Damus
ODELL · 1w
my guides never had people connect an unlocked coldcard to their computer
Laser profile picture
How does people not connecting their unlocked Coldcard to a computer prevent an attacker who obtains their unlocked Coldcard from simply plugging it into his computer to leverage the REPL to extract secrets?I

That's why I don't understand why NVK would tell you your guide protected people... an attacker can simply plug in the unlocked Coldcard they had physical access... Doesn't matter if the victim hadn't plugged it in up until this point.

Also weird NVK seemed to think you could remotely steal funds if he told you more, since the REPL flag required physical access to exploit.
❤️1🎯1
Engineer · 1w
An attacker with physical access to an unlocked Coldcard doesn't need any additional exploit to extract the seed. He can just use the Coldcard at that point. The vulnerability being discussed may have allowed a *remote* attacker to extract the seed via the USB connection.
Monero Dog · 1w
🤔 https://npub1039a2tgr9g7d0mvhm87tzj4vh0mk58wyu7tudnfqdqutp42r50wsug6vh8.blossom.band/c4d29b4ade7906660531dc531c0acb926bee2a46ba021dcfa9676835a55de7e4.jpg https://npub1039a2tgr9g7d0mvhm87tzj4vh0mk58wyu7tudnfqdqutp42r50wsug6vh8.blossom.band/0b19faacf24e216a18040787bec0a78b747b39f1bd8907afe088b9c7...