The Secret to Security

In today’s world, security is imperative for maintaining control of your belongings whether physical or virtual. Cyber security is vital to keeping you protected, safeguarding your integrity, and avoiding unwanted data disclosure. IOTA provides robust cyber security measures around data integrity and confidentiality, and is even future proof against quantum attacks. While these technological security features are a major benefit to using public/private key encryption, the keys themselves rely on more “human” security measures. It is this latter type of security that is most frequently the weak link.

Recently, a large number of unfortunate users fell victim to an attack against the IOTA community. The attackers in this instance correctly identified this “human element” as the weak link. By using a well-crafted phishing website that appeared to be a legitimate IOTA seed generator, they were able to collect a large number of seeds over a long period of time. They preyed upon the trust of the community, and spent time carefully optimizing the page to appear higher in search engine results, further legitimizing their scam in the eyes of unsuspecting community members.

Unfortunately, this is not the first nor will it be the last time such a scam is perpetrated against IOTA, or digital ledger technologies more broadly. Nevertheless, there are some things you can do to keep yourself safe, the first and foremost of these being to keep your secrets secret.

There is only one way to “prove” who owns a given IOTA address, and that is to spend from it. To spend from an address, one only needs to know the seed from which the address originated. The key takeaways of these facts are:

Spending IOTA tokens is proof of ownership*
If your seed is compromised in any way, the tokens in your wallet are as good as gone.

To put in the simplest possible terms: treat your seed as if it were the only key to your safe.Whoever holds the key has direct access to the contents of the safe. There is a common English idiom that says “possession is 9/10ths of the law.” In IOTA (and indeed, most of the DLT space), possession is the law.**

Creating A Seed, Safely

First and foremost, do not create your seed on a website simply because it appears high up on a list of search results. Better yet, do not use an online seed generator, period.

Choosing a seed is a simple process, in theory: randomly write down uppercase letters (A-Z) and the number 9 on a piece of paper until you have 81 characters written. That’s it, you’re done!

Unfortunately, humans are generally bad at choosing things randomly, so we can use a few tools to increase the randomness of our seed. If you are on Linux or MacOS, you’re in luck! Creating a seed safely and securely on Linux or MacOS takes just a single terminal command. If you’re not comfortable with the terminal, don’t worry, you only need to copy and paste a single command to create the seed.

Linux:

cat /dev/urandom |tr -dc A-Z9|head -c${1:-81}

Mac OSX:
cat /dev/urandom |LC_ALL=C tr -dc 'A-Z9' | fold -w 81 | head -n 1

Remember, your IOTA seed is the key to your safe, and you should always take the extra step to make sure your key is secure. Copy your seed somewhere safe (like an encrypted password database, e.g. KeePass), and after you have copied it, randomly change at least 10 letters (remember: uppercase A-Z and the number 9 only). Save your changes. If you’re writing the seed down, change 10 letters as you write.

If you are on Windows, you can use KeePass directly. Set the password generator to use the symbols A-Z and the number 9, and set a password length of 81. Again, make sure to change at least 10 letters before saving and using the seed.

You can also use KeePassX on Linux or MacOS, but at the time of this writing there is no way to limit your character choices to A-Z and 9. Instead use “A-Z” and then randomly change at least 10 letters and randomly change some letters to the number 9.

The purpose of this somewhat more complicated routine should be clear by now. After doing these steps, you can be 100% sure, or as close to it as technically possible, that:

Your seed is sufficiently random.
You are the only person who has ever had access to your seed.

From now on, keeping your seed safe is up to you and you alone. We offer some tips in the next section.

Storing Your Seed, Safely

You can store your seed easily offline by printing it out and keeping it in a safe place. A physical safe or a safe deposit box are ideal. This means: do not pin it on a board in the kitchen, or on a post-it note stuck to your monitor. If you put it in a filing cabinet under your desk, at least make sure the filing cabinet can be locked. Some Dos and Don’ts for keeping your seed safe:

DO write it down or print it out (at home) and keep it in a physically secured location. A safe may help prevent or delay unauthorized access, but does not necessarily protect against loss. Make sure you understand the fire, flood, damage, and other ratings for your safe.
DO keep a copy of your seed in a bank vault or safe deposit box.
DO use a password manager or virtual vault that is protected by a passphrase and/or a key file. The password database file itself is encrypted, which increases security dramatically. See our tips below for choosing a strong password.
DO use an encrypted disk or NAS to store your password database — more layers of encryption decreases the chances of someone being able to break in.
DON’T print your seed from a public computer.
DON’T leave your password database lying around on unprotected devices such as USB drives or external hard disks.
DON’T store your encrypted password database file on a public cloud.
DON’T share your password database file or passphrase with people you do not know or trust.

P.S: Creating a safe passphrase might seem a daunting task. These simple tips should get you on your way:

Use phrases from songs, literature, movies, or theater.
Add something random to it: a special character, replace a letter by a number, etc.
Use a mixture of letters, capitals, numbers and special characters
Use a pattern to help you remember your changes, e.g., “capital letter before each special character”.
Don’t make it impossible to remember or you will be doing more harm than good — if you forget the passphrase, your seed will be gone forever!

Here is an example:

It takes three years to learn to speak, a lifetime to learn to listen and shut up!

Would become:

It takes 3 years to learn to SPEAK , A life time to listen and shut-UP!

REMEMBER:

Digital ledger technology is unique in that there is no need for an intermediary, such as a bank, to maintain control of your assets. This sounds great in theory — you maintain full control over your own assets! The practical consequence, however, is that you are also fully responsible for their security. All physical and digital security measures you put in place are rendered useless if you disclose sensitive information such as a seed, password or pin code.

What’s more, this responsibility starts at the very beginning. Following best practices for maintaining your seed will not do you any good if your seed was stolen at the moment it was created. All of your security measures — your password database, your passphrase, your bank vault — were obsolete before you even set them up. If you’re not absolutely positive about how to create a seed in a secure fashion, STOP. Join the IOTA Discord and ask the #help channel for how to proceed.

Neither IOTA Foundation nor anyone else can recover stolen tokens.

Please be responsible.

*This is not proof in any legal sense, but rather in the mathematical sense. You can prove, mathematically, that you have control over tokens in a digital ledger only by spending the token.
** Again, the word law is used here as a metaphor — possession of the seed means that you are mathematically capable of spending the funds it contains. This is a “mathematical law.”