You decided that you don’t need a hardware wallet for whatever reason, but what would happen if you solely relied on your software wallet to be safe?
Here are 3 reasons why you should think twice about not using a hardware wallet.
But, before we talk about potential security risks of software wallets, let’s talk about some basic cryptography first.
The parts of cryptography that are most relevant to your understanding in NFTs and web3 are asymmetric cryptography and key pairs. Now, before your eyes glaze over, you can think of asymmetric cryptography in the same way you'd think about the address to your house and the key to unlock the door. It is totally ok for someone to have your address, but if they have your key, you'd better trust them! In cryptography, we call these your public key (address) and private key (house key).
Remember your seed phrase? (Well, we hope you at least have it written down). Your seed phrase is like a master key that generates all of your keys (often referred to as key-pairs). In fact, many thousands of “key pairs” are generated under one seed phrase.
Your public key is public, it's the ETH address that you share with people you make transactions with. Your private key is something that you should only keep to yourself and is used to sign transactions and messages that the blockchain can interpret as valid. For a more in depth description, check out this Wikipedia page on Public-Key Cryptography.
Now - back to wallets.
Software wallets always have their data stored on the device they’re being used on (desktop, mobile etc.), making your keys vulnerable to attacks that target those device(s). Here are some reasons why you should not exclusively rely on your software wallet:
Reason #1 - You don’t have any buffer for transactions you didn’t intend to make.
Have you ever accidentally clicked “sign” on a transaction you didn’t mean to make? We’ve all been there.
When you only use your software wallet to sign transactions, you’re giving away the benefit of confirming a transaction twice. With a hardware wallet, you always sign twice (first on your software wallet, then on the hardware wallet). This added step alone could help you catch potential mistakes in situations where you weren’t paying attention to what you are signing.
Reason #2 - You have less protection against malware and Social Engineering.
Question: What’s our biggest defense against malware in crypto? A hardware wallet!
Why? Because it protects our private keys from getting exposed by malware.
Malware itself can reach you in many forms:
- It could be a job offer you received via LinkedIn with malware disguised as a .pdf file.
- It could be a .scr or screensaver file that you download from somewhere, with you and your computer not realizing there is malicious code attached. The SCR Malware hack explained
- It could be someone DM’ing you on Twitter, offering you a trial of their awesome new P2E blockchain game. You just have to download their .exe launcher, right?
Hardware wallets defend you by:
- Protecting against keyloggers, or remote control software malware, or even someone physically accessing your computer from being able to send funds out of your wallet without having physical access to your hardware wallet and having knowledge of your PIN code to unlock it.
And lastly, “support” scams, screensharing, and many other forms of social engineering are made a lot easier if some of the above tactics can be leveraged due to a user’s lack of a hardware wallet. A common scam in 2021 was to pretend to be a support agent who didn’t speak english well, have you change the language of metamask so they could read it, and then have you reveal your seed phrase in metamask. It was wildly successful, and Boring Security’s discord had many folks wandering in who fell victim to this scam.
Malware is not a thing you worry about?
Reason #3 - You’re leaving yourself open to a lot of vulnerabilities
You are a zero-day vulnerability away from getting your wallet and funds wiped out.
These zero-day vulnerabilities come in many forms:
- Browser vulnerabilities
- Operating system vulnerabilities
- Wallet vulnerabilities
- Clickjacking
- Etc.
These are a lot of vulnerabilities to deal with. You’re relying entirely on your eyes alone, trusting that you “won’t ever click anything bad”.
Even if you are somehow bulletproof to failure (which no one is), there are still third parties involved that you must trust to be bulletproof as well. These include: your browser, operating system, wallet provider, and antivirus.
A recent example of how third party applications can leave you vulnerable is clickjacking. Clickjacking is when a clickable button on a seemingly trustworthy website is mirrored / forwarded to another website or extension. This is precisely what happened in June 2022. Could it happen again? Probably.
Metamask's clickjacking exploit
We hope you’re well aware of what risks you’re exposed to if you’re not getting a hardware wallet when moving in crypto / the NFT space. Stay safe!