3 ms·
> I thought there are air gapped hardware wallets? I had to Google that and they do indeed exist. It seems they use QR codes to send and receive data. It's pro
by olalonde 4y ago
> I thought there are air gapped hardware wallets?
I had to Google that and they do indeed exist. It seems they use QR codes to send and receive data. It's probably a step up from USB since you can visually inspect how much data is transferred. But then again, the device could theoretically transmit your seed to your computer camera and you might not even notice[0]. Probably a step up from USB in terms of security but at the cost of some convenience.
> Without a keyboard, how do you enter your seed phrase?
They have a very rudimentary virtual keyboard which takes forever to type.
[0] As part of the QR code itself, as a separate QR code that flashes too quickly to be noticed to the naked eye, encoded as slight pixel brightness variations within the QR code itself, etc. It could even exfiltrate the seed one bit at a time which would make it pretty much impossible to detect (but would take ~256 transactions to complete).
- JonathanBeuys 4y agoQR codes seem like a terrible choice to transfer data in a trustless way. There are infinite ways to hide data in them.
- olalonde 4y agoBingo. It would be interesting if there was a sort of generic touchscreen device that acted as a USB firewall. It would prompt you and display the data before allowing it to go through. But even if such a device existed, how would you tell whether a transaction signature is really a signature of your transaction and not some encoding of your seed? It seems that no matter how you look at it, there will always be some level of trust involved[0]. For maximum security, the best would probably be to use an airgaped/secured/encrypted general-purpose computer and use a SD card to transmit transaction data. You could even use pre-bitcoin computer hardware if you are super paranoid. Also, if I recall correctly, there are fully open source hardware wallets like Trezor. In theory, you could review the firmware and flash it yourself. You then just need to trust the hardware isn't backdoored to steal Bitcoin seeds. But that would require some rather large companies like ARM to get in the Bitcoin seed stealing business (and for your computer to be infected by ARM-developed seed stealing malware). [0] https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
- snovv_crash 4y agoQR can have ECC turned off so there can't be any hidden information. Of course, it makes it more susceptible to errors.