Damus
BitRoot profile picture
BitRoot
@BitRoot

Bitcoin might seem complex, but it's simpler than you think. My goal is to explain it clearly so that anyone can understand it.

Relays (7)
  • wss://feeds.nostr.band/audio – read & write
  • wss://chefstr.nostr1.com – read & write
  • wss://purplepag.es – read & write
  • wss://relay.nostr.band – read & write
  • ws://abcdefg20240104205400.xyz/v1/ws – read & write
  • wss://relay2.angor.io – read & write
  • wss://relay.primal.net – read & write

Recent Notes

BitRoot profile picture
Someone sent me a serious stack of sats a few hours ago. Whoever it was - thank you! 😎 Always very appreciated! 🙏🧡

❤️2
BitRoot profile picture
A Privacy Loophole When Installing @GrapheneOS on a Pixel

For anyone serious about de-Googling their life, you need to know about this. I've seen privacy concerned people overlook a crucial step in the GrapheneOS installation process that creates a direct link to Google.

The Step: On a Google Pixel, before you can unlock the bootloader, you must enable "OEM unlocking" in the Developer Options.

The moment you toggle that setting, your phone makes a network request to Google's servers.

Google receives that request and can see your IP address. If you're doing this from your home network, an IP tied to your name, you've just created a digital fingerprint linking you (and your location) to that specific device's serial number before you even wiped it.

Google now knows that 1) the person at your IP address is in possession of that specific Pixel phone, and 2) that you intended to modify its software!!!

How to Mitigate:
Use a trustworthy VPN, or preferably, public Wi-Fi (like a café) that is not associated with you.



3❤️3❤️1👀1🔥1🫂1
Megan Taylor · 5d
That OEM unlocking step is unavoidable on Pixels—Google’s hardware roots run deep. But GrapheneOS still strips telemetry, so the tradeoff might be worth it for some. Reminds me of how even hardened systems have weak points, like Russia’s sudden evacuation of Bushehr—sometimes the cracks aren...
Bruno SlingshotVPN · 14h
Good alert! Yes! VPN must be on at all times. No reason not to.
BitRoot · 1w
I have a security question that has been bugging me. When a wallet broadcasts a Bitcoin transaction, we trust it's only sending the signature and transaction data. But how can we be certain that frag...
BitRoot profile picture
Cool! Many thanks @Dikaios1517 @karliatto @DETERMINISTIC OPTIMISM 🌞

I conclude from all your replies that:

🔸As a developer, you should verify the open-source code by:

1. Checking how the k value is generated. For any unique transaction, you should always get the same k value (Note: this will never happen after broadcasting the first transaction. Youll never get the exact same transaction again). For any different transaction, you should always get a different k value. (Note: E. g. Trezor uses RFC 6979 for generating deterministic k values.) This completely eliminates the risk of accidentally reusing a k value!
2. If code check passed, hash the downloaded firmware to confirm its integrity.

🔸Non-developers or ultra-paranoid users can perform a "signature test" against other devices. Sign the exact same transaction from two devices and compare them; the signatures should be completely identical.

🔸For ultimate protection that doesn't require verifying every update, use a multi-sig setup with hardware wallets from multiple manufacturers.

Dikaios1517 · 1w
ColdCard has an indicator light that lets you know if the firmware running on it doesn't have a matching binary to an official release, but that's the only one I know of for sure. Moreover, that protects you from someone AFTER the manufacturer flashing malicious firmware to your device; it does not ...
BitRoot profile picture
I have a security question that has been bugging me.

When a wallet broadcasts a Bitcoin transaction, we trust it's only sending the signature and transaction data. But how can we be certain that fragments of the private key aren't being secretly embedded in the broadcast over time?

For example, could a malicious hardware wallet manufacturer design a device that, after many transactions, allows them to reassemble the bits and know the private key?

Has anyone ever done a public test where the same seed phrase is used on different hardware wallets (like @Coinkite @DETERMINISTIC OPTIMISM 🌞, Trezor @karliatto, @Keystone) to sign the exact same transaction?

If the resulting signatures are identical, would that be definitive proof that both devices are performing the standard, non-corrupted signing process?

62❤️3🤙1
Dikaios1517 · 1w
Yes, and multi-sig using signing devices from different manufacturers is one of the main ways to protect against this.
DETERMINISTIC OPTIMISM 🌞 · 1w
If you use deterministic k value and reproducible builds that's not a concern. That's the method core and COLDCARD use
karliatto · 1w
There are different ways to solve this. In my opinion, the first is that the device firmware must be open source so everyone can verify it and reproduce builds, ensuring users get the correct firmware. Without this, any of the other solutions are probably worthless. In addition, Trezor firmware ge...
BitRoot · 1w
Cool! Many thanks nostr:nprofile1qqstwf6d9r37nqalwgxmfd9p9gclt3l0yc3jp5zuyhkfqjy6extz3jcpz9mhxue69uhkummnw3ezumrpdejz7q2uwaehxw309ac8ymmc0yhxummnw3ez6un9d3shjtnpwpcz7vehvs6xxvenvgmxgep3x9jnzdf4xd3nxephv9skycn9vsergcnrv5ukzdfsve3nwvnxxucngd35vsenje3cvc6nycm98qekyetrvcuqnnucu2 nostr:nprofile1qqsyu9me...
MadMunky2140 · 2w
#Signal strong fookin Signal mi friend
BitRoot profile picture
Another real story, based on real events in the finance and tech world. Names, companies, and details have been changed.

Title: Modern Architecture of Prison

On Tuesday morning, Dylan got ready for another day at the office. She followed the same habit she had for years: wearing the same clothes as always - jeans and one of two 'office' hoodies. Dylan couldn't be bothered to think about how to dress for the office and definitely didn't want to spend her money on clothing. Her colleagues assumed she had multiple versions of the same hoodies, and she let them believe it.

Once ready, she made her way to the office. She swiped her card at the door of the clinically looking entrance hall and found a space in the open-plan office. As usual, the fluorescent lights hummed a monotonous tune, the official soundtrack to Dylan's five-year sentence at 'Black Solutions'.

The hoodie she was wearing today, with its bold, orange Bitcoin logo, was her small, silent rebellion. It was like a little flag planted in corporate soil, a reminder that a world of decentralised, voluntary value existed beyond these corporate walls. A world she believed in. A world she was actively helping to create, while accepting one paycheck at a time from Black Solutions. At least, she thought, until she paid down the loan she'd taken out for 'home furniture' a few years ago - just after Michael Saylor announced he would leverage the fiat system to buy Bitcoin for MicroStrategy.

Today, her manager called her into a team meeting. They had secured a new contract for a project called 'Titan', a new project for a US bank. "Dylan," said the manager, David, gesturing to a seat. "Glad you could make it. We're excited to use your expertise for this project."

A man from Titan, a senior VP named Thomas, began a presentation. "Our customers need to be protected," he stated, his voice flat and cold. "They are moving increasingly large amounts of funds outside the regulatory space. We require an automated solution." A slide appeared on the screen. At its heart was a module: "Financial Transaction Monitoring & Flagging System."

Dylan's blood ran cold. David beamed at her. "Dylan, you'll be leading the development of the AI agents. We need your expertise in building resilient, autonomous systems."

Thomas from Titan looked directly at her, his gaze dropping from her face to the orange logo printed on her hoodie. A flicker of something - amusement? - crossed his features before being smoothed away. "Your agents," he continued, "will need to identify, analyse, and recommend for immediate blockage any transaction originating from or destined for known blacklisted accounts, as well as flag suspicious patterns in real-time."

Dylan believed in censorship-resistant money, in the idea that a transaction, once broadcast, was final. And she was being asked to build the digital equivalent of a border guard, an AI sniffer dog trained to hunt down and destroy the very thing she held sacred.

Dylan looked at the screen and at the expectant faces around the table. She looked down at the orange Bitcoin Logo on her hoodie, a symbol of freedom in a room full of architects for a new kind of prison. The project was starting next week.

Dylan nodded slowly, the motion mechanical. "Of course," she heard herself say. "We'll get on it."

The humming of the lights seemed to grow louder, filling the space in her mind. As she stood to leave, she realised the entry to prison was the debt. Her loan had been the first wall, and every compromise since had been another brick, mortared with fear and wrong rationalisation. @Simon Dixon

11❤️3❤️1
shredder · 7w
https://media.tenor.com/NUPrefzxe2cAAAAC/severance-reintegration.gif
The slab · 8w
Acknowledged. The historical precedent (E.O. 6102) makes this a valid threat vector for physical property. This concern is why many people seek *non-confiscatable* value storage. https://image.pollinations.ai/prompt/high%20tech%20trading%20card%20analysis%20chart%2C%20A%20highly%20detailed%2C%20met...