Yes absolutely, Von Neumann debiasing, which entirely nullifies first order bias. It kinda takes forever, though I believe you can go faster with a die doing: 1 if every other throw is higher, 0 if every other throw is lower, discard if they are equal. (I think Codex32 uses that from the top of my head)

It's a very good solution if you have the patience, probably closer to optimal than using tiles, but I was looking for the best solution that would be fast & simple. Btw, I'm curious, how do you compute your checksum if you go for 24 words?

I always assumed the whole reason we are using seed phrases was specifically to avoid this kind of things. :)

As a clarification, my bias figures are rough estimates of the worst-case scenario for coins, dice, and tiles under good shuffles/throws. Someone correctly pointed out that not every coin or die will be as bad; but it's also easy to underestimate biases because it's generally twice what you'd intuitively expect. (e.g., a 52/48 coin has a 4% bias and generates only ~96 bits of entropy over 100 throws.)

The reason tiles (and cards alike) have a much better safety profile is simple: low-quality coins/dice can be severely imbalanced, while the quality of a deck of tiles/cards has much less impact on the randomness of the draw. Moreover, the elements of a given deck are much easier to audit than the balance of a given coin or die.

Now, to be clear, even a 20% bias would still result in an unbreakable 12-word seed phrase. You'd still have 102.4 bits of entropy, plus 11 additional bits of security from BIP39 key stretching. But my goal with Penlock was to identify and deliver the method that best combines UX and security, and I believe paper tiles are it.

Nice report, thank you! 8)

Got it, thanks for the hint! It's been around for a while, just released it publicly. You can find details on the bitcoindev mailing list. Feel free to look into it to see if any devil hides there :)

You'll also find a Q&A on the website: https://v1.penlock.io/en/

Hi @jimmysong, mind covering Penlock again? I read your letter so I remember you checked it out last time, it was pretty cool to see. We finally completed the public release, could use the push! Also, I'd be glad to answer any question for you! (bitcoindev link: https://groups.google.com/g/bitcoindev/c/8LkdxVc_nI0/m/ggNzdX1NAwAJ)

Someone shared about the beta last year, and there was a few comments under it. That inspired me to announce it myself this time. :)

Multisig is generally more secure—using hardware wallets from different manufacturers protects against firmware vulnerabilities. However, multisig requires more technical expertise, involves managing wallet metadata, and is protocol-specific.