The fatal commit

When random.bytes() runs but doesn't work

What a commit message tells us about the recent COLDCARD bug

hashing and trusting are one-way functions.

Reposting again, because this is what I am focused on. View quoted note →

abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon

GN

F*** this.

Don't influence. Verify.

Always pick a slow news day to announce the new phase of a project. Introducing #safebox #acorn - once released, it will be a separately installable component to manage identity, funds and records that live independently on replaceable relays, mints and blossom servers.

Acorn - Acorn

A protocol-first component for safeguarding user-controlled keys, funds and records.

128 bits of entropy versus 72 bits (more likely, 35)

Unfortunately, the big lesson here is - don't upgrade hardware wallet firmware unless the company has gone through a third-party audit that is signed off.

X (formerly Twitter)

Lucia Miller (@LuciaMillezyj) on X

@giacomozucco You don't need to move anything if your seed is generated before 29.03.2021 because 4.0.1 version wasn't live yet. I think it is impo...

My bet this attack was weeks in the making. Once the attackers assembled enough private keys for high value utxos they executed. My biggest disappointment is relying on a hardware vendor that has 'Don't Trust. Verify.' plastered all over their product marketing and the primary motivation that led to the bug was a 'get out of open source' licensing issue. Let this be a lesson for all in the industry. 'Not your keys, not your coins' rings a bit hollow now. It's more like: 'God plays dice for those who self-custody.'

This is the Ford Pinto moment for the Bitcoin hardware wallet industry.

Ford Pinto - Wikipedia

I notice that @primal and @Coracle websites are no longer considered as secure in the Google Chrome Browser. Any idea @miljan @hodlbod ? #asknostr

I took all of the necessary migration steps with my #ColdCard but I might be ok. After doing a recovery for one that I gifted, I noted that the firmware was 3.1.9(2020) versus an affected version 4.1.9(2023). I realized that my seed was generated on the unaffected version, and I should be ok. I upgraded the firmware after the fact, so I should be safe? Is that a correct assumption #asknostr ? Nonetheless, I plan to continue all migrations.

QOTD: Will God blame you for not rolling dice?