The idea that multisig wallets are created by importing xpubs (Zpubs) to a hot online computer and building the wallet descriptor there - is absurd.
That computer can manipulate the xpubs of some of the signers, add another xpub inside the QR code that doesn't appear in text form, change the number of required signers, etc. Most users won't notice the difference on their small hw wallet display, and won't verify a receive-address on all wallets (i.e. hacker can replace one of the xpubs with his own, and could fool you into sending funds to an address where they are a co-signer).
The wallet descriptors should be generated on the hardware wallets themselves, with clear instructions how to verify them on all other hw wallets.
https://github.com/cryptoadvance/specter-diy/issues/385
That computer can manipulate the xpubs of some of the signers, add another xpub inside the QR code that doesn't appear in text form, change the number of required signers, etc. Most users won't notice the difference on their small hw wallet display, and won't verify a receive-address on all wallets (i.e. hacker can replace one of the xpubs with his own, and could fool you into sending funds to an address where they are a co-signer).
The wallet descriptors should be generated on the hardware wallets themselves, with clear instructions how to verify them on all other hw wallets.
https://github.com/cryptoadvance/specter-diy/issues/385
1
