This whole thing seems to be a reminder of the old phrase. "Do your own research". That said, most people will not and never will. Society does not work that way. Most people do no research and trust confident people. But even a little research is better than none. CoinKite's biggesst mistake was building hardware that allowed for this to happen. I don't think they are alone in building bitcoin devices that allow you to make mistakes. We may not even be aware of some the mistakes we are making.
All that to say. Entropy is incredibly important. You can screw it up even with dice rolls. This is one of the biggest tradeoffs with bitcoin vs something like gold. The ability to send it anywhere cheaply and control it with something you hold in your brain is also the big risk. You are responsible. And most people are not responsible. So we will continue to see people trusting third parties.
We will see more people moving their bitcoin into ETFs or on to exchanges. Hard-core bitcoiners will probably look more closely at who they are trusting. More vulnerabilities will be exposed in more products. Before you do the rounds dunking on Coinkite think about that.
I'm not excusing NVK or anyone that promoted ColdCard. I'm just saying no one will save you. When you trust a third party like Coinkite that is what you are doing. We all are trusting the bitcoin protocol. We are trusting the code we run. The fact that we run it and depend on it for securing our bitcoin is trust.
This is why I struggled when I looked for a wallet to generate entropy at the time when I started saving in Bitcoin.
In the past I used to move my mouse to generate entropy with the Gnu implementation of PGP. To me anything which uses natural phenomena is good enough. At the time when I did my research I quite liked how Cloudflare uses lava lamps to generate entropy (see https://blog.cloudflare.com/lavarand-in-production-the-nitty-gritty-technical-details/). But we can't have the same for hardware wallets.
So since I didn't know at the time (and still don't know enough about Number theory to trust myself), to me the most important source of trust is credentials. We can at who has a PhD to make good judgement. At the time when I did my research there were public figures like Adam back, Charles Guillemet, and a Swiss individual who made a wallet which recruited good people but I don't remember the name. So at the time the choice was either Blockstream Jade or Ledger if we wanted to use specific hardware. Blockstream did the entropy mistake around 2015 I think but I would still trust them just based on the credentials by assuming they learned from their mistakes.
As a public figure I saw recently Tadge Dryja, who recommended to just use a computer with Linux. In my multisig I had a hot wallet generated with Android, it is the same, based on Linux. So just using a computer is good enough, although if we learn from Luke Dash Jr's mistake, we should save it offline in the long run.
In retrospect I am very happy not to have fallen for peer pressure and did not use Coldcards on mainnet (I ended up just using it on testnet). NVK's criticism related to raspberry pi boards was extremely disrespectful for others. Someone who spends time criticizing others in general is someone who lacks self-confidence. And NVK didn't publish his credentials or works in cryptography, so I assume he has none. I may have generated seeds from a "shitcoin inside" wallet, and from someone who accepted money from Epstein but I slept well this weekend.
So in short, my responsibility is shifted to social trust based on educational background and what big companies use (servers with Linux). What I learned from this is the same than during the corona virus period, don't fall for peer pressure and what people recommend, only use what seems to make sense.
lol. This line got me.
RNG always scare the crap out of me. Its one of the hardest things for computers to do. Be random.
Hahaha.
I was thinking about what I read from pro-BIP110 people and what I hear in some Bitcoin podcasts.
LLM models can do an amazing job to replace engineers and teachers, and there are issues for sure in academic circles. But to prove someone learned and can apply theoretical knowledge (e.g.: for cryptography) in critical applications, I trust and discriminate based on credentials from universities.
I have chosen Core Lightning over LND for the same reason hahaha.
I’ve been mulling over these same thoughts, probably most of us have been.
The aspect of personal responsibility that I’ve been reflecting on is also the responsibility to be humble in our claims. How many people confidently asserted that ColdCard was the best in class or something to that effect, without having done the work to verify the claim?
How many of us believed those claims without thinking about how the person making them could possibly know that?
The various posters on the internet, podcasters, etc. are all saying things like "we were told they were the gold standard" "we were led to believe they were best in class".
Who told them? Who led them to believe?
Folks were just told they were the best, and repeated it to their friends and each other until eventually everyone was just told. Taken for granted.
If you didn't think so, NVK shat on you on X and no one stood up for you because they all wanted to stay part of the cool kids.
Huge circlejerk.
Why were so many of us listening to people who would abandon their own intellectual agency to such a degree?
It seems like the security experts were all expecting each other to do the verification, while no one was doing it themselves.
Classic public goods problem?
Maybe so, but ultimately it imputes back to us being too credulous.
Very important point. That's my biggest struggle when deciding roll your own v RNG - Do I trust my own ability?
How would you screw up dice rolls?
Well, for one you could only roll once and call it a day.
Not rolling enough times. Just pulling out the list and rolling a throw for each word doesn't cut it, I don't believe.
You should never roll for words! Ideally, you take a bunch of dice, roll, append to hash function aligned to the number of dice (and number of sides on your dice) and stream it in, until you have at least enough entropy (50 rolls with a D6 for 128 bits, 99 with a D6 for 256 bits) and then you generate the words per BIP-39 (or equivalent scheme.)
Never focus on the words... ever. They're a mnemonic taken in the middle of a cryptographic process, not source entropy.
You absolutely can roll directly for words.
e.g. https://github.com/sarpulhu/dicebip39
It's safer and easier to verify than imputing the rolls into some device.
You derive the keys manually too?
Correct key derivation can be verified across multiple devices that use bip 39 & 32. There is a standard.
Creating the seed is something you can only do once, and there is no way to verify you did it right.
So what you're really saying is that the issue is that there is no standard (within Bitcoin) for entropy whitening and therefore you shouldn't do it. That makes sense, though you should realize you're not doing it and protect your mnemonic (and dice) with more care because any bias is directly visible in recorded data - which is why we whiten. (Perhaps you can counter this by, after you generated the entropy, destroying the dice, so that you can't ever use the same set again. Static bias = vuln.)
There's a "standard" inside NIST SP 800-90B (section 3.1.5.1.1, pdf-page 23) - they call it "conditioning" there, but it's sparse, it basically just says "hash it, see our list of certified hashing mechanisms". There are a bunch of random papers, like 2208.11935 but these are all working from an input granularity larger than or equal to the hash function, so it wouldn't be enough for dice where the granularity is smaller (padding is not your friend.)
Maybe it would be good to build a standard, and at least document the tradeoffs.
I forgot the exact details, but your explanation is why it's not as simple as it might first seem.
Oh. Yes. It also means that if you want to be absolutely sure, you have to verify a bunch of cryptographic functions. Which I can't pull off without help from someone that actually does verification of cryptographic functions for a living, so I can never be 100% certain. What I can do is test the hash function against fixtures and be somewhat sure that it does what is advertised. But that is already less than 100%.
However, next time I text you on whitenoise we're likely to be using inferior base entropy there than we would have had when we'd do 100 dice rolls on a coldcard.
If you buy cheap ones on Amazon, would you have the tools to make sure these are not biased dice?
Never used dice rolls because I prefer to trust a computer.
Gotta use a Yahtzee cup for good measure
I don't trust myself
Same here
I don't recall where/how I heard about the Coldcard thing but I can tell you... I felt it in my gut. I don't even use their stuff. Never really recommended it personally. But, I felt it. I checked on set up even. I imagine I am not alone.
Same
ColdCard being Canadian made me reluctant, ngl
I don't think it's feasible for the average user to audit every product they use. There does have to be some trust somewhere in the chain. Sadly, this time the people who claimed to be trustworthy were proven not to be.
I mean... if I am understanding it right if you had just added a strong pass phrase or added entropy through dice rolls it would be OK. For now.
That said, I do not trust Coinkite. I do suspect it is unlikely they make a mistake like this again.
I insist: putting the responsibility on the user side for not having a PHD on thermodynamics in order to be able to buy bread at the store is the worst possible take on the incident, as it makes sure the exact same incident will repeat again in the exact same way.
Thanks for the compliment.
You are correct about one thing. It will happen again. We are still early and many more things like this will happen again. Coldcard is targeted at power users. I'm not blaming them nor excusing Coinkite. The reality is we all have to trust someone and it's on us.
It all depends on what's the objective.
It doesn't matter what I want. I am just stating the way things are today.
hardware wallets are overrated
Multi Sig is a necessity
Even some mobile wallets like Blockstream have multi sig option built it
"You can screw it up even with dice rolls."
How?
Not enough rolls. Bad dice that are not random. Other things I probably don't know about but those two I have heard and make sense.