Cyph3rp9nk's avatar
Cyph3rp9nk
cyph3rp9nk@getalby.com
npub1lnms...rrnt
Non nobis, Domine, non nobis, sed nomini tuo da gloriam.
Cyph3rp9nk's avatar
Cyph3rp9nk 2 weeks ago
At this point in history, with everything we know, defining oneself as left-wing or right-wing is a sign of profound brain damage. There are only two kinds of people: those who try to be free—and therefore try to prevent others from stealing from them—and those who are slaves and don’t care if others steal from them. All those who believe in the system belong to the group of slaves. The left-right dichotomy is merely a flawed social construct designed to make slaves believe they have a choice.
Cyph3rp9nk's avatar
Cyph3rp9nk 2 weeks ago
To say that multisig is a huge pain in the ass is to fail to understand the new paradigm we're in. A real pain in the ass is losing your stack—now that's a pain in the ass.
Cyph3rp9nk's avatar
Cyph3rp9nk 2 weeks ago
Everyone’s talking about that compressed-gas-powered jumping car—a far cry from a flying car by the statist Elon Musk, one of the people who receives the most government subsidies. I don’t care one bit; I’ll never be able to buy that car. I’m just a regular worker who gets taken advantage of by the government. I’m way more interested in Monero’s FCMP++—now that’s fucking awesome. Look up where this transaction came from:
Cyph3rp9nk's avatar
Cyph3rp9nk 2 weeks ago
After examining the current state of self-custody, my views on what setup to recommend to the average user have evolved. As you know, I have not always advocated multisig. I previously believed that a strong passphrase with sufficient entropy provided adequate protection. However, following the Coldcard incident, I began reconsidering that recommendation: a passphrase can add security, but we still depend on the device on which it is used, leaving us exposed to both software flaws and supply chain attacks. A compromised device capable of capturing the passphrase or the derived keys can defeat that protection. This led me to recommend multisig using devices from different manufacturers. However, the severity and scope of the Ledger attack have also made me question relying exclusively on hardware wallets, even when combining multiple brands. A device being open source makes it possible to review how it works, but it does not guarantee that anyone has reviewed it thoroughly enough. We cannot assume that comprehensive, ongoing, independent audits exist, or that there are sufficient incentives to discover and disclose vulnerabilities. Setups such as Yeti attempt to address this problem by relying on widely reviewed software, such as Bitcoin Core and Ubuntu, and on general-purpose hardware. The latter has an advantage: purchasing it does not directly identify the buyer as someone intending to hold bitcoin, which may make certain targeted supply chain attacks more difficult. However, I also see limitations in this approach. If several keys are generated or used on the same computer, compromising that computer could compromise the entire setup. We still depend on Bitcoin Core, the operating system, and the hardware itself. A tampered download or a vulnerability in any of those layers could undermine security. Keeping the computer offline reduces risks, but does not eliminate the possibility of introducing malicious data or leaking information through the signatures it produces. I also believe that a 3-of-7 setup adds too much complexity for the average user. Securely distributing and maintaining seven keys and their backups is difficult in practice. Nor am I comfortable relying on digital backups for long-term recovery: they require maintenance and may become tied to storage media, software, or formats that are no longer accessible. For these reasons, my proposal would be: - A 2-of-3 multisig setup, balancing security, redundancy, and ease of management. - Durable physical backups, such as metal plates, while also preserving the complete multisig wallet configuration. - Three independent general-purpose devices, from different manufacturers and running different applications. - Only one private key on each device, generated independently, with no device ever having access to the other two keys. One combination I would consider exploring is: - An Android device running Electrum. - Another Android device from a different manufacturer running MetroVault. - An iPhone running BlueWallet. The idea is to diversify the hardware, the software, and, to some extent, the operating system. This way, compromising a single device or application would not be enough to spend the funds. For this purpose, I would choose devices dedicated to signing, kept offline and separate from everyday phones. Backups should also be distributed so that a single incident cannot expose two keys or cause a loss of access. This approach still has one significant weakness: **the level of review and auditing of the applications**. We cannot assume that all of them have undergone sufficient security analysis; MetroVault, for example, acknowledges that it has not yet undergone a formal independent audit. That is why I believe the community should support the review of these tools, fund audits, and improve their interoperability and recovery procedures. The goal would be to have independent, straightforward signing applications subject to sustained scrutiny, using Bitcoin Core’s level of review as a benchmark. This is the direction that currently seems most reasonable to me for reducing dependence on any single manufacturer, device, or application. Any criticism or suggestions for improving the setup are welcome.
Cyph3rp9nk's avatar
Cyph3rp9nk 2 weeks ago
I don't have the energy for anything today, but I think it's worth remembering that without privacy, there is no freedom. France will require you to declare if you hold more than 100,000 euros in cryptocurrency, under penalty of a 10,000-euro fine. Eventually, all European countries will implement this, so it’s more important than ever that you understand how to anonymize your coins. You’ll be targeted by governments and by common thieves when databases are leaked. Bitcoin + CoinJoin + Monero https://cryptoast.fr/amendement-declaration-obligatoire-wallet-crypto-100000-euros-adopte-commission/
Cyph3rp9nk's avatar
Cyph3rp9nk 3 weeks ago
Hasta siempre amigo 🐕🐾❤️ 18 años a mi lado, siempre fiel, sabias cuando me encontraba mal, estuviste a mi lado en los mejores momentos y en los peores, sin pedir nunca nada a cambio, siempre contento, siempre esperándome, te cuide como si fueras un hijo y he estado a tu lado hasta tu último aliento, quizás la gente no lo entienda, para muchos solo serias un perro, pero para mí eras mi mejor amigo. Descansa en paz, y recuerda, los perros siempre van al cielo.
Cyph3rp9nk's avatar
Cyph3rp9nk 3 weeks ago
The way things stand right now, running a Lightning node is a risky business because of AI, and ensuring privacy for the recipient is still a pain in the neck and expensive. On the other hand, Liquid and the swaps that used to provide cheap privacy are out of the picture. What about CoinJoin? Wasabi is more alive than ever, and so is JoinMarket-ng. You should use them to anonymize your savings, but they aren’t practical for day-to-day use—although Wasabi’s “pay with CoinJoin” option mitigates this somewhat. View quoted note →
Cyph3rp9nk's avatar
Cyph3rp9nk 3 weeks ago
After almost a year of tinkering with Monero, achieving privacy on Bitcoin feels rudimentary and expensive. Monero is a tool you should have in your toolbox to fight this shitty system. As things stand, for me, Monero is better than Lightning for receiving and sending everyday payments, while Bitcoin serves as a long-term savings account. On the other hand, running a Monero node feels cumbersome compared to Bitcoin Core—Bitcoin Core’s P2P network stack is on a whole other level.
Cyph3rp9nk's avatar
Cyph3rp9nk 3 weeks ago
A Lightning wallet is like an exchange—an IP address that’s open to attack by anyone.
Cyph3rp9nk's avatar
Cyph3rp9nk 3 weeks ago
Don't vote, man; don't be part of the system. Raise your kids by teaching them that politicians are the bad guys, that banks are thieves, that the police serve the system and not you, and that the military is a bunch of morons with guns ready to murder innocent people in the name of some shitty flag. View quoted note →
Cyph3rp9nk's avatar
Cyph3rp9nk 3 weeks ago
Exercising your “right” to vote in a democracy is to trample on your dignity and tarnish your honor as a man. You are not exercising your right to vote; you are fulfilling your obligation to vote like a good slave.
↑