7 ms·

Ask HN: How do you use Bitcoin in a trustless way?

• shaicoleman 4y ago
  Instead of trying to eliminate trust, a better approach would be to decentralize trust. There are various solutions for that, e.g. multi-sig, Shamir's Secret Sharing, etc.
• pcdoodle 4y ago
  Download green wallet by blockstream and call it a day. Make sure to close all other apps before opening it. Write your seed phrase down and give it to your Mom.
• high_byte 4y ago
  if you don't fully trust your hardware wallet, you could try multisig with multiple wallets of different vendors. also see BLS signatures. Ethereum is much better in these scenarios.
• uAllStupid 4y ago
  brain wallet + coinb.in offline. you're welcome
• ALittleLight 4y ago
  This method is still vulnerable to rubber hose cryptanalysis - which is what I'd worry about.
• FatalLogic 4y ago
  I think you can't. You're right about 3 and 6, which are the same basic issue of needing to trust the vendor, their hardware suppliers, their employees, and the delivery chain to you. (You can be more secure, but you can't be totally secure) Or, for example, what if all your communications and actions are being monitored continuously by state-level actors with cameras and hidden bugs, recording every keystroke? Or what if we are living in a simulation, and the malicious operators can extract data from your brain, or just alter reality at will? But I think you can provide a "practical" level of trustless. That means that, if your adversary was powerful enough to steal your Bitcoins, then they'd be so powerful that they could destroy you in many other ways. So it's a moot point. A practical solution to your question could be to take all the precautions you've said above, and then simply gradually increase the amounts you are transacting, using a variety of methods, and see if anything gets stolen. Call it a bribe or a bug bounty or a tax. It's quite effective, because organizations are comprised of individuals, who are subject to human temptations. At least two federal agents independently stole funds from the Silk Road marketplace while investigating it, and they were imprisoned later
  • JonathanBeuys 4y ago
    I don't think the bug bounty approach helps. Say an attacker compromised a certain batch of Ledger wallets. They might very well wait for a few years before they reap coins of the wallets. Because as soon as they do it for the first time, there will be an uproar and people will analyze whats up and transfer their funds to other wallets.
    • FatalLogic 4y ago
      Think about that situation from the attacker's POV. They have invested extensive resources, but they still haven't got anything. What if they're not the only one who compromised the insecure wallets? If they could do it, then probably someone else also could, and that other hacker could empty all the wallets first. Meanwhile, users like you will be occasionally moving their Bitcoins around, sometimes to wallets that the attacker cannot access. If an attacker just wants to make money, they're unlikely to wait for years to exploit an old vulnerability. In the real world, most security vulnerabilities get exploited quickly, because they are very likely to lose value as time passes. You can find numerous real examples of this attitude, such as weak brain wallet keys which are exploited in seconds, instead of waiting and hoping that more money will accumulate in the address before someone else steals it And, like I suggested already, a practical best case solution for the paranoid is diversifying your assets and security methods, so you can identify vulnerability sources early and be unlikely to lose everything Edit : Bottom line though is that you cannot use Bitcoin in totally trustless way, I think. Nothing in security or in real life is totally trustless. So do your best to employ reasonable precautions and mitigations and then get on with your life
• olalonde 4y ago
  Mostly agree with your steps except that to sign a transaction, you need all of its data, not just the hash. So it would be impractical to manually type it in a hardware wallet (also, most hardware wallets don't have a keyboard). Hardware wallets like Ledger instead connect directly to a computer via USB to receive/transmit transactions to sign. They also transmit the extended public key to the wallet software so you don't have to type it manually. You have to trust the hardware wallet vendor to some degree. Regarding, your comment on number 6, that's an interesting thought that I hadn't considered. Since you are not supposed to enter your seed on a computer, there really isn't any way to verify that the hardware wallet is really using the seed you provided and not some seed that can be predicted by the hardware manufacturer. I guess you could enter it on a hardware wallet from a different vendor, or on an air-gapped computer[0], and see if it matches. [0] Make sure that the computer is never connected to the Internet again in case there was a key logger running and waiting for Internet connectivity.
  • JonathanBeuys 4y ago
    Wow, the signing of a transaction needs the whole transaction, not just a hash? I thought there are air gapped hardware wallets? Without a keyboard, how do you enter your seed phrase? Connecting the hardware wallet to the computer brings up a bunch of complex security questions.
    • olalonde 4y ago
      > I thought there are air gapped hardware wallets? I had to Google that and they do indeed exist. It seems they use QR codes to send and receive data. It's probably a step up from USB since you can visually inspect how much data is transferred. But then again, the device could theoretically transmit your seed to your computer camera and you might not even notice[0]. Probably a step up from USB in terms of security but at the cost of some convenience. > Without a keyboard, how do you enter your seed phrase? They have a very rudimentary virtual keyboard which takes forever to type. [0] As part of the QR code itself, as a separate QR code that flashes too quickly to be noticed to the naked eye, encoded as slight pixel brightness variations within the QR code itself, etc. It could even exfiltrate the seed one bit at a time which would make it pretty much impossible to detect (but would take ~256 transactions to complete).
• globalreset 4y ago
  Decent breakdown. Good job. 8. You can usually export it more conveniently. 10-13 is overkill. Most wallets have some reasonable way to move txes between hardware wallet and online system (like SD card). They don't really compromise the practical security and are a much better UX. 3. checking if hardware really have no internet connectivity is indeed a thing. You could use Faraday Cage to be certain. Some wallets like ColdCard are translucent so you can inspect the components. 6. It is maximally secure to generate seed phrase manually using dices and paper lookup table. If you enter it into two wallets from two different vendors, you can see if they generate same addresses. There's one attack you're missing: Hardware wallets could possibly slowly leak your private key by biasing bits in the signatures by grinding nonce. It would take whole lot of txes, but it is theoretically possible. There's also possibility of someone just analyzing the electromagnetic waves during hw wallet signing txes to extra a key. Very very sophisticated and unlikely, but since we already have the tin foil hat on... just invest in Faraday Cage. :D For maximum tin foil hat security, use multisig between two or more different devices (and/or parties), signing in different locations. Edit: Oh. And since you're so into it it's worth mentioning that using seed passphrase is always a good idea!
  • operator-name 4y ago
    Assuming the hardware wallet isn't following convention and impliments RFC 6979 (a huge red flag) that is. At that point the hardware wallet can be considered to do all kinds of messed up stuff - what about a wallet that deletes the private keys after X transactions? This is actually a realistic failure mode - hardware wallets do fail even if rare.
  • JonathanBeuys 4y ago
    8: Using an SD card seems to completely throw the trustlessness regarding the hardware wallet out of the window? How do you know it does not write your seed phrase to the SD? The "leak via grinding nonce" seems scary. That means signing a transaction is not a deterministic process? The same transaction can be signed in multiple ways?
    • globalreset 4y ago
• apengwin 4y ago
  1. How can you know for sure that the dice are not rigged?
  • cheeze 4y ago
    The same way that you can trust that we aren't brains in vats. At some point you have to have some trust.
  • globalreset 4y ago
    It's recommended to test dice used for fairness. Also - they would have to be really, really rigged to weaken the security in any meaningful way.
  • mightybyte 4y ago
    You can use casino grade dice which are translucent specifically for this reason. And on top of that you can also test them yourself to verify.
• Peleus 4y ago
  Step 1 is going to be figure out what you are prepared to trust and work upwards from there. There will always be an infinitely recursive list of trust issues or potential attack vectors, they will just become less and less likely. What if the hardware wallet is backdoored? Use a Faraday cage. What if both the hardware wallet and Faraday cage is compromised? etc.
• trixie_ 4y ago
  Step 6: unless you reviewed the source code, there’s no telling the key it generates is not compromised. A wallet like Coinomi on an iPhone is a secure enough platform to keep your crypto on.
  • trixie_ 4y ago
    And yes you must still trust Coinomi, Apple, TSMC, certificate signing entities, etc.. To be totally sure you could do all the math on a piece of paper and send crypto to the public key you generated by hand.
• rlt 4y ago
  Instead of a hardware wallet you could buy or build an airgapped PC with no wireless hardware. Of course it’s possible to exfiltrate data even without dedicated wireless hardware (TEMPEST etc) so I guess build a faraday cage if you’re really paranoid. Also: https://glacierprotocol.org/ https://glacierprotocol.org/
• nathias 4y ago
  you buy monero
  • irusensei 4y ago
    > you buy monero You realize you could s/bitcoin/monero/ and OP would pretty much have the same relevance right?
• runeks 4y ago
  The solution is to replace the hardware wallet with a Raspberry Pi, or similar hardware device, and use open source wallet software. However you need to be able to disable the Wi-Fi of the hardware device so that the device that holds the keys is offline.
  • chromatin 4y ago
    Check out https://seedsigner.com/ https://seedsigner.com/ which does precisely this.
  • lrvick 4y ago
    If the threat model includes side channel and supply chain attacks then something like the Precursor would be a better bet because you still need a rusted input method and screen.
    • operator-name 4y ago
      If your threat model includes side channel and supply chain attacks then you're pretty much fucked in modern society. Might as well just use cash or attempt to self sustain a cabin in the woods.
    • runeks 4y ago
      > the Precursor What’s this?
      • lrvick 4y ago
        Background: https://media.ccc.de/v/36c3-10690-open_source_is_insufficient_to_solve_trust_problems_in_hardware https://media.ccc.de/v/36c3-10690-open_source_is_insufficien... Purchase: https://www.crowdsupply.com/sutajio-kosagi/precursor https://www.crowdsupply.com/sutajio-kosagi/precursor
• larsrc 4y ago
  You can't. You have to live with the fact that there's some amount of risk and weigh whether it's an acceptable level compared to what you're securing. See Reflections on Trusting Trust for the canonical example.
  • JonathanBeuys 4y ago
    Even though the terms are related, I did not talk about "risk" but about "trust". If you think there is no way around trusting some party, then please name which party that would be. And why one cannot use Bitcoin without trusting them.
    • operator-name 4y ago
      Bitcoin was designed with a specific trust model in mind. The most well known point of trust in 51% attacks. Lesser known is bitcoin master nodes. Even lesser realised is the trust that your client is connected to the broader bitcoin network (and not segregated somehow). This also assumes trust in your client, which can also perform all kind of attacks (such as not reusing R values: https://bitcointalk.org/index.php?topic=581411.0 https://bitcointalk.org/index.php?topic=581411.0) There's no such thing as no trust, only different threat models. I'd reccomend reading https://www.threatmodelingmanifesto.org/ https://www.threatmodelingmanifesto.org/
    • FatalLogic 4y ago
      Considering collectively all your comments here, the answer for you, personally, is simple: DON'T USE BITCOIN. It cannot provide the impossible level of perfection and assurance that you seem to be striving for. This what both GP above, and I have told you already Just use traditional finance and traditional banks. Because then at least you will have more hope of getting transactions reversed if you get scammed by any of the elaborate and unlikely device subversion or middlemanning methods that Bitcoin transactions are also susceptible to (those methods that you've alluded to already here)
      • redox99 4y ago
        > Just use traditional finance and traditional banks. That's a very first world centrist view. In my country the banks/government have outright stolen people's money in the past[1]. Most people don't trust the banks here, with good reason. When you put your money in the banks, you are trusting the "system" with your money. And for shitty countries, something like Bitcoin is more trustworthy than the banking system. [1] https://en.wikipedia.org/wiki/Corral%C3%B3n https://en.wikipedia.org/wiki/Corral%C3%B3n
• joosters 4y ago
  You've missed step 0 (and earlier): how did you trustlessly obtain the bitcoin in the first place? Your options aren't good here: a) Buy it on an exchange: You need to trust that the exchange won't just run off with/sell your real money/credit card details (but at least in the real world you have a chance of clawing back stolen cash) b) Buy it via a service like localbitcoins, where you meet a stranger in an alley and hand them hard cash. Not very trustless! c) Mine the coins yourself. But unless you build a bitcoin miner from scratch, you need to trust the hardware and software (how do you know for sure that it isn't mining to someone else's account?) And your miner needs to be connected to the internet, so hackers could get your coins. There are no good trustless options. You have to accept some risk. EDIT: I missed the only tried and true trustless way to get bitcoins: d) Hack/phish/con someone else out of their bitcoins!
  • Yeahsureok 4y ago
    Bisq - P2P trading, pay by cash deposit into a strangers bank account
  • Geee 4y ago
    This is the world outside of Bitcoin, and is irrelevant to this question. For these transactions, you have faith in your legal system, government, democracy etc. If you're scammed by an exchange, you sue them and you should get your money back.
  • JonathanBeuys 4y ago
    You can obtain them via as many small transactions as you like. Never trusting anyone with more than the transaction amount.
    • dividedbyzero 4y ago
      That minimizes risk, but trust is still involved.
  • runeks 4y ago
    Why is this relevant? It doesn’t matter how OP obtained their bitcoins — trustlessly or not — what matters is that OP now has them and want to keep them without trusting a hardware wallet company.
• andreskytt 4y ago
  Your hardware might either leak the private key via a non-internet connection (bluetooth, nfc, physical interface, some non-standard protocol). Also, it might use weak crypto to generate the private key (see ROCA vulnerability). Trusting non-trivial hardware is hard as it takes very little to have it behave maliciously under very specific circumstance.
• _ink_ 4y ago
  I think you left out one important part, which might lead to losing your funds! When you withdraw only a portion from your bitcoin wallet the default behaviour is that that your wallet is still emptied completly. The leftover amount is transferred to a different wallet generated by the software wallet you use to generate the transaction. I am not sure if the new private key could be restored from the original private, if you would delete the software wallet after the transaction. There is no good solution. You can specify multiple recipients, so you could send the leftover back to your secure wallet. But reusing adresses after a transaction is considered insecure (I don't know why). Or you have a second secure hardware wallet, that can receive the leftover.
• TacticalCoder 4y ago
  (as others have noted multi-sig schemes may be a better option but here are a few infos regarding your questions) > 1: Create a seed phrase with dices You can do that but you'll need a way to generate the checksum for the seed phrase. A 24 words BIP39 seed contains 264 bits (24 x 11 bits): 256 bits for the seed and 8 bits for the checksum. > There is not an easy way to check if the hardware wallet really has no internet connectivity. Indeed but you can at least open / disassemble some of them easily (there are even docs by the manufacturers explaining how to verify that the hardware wallet's PCB looks legit). Seed exfiltration, even without connectivity, is an issue too. And some hardware wallets are extremely noisy and impossible to use totally offline (there are mandatory firmware upgrades and mandatory connectivity needed to install the "apps" that allow to sign transactions), so you have to trust the vendor. > There is no way to check if the hardware wallet really uses the seed phrase to create the extended public key. Yes there is. Use an airgapped/offline computer which has physically no network connectivity options (no wifi / no ethernet / no bluetooth / no nothing), no HDD, booted from, say, a live Linux CD with contains for example Ian Coleman's BIP39 tools. Then you enter your seed and verify that the extended public key / keys derived is the same as the one shown by your hardware wallet. Data exfiltration from such a computer is still technically possible but I wouldn't worry too much about it: you power that computer for a few minutes, turn it off, and you'll be fine.
  • deleted 4y ago
    [deleted]
  • deleted 4y ago
    [deleted]
  • olalonde 4y ago
    > You can do that but you'll need a way to generate the checksum for the seed phrase. A 24 words BIP39 seed contains 264 bits (24 x 11 bits): 256 bits for the seed and 8 bits for the checksum. In theory, you could pick 23 words at random with 11 * 23 coin flips, every 11 flips representing an index in the dictionary. Now to find which 24th word passes the checksum, you could guess it in at most 2048 attempts on your hardware wallet :) More realistically, it might be possible to develop a Ledger app that, given 23 words, finds the "checksum-passing" 24th word for you.
• Geee 4y ago
  Everything that is non-verifiable, requires trust. So, if you can verify that your hardware works correctly, you don't need to trust the manufacturer or supply chains. There are ways to verify that hardware works correctly. 3: You measure RF signals to verify that there's no wireless connection of any kind. 6: You can verify the public key by using multiple devices from different vendors with the same seed. Practically speaking, you don't need to verify everything yourself. It's guaranteed that any information about attacks will be quickly available, if someone is able to verify everything.
• nathias 4y ago
  runinga vm linux distro with a wallet that connects to internet would probably make it less or the same degree of trustlessness while being more practical
• strbean 4y ago
  If you're willing to accept that an individual MOSFET won't be bugged, build your own hardware from individual transistors to do all the necessary cryptographic steps. Run it on a battery supply to avoid power line information leakage[0]. Run the hardware inside a Faraday cage to avoid RF information leakage. [0]: using a lead acid battery so you can disassemble it and verify it isn't bugged.
  • thfuran 4y ago
    And then, of course, you simply have to rewrite the entire software stack.
• mightybyte 4y ago
  There is still some trust hidden away in step 10 that you didn't call out, which is that you're trusting the software wallet. The software wallet that you use to create the transaction could under the hood create a different transaction than what you expect and show you the hash of that transaction. A hardware wallet that signs a raw hash will always be vulnerable to this kind of attack. To really eliminate the need to trust the software wallet, you should send the whole transaction to the hardware wallet so the hardware wallet can calculate the hash. You're still trusting the hardware wallet to some extent but you entered your seed phrase into the hardware wallet so you're implicitly trusting that no matter what.
• deleted 4y ago
  [deleted]
• deleted 4y ago
  [deleted]
• deyan 4y ago
  Regarding 7-10: any recommendations for good software wallets?
• faangiq 4y ago
  You don’t.
• lfpeb8b45ez 4y ago
  You’ll need to first discover if you can trust yourself. Make sure you don’t sleepwalk, test your susceptibility to hypnotic suggestion, and talk to a medical professional you trust about other possible health conditions that could jeopardize your assets. Unfortunately, there are few cryptographically verifiable medical professionals.