3 ms·

> There should be more discussion about how to store value without counterparty risk. > Most people think it is as easy as ordering a hardware wallet, followin

> There should be more discussion about how to store value without counterparty risk. > Most people think it is as easy as ordering a hardware wallet, following the process the wallet software suggests and - hurray! - your keys, your coins! What exactly is the threat model here? To my knowledge, there's been no general compromise of truly air-gapped hardware that could only exfiltrate data by a back channel in an otherwise valid cryptographic transaction. This scenario seems to therefore imagine a targeted attack. However, if you're storing enough value to be the subject of a targeted attack, then it would also be unwise to have the assets so concentrated in cryptocurrencies. Diversification reduces overall risk. With cryptocurrencies as just one asset among many, the "storage" answer becomes obvious: use a law firm or financial institution that holds enough liability insurance to cover any losses arising from bad storage practices. Use the legal system, rather than evade it.

JonathanBeuys 4y ago
Not targeted. The typical way of handling bitcoin is flawed in multiple ways. Lets look at the simplest way a hardware manufacturer could get your private key: They make the hardware wallet create the private key in a way the manufacturer can guess. But there are more elaborate ones. For another one, take a look at this discussion: https://news.ycombinator.com/item?id=32181462 https://news.ycombinator.com/item?id=32181462
- redox99 4y ago
  Some hardware wallets recommend you to generate your key with dice.
  - JonathanBeuys 4y ago
    Yes, that would be part of a solution. Another part has to be multiple air gapped hardware wallets from different manufacturers that all are RFC-6979 compliant. And here it already ends AFAIC. I don't know of any air gapped wallets. The ones that call themselfes "air gapped" just connect to the computer via different means like display->camera.
    - TacticalCoder 4y ago
      You can use an hardware wallet, protected by a HSM, on a computer which is itself airgapped. I've written a decoder which decode Ethereum transactions and verify that at least it's what the hardware wallet says it is signing that it is actually signing (amount / fees / destination address). So you take your hardware wallet, you connect it to a fully airgapped computer (one without any WiFi capability and without any ethernet whatsoever) (btw let's please not get carried away with exfiltration through "fan rotating speed" or the like and hence that not being a really "airgapped computer" and the very concept of "airgapped" being non-existent). You then sign a tx on your hardware wallet, which generates a text file. You copy that text file to a USB stick. You check that USB stick from another airgapped computer running the tx decoder software. You can see what's signed. If it's what you wanted, you broadcast the transaction. This is reasonably secure. I'm talking about security for people protecting millions in assets, not $1 K, not $1 billion. There are still several issues. For example the Ledger hardware wallets, often regarded as the be-all / end-all of hardware wallets require constant updating, needing the wallet to be connected to a computer connected to the Internet to download updates. You can update the firmware before entering your key (for example on a new wallet), but you cannot install the "Nano apps" before entering your keys. Which is an issue in itself. Data exfiltration through non-deterministic signatures is another very serious issue. I haven't looked into using the same seed from different hardware wallet vendors and verifying that you get the transaction signature: if that can be done, I'm all ears. The Ledger CTO and Ledger overall will constantly dodge questions on these issues. The answer is basically: "Trust us, we won't exfiltrate your seed through non-deterministic transactions" and "Trust us, we won't exfiltrate your seed during apps or firmware updates". Firmware updates which aren't even signed with a signature people can verify: Ledger can decide to serve, if they want to, a backdoored firmware leaking seeds through non-deterministic to one person in one thousand if they want to. And they pretend there's nothing to worry about. What Ledger should do is let people download firmwares and Nano apps offline, put them on USB keys, and then update their hardware wallets from an airgapped computer. This would at least allow people to crosscheck their firmware and Nano app hashes. It still wouldn't solve all the issues. It's very hard to have something you can really trust and the hardware wallets vendors are really trying very hard to make sure you cannot verify what they're doing.
schlauerfox 4y ago
Actually secure uses for distributed decentralized databases (cryptocurrencies) like the world bank climate warehouse are going to use proper self custody solutions that aren't 'keep this paper safe' with clawback technologies and peer to peer (escrowless) methods of transfer. This one is being built by BitTorrent creator Bram Cohen. It's me shilling but I feel I'm a supporter for a technology reason, it's not been affected by the latest madness because it's business focused tech that works. https://www.chia.net/2022/10/29/a-new-home-for-the-prefarm/ https://www.chia.net/2022/10/29/a-new-home-for-the-prefarm/

JonathanBeuys 4y ago

Not targeted. The typical way of handling bitcoin is flawed in multiple ways. Lets look at the simplest way a hardware manufacturer could get your private key: They make the hardware wallet create the private key in a way the manufacturer can guess. But there are more elaborate ones. For another one, take a look at this discussion: https://news.ycombinator.com/item?id=32181462 https://news.ycombinator.com/item?id=32181462

redox99 4y ago
Some hardware wallets recommend you to generate your key with dice.
- JonathanBeuys 4y ago
  Yes, that would be part of a solution. Another part has to be multiple air gapped hardware wallets from different manufacturers that all are RFC-6979 compliant. And here it already ends AFAIC. I don't know of any air gapped wallets. The ones that call themselfes "air gapped" just connect to the computer via different means like display->camera.
  - TacticalCoder 4y ago
    You can use an hardware wallet, protected by a HSM, on a computer which is itself airgapped. I've written a decoder which decode Ethereum transactions and verify that at least it's what the hardware wallet says it is signing that it is actually signing (amount / fees / destination address). So you take your hardware wallet, you connect it to a fully airgapped computer (one without any WiFi capability and without any ethernet whatsoever) (btw let's please not get carried away with exfiltration through "fan rotating speed" or the like and hence that not being a really "airgapped computer" and the very concept of "airgapped" being non-existent). You then sign a tx on your hardware wallet, which generates a text file. You copy that text file to a USB stick. You check that USB stick from another airgapped computer running the tx decoder software. You can see what's signed. If it's what you wanted, you broadcast the transaction. This is reasonably secure. I'm talking about security for people protecting millions in assets, not $1 K, not $1 billion. There are still several issues. For example the Ledger hardware wallets, often regarded as the be-all / end-all of hardware wallets require constant updating, needing the wallet to be connected to a computer connected to the Internet to download updates. You can update the firmware before entering your key (for example on a new wallet), but you cannot install the "Nano apps" before entering your keys. Which is an issue in itself. Data exfiltration through non-deterministic signatures is another very serious issue. I haven't looked into using the same seed from different hardware wallet vendors and verifying that you get the transaction signature: if that can be done, I'm all ears. The Ledger CTO and Ledger overall will constantly dodge questions on these issues. The answer is basically: "Trust us, we won't exfiltrate your seed through non-deterministic transactions" and "Trust us, we won't exfiltrate your seed during apps or firmware updates". Firmware updates which aren't even signed with a signature people can verify: Ledger can decide to serve, if they want to, a backdoored firmware leaking seeds through non-deterministic to one person in one thousand if they want to. And they pretend there's nothing to worry about. What Ledger should do is let people download firmwares and Nano apps offline, put them on USB keys, and then update their hardware wallets from an airgapped computer. This would at least allow people to crosscheck their firmware and Nano app hashes. It still wouldn't solve all the issues. It's very hard to have something you can really trust and the hardware wallets vendors are really trying very hard to make sure you cannot verify what they're doing.

schlauerfox 4y ago

Actually secure uses for distributed decentralized databases (cryptocurrencies) like the world bank climate warehouse are going to use proper self custody solutions that aren't 'keep this paper safe' with clawback technologies and peer to peer (escrowless) methods of transfer. This one is being built by BitTorrent creator Bram Cohen. It's me shilling but I feel I'm a supporter for a technology reason, it's not been affected by the latest madness because it's business focused tech that works. https://www.chia.net/2022/10/29/a-new-home-for-the-prefarm/ https://www.chia.net/2022/10/29/a-new-home-for-the-prefarm/