{"id":53813,"date":"2021-11-30T16:01:11","date_gmt":"2021-11-30T14:01:11","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=53813"},"modified":"2025-09-03T17:04:33","modified_gmt":"2025-09-03T14:04:33","slug":"databases-ciphers-and-secrets-a-guide-to-securely-storing-cake-wallet-private-keys","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/databases-ciphers-and-secrets-a-guide-to-securely-storing-cake-wallet-private-keys\/","title":{"rendered":"Databases, Ciphers and Secrets: A Guide to Securely Storing Cake Wallet Private Keys"},"content":{"rendered":"

Almost any cryptocurrency wallet allows a backup \u2014 saving the private key in a special file to restore access in case of loss or device failure. But this creates new problems: the file could be stolen by attackers.<\/p>\n

<\/p>\n

The developers of the Cake Wallet<\/a> cryptocurrency wallet discuss open-source software for secure storage and encryption of private keys.<\/p>\n

Cracking a wallet in three minutes<\/h2>\n

Desktop, mobile and browser wallets store private keys on the user’s device. For example, the Exodus crypto wallet stores them in the AppRoaming folder on Windows and in Application Support on macOS. <\/p>\n

The most important files are seed.seco and passphrase.json. The former contains the private key, and the latter the phrase to decrypt it.<\/p>\n

\\\"\u0411\u0430\u0437\u044b
Contents of the exodus.wallet folder in Application Support. Access requires revealing hidden folders.<\/figcaption><\/figure>\n

If a hacker copies the files to their computer, they gain access to the wallet. We performed such steps in the example below.<\/p>\n

\\\"\u0411\u0430\u0437\u044b
Transferring files to another computer. Bitcoin addresses match.<\/figcaption><\/figure>\n

This does not mean Exodus and other desktop wallets are unreliable. We deliberately did not use passwords, encryption or 2FA to illustrate the theft mechanism.<\/p>\n

Most wallets offer to encrypt key files with a password. But even then they will remain in obvious places and be vulnerable to brute-force attacks.<\/p>\n

Spoiling the files on a smartphone is harder: iOS and Android do not provide full access to the file system. We installed Cake Wallet, MyEtherWallet and TON Surf on a smartphone but could not locate key folders without root access.<\/p>\n

However, a phone can be lost or damaged, and thus cryptocurrency can be lost. In that case, back up the wallet: store the private key or mnemonic phrase on a separate device, and then encrypt them.\u00a0<\/p>\n

Additionally, backups let you safely use desktop wallets. To do this, turn them into non-custodial: manually import the private key each time, and after finishing, wipe the folders.<\/p>\n

How to Back Up Properly<\/h2>\n

Access to the wallet requires either the private key or the seed phrase\u2014one will suffice.<\/p>\n

It is better to choose the seed phrase. It consists of English words, and therefore reduces the likelihood of errors when creating a backup.<\/p>\n

Seed phrases and private keys are roughly equally resistant to brute-force attacks\u2014 the method of guessing possible combinations.<\/p>\n

The data can be secured in four ways:<\/p>\n