jwhendy

[jwhendy @jw_hendy]

@JoshCruz713 @bizzzDJM I tf do this, but I auto lock it and stand by my car while it pumps.

[jwhendy @jw_hendy]

@FractalEncrypt @TheBTCGame This tool suggests the last word will be one "of the words in the block of 16 that the last word is found inside; one and only one word will work from the group." Thoughts?
https://t.co/sr3o9lBaUz

[jwhendy @jw_hendy]

@raw_avocado What!? What did he link to on github??

[jwhendy @jw_hendy]

@jamesob Suddenly errybody and their mom did "hardcore analysis" and knew about this years ago. "I sent a report to the CC team that I had doubts about whether the true RNG was actually in use."

Neat story, pics or it didn't happen.

[jwhendy @jw_hendy]

@PanHodl @zherbert @FoundationHQ Sigh, they commented about a coder's commits and tweets, not the library/code itself.

[jwhendy @jw_hendy]

@BlockUnmasked @w_s_bitcoin Original: "traced it to weak seed entropy on the device." Here: "kinda sorta had an early working hypothesis." C'mon, you Sherlocked this, or you didn't. Which is it?

[jwhendy @jw_hendy]

@BlockUnmasked "Our analysis pointed to weak seed entropy on the devices themselves. We took our findings to Coldcard, and we filed a complete report with local, state and federal agencies." Post the receipts (analyses with dates), then.

[jwhendy @jw_hendy]

@AutisticHODL Pressurized with helium might be preferred.

[jwhendy @jw_hendy]

@bitcoinsbanker @lucien21m @PPQdotAI @Coinkite @OPENDIME @SeedSigner @Bitkey @bluewalletio @PhoenixWallet @SparrowWallet What is the test?

[jwhendy @jw_hendy]

@bitcoinsbanker @PPQdotAI @Coinkite @OPENDIME @SeedSigner @Bitkey @bluewalletio @PhoenixWallet @SparrowWallet Is there a more full explanation for anything? Like I'm intrigued by Seedsigner, but can't interpret what the comments actually mean. Is "<50 preview frames and final picture" good or bad? Is accepting degenerate dice rolls good or bad?

[jwhendy @jw_hendy]

@intangiblecoins Would be amazing if this all turned out to be whitehat and they were returned on Christmas.

[jwhendy @jw_hendy]

@hodlonaut 1000%. The blog literally confesses to not understanding what they were doing in the switch to libNgU, and a failure to understand the implementation and lib options. Then in the apology it's "Well, we tried to pen test 3 weeks ago with AI. Schucks."
https://t.co/RqAQ6g185X

[jwhendy @jw_hendy]

@KLoaec Is "encryption treated as absent" for USB just an assumption? I thought the PRNG wasn't "faulty," just less random than required. Seems like this specific thing was about reduced search space of HW-only generated seed words; how does that imply the CC can't encrypt USB properly?

[jwhendy @jw_hendy]

@KLoaec @glgrau For paper wallets, private key -> PRNG -> predictable output? But doesn't cracking this still rely on a guessable input in order to have a starting point for reduced search space on the PRNG output? Or is that not the exploit?

[jwhendy @jw_hendy]

@sDefrees What's the original post date?

[jwhendy @jw_hendy]

@janrothen I think it's worse that it was rushed as part of getting out from the GPL license. The crypto lib change was motivated by preventing competition, not anything that needed to happen to provide security to users.

[jwhendy @jw_hendy]

@sttsfnd @Coinicarus Looks like three users, switck is the owner. scgbckbone owns coldcard firmware, doc-hex looks like an overall btc contributor.
https://t.co/MpfJ2chk0j
https://t.co/73III6ymHh
https://t.co/MpfJ2chk0j

[jwhendy @jw_hendy]

@Coinicarus User switck owns libNgU. How are they tied to Coinkite? I see them thanked on a March 2021 release, but you're saying owned/strictly maintained by Coinkite. Is switck coinkite?
https://t.co/MpfJ2chk0j
https://t.co/ILRkWgxtOt

[jwhendy @jw_hendy]

@Coinicarus Their blog post says "That required adding libNgU, an embedded MicroPython library that exposes libsecp256k1 and other Bitcoin primitives." When I read that, it sounded like it's part of MicroPython. This is their own thing? Wow, plot thickens.

[jwhendy @jw_hendy]

@chainalysis Not if you dice rolled you don't?