What is the more secure way to use XMR?

General
1
  1. Cake Wallet installed through Accrascent
  2. Monero.com Monero only Cakewallet installed through Obtainium (via Github)

I want to use the app with less bloat to minimise attack surface, but Accrascent (which only contains no. 1) seems like the most secure way to get apps. I am therefore torn on what to use.

1 Like
2

cake wallet to swap, monero.com to actual storage and payments

1 Like
3

Accrescent can lag behind on versions, uses a different signing key than github releases (can only be updated using accrescent), and (of course) cake has a larger attack surface than monero.com

i would opt for monero.com using github/obtainium

3 Likes
4

Ditto what @ofrnxmr said. Also monerujo is maybe an option to look at.

1 Like
5

This is also what I’ve done. I haven’t done too many XMR transactions. Glad to know I’m doing it right…

3 Likes
6

Oh i also forgot to mention, if you use GOS, have a separate profile for your wallets that stays shutdown (offline) always unless doing the crypto things… Gives you a kind of cold/hot hybrid that is very secure. If possible, i would download the apps in Owner and push them, that way they stay updated.

2 Likes
7

That’s a good idea I didn’t even think about that. Locked profiles are BFU, damn thanks for sharing. I might start doing that.

If you or anyone wants more practice feel free to drop an address and I’ll send you a small amount. And you could send it back to me or to anyone to practice sending.

2 Likes
8

Yeah its great, ive never seen anyone recommend it but idk why… Best of both worlds imo.

2 Likes
9

It’s not really worth it for me. I don’t have a ton of crypto.

If I did have a lot I would use Cupcake or a Trezor.

My phone being seized by an adversary that can bypass Pixel w/ GrapheneOS AFU mode in under 12 hours is not in my threat model.

But actually, another benefit is you use a different unlock method, so it’s less prone to compromise by peeking.

I suppose it’s defense in depth (I think that’s what this means).

So, to summarize the benefits.

  1. Your seedphrase stays BFU more often because you don’t unlock the crypto specific profile as often as your main profile.
  2. You could use a stronger unlock method like long passphrase because you use it infrequently meaning inconvenience is limited. Although hopefully as time progresses you use crypto more often.
  3. Your profile unlock method protecting your seed phrase isn’t exposed as often meaning less opportunity of spying to capture the password.
  4. Psychologically you feel more focused using a profile with only one or two extra apps, specifically for this use case. No accidental fiddling or playing around.

One problem is you can’t regularly easily sync your wallet meaning transacting could take longer.

2 Likes