@thebillyboone Unpopular Opinion: We actually need Cold Cards to generate seed phrases that are secure, considering it is now the most overkillreviewed software project in perhaps the history of the world. And everything else is about to break...
https://t.co/muurYI2woS
Check out these two Bitcoin seed phrases:
(a general lesson in entropy)
SEED A:
ocean tiger silver dance pigeon melody crystal rocket amber jungle violin sunset.
Now check out this one:
SEED B:
garden mirror silent canyon river melody crystal rocket amber jungle violin sunset
They both look random to me.
But this is the issue that has unfortunately happened with the Coldcard wallet bug.
It's random generator didn't give sufficient randomness.
You can't tell the two phrases apart if you use the device to give you your words.
You get them. You write them down. Stamp them in steel. Done.
All proper 12-word BIP-39 seed phrases starts with 128 bits of high-quality randomness (entropy).
And most devices have a TRNG (True Random Number Generator).
If that TRNG is flawed or has a bug, the device doesn't produce the full 128 bits of real entropy (or 256 bits for a 24-word seed phrase).
SEED A above was generated with 128 bits of entropy.
SEED B, however, was generated with only 40 bits of entropy.
Again, so what? Doesn't someone still have to guess those 12 words?
With only 40 bits of entropy, a skilled attacker could download the entire possibilities of those seed words, which is about 1.1 trillion.
Although large, that's small enough to run a program, extract every possibility, and begin taking funds from wallets with balances.
This is the bug/attack that struck Coinkite with their Coldcark MK3 generated seeds (using firmware 4.0.1 and later).
You cannot spot the problem just by looking at the words👀
SEED A above has the full 128 bit entropy, and thus gives 340 undecillion combinations.
This number can't be brute forced with any computing power currently available to man.
The fix?
Roll your own words for true, full randomness you can see and verify. Add a passphrase (a 13th "word") to increase that randomness. And don't let those words touch the internet.
But still... look into multi-sig. It really solves so many problems that we've had and continue to have.
DON'T WASTE ANOTHER YEAR OF YOUR LIFE
Fix Yourself in 40 Ways Before It's Too Late
1. Deep clean your room. Your outer world is a printout of your inner chaos.
If you've been thinking about taking self-custody seriously, this is your sign. We are giving away a COLDCARD Q to get you the most secure hardware out there!
To enter like, retweet and follow our friends at
@COLDCARDwallet
Matthew McConaughey gets it: I’m a fan of the word 'privilege.' To me, it’s a privilege to be able to have a roof over your head, food in your belly, and people you love. Everything else is just 'dessert.' I’d rather be in a tent in the middle of nowhere than at a red carpet event any day of the week."
INSTEAD OF WATCHING NETFLIX TONIGHT.
Spend 1 hour with this.
Claude AI FULL COURSE that teaches you how to BUILD and AUTOMATE anything.
The people who watch this tonight will wake up tomorrow with a skill that most people will not have in 2 years.
The people who skip it will still be watching Netflix next year wondering why nothing in their life has changed.
Your call.