1

There have already been some questions regarding moving Ethereum Wallet data under Windows, for example:

My C: drive in my WINDOWS PC is almost full. How can I change both geth and Mist path to relocate my blockchain files?

I see no problem with this when it come's to the block chain data. However, is it less secure to have the key store outside of the C:\Users\$username$ folder?

I am aware that to compromise a wallet, both the key store file and the associated password would be required.

(I might have written this as a comment in a previous question on this topic but I do not have high enough reputation.)

3 Answers 3

1

is it less secure to have the key store outside of the C:\Users\$username$ folder?

No, it isn't less secure. However If you are keeping your key store on your machine once compromised any location on that machine is no more or less secure. It may be slightly more secure depending on the nature of the attack vector. Though this would only be security through obscurity as you are essentially hiding your key store. Though this is presuming the attacker is using a script that can only search for the key store in predefined locations.

However if you are creating duplicates of your key in multiple locations on your machine then you are essentially making it easier for an attacker to find your key store.

I am aware that to compromise a wallet, both the key store file and the associated password would be required.

Yes this is true, but it is far far easier to brute force attack a password than try to brute force your private key. And if the attacker is using a key logger then then you may expose your password to them without the need for brute force.


I'd recommend that you use a hardware wallet if you are trying to get maximum security.

1

Once a file is on your computer, its location doesn't matter, it is nowhere safe. The only security you can have on a wallet that you keep on your computer is to have a strong password. Make it very strong.


Anyway I recommend you not to use a critical wallet (one with a lot of ether in it) on a computer that you use to connect to the internet.

Have an offline computer holding what we call a "cold storage" and when you need some ETH, just transfert the needed amount from your cold storage to the wallet you use on your online computer (MyEtherWallet offline transaction is nice for that).

1

Looking at this question from a different perspective...

is it less secure to have the key store outside of the C:\Users\$username$ folder?

Potentially, yes.

Especially if you're using a shared machine used by other people.


Your $username$ directory is private to you. Yes, the administrator has access to it, but by moving your keystore you're potentially putting it in a place where other non-admin users of the same machine could access it, increasing the size of your attack surface. Understand what is and isn't a shared/private folder.

(This may not apply to you, if it's only you using the machine, but could apply to other people reading this in future.)

1
  • Thanks, good of you to point this out. This helps me understand the situation. I was aware of the risks particular to a shared computer, my main uncertainty was whether the private user folder gave any additional protection from particular types of hacking attacks, not from other users of the computer.
    – Moustache
    Commented Mar 15, 2017 at 15:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.