Hey everyone! This is the Blockstream Jade team and we’re here to answer questions about the latest firmware upgrade that brings air-gapped transaction capability to Jade.
Blockstream Jade’s camera has been dormant since its release in early 2021, but firmware version 0.1.41 brings some powerful new functionality to Jade by fully enabling the camera for use. Jade users can now access their device and communicate with companion apps solely using QR codes - no USB or Bluetooth required. This includes importing a wallet, verifying receive addresses, and signing bitcoin transactions.
Jade has become even more versatile with this upgrade, specifically by allowing for additional compatibility with mobile wallet apps such as BlueWallet and Nunchuk. However Jade can also now be used in an air-gapped manner with popular desktop apps, such as Sparrow and Specter.
We hope everyone enjoys this feature as much as we’ve enjoyed building it. AMA!
Get a Jade here (coupon code “wencamera” for 10% off): https://store.blockstream.com/product/blockstream-jade-hardware-wallet/
demo video of jade QR code and seed QR https://twitter.com/Blockstream/status/1591831525418573824?s=20&t=GJ5_HQ5m7KXQOElIyJ6Xug
welcome to SN!
if you had to rank the security of the various connection methods that hardware wallets use today, how would you rank the following?
It's debatable if the USB driver is worse than QR and bcur decoders
Camera is likely better - since it allows you to communicate with your companion app only when you choose for it to. Less likely to be attacked
Why is the MicroSD safer than the Camera? Isn't the autorun* ability of the card an attack vector?
[*] Is it still a thing on Windows?
What is the biggest attack vector for QR code based communication?
Is the firmware for camera open source? Audited?
Probably the bcur and qrparsing libraries. We have done some level and review and modifications to ensure security, however we do not have a third party auditing that we commissioned. The libraries are indeed open source, as well as the esp32 camera library (however the esp32 doesn't load the camera firmware)
Are there any plans for a second (upgraded) version of Jade??
We have a couple ideas of what this could look like, but probably not coming any time soon
what were the most difficult design trade-offs you had to consider when building Jade?
One of the most difficult tradeoffs was the choice between using a remote PIN server and a secure element. We decided to choose the PIN server route to maintain DIY possibilities, and also to keep the design fully open-source
What are the primary differentiators of the Jade when compared to the Foundation Passport?
Jade doesn't have an SD card option, although it is offered for a much lower price
I think there's a good bit more. Passport has/is: -physical secure element -much bigger screen -removable battery -much higher price
While Jade has: -Anti-Klepto -way lower price
Curious, is the blocklstream jade compatible with chrome os (chromebooks?). Looking to buy a friend a hardware wallet but he only has chromebook and an iphone. Cheers.
We haven't tested specifically with Chrome OS, however Jade can be used with three different mobile apps on iOS including Blockstream Green, BlueWallet, and Nunchuk if you'd like to recommend he try Jade with one of those
How does the wallet protect ageinst qr codes containing malicious payloads in the case where there is a vulnerability in the hardware?
Is there any difference in the way you need to protect ageinst these when using qr compared to other solutions?
We only accept a very small list of certain UR messages and other specific payload types (eg. SeedQR). We then apply strict checks to the format of that payload to ensure it is valid and is what we think it is (for example our PSBT parser can be quite strict in what it accepts). Then after that, we still have the checks and validations we run on the payload (eg. the txn data) regardless of which transport it was received from.
Hi Blockstream Jade team!
I just wondered, how does the security of air-gap transaction by QR code compare to the other forms of air-gapped transactions? For example, the Coldcard using a microSD, or Ledger Nano X or Jade using Bluetooth, or using NFC methods (does that count as air-gapped)?
I guess there are pros and cons to each method, but how would you say QR stands up overall, compared to the other ways?
Love your work at Blockstream, by the way! :-)
Thanks for the kind words! SD cards should be safe. NFC depends on the stack/security of each part. Bluetooth also depends on stack/security of each part. QR relies on the QR parsers and all the bcur dependencies, as well as PSBT parsing dependencies.
Since jade supports seedQR, is it on the roadmap to operate stateless similar to how seedsigner works?
This is actually exactly how a fully air-gapped workflow with Jade works today. Users simply scan a SeedQR with Recovery Phrase Login, and the wallet is forgotten as soon as the device is rebooted. Users can also use Jade as a "stateless" device for USB and Bluetooth communications as well.
Favy Sci-Fi novel?
Foundation
@adam3us what's yours? You read cyberpunk?
snow crash by neal stephenson
Mr. Lee's Hong Kong Citadels ;)
From another team member:
(At least some of) Ian M. Banks 'Culture' novels. Peter F. Hamilton's 'Night's Dawn' trilogy. Stephen Donaldson's 'The Gap'. Dune, of course. Anything by Larry Niven.
Thanks. That's a lot of author's I don't know yet.
Are we able to do air-gapped transactions for Liquid assets?
This will not currently work for Liquid txs (PSET) however it is something we are exploring
Is the new air-gapped feature compatible with Liquid? If not, are there plans to?
This will not currently work for Liquid txs (PSET) however it is something we are exploring
Under what circumstance would you recommend someone switch to Jade walllet from another hardware wallet?
Makes sense to switch if your manufacturer has a poor security track record and/or stops providing support/upgrades for a device.
Speaking of Jade specifically: Jade is highly versatile device with three communication methods and you can use both with remote PIN server or statelessly. Jade is supported by a large range of apps, a libwally stack with no external dependencies, and we still have a lot more planned.
Also offers some unique security features you can't find many other places, such as anti-exfil
What are the principles that guide the building of your products?
Security, privacy, FOSS, ease-of-use
Weird boring question— What is the current delivery lead time to the UK for a Jade?
Hard to give an exact answer, typically under two weeks
I've really been enjoying using my Jade, I really only picked one up because I wanted to use L-BTC but it's really become a favourite wallet of mine and with these new firmware upgrades its only getting better.
Definitely considering picking up a few more for friends and family
Love to hear it, thanks for the feedback!
Big fan happy customer here thank for the AMA
very cool! love to see new features come to jade!
What is ur hardware wallet spac