>use hardware wallet>still get hackedSo where exactly are you supposed to hold your buttcoins?
>>62549140I keep mine offline in an encrypted file.
Hardware wallets are bulletproof. It's dumbass humans that get hacked.
>>62549140on an exchange
>>62549194their seed generation had a bug, literally the wallets fault
>>62508806
I'm very fucking glad I didn't trust any hardware and I generated my wallet with the 100 dice rolls method. So even though I have a Q, its basically just a signer for me and I never relied on its PRNG for my security.
>>62549194>bulletproofbut not wrench proof you moron
>>62549140not all hardware wallets are made equally.don't use a cuckcard.
>>62549808Brought to you by CoinKike
i simply do not hold coins
I only remember this piece of shit from ads I saw years ago. no one ever talked about it. now we see why
Rolling for inside job. Thankfully, I rolled dice but I still transferred the funds off my Q this morning.
>>62549735It's funny how everyone preaches "don't trust, verify" but then trust all this complex code, RNG functions, secure chips, crypto libraries etc. Nobody can convince me there's a more secure and fool proof way of generating randomness for a BIP39 word than flipping a coin 11 times.>>62549789There are timelocks, fake PINs, wipe PINs, multisigs, Shamir's secret sharing... so many different ways to prevent a wrench attack.
>>62549194Coldcard literally wasn't. Its RNG seed generation was flawed and now people can find working seeds in like 5-10 seconds with AI.Ledger and trezor are probably safe though
>>62549938>I rolled dice> I still transferred the funds off my Q this morning.I'm really not sure why you'd bother. If you rolled enough dice for a full 256 bits of entropy then the Q is doing nothing at all other than signing. I'm not sure why you'd "transfer" funds off a perfectly randomized wallet. If you distrust the hardware then run the nuke on the Q and just switch the same wallet onto a different hardware capable of doing signing.
>>62549947Yeah, at this point I think the ideal cold storage hardware wallet only has a secure element to optionally store your 24 words and a way to do signing.Generating is a waste. You can never trust a hardware wallet to do the generation better than dice or coin throws.
Everyone preaching "generate your own with dice/coin throws"... how do you generate the 24th word which is a checksum?
>>62550296General consensus is to use a checksum generator on computer that is not connected to the internet and will be wiped later (Linux distro Tails is good for this).
>>62549140Coinbase
>>62550296some wallets give you the option to use dice and compute everything for you. You should still do a few test runs and compare them with an online tool like iancoleman. Then when you're sure it works you only use the hardware wallet.other wallets compute the checksum for you and give you a list of valid words after entering the first 23. Blockstream Jade for example.I also found a sh (I only use linux) file that lets me xor two seeds (even without valid checksum) and gives the XOR with a valid checksum (use option -s). So to get a valid checksum you can do. script.sh -s -24 words here- XOR -abandon x24-. Because abandon is just 11 zeros it does nothing when xor'ing. But the script will still return the correct checksum.> https://github.com/GregTonoski/BIP39-XORXORing seed also allows you to mix entropy from two sources. So you could xor a computer generated seed together with a dice generated seed
>>62549938Don't attribute to malice what can be attributed to incompetence.If you ever worked a day in software dev you would know how retard most devs are
>>62549140use open source software
Funds are safu
>>62549938Well, it is closed source so it probably was.
>>62549140>Don't trust. Verify.Oh how ironic.
>>62550530Coldcard literally was open source
>>62549140Metamask
>>62550583Was until it wasn't, stop spreading bollocks mate
>>62549140>Company called coldcard>Isn't actually cold storage ?????
>>62550581Not trusting Coldcard and using their own paranoid guide is actually what saved me here, thanks to doing 100 dice of entropy avoiding the firmware bug entirely.
>>62550615What the fuck are you talking about? The firmware source code has been completely open to anyone since 2018 until today, you fucking retard
>>62550637I think you mean source available which is not the same as open source, that's like saying your website is open source because you published the code, you're just saying to people trust me bro
>>62550660>Yeah, the source code was publicly available, auditable and reproducible, but they restricted commercial resale by competitors so it's not truly open sourceSemantics and irrelevant to the discussion
I remember my phrase.My mind is my hardware wallet.
Dice, paper and prayers
>>62550714You do have backups in case you lose that little paper, correct?
>>62550660Quit with your arbitrary and autistic definitions. If you can see the source code, its open source. So fucking stupid that fosstards think if they can't compile it it doesn't count. That is a mentally retarded and arbitrary line.
All of this shit has just shown me that hardware wallets are mostly gimmicks of various sorts. The real way is to generate a wallet is 100 dice throws and then using that phrase. If you want more, throw a passphrase in there.After that its just a matter of whether the hardware wallet stores the keys or if its a QR solution or a secured element card. Everything else is just simple ass signing or features like temporary wallets, indexes, whatever.For 99% of hodlers, you do not give a shit about your wallet's capabilities beyond how secure the secure element is if its storing your keys. All you need is signing so you can move your coins.>>62550685Based, just don't get hit in the head.
>>62550747that is an important distinction and it has a meaning, the amount of eyeballs in an actual (and important) open source project makes those kind of issues improbable, coldcard was not open source and the meaning was "let us handle the code", well here is the resultthis issue is clearly a consequence of human error from a very limited amount of people working on it
>>62550811>fuck up the dice throws easiest and fastest way to use dices is to put them in a clear box and shake it.>or the dice are biasedyou can throw dices and look at the distribution of the numbers. bitcoin only has 128 bits of security. Throwing some slightly biased dices for 256 bits is still overkill
Coldcard was not open source. Nobody is allowed to use the source code for new projects. There's no point for anyone to review the code. The bug literally got introduced and stayed there ever since they removed all GPL code dependencies.Continuation of tweet:Our best understanding right now is that the entropy bug was collateral damage from this major overhaul of the codebase.To be clear, this overhaul was not solely about licensing. Coldcard also cited technical goals including adopting Bitcoin Core’s libsecp256k1, faster AES and SHA implementations, and reproducible builds.But the timeline establishes two things: (1) Foundation’s launch was the obvious impetus for Coldcard’s licensing change, and (2) removing the remaining GPL code was an explicit goal of the subsequent v4 rewrite.We don't know by how much the licensing pressure affected the scope or timeline of the rewrite. All we can determine is that the entropy bug was introduced inside the same 120-file commit that removed the old GPL code dependencies.
>>62550620it was cold storage you could have done everything right, but it only generated a few different seeds so anyone can guess them, and now people are guessing multi-sigs and 25th words which take more time to crack. It's a free for all 1,000s of BTC are being stolen right out of safety deposit boxes with zero access all because of a non random seed generator.
>>62550861>they removed all GPL code dependencies.>the entropy bug was collateral damage from this major overhaul of the codebase.>adopting Bitcoin Core’s libsecp256k1, faster AES and SHA implementations, and reproducible builds.>removing the remaining GPL code was an explicit goal of the subsequent v4 rewrite.>120-file commit that removed the old GPL code dependencies.lol NERDS
You fucking retards thought you could be your own bank KEK
>>62549140>So where exactly are you supposed to hold your buttcoinsIn your butt
>>62550321>>62550296All this cuck work just to lose money KEK
>>62549342Not to sound like a massive faggot but if you just rolled the dice instead of using their shit rng. You would be fine.
>>62550934OY VEY COINKIKE WILL TEACH YOU ABOUT BEING YOUR OWN BANK GOY YOU CAN TRUST NVK HE'S A NICE JEWISH BOY
>>62550672it's not semantics. you are stupid
There's people dumping their coins over this and I dont blame them. You lose 40, 50k and get ready to sign divorce papers or live with the shades drawn all your life out of embarrassmentand and fear. Its literally the same story, guy wakes up to find his life savings gone and nothing he can do about it, asks for help, gets scammed some more lol.
more like aladdincard cause that rug flew
>>62549140multisign
>>62549203>exchange goes bankrupt when oil is 300 dollars a barrel because of drumpf's war for chosenites and they can't afford to keep the lights on>sorry no refundsGenius move.
>>62550685Your memory goes to shit as you age. Good luck.
>>62549947>so many different ways to prevent a wrench attack.yes
i make 30k/yr in dividends at 2.6%. i don't even know what's happening. the device looks like a bargain bin overstock lot of blackberries that some autist figured out to sell to retards on the Internet.
>>62550739How many times have you lost your passport anon? your social security number or your birth certificate?
>>62549140So how did no one catch this for so long? Wasn't this vulnerability around since 2022? And even AI models running the code could tell you about the vulnerability. So no one thought to check openly available code at all? Not even their own devs?Also is something like Keystone still safe? Kind of starting to think this whole "be your own bank" larp is becoming laughably absurd if you start having to talk about doing 100 fucking dice rolls to secure your stack. "Future of finance." Yeah, imagine any of this becoming mainstream.
>>62552710That's not even the real problem. Even if you were using a regular bank, you could still fuckup and leak your password/pin/whatever and get drained. The real problem is that with bitcoin or any crypto, if it happens, there's nothing you can do about it. Poof, gone forever with no help. With regular banking you have a good chance of getting it back or potentially having the transaction caught and stopped before it even occurs. The danger of crypto is having literally 0 backstop. Well, that and also the fact that nearly everyone in the space is trying to scam you.
>>62549140future of finance! no refunds
>>62552666I lost all of it in a housefire.
>>62553112Damn, that's a shame. I hope you are doing alright anon.
>>62553130Happened a long time ago. Point in making this is that you can lose the seed on paper through factors outside of your control. At least get a titanium plate and dremel the seed on it so you can dig for it if your house burns down.
>>62550296You don't. You generate the private key directly with dice throws and generate your seed phrase from that
sars your coins are in veryvery trouble
>>62549947> muh mitigation and muh self-soveriengtyTorture enters the chat.
>>62550296Okay I was wrong about fool proof because the checksum makes it complicated, but the main point is to generate entropy in a way where you can guarantee it's random.>how do you generate the 24th word which is a checksum?Easy mode with a dedicated tool: get offline version of iancoleman BIP39 tool and use that on an airgapped pc.Medium mode with basic tools: convert your 256 bits of dice/coin generated entropy to hex, run that through SHA256 (make sure to use hex encoding and not UTF-8 or whatever else), take the first 8 bits of the hash (2 hex characters), convert those to binary and add them to the end of the last 3 bits of your entropy, and walla those 3+8=11 bits are your 24th word.Schizo mode with zero computer tools: medium method but convert bin<->hex by hand and hash SHA256 on paper. You will need software for deriving keys and signing transactions anyway so going this far is pure schizo.>>62552638Based, but having crypto logos visible anywhere can only reduce your security. >>62553725>tortureYour picrel is right. It doesn't matter if the torturer gets your crypto or not because anyone willing to go that far will just kill you in the end. If a smart robber knows there might be all these crypto security setups that make it impossible or extremely hard to access the money, they might choose a different target like a gold hoarding boomer or a watchfag.
>>62549194/thread>>62549342>>62549789>>62550131Hardware wallets store your crypto offlineThey probably had itA) Either connected to the internetB) Wrote down their seed phrase someplace and hackers found itRule 1 in crypto: - Don't believe everything you see on the internet
>>62554499no dude that's not at all happened. the hardware wallet generated shitty seed phrases that were easy to predict. It was a bug in the code of the hardware wallet
>>62549194>Hardware wallets are bulletproof. It's dumbass humans that get hacked.no, it had bug in firmware.>>62554499>>>62549194>/thread!!!!!!!!!1111111111111WOWWWZAAAA!!!!no you fucking idiot - it had a bug in the firmware.
>not storing your bitcoins physicall in your asshole coinslotngmi
why not just buy gold at this point?
>>62549140Up your ass ideally.
>>62556062Nikocado wallet
>>62549194>>62554499Love it when mumbling retards say shit so confidently yet they are so wrong. They should do iq tests to be allowed to post here.
>>62556059the bug in the cold card firmware was such an amateur thing that it's frankly embarrassing. it's not an issue for ledger/trezor. people trying to act like no hardware wallet is safe are dumb and don't get it.
>>62556062>>62556244Post the slot
I never understood why anyone would get a hardware wallet, it's all just protected by a private key, that's it
>btc funbois>buy hardware wallet>adds another weak point to security It doesnt foken matter if your harware wallet maker sucks dicks on Venus and he absorbs cryptographic energy which charges your harware wallet keys, in the end, he has employees, and its already weak link, he himself is weak link and subject to hackYet... they still buy it and hardware makers can go on sucking more dicks on VenusahahahahahahhahahaMy bet is: weak link was employee
>>62549140web browser extensions
>>62549140Dice Roll Seed Phrase + Multi SigThe coldcard exploit was a result of the Jeet tier canadian programming of their internal seed phrase generation tool
>>62549140Does coldcard have a pass phrase option?
>>62556696Wouldn't it be best to store it on a phone app? More secure than windows on browsers? What's the best wallet generator on iphone?
>>62549947The incompetence in this case would be explicitly switching off the hardware entropy generationWatch how they made cryptotards rope themselves by switching a 1... To a 0...
>>62554499this
>>62549735>So even though I have a Q?
>>62557466>Wouldn't it be best to store it on a phone app?Yes until picrel kidnaps you
>>62559131How is a phone app different in this case?
>>62549140inside job, people will be made whole again, or the ceo will be publicly executed and his wealth will be used to make people whole again
>>62554499Lmao your crapto never leaves the internet. You own words. You put your words on the cold wallet or write down on paper aka a paper wallet.
>>62559131I meant to use a phone app to create the wallet. then write down the seed and delete it. not actually walk around with it
