyberespionage: in principle, a cold wallet is not connected and cannot be exposed to espionage on networks and computer systems. However, the attack by listening to the NFC signal is possible if the device is not equipped with a security and encryption system. The risk of remote espionage is therefore almost nil. As for proximity cyberespionage, whether invasive or non-invasive, the risk is nil to moderate depending on the type of security and access control implemented. You should avoid sharing your secret phrase with unauthorized third parties or using it in public or insecure places. Some technologies such as EviSeed have an encrypted sharing system with trust criteria defined by the sender that the recipient cannot modify and must also have an NFC device to access the secret phrase.
The legal aspect and the protection of sensitive data
Legal aspect: this technique does not pose any particular legal problem, unless the possession or use of crypto assets is prohibited or regulated in the country concerned.
Protection of sensitive data: this technique depends on the encryption and security measures implemented by the electronic device and its NFC technology. You should inquire about the technical characteristics and guarantees offered by the manufacturer or supplier of the device.
Another aspect that you need to consider when backing up your secret phrase is the legal aspect and protection of sensitive data. Depending on where you live and where you store your secret phrase, you may be subject to different laws and regulations regarding data privacy and security.
Data privacy refers to the right of individuals to control how their personal information is collected, used and shared by others. Data security refers to the technical measures taken to protect data from unauthorized access or disclosure.
Some examples of laws and regulations that may affect how you backup your secret phrase are:
GDPR (General Data Protection Regulation): A European Union law that aims to protect the personal data of EU citizens and residents by imposing strict rules on how data controllers and processors handle their data.
CCPA (California Consumer Privacy Act): A California state law that gives California consumers more control over their personal information by granting them rights such as access, deletion and opt-out.
HIPAA (Health Insurance Portability and Accountability Act): A US federal law that protects the privacy and security of health information by setting standards for how health care providers and other entities handle their data.
To comply with these laws and regulations, you need to be aware of:
The type of data that you backup: Is it personal data (such as name, email address or phone number) or sensitive data (such as health records, biometric data or financial information)?
The location where you backup your data: Is it within your country or jurisdiction, or is it in another country or region that may have different laws or standards?
The purpose for which you backup your data: Is it for personal use only, or is it for business or professional purposes?
The consent that you obtain from others: If you backup data that belongs to someone else (such as a client or a partner), do you have their permission and agreement on how you will use and protect their data?
To ensure that you respect the legal aspect and protection of sensitive data when backing up your secret phrase, you need to:
Choose a technique that suits your needs and preferences in terms of privacy and security.
Check the laws and regulations that apply to your situation and follow their requirements.
Inform yourself about the risks and responsibilities involved in backing up your secret phrase.
Respect the rights and interests of others whose data may be affected by your backup.
Use a mnemonic method
This technique consists of using a mnemonic method that consists of associating each word of the secret phrase with a mental image or a story. This method allows you to memorize your secret phrase more easily without having to write it down or store it. It requires however a good memory and regular repetition to not forget your secret phrase.
Advantages and disadvantages
Advantages: this technique offers discretion and total independence, but it exposes the secret phrase to risks of amnesia, confusion or interference.
Disadvantages: this technique exposes the secret phrase to risks of amnesia, confusion or interference.
Risks related to cyber security and cyber espionage
Risks related to cyber security: this technique does not involve exposure to networks or computer systems, so the risk of cyber security is low.
Risks related to cyber espionage: this technique does not involve exposure to networks or computer systems, so the risk of cyber espionage is low.
The legal aspect and protection of sensitive data
Legal aspect: this technique does not pose any particular legal problem, unless the possession or use of crypto-assets is prohibited or regulated in the country concerned.
Protection of sensitive data: this technique offers optimal protection of sensitive data as long as you do not reveal your mnemonic method or your secret phrase.
Another aspect that you need to consider when backing up your secret phrase is the legal aspect and protection of sensitive data. Depending on where you live and where you store your secret phrase, you may be subject to different laws and regulations regarding data privacy and security.
Data privacy refers to the right of individuals to control how their personal information is collected, used and shared by others. Data security refers to the technical measures taken to protect data from unauthorized access or disclosure.
Some examples of laws and regulations that may affect how you backup your secret phrase are:
GDPR (General Data Protection Regulation): A European Union law that aims to protect the personal data of EU citizens and residents by imposing strict rules on how data controllers and processors handle their data.
CCPA (California Consumer Privacy Act): A California state law that gives California consumers more control over their personal information by granting them rights such as access, deletion and opt-out.
HIPAA (Health Insurance Portability and Accountability Act): A US federal law that protects the privacy and security of health information by setting standards for how health care providers and other entities handle their data.
To comply with these laws and regulations, you need to be aware of:
The type of data that you backup: Is it personal data (such as name, email address or phone number) or sensitive data (such as health records, biometric data or financial information)?
The location where you backup your data: Is it within your country or jurisdiction, or is it in another country or region that may have different laws or standards?
The purpose for which you backup your data: Is it for personal use only, or is it for business or professional purposes?
The consent that you obtain from others: If you backup data that belongs to someone else (such as a client or a partner), do you have their permission and agreement on how you will use and protect their data?
To ensure that you respect the legal aspect and protection of sensitive data when backing up your secret phrase, you need to:
Choose a technique that suits your needs and preferences in terms of privacy and security.
Check the laws and regulations that apply to your situation and follow their requirements.
Inform yourself about the risks and responsibilities involved in backing up your secret phrase.
Respect the rights and interests of others whose data may be affected by your backup.
How to update your backup phrase
Sometimes, you may need to update your Backup phrase if you change your wallet settings or switch to a different custody model. For example, if you add a passphrase to your singlesig wallet, you need to update your backup phrase with the new passphrase. Or if you migrate from singlesig to multisig, you need to create new recovery phrase backups for each of the multisig keys.
To update your recovery phrase backup, follow these steps:
Make sure you have access to your current recovery phrase backup and any other information that may affect your wallet, such as a passphrase or a derivation path.
Create a new physical backup of your updated seed phrase using the same methods and materials as before.
Test your new recovery phrase backupusing a different device or platform than the one you used to create or update your wallet.
If everything matches, your new recovery phrase backup works and you can safely destroy or erase your old recovery phrase backup.
If something doesn’t match, check for errors in your new recovery phrase backup and try again.
Why and How to Share Your Recovery Phrase Backup with Trusted Parties.
In some cases, If you choose to share your backup seed phrase with trusted individuals, such as family, friends, or lawyers, to ensure your cryptographic assets remain accessible in emergencies, accidents, or death. However, sharing your backup seed phrase has risks and challenges, such as choosing trustworthy individuals, secure communication, and preventing conflicts or disputes.
If you want to share your approved seed phrase with others, follow these steps:
Choose trusted individuals who have knowledge about cryptography to access your backup seed phrase. Explain to them the risks and responsibilities associated with accessing it, as well as what a seed phrase is and how it works.
Select a secure communication method that protects your privacy and prevents unauthorized access or interception. You can use encrypted messaging apps, password-protected files, or face-to-face meetings. For an added layer of security, you can use Freemindtronic’s EviSeed technology. EviSeed allows you to share your encrypted seed phrases offline via the Near Field Communication (NFC) encrypted communication protocol between end-to-end encrypted NFC devices. You can also share your seed phrases via an RSA-4096 encrypted QR code, which can be generated from an NFC device and shared through any means of communication, including air gap (webcam, proximity, email, SMS, chat, face-to-face).
Share your backup seed phrase with chosen individuals using the secure communication method selected. Include any relevant information for accessing or managing your cryptographic assets, such as a secret phrase, derivation path, or wallet instructions. Use EviSeed’s patented technology for higher security, including segmented key authentication by adding trust criteria.
For example, share one or more trust criteria to control access conditions to your AES-256 post-quantum encrypted seed phrases. Share a password associated with a unique geographic zone, which must be used in a specific location to decrypt your seed phrase. Provide this password to a trusted third party who does not know the geographic zone or who can only access it under complicated conditions, such as at a notary, sealed by a bailiff, or in a bank vault.
Once you have shared your backup seed phrase with your chosen individuals, ask them to confirm that they have received and understood it, as well as any other relevant information.</li>
Keep their contact information in a safe place in case you need to contact them in the future.
With EviSeed technology, you have other options for sharing backup seed phrases. You can clone your NFC device with all of your trust criteria onto another Freemindtronic NFC device. Then, you can entrust it to a trusted third party or keep it in an easily remembered location. Choose an extremely rugged and waterproof IP89KNFC device to limit the risk of damage. Your recovery phrase backups are also protected against the risk of theft or loss since the device is physically locked with multi-factor physical and digital authentication. Additionally, if you have added trust criteria, even if the access controls are compromised, your recovery phrase backups will remain secure until all the trust criteria you have defined are validated. You can also share your individually encrypted and protected seed phrases by trust criteria, which you can also share in a segmented manner among various individuals, as explained above.
Lastly, make sure to periodically review and update your list of trusted individuals, as well as your communication and security methods, to ensure the ongoing protection and accessibility of your cryptographic assets.
The SeedNFC HSM Tag format, available in multiple colors, includes a free Bluetooth keyboard emulator for the Model 100. Manage your cryptocurrency securely and conveniently.
Best practices for creating and storing your physical backup
Here are some best practices that you should follow when creating and storing your physical backup:
Write down or engrave your seed phrase on a durable material such as paper, metal or plastic. Avoid using materials that can fade, rust, melt or degrade over time.
Use a pen or a tool that produces clear and permanent marks on the material. Avoid using pencils, markers or stickers that can smudge, erase or peel off.
Use a standard format for writing down your seed phrase such as BIP39 or SLIP39. These formats use a predefined list of words that are easy to spell and recognize. Avoid using abbreviations, acronyms or symbols that can cause confusion or errors.
Make multiple copies of your physical backup and store them in different locations. This way, you can reduce the risk of losing all your backups in case of theft, loss or damage. You can also use different materials for each copy to increase the durability and diversity of your backups.
Store your physical backups in a safe and secret place that only you know and can access. You can use a safe, a lockbox, a hidden compartment or any other secure container that can protect your backups from unauthorized access or environmental factors.
Do not share your seed phrase with anyone or store it online. Your seed phrase is the key to your crypto wallet and funds. If you share it with anyone or store it online, you are exposing yourself to the risk of losing your funds to hackers, scammers or third parties.
Tools for Creating and Storing Your Physical Backups
Several tools help you create and store your physical backups easily and securely. These tools let you write or engrave your seed phrase on durable materials, protecting them from damage or tampering. Here are some examples:
CryptoSteel: This device engraves your seed phrase on stainless steel tiles that resist fire, water, and corrosion. The tiles assemble in a metal casing with a lock and a seal. CryptoSteel is compatible with BIP39 and SLIP39 formats and stores up to 24 words.
Billfodl: This device also engraves your seed phrase on stainless steel tiles that resist fire, water, and corrosion. The tiles arrange in a metal frame with a sliding cover and a seal. Billfodl is compatible with the BIP39 format and stores up to 24 words.
Cobo Tablet: This device also engraves your seed phrase on stainless steel tiles that resist fire, water, and corrosion. The tiles insert into a metal plate with holes for each word position. Cobo Tablet is compatible with the BIP39 format and stores up to 24 words.
Paper Wallet: This is the simplest way to create a physical backup. You just write your seed phrase on paper with a pen. You can also print your seed phrase if you prefer. However, paper wallets are not durable and can be damaged by fire, water, or wear and tear.
NFC Seed Backup: This device encrypts and saves your seed phrase on an NFC coin that resists fire, water, and corrosion. An app on your smartphone scans the NFC coin and views your seed phrase without leaving anything visible. NFC Seed Backup is compatible with the BIP39 format and stores up to 24 words.
EviSeed: EviSeed is a technology developed by Freemindtronic that allows you to save and share sensitive data such as private keys, recovery phrases, or passwords. It is integrated into physical devices such as electronic cards that work with NFC (Near Field Communication) technology. The EviSeed technology offers several advantages:</p>
The EviSeed technology uses two patented systems of multifactor authentication and advanced access control.
It encrypts data with the AES256 algorithm, ensuring a high level of security.
It stores data in EPROM memory, ensuring long-term durability without a battery.
It allows data sharing via QR code, NFC tag, NFC reader/writer, Bluetooth, Wi-Fi, SMS, email, etc.
It supports multiple languages, formats, standards, protocols, etc.
It protects data with patented physical blockchain technology, allowing user-defined access control, authentication, encryption, decryption, etc.
EviSeed is compatible with BIP39, SLIP39, and IOTA formats and can store up to 100 recovery phrases.
It protects data with two international patents on access control and segmented key authentication.
et=”_blank” rel=”noopener”>DataShielder HSM PGP: This device allows you to encrypt all your seed phrases using the EviSeed function</strong> for just €39 as a one-time cost. This enables users to duplicate the seed phrases multiple times and store them in different locations, ensuring cyber resilience.
et=”_blank” rel=”noopener”>SeedNFC HSM: This device incorporates advanced technologies such as AES-256 CBC to secure recovery phrases and an RSA 4096 key pair</strong> to share or duplicate them even remotely between NFC HSMs. This device can store up to 100 BIP39 seed phrases (12/15/18/21/24 words) in 8 languages: English, French, Italian, Spanish, Japanese, Korean, Simplified Chinese, and Traditional Chinese. It also manages up to 50 different wallets on the Bitcoin and Ethereum blockchains and is discreet and easy to carry.</p>
Keepser: Keepser is another product based on EviSeed technology created by Keepser Group. It allows you to store up to 100 recovery phrases on an electronic card embedded in military-grade resin. It offers the same features as EviSeed plus some additional benefits.
Understanding and Securing Your Recovery Phrase
In this article, we have explained what a recovery phrase is and how to secure it. A recovery phrase is a list of 12 or 24 words that can restore your crypto wallet and your private keys on any device. It is the ultimate key to access your crypto assets, so you need to keep it safe and secret.
Tips for Physically Backing Up and Storing Your Recovery Phrase
We have given some tips on how to physically back up your recovery phrase and store it in a safe and secret place. Some of the methods include:
Writing it down on paper and keeping it in a fireproof and waterproof container.
Engraving it on durable metals like stainless steel or titanium and hiding it in a secure location.
Encrypting it with a strong password and storing it on an offline device or a cloud service that you trust.
Using a legitimate and trustworthy hardware wallet and keeping it away from physical damage or malware.</p></li>
Using a decentralized digital vault that offers a high level of security and privacy and does not require you to trust a third party.
</p>
Introducing EviSeed Technology
We have introduced EviSeed, a technology developed by Freemindtronic that allows you to store and share your recovery phrase securely and contactlessly. EviSeed uses NFC technology to store your recovery phrase in a hardware device. This device can last for at least 40 years without a battery or maintenance. This provides a highly reliable method for securing your recovery phrase.
Furthermore, EviSeed employs its own patented segmented key technology to add criteria to the encryption keys of your recovery phrases. All segments must be reunited and validated to access your seed phrases. This gives you total control of the segmentation from end to end with your NFC HSM device by Freemindtronic. EviSeed is compatible with all BIP39 recovery phrases and offers several solutions for storing encrypted recovery phrases. These solutions include externalizing them from the NFC device. This ensures you can recover your recovery phrase in case of loss or theft.
In Summary
we hope this article has helped you understand the importance of securing your recovery phrase. Additionally, we have discussed the different options available to do so. Remember, your recovery phrase is the key to your crypto wealth. Therefore, treat it with care and respect.
Among the various solutions, we believe that EviSeed is the most innovative and reliable one. This solution combines the advantages of physical and digital backups. Furthermore, it adds an extra layer of security and convenience. With EviSeed, you can access your crypto funds with ease and confidence. Consequently, you won’t fear losing or compromising your recovery phrase.
BITB attacks by Jacques Gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
Beware of BitB phishing attacks by iframe!
Phishing by iframe is a malicious technique that inserts a fake web page into a legitimate one, to trick users and steal their personal or financial information. This method often targets cryptocurrency holders, especially BitB users. Learn how to spot and avoid BitB phishing attacks by iframe with Freemindtronic.
We have all seen phishing attacks aren’t uncommon, and they demand urgent attention with fake emails and messages at least once.. However, there’s much more in the cybersecurity landscape than just conventional email practices when it comes to phishing. Enterprises that don’t take the necessary precautions can suffer a death blow from a phishing attack. The top line is affected, but the brand’s image and trust can be obliterated if news of a data breach reaches the public.
The latest form of phishing scam is the browser in the browser attack (BITB) that simulates a browser window within a web browser and steals sensitive user information. A fraudulent pop-up window caters to the user and asks for their credentials to sign into the website in the previous web browser window, leading to identity theft.
This article explains what BITB attacks are and how they work, what the risks and consequences of BITB attacks are, how to prevent and protect yourself from BITB attacks using EviBITB technology, and how to install EviBITB on your web browser.
What are BITB attacks and how do they work?
BITB stands for Browser-In-The-Browser. This phishing technique creates a fake browser window within your web browser using HTML and CSS code. An iFrame of redirection, which is an invisible element that loads content from another URL, is displayed by this fake window. The iFrame of redirection mimics the appearance and functionality of a legitimate site, such as Google, Facebook, or Outlook, and asks you to enter your authentication information.
This fake window shows a legitimate URL in the address bar, as well as the icon and the title of the original site. That is the problem. Most users rely on checking the URL to verify the authenticity of a site. This makes it very difficult to detect the phishing attempt. This attack can affect you even if you use a secure connection (https).
BITB attacks can bypass many security measures that are designed to prevent phishing. That is why they are very dangerous. For example:
BITB attacks do not involve malicious links or domains. Anti-phishing software may fail to detect them because of that.
BITB attacks do not intercept your verification codes or tokens. Two-factor authentication may not protect you from them because of that.
Password managers may autofill your credentials on the fake window. They may not protect you from BITB attacks because of that.
Therefore, BITB attacks can allow hackers to access your accounts, steal your data, or even take over your identity. They pose a serious threat to your online security and privacy because of that.
How do BITB attacks work?
Two features of modern web development enable BITB attacks: single sign-on (SSO) options and iFrames.
Many websites embed SSO options that allow you to sign in using an existing account from another service, such as Google, Facebook, Apple, or Microsoft. This option is convenient because you do not need to create a new account or remember a new password for each website you visit.
iFrames are elements that can load content from another URL within a web page. They are often used for embedding videos, maps, ads, or widgets on websites.
The attackers do the following steps:
They make a phishing website with SSO options.
On their phishing website, they embed an iFrame of redirection that leads to their own server with a fake SSO window.
Using HTML and CSS code, they design their fake SSO window to imitate a browser window inside the browser.
They make their fake SSO window appear when you click on an SSO option on their phishing website.
With JavaScript code, they show a legitimate URL in the address bar of their fake SSO window.
Using OAuth methods, they request you to enter your credentials on their fake SSO window.
To their server, they send your credentials and then redirect you to the real website.
As you can see, BITB attacks are very deceptive and convincing. They can fool even savvy users who check the URL before entering their credentials.
What are the risks and consequences of BITB attacks?
BITB attacks are a serious threat. They can compromise data and identity for users and businesses. Users who fall victim to BITB attacks face these risks and consequences:
Their SSO account can be hijacked and all linked services accessed by the attacker.
Their personal and financial information can be stolen and used for identity theft, fraud or blackmail.
Their devices can be infected by malware or ransomware and their files damaged or encrypted.
Their online reputation can be tarnished by spamming or posting malicious content.
Businesses that offer SSO options are also vulnerable to BITB attacks. They can lose trust and loyalty from their customers or employees. Businesses that suffer a data breach due to BITB attacks face these risks and consequences:
Their customer or employee data can be exposed, exploited or sold by the attacker or the dark web.
Their brand image and reputation can be damaged by negative publicity and customer complaints.
Their legal and regulatory compliance can be violated by data protection laws and regulations.
Their revenue and profitability can be reduced by customer churn, lawsuits and fines.
Recent Examples of BITB Attacks
BITB attacks are not new, but they have become more sophisticated and widespread in recent years. Here are some examples of BITB attacks that targeted governmental entities:
In February 2020, Zscaler revealed a campaign of phishing BitB targeting users of Steam, a video game digital distribution service. The hackers created fake Counter-Strike: Global Offensive (CS: GO) websites that offered free skins or weapons for the game. These websites displayed a fake pop-up window that asked users to sign in with Steam. If users entered their credentials, they were sent to the hackers who could then access their Steam accounts and steal their items.
In March 2020, Bitdefender reported a campaign of phishing BitB targeting users of Office 365, a cloud-based suite of productivity applications. The hackers sent emails that pretended to be from Microsoft and asked users to update their Office 365 settings. These emails contained a link that led users to a fake Office 365 website that displayed a fake pop-up window that asked users to sign in with Office 365. If users entered their credentials, they were sent to the hackers who could then access their Office 365 accounts and steal their data.
In September 2020, Proofpoint uncovered a campaign of phishing BitB targeting users of Okta, a cloud-based identity and access management service. The hackers sent emails that pretended to be from various organizations and asked users to verify their Okta account. These emails contained a link that led users to a fake Okta website that displayed a fake pop-up window that asked users to sign in with Okta. If users entered their credentials, they were sent to the hackers who could then access their Okta account and compromise their other connected applications.
These examples show that BITB attacks can target any SSO provider and any website or web application that uses SSO. They also show that hackers can use various methods to lure users into clicking on malicious links or entering their credentials on fake windows.
What are some statistics on BITB attacks?
BITB attacks use iFrames to deceive users with fake SSO windows. Here are some statistics on BITB attacks:
According to Statista, the number of unique phishing sites detected worldwide reached 2.11 million in the third quarter of 2020, an increase of 10% from the previous quarter.
According to The Hacker News, BITB attacks can exploit third-party SSO options embedded on websites such as “Sign in with Google” (or Facebook, Apple, or Microsoft) to create fake browser windows within the browser and spoof legitimate domains.
According to Zscaler, BITB attacks have been used in the wild at least once before, in February 2020, to target Steam users by means of fake Counter-Strike: Global Offensive (CS: GO) websites.
According to NetSPI, the volume of successful phishing attacks on organizations worldwide in 2021 was highest in Brazil (25%), followed by India (17%), and Mexico (14%).
According to DZone, the most targeted industry sectors by phishing attacks as of the third quarter of 2020 were SaaS/Webmail (33%), Financial Institutions (22%), and Payment Services (14%).
How to effectively fight against BITB attacks?
BITB attacks are very hard to detect, but not impossible. There are some signs that can help you spot them and some measures that can help you prevent them. Here are some tips:
Always check the URL of the site before entering your credentials. Make sure it matches the domain of the site or the SSO provider that you want to use. Do not rely on the URL displayed on the pop-up window, as it can be fake.
Always check the SSL certificate of the site before entering your credentials. Make sure it is valid and issued by a trusted authority. Do not rely on the padlock icon displayed on the pop-up window, as it can be fake.
Always use an updated antivirus software and browser extension that can detect and block malicious sites and scripts. They can help you avoid landing on phishing pages or loading fake windows.
Always use strong and unique passwords for each site or application that you use. Do not reuse the same password for different accounts, as it can increase the risk of compromise if one of them is breached.
Always use two-factor authentication (2FA) for your accounts, especially those that you use for SSO. 2FA adds an extra layer of security by requiring a second factor (such as a code sent to your phone or email) to verify your identity. Having your username and password is less useful for hackers if they need your device or access to your email account too.
How to prevent and protect yourself from BITB attacks using EviBITB technology?
The best way to prevent and protect yourself from BITB attacks is to use EviBITB technology, a technology that allows you to detect and remove redirection iframes from web pages. EviBITB is integrated for free in the free and paid extensions of Freemindtronic that are compatible with NFC HSM devices that use a smartphone or an NFC HSM device. The latter stores encrypted multiple authentication information (username, password, otp) for secure authentication for any website on the internet or intranet.
EviBITB technology also has a system of automatic backup of the URL of connection to the account using a web browser to connect to an online account on the internet or intranet. This extension is paired with the NFC android phone which is itself paired with an NFC HSM where encrypted detailed authentication information such as username, password, and secret keys OTP (TOP or HOTP) are stored. Thus, before authorizing auto-filling of connection fields or auto-connection to an online account, the phone will check beforehand if the connection URL is compliant (sandbox technique). This system adds to EviBITB protection.(click here to learn more about EviBITB)
By using EviBITB technology, you can enjoy many benefits:
You can avoid falling victim to BITB attacks that can steal your data or compromise your identity.
You can reduce the risk of keylogging or malware infections that can capture your keystrokes or spy on your online activity.
You can save time and hassle by using your smartphone or NFC HSM card as an authentication key instead of creating or remembering passwords for each website you visit.
You can enjoy a seamless and user-friendly experience by accessing websites with just a tap of your smartphone or NFC HSM card on your computer screen.
You can protect your privacy by controlling what data you share with each website you visit, such as your name, email, or profile picture.
By using EviBITB technology, you can be sure that the web page you see is the one you want to see, and that you do not give away your data to hackers.
How can EviBITB protect you from BITB attacks?
EviBITB is a technology that enhances your online security. It is implemented in the freemindtronic extensions that allow secure end-to-end autofill and auto-login from an NFC HSM. It also detects and removes phishing iFrames from your web browser.
EviBITB works with an application installed on an NFC Android phone that is paired with an NFC HSM. The application has a sandbox that checks if the origin URLs saved automatically during the first login are compliant. If they are, it transfers encrypted authentication information to the extension.
EviBITB also analyzes the web page source code and detects any possible BITB iFrames. It looks for hidden elements, suspicious URLs, or mismatched styles that indicate a fake browser window.
When EviBITB detects a BITB iFrame, it alerts you by showing a warning window on your computer screen. This window shows you the redirection iFrame URL and asks you to check if you trust this URL before entering any sensitive information.
How EviBITB technology can improve your browsing experience?
EviBITB technology is a security, performance and privacy enhancer. It removes redirection iframes and improves your browsing experience in several ways:
It speeds up web page loading, by avoiding requests to third-party sites.
It reduces bandwidth consumption, by saving data transferred to or from iframes.
It limits exposure to ads and pop-ups, by blocking their sources in iframes.
It prevents online activity tracking, by deleting cookies and data stored by iframes.
It enhances readability and usability of web pages, by removing distracting elements from iframes.
It increases compatibility and accessibility of web pages, by avoiding conflicts or errors caused by iframes.
With EviBITB technology, you can enjoy a faster, smoother and more private browsing experience, without compromising security or convenience.
How to use EviBITB to protect yourself from BITB attacks?
EviBITB is a technology that detects and removes malicious iFrames that expose you to BITB attacks. These attacks simulate a browser window in a web page to prompt you to enter credentials on a fraudulent site.
When EviBITB detects a suspicious iFrame, it shows a warning window that informs you of the risk. This window also gives you five buttons to act on the BITB iFrame:
Close Warning: this button closes the warning window without acting on the BITB iFrame. You can use it if you trust the iFrame URL or want to ignore it.
Never Show Warnings On This Site: this button adds the website URL to a list of trusted sites. EviBITB will not alert you of BITB iFrames on these sites. You can use it if you are sure the website is safe and has no malicious iFrames.
Destroy: this button deletes the BITB iFrame from the web page source code. You can use it if you do not trust the iFrame URL or want to remove it.
Clean Storage: this button clears the data stored by the BITB iFrame in the browser. You can use it if you have been exposed to phishing by iFrame and want to erase any traces.
Read More: this button redirects you to a page with more information about EviBITB and its benefits. You can use it if you want to learn more about how EviBITB works and protects you from hackers.
Why you should use EviBITB to secure your online access?
EviBITB is a technology that allows you to use your smartphone or your NFC HSM card as a secure authentication key for any website. With EviBITB, you enjoy many benefits:
You avoid BITB attacks that can steal your data or impersonate your identity.
These attacks simulate a browser window in a web page to prompt you to enter your credentials on a fraudulent site.
You reduce the risk of keylogging or malware infections that can capture your keystrokes or spy on your online activity.
You save time and hassle by using your smartphone or NFC HSM card as an authentication key instead of creating or remembering passwords for each website you visit.
You enjoy a seamless and user-friendly experience by accessing websites with just a tap of your smartphone or NFC HSM card on your computer screen.
You protect your privacy by controlling what data you share with each website you visit, such as your name, email, or profile picture.
By using EviBITB, you can be sure that the web page you see is the one you want to see, and that you do not give away your data to hackers.
How EviBITB can improve your browsing experience?
EviBITB is not only a security tool, but also a performance and privacy enhancer. By removing redirection iframes, EviBITB can improve your browsing experience in several ways:
It can speed up the loading of web pages, by avoiding unnecessary or malicious requests to third-party sites.
It can reduce the bandwidth consumption, by saving the data that would otherwise be transferred to or from the iframes.
It can limit the exposure to ads and pop-ups, by blocking the sources that display them in the iframes.
It can prevent the tracking of your online activity, by deleting the cookies and other data that the iframes may store in your browser.
It can enhance the readability and usability of web pages, by removing distracting or irrelevant elements from the iframes.
It can increase the compatibility and accessibility of web pages, by avoiding potential conflicts or errors caused by the iframes.
By using EviBITB, you can enjoy a faster, smoother and more private browsing experience, without compromising your security or convenience.
How to get started with EviBITB?
Getting started with EviBITB is easy and fast. You just need to follow these steps:
Download the EviBITB extension for your web browser based on Chromium or Firefox from Freemindtronic’s official website: https://freemindtronic.com/evibitb-stop-bitb-phishing-attacks/
Install the extension on your web browser and follow the instructions to set it up.
Get a smartphone or an NFC HSM card compatible with the extension. You can find more information about these devices on Freemindtronic’s website: https://freemindtronic.com/how-does-evibitb-work-detailed-guide/
Pair your smartphone or NFC HSM card with your computer using Bluetooth or NFC technology.
Start browsing the web securely with EviBITB. Whenever you visit a website that offers SSO options, you will see a green icon on the address bar indicating that EviBITB is active. You can then tap your smartphone or NFC HSM card on your computer screen to authenticate yourself and access the website.
What are some videos on BITB attacks and EviBITB?
If you want to learn more about BITB attacks and EviBITB technology, you can watch some videos on these topics:
A video demonstration of a BITB attack by mrd0x:
In conclusion
BITB attacks are a new and sophisticated form of phishing that can steal your credentials by simulating a browser window within your browser. They can bypass many security measures that are designed to prevent phishing and compromise your online security and privacy.
EviBITB is a free technology that detects and removes phishing iFrames from your web browser. It also offers other features to enhance your online security, such as authentication via NFC HSM devices that secure your credentials without typing them on your keyboard.
If you want to benefit from EviBITB technology, you just need to download the extension corresponding to your web browser on Freemindtronic’s official website:
You will also need a smartphone or an NFC HSM card compatible with the extension. You can find more information about these devices on Freemindtronic’s website.
Snake malware by Jacques gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
Snake: The Russian malware that steals sensitive information for 20 years
Snake is a malware that allows Russian intelligence services to collect and transmit sensitive information from hundreds of infected computers across 50 countries. It is a very sophisticated espionage tool, designed and used by Center 16 of the Federal Security Service of the Russian Federation (FSB) for long-term operations on strategic targets.
Snake: The Russian malware that steals sensitive information for 20 years
Snake is a malware that allows Russian intelligence services to collect and transmit sensitive information from hundreds of infected computers across 50 countries. It is a very sophisticated espionage tool, designed and used by Center 16 of the Federal Security Service of the Russian Federation (FSB) for long-term operations on strategic targets.
The origin of the name Snake
The malware authors named the malware Snake themselves, as it appears in the data that Snake exfiltrates from compromised systems. It is also known by the names Uroboros, Turla, Venomous Bear or Waterbug. These names are used by different security researchers or vendors to refer to the same malware family.
The Mac version of Snake malware
In 2017, security researchers discovered a Mac version of Snake malware. It had many similarities with the Windows version, such as the use of encryption and fragmentation for communication, the ability to execute commands and download modules, and the presence of the name “Snake” in the exfiltrated data. However, it also had some differences, such as the use of a fake Adobe Flash Player installer to infect systems, the use of a launch daemon to achieve persistence, and the use of a Python script to run the main payload. The Mac version of Snake malware showed that the FSB was expanding its target range to include Mac users.
What is Snake?
Snake is a malware that implants itself on infected systems and steals confidential information, such as documents, communications or credentials. It is implemented in the .NET programming language and uses custom communication protocols that employ encryption and fragmentation to ensure confidentiality and avoid detection. It is capable of spreading on local networks and bypassing security measures.
Snake is implemented in the .NET programming language and custom communication protocols with encryption and fragmentation are the tools that Snake uses to ensure confidentiality and avoid detection. It is capable of spreading on local networks and bypassing security measures. It can also execute commands on infected systems and download additional modules or payloads.
Another variant of Snake malware is Snake ransomware, also known as Ekans. This variant targets manufacturers and industrial control systems. It can infect an entire network before activating and encrypting files. It also attempts to stop processes related to industrial control systems, such as SCADA and HMI software. This can cause serious disruption and damage to critical infrastructure. Snake malware as a ransomware threat demands a ransom in Bitcoin to decrypt the files. Some of its victims include Honda and Enel Group.
How does Snake work?
Snake works by creating a covert peer-to-peer (P2P) network of many infected computers worldwide. Many of these systems serve as relay nodes that route disguised operational traffic to and from Snake implants on the FSB’s final targets. Thus, Snake creates an almost undetectable way to transmit stolen information to Russia.
On May 9, 2023, the Cybersecurity and Infrastructure Security Agency (CISA) and its partners issued a joint advisory to disclose the threat of Snake malware. The advisory provides technical descriptions of the malware’s host architecture and network communications, and mitigations to help detect and defend against this threat. On the same day, the US Department of Justice announced the completion of a court-authorized operation, code-named MEDUSA, to disrupt a global peer-to-peer network of computers compromised by Snake malware.
An example of technical analysis of Snake malware
To illustrate how Snake malware works in detail, we will use an example of technical analysis conducted by FortiGuard Labs on a fresh variant of Snake keylogger malware. This variant was captured in November 2021 and was delivered as an Excel file with malicious macro code. The main payload of Snake keylogger malware was an executable file named “Requests07520000652.exe”, which the macro code downloaded and executed
Snake malware’s core component
Several embedded resources were contained in the main payload, which was a .NET assembly file. Reflection loaded another .NET assembly file named “Guna.UI2.dll” into memory, which was one of theml”, which was loaded into memory by reflection. This file contained the core functionality of Snake keylogger malware, such as stealing information, taking screenshots, capturing clipboard data, and communicating with a command and control (C2) server.
How Snake malware steals sensitive data
The information stealing module was responsible for collecting various types of sensitive information from the infected system, such as:
System information: computer name, user name, operating system version, processor architecture, etc.
Saved credentials: passwords stored in browsers (Chrome, Firefox, Edge), email clients (Outlook), FTP clients (FileZilla), etc.
Keystrokes: keyboard input from various applications (browsers, email clients, chat programs, etc.)
Screenshots: images of the desktop or active window at regular intervals
Clipboard data: text or images copied to the clipboard
Snake stored the collected information in a temporary folder with random names and encrypted it with AES.
How Snake malware communicates with its operators
After the previous subsection, you can add this subsection:
The communication module was responsible for sending the encrypted information to a C2 server and receiving commands from it. The C2 server used a domain name that was generated by an algorithm based on the current date. The communication protocol used HTTP POST requests with custom headers and parameters. Snake encoded the data with Base64 and encrypted it with AES.
Some of the commands that the C2 server could send to the malware were:
GetInfo: request system information from the malware
GetLogs: request keystroke logs from the malware
GetClipboard: request clipboard data from the malware
GetScreen: demander des captures d’écran du malware
Mise à jour : téléchargez et exécutez une version mise à jour du malware
Désinstaller: supprimer le malware du système
How Operation MEDUSA neutralized Snake
After the previous paragraph, you can add this subsection:
Operation MEDUSA used a tool created by the FBI named PERSEUS, which issued commands that caused the Snake malware to overwrite its own vital components. This effectively disabled the malware on infected computers and prevented it from communicating with other nodes or exfiltrating data. The operation also seized several domains used by Snake to communicate with its infrastructure.
How to mitigate against Snake
After the previous subsection, you can add this subsection:
The joint advisory from CISA and its partners provides several recommendations to mitigate against Snake malware. These include:
Updating antivirus software and scanning for indicators of compromise (IOCs)
Implementing network segmentation and firewall rules
Applying security patches and updates
Enforcing strong password policies and multi-factor authentication
Disabling unnecessary services and ports
Educating users about phishing and social engineering
Reporting any suspicious activity or incidents to CISA or law enforcement
How to detect Snake?
The detection of Snake can be difficult due to its high level of stealth and its use of custom protocols. However, there are some ways to identify the presence of the malware on a system or a network.
On the infected system, it is possible to spot a Windows service named “Windows Error Reporting Service” that is not the legitimate service of the same name. This malicious service executes a file WerFault.exe hidden among the many valid Windows WerFault.exe files in the %windows%WinSxS directory. This file is responsible for decrypting and loading Snake’s components into memory2.
There are no official statistics on the exact number of computers infected by Snake or on the amount of information stolen by malware. However, we can rely on some indicators to get an approximate idea of the scale of phenomenon.
Snake is a feature-rich malware that poses a significant threat to users’ privacy and security. Some of its technical characteristics are:
It is implemented in .NET programming language and uses custom communication protocols that employ encryption and fragmentation for confidentiality and avoid detection.
It consists of several components that are encrypted and stored either in files or registry keys on infected systems. These components are decrypted and loaded into memory at runtime by a loader component.
It uses different techniques for persistence on infected systems, such as creating malicious Windows services or modifying legitimate ones.
It uses different techniques for stealth on infected systems, such as hiding its files among valid Windows files or using steganography to hide its malicious code in PNG images.
It uses different techniques for propagation on local networks, such as exploiting vulnerabilities or using stolen credentials.
Message reçu. Here is the same article in English, with some additions on how to prevent Snake from stealing your sensitive data, the technical characteristics of Snake, the consequences of data theft by the malware, and the impact of Snake on businesses and governments. # Snake: The Russian malware that steals sensitive information for 20 years Snake is a malware that allows Russian intelligence services to collect and transmit sensitive information from hundreds of infected computers across 50 countries. It is a very sophisticated espionage tool, designed and used by Center 16 of the Federal Security Service of the Russian Federation (FSB) for long-term operations on strategic targets. ## What is Snake? Snake is a malware that implants itself on infected systems and steals confidential information, such as documents, communications or credentials. It is implemented in the .NET programming language and uses custom communication protocols that employ encryption and fragmentation to ensure confidentiality and avoid detection. It is capable of spreading on local networks and bypassing security measures. The name Snake comes from the name that the malware authors gave it themselves, as it appears in the data that Snake exfiltrates from compromised systems. It is also known by the names Uroboros, Turla, Venomous Bear or Waterbug. ## How does Snake work? Snake works by creating a covert peer-to-peer (P2P) network of many infected computers worldwide. Many of these systems serve as relay nodes that route disguised operational traffic to and from Snake implants on the FSB’s final targets. Thus, Snake creates an almost undetectable way to transmit stolen information to Russia. Snake mainly targets sectors of interest for Russian intelligence, such as governments, research facilities, journalists, or financial and technological sectors. Among the identified victims are NATO member countries, media and educational organizations in the United States, or critical infrastructure sectors such as government facilities, financial services, critical manufacturing or communications. Snake has been used by the FSB since 2004 and has undergone numerous adaptations and revisions to remain viable after several public disclosures and other mitigation measures. On the computers it has compromised, the Snake implant persists indefinitely on the system, usually without being detected by the owner or authorized users of the system. ## How to detect Snake? The detection of Snake can be difficult due to its high level of stealth and its use of custom protocols. However, there are some ways to identify the presence of the malware on a system or a network. – On the infected system, it is possible to spot a Windows service named “Windows Error Reporting Service” that is not the legitimate service of the same name. This malicious service executes a file WerFault.exe hidden among the many valid Windows WerFault.exe files in the %windows%WinSxS directory. This file is responsible for decrypting and loading Snake’s components into memory. – On the infected network, it is possible to use network intrusion detection systems (NIDS) to identify some of the custom communication protocols of Snake, such as UDP with XOR fragmentation or TCP with RC4 encryption. These protocols are described in detail in the joint warning issued by partner agencies. ## How extensive is Snake infection? According to partner agencies that issued the joint warning on Snake, malware infrastructure has been identified in more than 50 countries across North America, South America, Europe, Africa, Asia and Australia, including the United States and Russia itself. Although Snake uses infrastructure across all industries, its targeting is purposeful and tactical. Globally, the FSB has used Snake to collect sensitive intelligence from high-priority targets, such as government networks, research facilities and journalists. For example, FSB actors used Snake to access and exfiltrate sensitive international relations documents, as well as other diplomatic communications, from a victim in a NATO country. In the United States, the FSB has affected sectors such as education, small businesses and media organizations, as well as critical infrastructure sectors such as government facilities, financial services, critical manufacturing and communications. ## Snake: All its features to collect sensitive data on compromised systems Snake has a set of features that allow it to collect various sensitive data on compromised systems. Among these features are: – The ability to execute arbitrary commands remotely on the infected system. – The ability to download or upload files from or to the infected system. – The ability to enumerate or modify Windows registry keys or values. – The ability to enumerate or modify files or directories present on the infected system. – The ability to enumerate or modify processes or services running on the infected system. – The ability to capture screenshots of the infected system. – The ability to record keystrokes (keylogging) on the infected system. – The ability to collect various information about the infected system, such as its hostname, IP address, username or password. ## What are the statistics on Snake malware? There are no official statistics on the exact number of computers infected by Snake or on the amount of information stolen by malware. However, we can rely on some indicators to get an approximate idea of the scale of phenomenon. – According to Cybereason , a cybersecurity company that analyzed a variant of malware in 2020 , Snake was distributed via a massive campaign malicious emails that affected more than 100 , 000 recipients in more than 30 countries [ ^1 ^ ] . – According to CISA , a US agency responsible for cybersecurity and security critical infrastructures that published a joint warning with several partners in 2023 , infrastructure malware has been identified in more than 50 countries across six continents [ ^2 ^ ] . – According to CBS News , an American media outlet that reported operation conducted by FBI to neutralize network Snake in United States in 2023 , malware was used for 20 years by FSB to collect sensitive intelligence from hundreds of infected computers [ ^3 ^ ] . ## What are technical characteristics of snake? Snake is a feature-rich malware that poses a significant threat to users’ privacy and security. Some of its technical characteristics are: – It is implemented in .NET programming language and uses custom communication protocols that employ encryption and fragmentation for confidentiality and avoid detection. – It consists of several components that are encrypted and stored either in files or registry keys on infected systems. These components are decrypted and loaded into memory at runtime by a loader component. – It uses different techniques for persistence on infected systems, such as creating malicious Windows services or modifying legitimate ones. – It uses different techniques for stealth on infected systems, such as hiding its files among valid Windows files or using steganography to hide its malicious code in PNG images. – It uses different techniques for propagation on local networks, such as exploiting vulnerabilities or using stolen credentials. – It uses different techniques for exfiltration of stolen data from infected systems, such as using custom UDP or TCP protocols with encryption or fragmentation, or using legitimate applications such as Telegram . ## How can you prevent snake from stealing your sensitive data? To prevent snake from stealing your sensitive data , you should follow some best practices in terms of computer security . These include : – Regularly update operating systems and applications with latest security patches . – Use effective antivirus and antimalware solutions and keep them up date . – Enable firewall and configure strict rules limit incoming outgoing traffic . – Apply principle least privilege limit access sensitive data only authorized users . – Educate users risks related unsolicited suspicious emails attachments . – Perform regular backups important data store them offline secure location . – Monitor anomalies suspicious activities networks report any potential incident . For more information snake how protect yourself it , you can consult joint warning issued by intelligence cybersecurity agencies [ ^2 ^ ] threat analysis report published by Cybereason [ ^1 ^ ] . ## How can you remove snake from your system? To remove snake from your system , you should follow some steps : – Disconnect your system from network prevent further communication with snake infrastructure . – Scan your system with updated antivirus antimalware tools detect remove any traces snake components . – Restore your system previous clean state using backups restore points . – Change passwords any accounts may have been compromised snake . – Report incident relevant authorities seek professional help needed . Alternatively , you can use tool developed FBI called Perseus force snake self-destruct your system . This tool was used operation Medusa neutralize network snake United States May 2023 [ ^3 ^ ] . ## What are consequences data theft by snake? The consequences data theft by snake can be serious both individuals organizations . Depending type data stolen , snake can : – Compromise privacy security victims exposing their personal professional information . – Cause financial losses damages victims stealing their credentials accessing their accounts . – Disrupt operations services victims affecting their availability integrity . – Undermine reputation trustworthiness victims damaging their image credibility . – Endanger national security interests victims revealing their secrets strategies . For example , snake was used FSB access exfiltrate sensitive international relations documents , well other diplomatic communications , victim NATO country [ ^2 ^ ] . This could have serious implications foreign policy security alliance . ## What is impact snake malware businesses ? The impact snake malware businesses can be significant depending type sector industry they belong . Businesses targeted snake may face : – Loss competitive advantage innovation stealing their intellectual property trade secrets . – Loss market share customers stealing their business plans customer data . – Loss revenue profit stealing their financial information disrupting their operations . – Loss reputation trust stealing their confidential information damaging their brand image . – Legal regulatory compliance issues stealing their sensitive information violating their obligations . For example , snake was used FSB victimize industries including education , small businesses media organizations United States [ ^2 ^ ] . These industries may have suffered economic social
ViperSoftX malware by Jacques gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
ViperSoftX: The malware that steals your passwords and cryptocurrencies
Do you use password managers or cryptocurrency wallets to secure your online data? Beware, you could be the target of a malware named ViperSoftX, which infiltrates your computer and steals your sensitive information. Find out how it works, how to detect it and how to protect yourself from it in this article.
ViperSoftX: The Malware that Steals Your Cryptocurrencies and Passwords
ViperSoftX is a malware that steals sensitive information from infected computers, including data related to cryptocurrencies and passwords. It was first discovered in 2020 as a JavaScript-based remote access trojan and cryptocurrency hijacker. Since then, it has evolved to become more sophisticated and stealthy, using innovative arrival and execution techniques, enhanced encryption and a malicious extension for web browsers. In this article, we will examine the features, targets and consequences of ViperSoftX malware, as well as how to protect yourself from it.
How to avoid ViperSoftX, the malware that steals your sensitive data
This is malware is dangerous malware that targets Chrome and other browsers, and can steal your passwords from virtual password managers like 1Password or KeePass 2 and virtual cryptocurrency wallets. In this article, you will learn how it works and how to prevent it from infecting your device.
Features of ViperSoftX malware
ViperSoftX is a malware that stands out for its innovative arrival and execution techniques, enhanced encryption and malicious extension for web browsers. VipersoftX is a malware that steals information from infected computers.
What is ViperSoftX and how does it work?
ViperSoftX is a type of malware called infostealer, which means it is designed to steal the data from a device. It was first discovered in 2020 by Fortinet1, and has since evolved to become more sophisticated and stealthy.
ViperSoftX mainly targets the users of Chrome and other browsers, such as Firefox, Opera, Brave and Microsoft Edge. It installs a malicious extension called VenomSoftX on the browser, which can access and extract sensitive information such as browser login data, cryptocurrency wallets, stored credit card information, passwords and more2.
It is a JavaScript-based Remote Access Trojan (RAT) that allows attackers to remotely control the compromised machine and execute various malicious actions. VipersoftX uses advanced obfuscation techniques to hide itself and evade detection from security software, It uses 8 layers of code obfuscation before executing its actual payload. It uses 3 types of obfuscation techniques: AES decryption, character array conversion, and UTF-81 decoding,
It establishes its persistence by copying itself to %APPDATA% and creating a shortcut in the startup directory to invoke it. It uses seemingly legitimate names to disguise itself, such as v pn_port.dll, reg.converter.sys, install.sig, and install.db
The main features of the malware
These features make ViperSoftX malware a serious threat to the security of users and organizations that use cryptocurrencies or password managers.
Arrival technique by cracked software: The malware usually poses as a cracked software, an activator or a key generator, which hides the malicious code in the overlay. The malware uses non-malicious files as carriers of the malicious code, such as gup.exe from Notepad++, firefox.exe from Tor or ErrorReportClient.exe from Magix. These files are accompanied by a DLL file that serves as a decryptor and loader of the malicious code. This technique aims to deceive users who are looking for illegal versions of software and to avoid detection by security solutions.
Enhanced encryption by byte remapping: The malware uses a sophisticated encryption method that consists of remapping the bytes of the malicious code according to a specific byte map. Without the correct byte map, the encrypted malicious code, including all components and relevant data, cannot be correctly decrypted, making the decryption and analysis of the code longer and more difficult for analysts. The malware also changes its byte map every month, which makes it even harder to track the malicious code.
Monthly change of command and control server: The malware communicates with a command and control (C&C) server to send the stolen information and receive instructions. The C&C server also changes every month, according to a predictable algorithm based on the current date. The C&C server uses the HTTPS protocol to encrypt the communication with the malware.
Ability to steal data from various cryptocurrency wallets and web browsers: The malware mainly aims to steal data related to cryptocurrencies, such as private keys, passwords and addresses of wallets. The malware targets more than 20 different cryptocurrency wallets, such as Blockchain, Binance, Coinbase, MetaMask or Ledger Live. The malware also installs a malicious extension named VenomSoftX on Chrome, Brave, Edge, Opera and Firefox web browsers. This extension can intercept and modify cryptocurrency transactions made on web browsers. The malware can also steal other sensitive data stored on web browsers, such as cookies, history, bookmarks or autofill data.
Detection of two password managers, KeePass 2 and 1Password: The malware checks for files associated with two popular password managers, KeePass 2 and 1Password, on the infected computer. It also tries to steal data stored in the browser extensions of these password managers. It is not clear whether the malware exploits a known vulnerability of the password managers or whether it uses another method to access the saved passwords.
Consequences of information theft by ViperSoftX malware
ViperSoftX is a malware that can cause serious damage to the users and organizations whose data it steals. The consequences of information theft by ViperSoftX malware can include:
Loss of money: The malware can steal data related to cryptocurrencies, such as private keys, passwords and addresses of wallets. This can result in the loss of funds stored in these wallets, or the redirection of transactions to the attacker’s accounts. The malware can also steal data related to online banking, credit cards or other payment methods, which can enable the attacker to make fraudulent purchases or transfers using the victim’s identity.
Loss of identity or confidentiality: The malware can steal data related to personal or professional identity, such as passport numbers, driver’s license numbers, social security numbers, medical records, online subscriptions, etc. This can result in identity theft, where the attacker can use the victim’s identity to access secure accounts, set up credit cards, apply for loans, or commit other crimes. The malware can also steal data related to confidential or proprietary information, such as software code, algorithms, processes or technologies. This can result in the loss of intellectual property, competitive advantage or trade secrets.
The ViperSoftX malware has made many victims around the world, especially in France. Some users have lost large amounts of cryptocurrencies due to the theft of their wallet addresses. Others have seen their online accounts hacked due to the theft of their passwords. Here are some testimonies collected from forums or social networks:
“I was infected by ViperSoftX two weeks ago. I only realized it when I wanted to make a transfer of bitcoins to another wallet. The address I had copied had been replaced by another one in the clipboard. I lost 0.5 bitcoin, which is about 20,000 euros.”
“I got caught by ViperSoftX by downloading a cracked software from a torrent site. The malware installed a malicious extension on my Firefox browser and stole my passwords stored in KeePass. I had to change all my passwords and disinfect my computer with an antivirus.”
“ViperSoftX caused me a lot of problems. The malware accessed my personal and professional data by going through the extension of 1Password on Chrome. It used my Gmail account to send spam to my contacts and my PayPal account to make fraudulent purchases.”
According to TrendMicro, the ViperSoftX malware has infected more than 10,000 computers worldwide since its appearance in 2020. The number of victims could be even higher, as the malware is difficult to detect by antivirus.
ViperSoftX also steals users’ cryptocurrency by attacking wallets and exchanges. It targets the following wallets in particular: Armory, Atomic Wallet, Binance, Bitcoin, Blockstream Green, Coinomi, Delta, Electrum, Exodus, Guarda, Jaxx Liberty, Ledger Live, Trezor Bridge, Coin98, Coinbase and MetaMask.
The stolen data is then sent to a command-and-control (C2) server controlled by the attackers, who can use it for financial gain or sell it to other hackers.
How to protect yourself from ViperSoftX malware
ViperSoftX is a stealthy and dangerous malware that can cause serious damage to your computer and your data. Therefore, you should take some preventive measures to avoid being infected by this malware. Here are some tips to help you protect yourself from ViperSoftX:
Avoid cracked software: The malware often arrives as cracked software, an activator or a key generator, which hides the malicious code in the overlay. Avoid downloading or using illegal versions of software or games, as they may contain malware. Only download software from trusted sources and verify their authenticity.
Use security software: Use a robust antivirus software that can detect and remove malware from your device. Keep your security software updated and perform regular scans of your device. You can also use a firewall to block unauthorized network connections and a VPN to encrypt your online traffic.
Update your browsers and password managers: The malware installs a malicious extension named VenomSoftX on web browsers and steals data from them. It also checks if the device has security software installed, such as Windows Defender or ESET, and activates its camouflage mechanisms accordingly. Update your browsers and password managers regularly to fix any security vulnerabilities. Also, only install extensions from trusted sources and check their permissions and reviews.
Backup your data: The malware can steal or encrypt your data, making it inaccessible or unusable. Backup your data regularly to an external storage device or a cloud service, so you can restore it in case of a malware attack. You can also use encryption tools to protect your data from unauthorized access.
Be careful with email attachments and links: The malware can also arrive through phishing emails that trick you into clicking on a link or opening an attachment. Be wary of emails that ask you to provide personal or financial information, or that seem to be from unknown or suspicious senders. Also, avoid clicking on links or attachments that look suspicious or irrelevant.
Use strong and unique passwords: The malware can steal your passwords for your online accounts, especially for your cryptocurrency wallets and exchange platforms. Use strong and unique passwords for each account, and avoid using the same password for multiple accounts. You can use a password generator or a password manager to create and store strong passwords.
Enable two-factor authentication (2FA): The malware can use your stolen passwords to access your accounts and perform fraudulent transactions. Enable two-factor authentication (2FA) whenever possible, which adds an extra layer of security to your login process. 2FA requires you to enter a code sent to your phone or email, or generated by an app, in addition to your password.
Avoid downloading and installing software or documents from untrusted sources: The malware often hides behind cracked versions of popular software or games, which are offered on torrent or illegal download sites.
Keep your browser and password manager updated: with the latest security patches, and use strong and unique passwords for each account.
How to remove ViperSoftX from your system
ViperSoftX is a malware that can infect your computer and steal your data. If you suspect or know that your computer is already infected by ViperSoftX, you should act quickly to remove it and prevent further damage. Here are some steps to help you remove ViperSoftX from your system:
Uninstall malicious programs from Windows: ViperSoftX may have installed some malicious programs on your computer that can interfere with your removal process. To uninstall them, go to Control Panel > Programs > Uninstall a program and look for any suspicious programs that you do not recognize or that you did not install yourself. Select them and click Uninstall.
Reset browsers back to default settings: ViperSoftX may have modified your browser settings and installed a malicious extension named VenomSoftX that can steal your data. To reset your browser settings, go to your browser settings and look for an option to reset your browser to its default state. This will remove any malicious extensions, cookies, history, passwords, and other data that ViperSoftX may have added or modified.
Use Rkill to terminate suspicious programs: ViperSoftX may have some processes running in the background that can prevent you from removing it. To stop them, use Rkill, a free tool that can terminate any suspicious processes that are running on your computer. Download Rkill from here and run it as administrator. Wait for it to finish scanning and killing any suspicious processes.
Use Malwarebytes to remove Trojans and unwanted programs: ViperSoftX is a Trojan malware that can hide itself from antivirus detection by using camouflage mechanisms. It also checks if the device has security software installed, such as Windows Defender or ESET, and activates its camouflage mechanisms accordingly. To remove it, use Malwarebytes, a powerful anti-malware software that can detect and remove ViperSoftX and other threats from your computer. Download Malwarebytes from here and install it. Run a full scan and follow the instructions to quarantine or delete any detected threats.
Use HitmanPro to remove rootkits and other malware: ViperSoftX may have some hidden malware components that may have escaped Malwarebytes. To find and remove them, use HitmanPro, a second-opinion scanner that can find and remove any hidden malware that may be on your computer. Download HitmanPro from here and run it. Follow the instructions to scan your computer and remove any remaining malware.
Use AdwCleaner to remove malicious browser policies and adware: ViperSoftX may have changed some browser policies or installed some adware on your computer that can display unwanted ads or pop-ups. To clean your browser from them, use AdwCleaner, a free tool that can remove any unwanted policies, extensions, toolbars, ads, or pop-ups that may have been installed by ViperSoftX or other adware. Download AdwCleaner from here and run it. Click Scan Now and then Clean & Repair to remove any detected threats.
Perform a final check with ESET Online Scanner: To make sure that your computer is completely free of malware infections, perform a final check with ESET Online Scanner, a free online tool that can scan your computer for any remaining malware infections. It can detect and remove viruses, Trojans, spyware, phishing and other internet threats. To use ESET Online Scanner, go to this website and click Start Scan Now. Accept the terms of use and click Enable ESET LiveGrid feedback system. This will allow ESET to collect anonymous data about detected threats and improve its detection capabilities. Wait for the scan to complete and follow the instructions to delete any detected threats.”
By following these steps, you should be able to remove ViperSoftX from your computer completely. However, you should also change your passwords for your online accounts, especially for your cryptocurrency wallets and exchange platforms
How to secure your passwords and cryptocurrencies with modern authentication methods?
One of the best ways to protect your passwords and cryptocurrencies from ViperSoftX and other malware is to use modern authentication methods that rely on hardware devices instead of software. These devices are called hardware password managers or cold wallets.
Hardware password manager
A hardware password manager is a device that stores and manages your passwords securely. Unlike a virtual password manager, which runs on your computer or smartphone, a hardware password manager is a separate device that you can carry with you. This way, you can avoid storing your passwords on potentially compromised devices or online services.
A hardware password manager generates and stores strong passwords for your online accounts, which you can access with one master password. To log in to an online service, you can either type the password manually or use the NFC feature of the device to transmit the password to your computer or smartphone.
NFC
NFC (Near Field Communication) is a wireless technology that allows devices to communicate over short distances. You can use NFC for various purposes, such as contactless payments, smart cards, and authentication. By using NFC, you can log in to your online accounts with a simple tap of your hardware password manager on your device.
Some of the benefits of using NFC are:
It is fast and convenient: you do not need to type long passwords or scan QR codes.
It is secure: NFC uses encryption and authentication protocols to prevent eavesdropping or tampering.
It is compatible: NFC works with most:
Cold wallet
A cold wallet is a device that stores your cryptocurrencies offline. Unlike a hot wallet, which is connected to the internet and vulnerable to hacking, a cold wallet is isolated and protected from unauthorized access. To use a cold wallet, you need to transfer your cryptocurrencies from an online platform to the device and vice versa.
A cold wallet generates and stores private keys for your cryptocurrency accounts. A private key is a secret code that allows you to access and control your cryptocurrency funds. You should never share or lose your private key, as it is the only way to access your funds.
Some of the advantages of using a cold wallet are:
It is safe and reliable: you do not have to worry about hackers, malware, or phishing attacks.
It is easy and convenient: you can manage your funds with a simple interface and a few clicks.
It is versatile and compatible: you can store different types of cryptocurrencies on the same device.
One example of a cold wallet that uses NFC technology is the NFC Cold Wallet with EviVault technology from Freemindtronic Andorra. This device allows you to store and manage your cryptocurrencies securely and conveniently with your smartphone.
EviVault Cold Wallet & Hardware Wallet
EviVault is a patented technology that enhances the security and performance of NFC devices. It uses a combination of hardware and software features to protect your data from physical and logical attacks.
Some of the features of EviVault are:
It encrypts and authenticates your data with AES-256 and HMAC-SHA256 algorithms.
It prevents cloning, tampering, or replay attacks with anti-counterfeiting and anti-replay mechanisms.
It detects and blocks brute force attacks with auto unpairing functions traced in a black box.
It optimizes the speed and reliability of NFC communication with error correction and data compression techniques.
With EviVault, you can enjoy the benefits of NFC technology without compromising your security or privacy.
The impact of the ViperSoftX malware on businesses
The ViperSoftX malware does not only target individuals, but also businesses. Indeed, the malware can compromise the security of professional data by stealing the passwords of employees or customers. It can also infect the computer network of the company and spread other malware, such as ransomware or cryptominers.
To protect themselves from the ViperSoftX malware, businesses must take several measures:
Educate employees about the risks associated with downloading software or documents from unofficial or illegal sources.
Use up-to-date and effective antivirus software to detect and remove the malware.
Choose secure and reliable password managers, which do not store sensitive data in browser extensions.
Check regularly the transactions in cryptocurrencies and the addresses of the wallets.
In conclusion
ViperSoftX is a dangerous malware that can steal your passwords and cryptocurrencies from your virtual password managers and online platforms. To protect yourself from ViperSoftX, you should be careful about what you download and install on your device, keep your software updated and secure, avoid installing unknown or suspicious extensions and backup your data regularly.
To secure your passwords and cryptocurrencies with modern authentication methods, you can use hardware password managers or cold wallets that rely on hardware devices instead of software. These devices use NFC technology to offer you a high level of security and convenience for your online accounts. However, you should also follow some best practices, such as keeping your devices updated and secure, using strong passwords and two-factor authentication, and storing only small amounts of cryptocurrency on online platforms.
