how do I delete my last renote that was an accident

Good morning Nostr It is good to see that many people’s efforts have helped people move their coins into safety. While I hope that the hardware wallet industry and developers will learn a lesson from this, I think that many will have the wrong takeaways, or none at all. This is not the first time that such things have happened, as seen with the Blockchain.info wallet, and I don’t think it will be the last. It is embarrassing that the same mistakes happen over and over again. These companies are often managed by people with little understanding of cryptography and security. A flawed leadership then leads to flawed products. While open source, AI security audits, etc., are nice, they are not going to solve the problem at all. I would recommend anyone who wants to make a signing device first study the history of cryptography, hardware security, and related topics. Then decide whether you want to take the risk.

Can’t help but think about this

It is unfortunate to see people spreading AI-generated disinformation, especially the CEO of a Bitcoin security company. Posting unverified Claude output for attention, especially when you are trusted by so many people, I don’t know what to say. View quoted note →

Since apparently it is not simple enough: 🚨 If your *passphrase* was generated using the Coldcard, assume it is leaked. ⚠️ If you used microSD to store your passphrase, destroy the microSD, as it can be decrypted. ⚠️ If you used Coldcard Cosign and did not set your own seed, assume the privacy of your funds is rekt. ⚠️ If you split your seed with SeedXOR, only one part of it can be used to get the whole seed. (Most of the time) ⚠️ If you used the password generator on the Coldcard, consider the generated passwords compromised. ✅ If you previously used HSM mode, that is fine. Stop using it, though. ✅ Key teleport is safe. ✅ If your seed was generated with dice, it is safe. View quoted note →

On Twitter, there is some AI-generated misinformation going around about the safety of dice-generated seeds. Only in the following cases are your seeds NOT SAFE: 🚨 You generated your seed with the Coldcard. 🚨 You used the Password Generator to generate a passphrase, along with a CC-seed. In the following cases, your funds are SAFE, but you need caution: ⚠️ SeedXOR: If you used the TRNG option, only one of your shards may be enough to recover the seed. However, they must find the specific shard. ⚠️ MicroSD 2FA: The passphrase stored on the SD card can be decrypted. If you destroy it, you’re fine. ⚠️ Cosign: If you used a CC-generated key, the co-sign can be bypassed + your privacy gone. Otherwise, 0 risk. ⚠️ Password generator: Passwords generated by it are not safe. Rotate them, but this has no impact on your funds. In the following cases, your funds are SAFE: ✅ HSM mode: The weak RNG was used, but does not have any impact on fund safety. ✅ Key Teleport: The weak RNG-generated password was used on top of ECDH, which nullifies risks. ✅ Dice generation: This uses a standard algorithm.

It is weird to see that people trust AI to evaluate the security of whatever HWW they use. These models cannot form independent opinion, and only repeat what people already said. From my testing, they get an egregious number of things extremely wrong. But I guess these models are trained to *sound* like an expert in everything, so…

gm nostr

Don’t overcomplicate your code View quoted note →

If you are disposing of your Coldcard, please take extra measures to overwrite the seed and PIN before disposing of it.