# Mobile wallet security doubt

**URL:** <https://forum.algorand.co/t/mobile-wallet-security-doubt/898>\
**Category:** General\
**Created:** [August 16, 2019, 9:38pm UTC](https://forum.algorand.co/t/mobile-wallet-security-doubt/898 "2019-08-16T21:38:09Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![cusma](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.algorand.co/cusma/32/888_2.png) [@cusma](https://forum.algorand.co/u/cusma)\
**Post date:** [August 16, 2019, 9:38pm UTC](https://forum.algorand.co/t/mobile-wallet-security-doubt/898/1 "2019-08-16T21:38:09Z")

</div>

Hi,

unlike others blockchains were user knows both “seed phrase” and “private key”, in Algorand the only thing I know is my “seed phrase”.

In others blockchain I never put my “seed phrase” online, while my Android Algorand wallet stores directly this information (giveing even the possibility to show it and copy it with a single button).

The point is the following: I was wondering if this kind of wallet is as safe as the “others” that keep these informations completely offline.

Regards,

---

<div class="post-metadata">

**Author:** ![ihagopian](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.algorand.co/ihagopian/32/2042_2.png) [@ihagopian](https://forum.algorand.co/u/ihagopian)\
**Post date:** [August 18, 2019, 6:09pm UTC](https://forum.algorand.co/t/mobile-wallet-security-doubt/898/2 "2019-08-18T18:09:58Z")

</div>

Despite someone can give you a reasonable answer to your question, I’d say the best advice is to not trust it. Not because bad intentions, but other possible risks.

You can have a main wallet with more security considerations, and other ‘mobile’ wallet which you can have some low balance just enough to make it comfortable to use, and safe enough to lose all its funds in the worst possible case.

---

<div class="post-metadata">

**Author:** ![studyres](https://avatars.discourse-cdn.com/v4/letter/s/9fc348/32.png) [@studyres](https://forum.algorand.co/u/studyres)\
**Post date:** [August 25, 2019, 3:37pm UTC](https://forum.algorand.co/t/mobile-wallet-security-doubt/898/3 "2019-08-25T15:37:09Z")

</div>

We hope that the team develop light-client wallets on popular OS platforms, such as windows/android/ios, with open-source code and clear instruction. I think this will attract more users and investors. good luck 🙂

It is really amazing that Algorand create no fork even when the network is partitioned. An essential progress.  
[https://runtimeverification.com/blog/formally-verifying-algorand-reinforcing-a-chain-of-steel-modeling-and-safety/](https://runtimeverification.com/blog/formally-verifying-algorand-reinforcing-a-chain-of-steel-modeling-and-safety/)

---

<div class="post-metadata">

**Author:** ![cusma](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.algorand.co/cusma/32/888_2.png) [@cusma](https://forum.algorand.co/u/cusma)\
**Post date:** [February 23, 2020, 4:43pm UTC](https://forum.algorand.co/t/mobile-wallet-security-doubt/898/4 "2020-02-23T16:43:29Z")

</div>

Hi guys,

suppose I take a RaspberryPi, boot a completely new OS, connect it to the Internet just to install a new Algorand node and create a new wallet. Than leave it disconnected from the Internet.

Is this wallet as safe as an hardware cold wallet like the Ledger Nano S?

---

<div class="post-metadata">

**Author:** ![Maugli](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.algorand.co/maugli/32/907_2.png) [@Maugli](https://forum.algorand.co/u/Maugli)\
**Post date:** [February 24, 2020, 8:33am UTC](https://forum.algorand.co/t/mobile-wallet-security-doubt/898/5 "2020-02-24T08:33:00Z")

</div>

Hi,

If you use the address as a RECEIVE only address, then yes.  
If you intend to send ALgos, then Nano-S is secure, because it never exposes your private key, when it signes the transaction.

Consider buying a Ledger Nano-S (or Nano-X) instead of this RPi solution. If is safe, and can be used with Web wallet.

> **[Ledger Nano S](https://shop.ledger.com/products/ledger-nano-s)**
>
> Protect your crypto assets with the first and only certified hardware wallet on the market. The Ledger Nano S is built around a secure chip, ensuring optimal security.

  
[https://wallet.myalgo.com/access](https://wallet.myalgo.com/access)

---

<div class="post-metadata">

**Author:** ![pipaman](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.algorand.co/pipaman/32/219_2.png) [@pipaman](https://forum.algorand.co/u/pipaman)\
**Post date:** [February 24, 2020, 12:27pm UTC](https://forum.algorand.co/t/mobile-wallet-security-doubt/898/6 "2020-02-24T12:27:18Z")

</div>

Ledger Nano S has a secure element which is tamper-resistant, it means that the attacker can’t get the private key even accessing physically to the device.  
It is not the case with a Raspberry Pi solution and also it is simpler.

---

<div class="post-metadata">

**Author:** ![JasonW](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@JasonW](https://forum.algorand.co/u/JasonW)\
**Post date:** [February 24, 2020, 3:07pm UTC](https://forum.algorand.co/t/mobile-wallet-security-doubt/898/7 "2020-02-24T15:07:10Z")

</div>

Also Algorand does support offline transaction signing using the goal binaries or the sdks. You do not need to have a node running offline. This allows you to store your private key on a disconnected device.

---

<div class="post-metadata">

**Author:** ![tsachi](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.algorand.co/tsachi/32/29_2.png) [@tsachi](https://forum.algorand.co/u/tsachi)\
**Post date:** [February 25, 2020, 4:19pm UTC](https://forum.algorand.co/t/mobile-wallet-security-doubt/898/8 "2020-02-25T16:19:24Z")

</div>

I don’t see why a raspberryPi would be any less secure than a Ledger device. If it’s sitting in your safe, and nobody powers it up, then your password is secured. If you want to take it further, after creating this setup, pull out the SD card out of the raspberryPi. At that point, you’re comparing the security of two offline storage devices, right ?

---

<div class="post-metadata">

**Author:** ![cusma](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.algorand.co/cusma/32/888_2.png) [@cusma](https://forum.algorand.co/u/cusma)\
**Post date:** [February 25, 2020, 4:46pm UTC](https://forum.algorand.co/t/mobile-wallet-security-doubt/898/9 "2020-02-25T16:46:30Z")

</div>

Thank you guys!  
I still have some doubt on the slightly different points of view expressed by @pipaman and @tsachi

If a Raspberry Pi can work fine as cold wallet, could be useful to write together a step-by-step guide for non-expert users on how to build an open source cold wallet, highlighting the critical operations that need to be exectued offline and providing useful tips on how ensure the best possible security.

I’m not sure to be able to do this on my own but I’m here to give any kind of help to write it down.

---

<div class="post-metadata">

**Author:** ![pipaman](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.algorand.co/pipaman/32/219_2.png) [@pipaman](https://forum.algorand.co/u/pipaman)\
**Post date:** [February 25, 2020, 7:55pm UTC](https://forum.algorand.co/t/mobile-wallet-security-doubt/898/10 "2020-02-25T19:55:40Z")

</div>

I don’t see it as ‘cold’ because it is connected and syncing the node. It is very limited with improves the security but it isn’t cold. To be cold, the keys should be stored offline and each the signing process should be executed in an isolated environment too.
