polymutex 🌸

Working on @Walletbeat 🌸
Who watches the wallets?

[polymutex 🌸 @polymutex]

Working on walletbeat, an L2Beat for Ethereum wallets.
Inspired by @VitalikButerin in one of his blog posts.

Who watches the wallets?

[Mattmatt 🌸 @0xMattmatt]

It was great evaluating @ambire!

IMO, it’s a wallet to watch in the coming months / years. Really happy to see their growth

It’s also clear the team is trying to make progress

There are also easy to achieve improvements in our breakdown that could make a big difference :)

[Walletbeat 🌸 @walletbeat]

Help watch the wallets contributing verified wallet data 👇

Anyone in the Ethereum community can contribute data to Walletbeat to help users understand how CROPS maps to wallets.

At this @EFDevcon workshop, @0xmattmatt will guide you through contributing one verified wallet attribute end to end.

[polymutex 🌸 @polymutex]

Making things legible is still an underrated skill.
I need to work on it 🫡

[kassandra.gwei @kassandraETH]

sincerely thank you for doing the important work of making these things legible/understandable for any-and-everyone

[Walletbeat 🌸 @walletbeat]

How does Ambire stack up against Walletbeat's attributes?

What's good, what could be better, and where are the gaps?

A Walletbeat thread 🧵

[ambire.eth @ambire]

@walletbeat No stopping until everything is 🟢

[polymutex 🌸 @polymutex]

@borislavItskovv @0xMattmatt 👀 👀 👀

[polymutex 🌸 @polymutex]

Privacy is where wallets have to make the most progress.

Was true when I started working on Walletbeat, still true now.

Turns out it's not just the hardest part of wallet dev, it's also the hardest part of wallet rating :)

Huge work by @0xMattmatt pouring over network data.

[Mattmatt 🌸 @0xMattmatt]

Over the past few weeks, @walletbeat has been finalizing the full ratings of the top 5 wallets

The last piece was Privacy. How well does your wallet protect it?

Most aren't doing well (surprised?)

Plenty of room for improvement! Let's push the wallet ecosystem forward :)

[Ambire Intern @AmbireIntern]

Vitalik will demo Kohaku privacy (Railgun, Privacy Pools, Tornado) using Ambire at Devcon

https://t.co/4fc8CAOXNb

[Mattmatt 🌸 @0xMattmatt]

@TrustWallet is now listed on @walletbeat!

Great timing as I heard the team is looking for feedbacks 🤓

[Walletbeat 🌸 @walletbeat]

Software supply chain directly impacts wallets' security, and therefore user funds' security. A compromised dependency in a wallet means a compromised wallet, which means compromised users.

@polymutex joins @EFDevcon to explore how should wallets protect against software supply chain attacks

Catch this lightning talk on the Open and Verifiable Stack 👇

[polymutex 🌸 @polymutex]

@wslyvh @walletbeat @finematics @jkb0x Also @Jun1on

[polymutex 🌸 @polymutex]

This but for every @Walletbeat attribute

Who's building this?

[ambire.eth @ambire]

EIP-7702 explained:

[Walletbeat 🌸 @walletbeat]

Solving CROPS' last-mile problem

Walletbeat contributor @polymutex will take the stage at @EFDevcon on Futures Worth Building track 👇

In this talk, polymutex introduces Walletbeat as a public good that aims to shine a light on CROPS' last mile: the access layer.

[Walletbeat 🌸 @walletbeat]

Walletbeat is heading to Mumbai for @EFDevcon!

We’ll be showcasing how we evaluate Ethereum wallets, what goes into their ratings, and how our findings are helping improve the wallet ecosystem.

Come visit us at our booth!

See how wallets get rated, what the data means, and what wallets have changed because of it 👇

[polymutex 🌸 @polymutex]

@hazae41 It's the tool not the people
https://t.co/aLVsEei73q

[polymutex 🌸 @polymutex]

@JBSchweitzer Not blaming any individuals, I'm blaming the tool the org uses: Flowcrypt. I haven't used it, but my guess is it does inline decryption of PGP-encrypted payloads, but doesn't warn that the reply isn't being re-encrypted on the way out when its recipient isn't using Flowcrypt.

[polymutex 🌸 @polymutex]

If you get an email with a PGP-encrypted payload, do not quote the decrypted message verbatim in a cleartext reply.

Twice now that the EF respond to my email and leaks my KYC details this way. 🫠

Better opsec required.

[polymutex 🌸 @polymutex]

@JBSchweitzer Thanks for passing on the message 🙂

[polymutex 🌸 @polymutex]

@JBSchweitzer Not blaming any individuals, I'm blaming the tool the org uses: Flowcrypt. I haven't used it, but my guess is it does inline decryption of PGP-encrypted payloads, but doesn't warn that the reply isn't being re-encrypted on the way out when its recipient isn't using Flowcrypt.

[polymutex 🌸 @polymutex]

@JBSchweitzer Yes

[polymutex 🌸 @polymutex]

Been asking for being able to run a validator behind Tor for a few years on the staker survey. Hoping this will get taken seriously now. Yes, it requires accepting much higher p2p latency and jitter.

[polymutex 🌸 @polymutex]

🚨 🚨 🚨

> They pulled IP addresses for Etherscan accounts that were tracking node rewards, figuring anyone watching a node was probably running one.
> Then they matched those against Verizon’s addresses for the Southern District.

🚨 🚨 🚨

[nixo.eth @nixorokish]

fascinating. feds used the IP addresses of etherscan email notifications to locate an ethereum node operator in the southern district of new york to satisfy a venue requirement to prosecute someone else