this attack was allowed by a coding error that mistakenly generated much weaker than intended entropy for seed generation.

bottom line: any wallet developer is capable of making a similar mistake.

This can be mitigated by not relying on any wallet to generate your seed words for you. Instead, you can generate your own near-perfect entropy offline simply by letting 11 coin flips choose each of your seed words from the list of 2048 BIP-39 words. Then tell your mobile wallet what your seed words are rather than the other way around.

PS... I think I would personally alter this method to flip 11 coins per word instead of using dice.... but the lookup chart would still basically be applicable.

You could just create your own seed words from soup to nuts - which pretty much all signing devices accept.

BitBox has a nifty lookup table for manually generating each word offline from 11 bits of dice roll entropy.
*this is not an endorsement of BitBox itself (I've never used it), but this method is device agnostic - save for the final word (with embedded checksum) which can get a bit tricky... but some devices are designed to help you more easily land on a valid final word.
https://bitbox.swiss/bitbox02/BitBox_Diceware_LookupTable.pdf

It definitely hurts; but, self-custody has always required normal people to stop being normal at some level.

IMO, we (the bitcoin community) have been a little too eager to spread adoption... e.g. just do what you can to get normies to start using now; properly explain trade-offs later (if ever). This is backwards from being a responsible advocate.

RNG vs dice rolls has always been a trade-off that seemingly very few bother to explain. If that explanation scares normal people off, so be it. At least they will have made an informed decision.

agreed. when it comes to seed generation: don't trust; verify... and since you can't really verify an RNG, just do it yourself.

In fact, IMO, all signing device providers probably ought to just stop offering to provide entropy for you.

It's a bug coinkite should have found long ago. It's a bug that the open-source community could have found long ago.

I suspect the failure on both counts is largely due to a lack of eyes on a specific function (reliance on RNG for seed generation) which is mostly avoided by those who are even capable of detecting such a bug.

*it's probably best for ALL signing devices to just discontinue offering this inherently risky convenience.

Also, if you don't want to bother running the python code, this can be a useful tool to verify that the hex output from the dice rolls is being properly converted into seed words (just paste the hex output into the "show entropy details" section)

*I'm not recommending going throw this process for any seed words you actually plan on using. Just run several test cases to verify the coldcard is processing the dice rolls properly, then you can be confident it will continue to do so with a seed you plan on keeping secret and offline.

https://iancoleman.io/bip39/

IMO, there's no need to throw the baby out with the bathwater. Just don't rely on RNG for seed generation. Verify that your coldcard is processing dice rolls correctly (perhaps with several test cases); you should be fine.

It shouldn't be surprising that if something was going to fall through the cracks (on any signing device), it would be reliance on RNG. It's one of the few functions that isn't deterministic, and therefore can't be independently verified is working properly. So, just don't rely on RNG for seed generation, period.

https://coldcard.com/docs/verifying-dice-roll-math/

IMO, it's worth it to learn how to just not rely on either hardware or software for seed word generation. Get yourself a list of the 2048 words, and figure out what works best for you to generate that 11 bits of entropy per word (dice, coin flips, whatever).

... that being said, I still wouldn't recommend exposing seed word generation to any sort of computer error risk anyway. It's well worth it (and not all that difficult) to learn how to generate them manually (with dice, and/or coins, or whatever you can come up with to generate 11 bits of entropy per word).

You should at least be able to verify that raw dice rolls are being processed properly:
https://coldcard.com/docs/verifying-dice-roll-math/

Just a heads-up: simply changing your credit card number alone may not be good enough.

Long story, short: your credit card provider may automatically allow subscriptions to certain 'reputable' services to persist through a card number change as a 'convenience' to *you*... best to also tell your card provider which specific subscriptions you want to stop paying.