Thank you for your comment.

There are some threat vectors like the following:

1. The ROM is launched by an external bootloader. It is the current standard for the nds homebrew scene.
2. The NDS itself embeds a WiFi module.

As long as the user downloads the official ndssigner.nds ROM properly checked against its SHA256 signature, the threats above are minimal: the software switches off the WiFi module, it does not store any permanent data and the RAM is wiped out before the console switches off.

Unlike smartphone apps or computer software, NDS does not use any upper layer acting as OS. It is not multitasking. The software running goes on its own, so, in that sense, the direct access to the hardware provides an additional security feature.

QR parsing is slow compared with modern hardware (phone cameras, etc) but it works. Occasionally some adjustments are necessary, like changing the brightness of the QR emitting screen (sometimes darker is better to compensate the exposure of the camera). Another sacrifices have been made to allow a faster detection: weird angles are not easily recognized by the software.

As for the entropy, it implements almost the same entropy generation sources from SeedSigner: dices and camera signal. The second one is a variation from SeedSigner's original code, made in order to fit NDSi's hardware limitations. Additionally, a nds-signer's "proprietary" (its opensource) entropy generator has been implemented: mic input + scribbling over the touch screen.

Nevertheless, entropy generation is used only in two cases: brand new seed generation and, with a simplified method using only mic input, PIN generation for seed backup/exchange via DTMF (telephone tones).

This document explains the actual motivations for this project, focused basically on the thread models of legacy systems. The purpose of nds-signer is to enable cheap vintage hardware to become a SeedSigner and, most importantly, to go unnoticed, not only against the $5 wrench attack but also against screenings (airports, etc).