<blockquote>
<p><strong>Let's assume we have a non custodial hd mobile wallet.</strong></p>
</blockquote>
<p>Non-custodial means no third party acts as custodian, the wallet stores the private key(s)</p>
<blockquote>
<p><strong>Where is the master key stored?</strong></p>
</blockquote>
<p>Wherever chosen by the software developer who wrote that part of the wallet app.</p>
<p>Normally you'd hope this is in a file in local storage. You'd hope that file is encrypted using a wallet password as a key and using a well-implemented well-known algorithm. In some cases you'd be wrong.</p>
<p>In some cases the wallet's backup feature might copy this rather vital data into cloud storage. You'd hope the data is competently encrypted before being sent and that the cloud storage provider are also competent at protecting their client's data. Sometimes our hopes are not fulfilled.</p>
<blockquote>
<p><strong>What are the components of the telephone that allow the derivation of keys?</strong></p>
</blockquote>
<p>No special hardware is necessary.</p>
<p>Derivation of keys will involve use of the the processor (CPU) and memory in conjunction with the software algorithms embedded in libraries provided by the operating system and/or in the software application that is acting as the wallet. The results are likely to be stored in normal non-volatile storage (e.g. onboard flash-memory). You'd hope the developer was competent and careful to ensure this data was not vulnerable to undesired access while in memory or in non-volatile storage.</p>

CC BY-SA 4.0
2020-10-02T15:51:30.393Z
@Prayank: Not in the usual sense, the cloud-storage provider (Dropbox, MS-OneDrive, etc) doesn't actively manage your keys, they just store chunks of data without explicitly knowing or being told what it consists of. With a normal custodial wallet, only the custodian has the keys, you as a customer typically don't. The custodian manages the keys as part of a specific Bitcoin service and typically uses the keys on your behalf. That's my view of the difference.
RedGrittyBrick
CC BY-SA 4.0
2020-10-02T14:12:35.727Z
2020-10-02T14:18:21.517Z
2020-10-02T14:18:21.517Z
RedGrittyBrick
<p>Let's assume we have a non custodial hd mobile wallet.</p>
<blockquote>
<p>Where is the master key stored?</p>
<p>What are the components of the telephone that allow the derivation of keys?</p>
</blockquote>

<wallet><security><bip32-hd-wallets><wallet-recovery>
How does the security of a mobile wallet work?
MaXbeMan
# How does the security of a mobile wallet work?

(Asked by: username_0 on 2020-10-02)

Let's assume we have a non custodial hd mobile wallet.

> Where is the master key stored?
>
> What are the components of the telephone that allow the derivation of keys?

**Tags:** wallet, security, bip32-hd-wallets, wallet-recovery


---

## 1 answers

### Answer by username_1 on 2020-10-02. Score: 0 | Accepted answer

> **Let's assume we have a non custodial hd mobile wallet.**

Non-custodial means no third party acts as custodian, the wallet stores the private key(s)

> **Where is the master key stored?**

Wherever chosen by the software developer who wrote that part of the wallet app.

Normally you'd hope this is in a file in local storage. You'd hope that file is encrypted using a wallet password as a key and using a well-implemented well-known algorithm. In some cases you'd be wrong.

In some cases the wallet's backup feature might copy this rather vital data into cloud storage. You'd hope the data is competently encrypted before being sent and that the cloud storage provider are also competent at protecting their client's data. Sometimes our hopes are not fulfilled.

> **What are the components of the telephone that allow the derivation of keys?**

No special hardware is necessary.

Derivation of keys will involve use of the the processor (CPU) and memory in conjunction with the software algorithms embedded in libraries provided by the operating system and/or in the software application that is acting as the wallet. The results are likely to be stored in normal non-volatile storage (e.g. onboard flash-memory). You'd hope the developer was competent and careful to ensure this data was not vulnerable to undesired access while in memory or in non-volatile storage.

> **Comments:**
> **username_1**: @Prayank: Not in the usual sense, the cloud-storage provider (Dropbox, MS-OneDrive, etc) doesn't actively manage your keys, they just store chunks of data without explicitly knowing or being told what it consists of. With a normal custodial wallet, only the custodian has the keys, you as a customer typically don't. The custodian manages the keys as part of a specific Bitcoin service and typically uses the keys on your behalf. That's my view of the difference.  

---

