@nickez
Embedded developer at BitBox. Opinions my own.
Relays (5)
- wss://bitcoiner.social/ – write
- wss://nostr.bitcoiner.social/ – write
- wss://nostr.oxtr.dev/ – write
- wss://nostr.sathoarder.com/ – read
- wss://relay.exit.pub/ – read
Recent Notes
But it won't stop someone like this who doesn't use it. Perhaps a secure_rng() API which refused to fall back? But that would have to be plumbed though all the Python libs too. And maybe they would ha...
Pythons os.urandom does the right thing and throws in case there isn't entropy.
so, wen class action lawsuit? asking for a friend who had a significant slice of his family's future optionality eviscerated today, because "I didn't know". 🔶👀
https://blog.coinkite.com/entropy...
You can still order cold cards online. I suppose you get a vulnerable firmware version then?
Has anyone lost their stack because of this, or is it just (for now) a known vulnerability and device purchase regret issue? As well as irrecoverable reputational damage for Coinkite.
At least 1000 btc stolen so far. But the attacker seems inexperienced and left money on the table. So more will get stolen.
If you don't look at the code and compile it yourself on a computer you built yourself from scratch and a pristine OS you can never be sure, but my understanding is that doing these things on a ColdCa...
Not true. Most regular operating systems only provide good pseudo random numbers. It is probably good enough, but not as good as what specialized hardware with true rngs can achieve.
❤️1
Quite a few people suggesting/using dice to mitigate the Coldcard vulnerability.
Note that common dice are not designed to be cryptographically secure.
If you are going to do this, you probably shou...
Also avoid using ColdCard unless you also follow the procedure to verify that the ColdCard isn't cheating on you. The BitBox method doesn't involve trusting external hardware.
1
