pull down to refresh

This comment from ColdCard's micropython:

 #else // MICROPY_HW_ENABLE_RNG

// For MCUs that don't have an RNG we still need to provide a rng_get() function,
// eg for lwIP and random.seed().  A pseudo-RNG is not really ideal but we go with
// it for now, seeding with numbers which will be somewhat different each time.  We
// don't want to use urandom's pRNG because then the user won't see a reproducible
// random stream.

remember, this is exactly the same reason why many people don't want to talk to Voskuil anymore. Same bug error.

reply

Voskuil was before my time. What was that situation like?

reply

I think this was 2021 or 2022 or so, not too long ago...

There was a keygen tool recommendation in mastering bitcoin that was maintained within libbitcoin. At some point, they replaced the (poor) entropy generator, because it could be relatively easily attacked, with a mersenne twister over timestamp (kinda means no entropy) and noted somewhere in the wiki help page to not use it.

However people did use it (after all it was a recommendation from the #1 bitcoin book) and got swept. Similar to this episode.

reply

I was thinking about that earlier.

Also the privacy implications of this might be a bit of a bummer:

reply

Kevin is panicking a bit

reply
126 sats \ 1 reply \ @Scoresby 31 Jul

Yes, I think he was up all night.

reply

Time for many to get some snores in.

Then in the morning, have a cup of whatever your starter is and perhaps, finally admit that process is everything. Tools are never enough. Not cold cards, not wasabi, not your paper wallet in your sock that you scan with seedsigner.

reply