PSA: I’m available for podcast appearances if anyone needs someone to explain of the problem, describe mitigations, or discuss entropy generation approaches. 🙏 #Bitcoin

DEFENSE IN DEPTH #Bitcoin View quoted note →

Today in #Bitcoin

In Bitcoin, ownership is what you KNOW. You either know the keys and can move coins, or you don’t. So, how do you KNOW that nobody that you has your seed? The only way is to generate it yourself. If you trust ANYONE ELSE to generate your seed material, then you DON’T KNOW that no one else has it. Therefore, you MUST generate your OWN ENTROPY in order to KNOW that it’s safe. #Bitcoin

Your signing device has one job: to protect your seed material from leakage during use. The ColdCard has not failed in this. People were trusting their ColdCards for an additional job: generating entropy. That was the mistake. It does not help that wallet manufacturers encourage using the devices for entropy generation. #Bitcoin View quoted note →

For people freaking out, here are a two relatively quick mitigations that don’t require any new hardware: 1. Using your existing ColdCard and seed, you can set up a passphrase. This acts like an entirely separate wallet on the same device. You can then sweep the coins to the passphrase sub-wallet. 2. Using your existing ColdCard and seed, set up a 2-of-2 wallet using that device and a software seed using Sparrow or Blue Wallet. Your attacker would have to both exploit the ColdCard vulnerability AND hack your software wallet to move those coins. Stay frosty out there. #Bitcoin

NOT YOUR KEYS, NOT YOUR COINS. NOT YOUR ENTROPY, NOT YOUR KEYS. #Bitcoin View quoted note →

#Bitcoin #memestr

If you roll the dice and put them in the machine to produce your seed, you’re STILL TRUSTING THE DEVICE. How do you know that those dice rolls yield THAT seed? You’re out here thinking you’re paranoid using dice with a hardware wallet. I’m telling you, you are NOT PARANOID ENOUGH. #Bitcoin