Keeping Bitcoin Core Safe Offline

I’m running two setups for Bitcoin Core. One on my main laptop for syncing the blockchain, and another offline for my private keys. The offline one has no internet access and just helps me create.psbt files which I send over to the online setup. Can I make sure the offline instance stops trying to connect?

You can't use an offline switch, but try noconnect. That should stop it from reaching out to other nodes. Just a heads up, you’ll still see that annoying ‘xx years behind’ message though.

Maybe just shut down all networking on the offline machine. Haven't tried it, but if it has no network interface, it shouldn't try to connect.

Core devs seem pretty set on wallet encryption being enough. Doubt they’ll go for a cold-storage feature. A node needs to be online, right? You'd probably need a separate program to handle that.

Keeping your wallet online is risky, I really don’t get why anyone would do that. Storing the wallet in an encrypted volume with a killer password is actually safer, since you don’t have the password exposed while doing transactions.

Totally get your point. But the way I see it, making a guide for passing it down to inheritors is a pain. That’s subjective though, might not matter to you.

Can you back up that claim? The wallet encryption is strong; but if your host system isn’t secure, that’s another story. Keyloggers can wreck everything.

I misphrased that. Let me edit it to clear up confusion. Luke had GPG encryption on his keys, and I thought they considered that a valid method.

You nailed it. Software can be secure but if the system is compromised, it’s like locking a gold bar in a safe with an impossible PIN and leaving it on the street.

Your setup sounds solid! Bitcoin Core works offline too, just needs to be configured right. You can disable connection attempts easily. But that sync status? Still there, no way to get rid of it yet.

I love how I can see transactions without entering my password. Some wallets just want the password all the time, which isn’t ideal for security.

Exactly! The need to keep typing your password to check balances increases risk. I guess that’s why monitoring transactions without frequent password entry is key.

I’m still lost on fully encrypting a wallet. There’s BIP38 for QR codes, but the address is still visible. BIP39 stores seed phrases unencrypted. What’s the solution?

If BIP38 bugs you, just don’t save the address. That’s a simple fix.

I sometimes miss the obvious things. You suggesting there’s something else to worry about with BIP38?

Not really! I like BIP38. Just not an expert, so I rely on what I read.

I’m with you on that. Using another password for GPG encryption helps too. Just make sure not to compromise the Bitcoin Core password!

Good point! I like 2-of-2 multisig setups for the same backup reason, plus they’re less risky when transferring PSBTs. Totally agree on plausible deniability.

Multisig is a solid strategy, but why go for a 2-of-2 structure? If you lose or compromise a key, you could lose funds permanently.

Fair concern! A 2-of-3 setup seems more forgiving if something happens to one key.