MyEtherWallet / etherwallet

https://vintage.myetherwallet.com
MIT License
2.34k stars 1.71k forks source link

Documentation of cold storage #540

Open gotcha opened 7 years ago

gotcha commented 7 years ago

The page at https://myetherwallet.groovehq.com/knowledge_base/topics/how-do-i-safely-slash-offline-slash-cold-storage-with-myetherwallet states (as a red warning) that I should

Save your wallet file. Without it, you cannot access your account or send your ETH or Tokens.

However, I have been able to send ETH back from a wallet recovered from a private key only. Is the recommendation above just to ensure that people keep enough copies of their keys on various media?

In other words, am I missing something or is it correct that keeping paper copies only (that includes public address and private key) is enough to send ETH and tokens from cold storage ?

I guess that the red warning might make some people think that they need the combination of the keystore file and the paper wallet.

If I am correct that it is not the case, I suggest to improve the wording and the color of the warning.

crptm commented 7 years ago

Private key is enough. Keystore files are preferable because they can be password protected.

tayvano commented 7 years ago

@gotcha It's far better for people like you to ask that question than for people to not save anything. You are the first person to ask this question, but over 20 people have not saved anything today alone and lost access to their account. The warning and color will stay.

gotcha commented 7 years ago

I understand the absolute need to protect users from losing access to their account.

However, the current wording might make some people believe that their ETH cannot be accessed with their paper wallet only. In other words, it might give the feeling that protecting those paper wallets is not that critical as an attacker would also need the password protected wallet file.

Reason why I suggest adding words like below at the end of the page:

The password protected wallet file holds your private key and your address. It is equivalent to a paper wallet with address and private key.

You can use ANY of the two to access your ETH and tokens.

It should be obvious that the need of a password makes it much less easy for any ill-intentioned person to access your ETH and tokens with the wallet file.

On the other hand, the paper wallet needs to be physically protected because it displays your private key.

tayvano commented 7 years ago

When you have to answer 500 people a day and 5% have lost their private key and or password, you can write the error message.

We used to do it like this. We used to try to give more information and teach people and warn them about everything.

The single biggest cause of loss is people not saving anything by miles. No one has ever said 'oh I thought my paper wallet wouldn't access my account' ever.

Once I get that cause of loss down, we can focus on every other potential reason shit can go wrong. But what we were doing isn't working I'm trying something else.

The longer the warning message, the more likely they are to lose it.

The more words they don't understand, the more likely they are to lose it.

Our users as of 2 months ago don't know what a wallet is, an address is, and account is, where their eth is, what a paper wallet is, what cold storage is, what a private key is, what a public key is, or what the blockchain is.

These are no longer developers nor people who have experience with Bitcoin. These are your grandmother.

You want to know the second highest support request today?

Asking we charge a fee if there is a bad instruction or out of gas error and demanding a refund.

Trust me, I know where you're coming from. But 500 emails a day say otherwise.

gotcha commented 7 years ago

Thanks for a long and thoughtful answer.

tayvano commented 7 years ago

@gotcha

Alright write me a message for the new helpbar I just made and tell me where to put it.

https://www.myetherwallet.com

Or if you want to rewrite / update

https://myetherwallet.groovehq.com/knowledge_base/topics/what-are-the-different-formats-of-a-private-key

or

https://myetherwallet.groovehq.com/knowledge_base/topics/how-do-i-safely-slash-offline-slash-cold-storage-with-myetherwallet

That would be cool too. I use those in a ton with support tickets.

gotcha commented 7 years ago

@tayvano Is there a github repo that I can fork to come up with a pull request ?

tayvano commented 7 years ago

Not for the knowledgbase :(

It's thru our support platform as it's the only way it stays up to date. That would be sweet though.

gotcha commented 7 years ago

Ok, I'll try to come up with a proposal.

tayvano commented 7 years ago

@gotcha Have you ever used an open source version of that knowledge base? You've got me thinking now......

gotcha commented 7 years ago

What is the name of the knowledge base you use ?

tayvano commented 7 years ago

Just the knowledge base that's built into Groove (what we use for emails)

https://www.groovehq.com/apps/knowledge-base

gotcha commented 7 years ago

I have started to think a bit about https://myetherwallet.groovehq.com/knowledge_base/topics/how-do-i-safely-slash-offline-slash-cold-storage-with-myetherwallet

You mention above that those answers need to be understandable by people like my grandmother.

However, I doubt she would understand "air-gapped' without more explanation.

Is it fine if I think how to expand a bit the explanation of those concepts without forcing too much reading on the users ?

tayvano commented 7 years ago

So for the knowledgbase pages, be as in depth as you want! I'm trying to restructure them with formatting to be like:

Explanation

Numbered list of steps to take

Reminders and further explanation.

But I simply don't have enough time.

As long as there are bulleted / numbered steps and heading, I wouldn't mind an essay in any of these.

tayvano commented 7 years ago

The error messages and stuff that displays on the site is what people simply refuse to read.