#coldcard #hack #rng #sweep #privacy I have had another thought I want to share with whoever reads my thoughts. So we all know that the Coldcard addresses created by these deterministic private keys are being swept. The MK3 devices are already done being swept. And attackers have moved on to the slightly harder MK4 devices etc. I have a lot to say about this inevitable process but for this post... I know many of you are very adamant about privacy and may have even done utxo coin control and tried to acquire non KYC coins and so on... Well, you might as well make peace with the fact that your UTXOs are eventually going to be known even if you have already moved your coins to another wallet. Because the attackers will eventually find your wallet and see your history and all the UTXOs and everywhere they went, etc. So this stuff's going to all be cataloged and kept by black hats, white hats, and the rest. Once everything is settled and the smoke is cleared, you can work on anonymizing your UTXOs however you choose to do that in the future.

Now there are mounting reports that the patched devices are breaking themselves.

X (formerly Twitter)

NORTHERN HODL (@northernH0DL) on X

Now we’re getting RNG related bug screens. This is a result of yesterday’s firmware release. DO NOT UPDATE FIRMWARE. This thing is bricked ...

Sure, so it'll seems like it. But why? There is certainly more than one possible reason. View quoted note →

Ugh. Honestly the whole thing is so retarded this is too possible... #coldcard #rng #snafu #sad

Sometimes I think some off these newer people to bitcoin do not quite understand it. More about style than substance... like confusing a green font with a cool terminal application while making a potentially private mesh network into a surveillance honeypot. Bitcoin is a robust experiment in trust minimized anti fragility and the failure of arrogant developers will not burn it down. It may confuse the faithful converts to a parallel pseudo religion formed around various plastic rock star personalities. But bitcoin dgaf. It eats this kind of drama as a midnight snack. But what do I know? View quoted note →

New Coinkite "Provable High Entropy Dice" dropping! Casino grade!

We already know that If an attacker can learn that a key holds Bitcoin they can use the private key to transfer the funds to a secure address they control. So if you are racing against time to clear Bitcoin from an address that came from a key that was created by the MicroPython deterministic RNG, you may think you're safe once you've publish the transaction. But that could be false. If you allowed replace by fee for your transaction, the attacker can still take those coins, even when they're in the mempool. So my suggestion would be do not allow RBF for your sweep transaction and set a very high fee to ensure that your transaction will be picked up immediately. Then pray. Also, ironically, you could use one of the controversial services that spammers like, for example, slipstream to pay a miner directly to include your transaction in a block without it ever being publicly seen before the block is mined. #coldcard #rng #sweep

Should I be worried about trying to use this new menu item?

Interesting thought here concerning the recent #coldcard debacle. When you back up your cold card, it saves all of the contents that it backs up as a 7-zip file. But it encrypts it with a 12-word seed that seems to me looks an awful lot like I Bip 39-type seed. I will look at the code, but I'm assuming older versions would use the same deterministic microPython RNG. Therefore, your backups would be vulnerable to brute forcing. And I'm going to guess that if you make a new backup and use the same 12-word seed as the passphrase, it isn't going to be any stronger than when that passphrase was first made. Hopefully the new firmware will create those 12-word seeds with higher entropy.

Frens. Be on the lookout for scams in the wake of recent events... you know they're coming and I think they're here.

I don't want to sound like an asshole, but it's painful, but also satisfying to watch "the plebs" waking up to the fact that purist axioms, like "not your keys, not your coins", as true as they are, are not entirely possible. If this creates dissonance for you, remember this. The revolution that trust minimized software is taking part in isn't that everyone has to be their own bank or make their own keys, but that you can. We've been ignoring as a community long enough the fact that not only can companies shank you like this, but you can shoot yourself in the foot just as easily. There's probably never been a better advertisement than this for BitKey and the ETFs.

Maybe "The Plebs" will finally consider what "stay humble" really means rather than how it has been being used.

I hear the #coldcard MK6 is gonna have a new menu item/feature! 8. Execute Digital Boating Accident. Wonder what that'll do???