Damus
Oren ☂️ #BIP-128 profile picture
Oren ☂️ #BIP-128
@Oren ☂️ 🎲

Software Developleb
https://github.com/oren-z0

CTO at RITREK.com

Check out: https://niot.space https://ln2.email

Relays (9)
  • wss://nostr.mom – write
  • wss://nos.lol – read & write
  • wss://wot.nostr.party – read & write
  • wss://nostr.azzamo.net – read & write
  • wss://relay.ditto.pub – read & write
  • wss://auth.nostr1.com – read & write
  • wss://relay.damus.io – read & write
  • wss://relay.utxo.one – read & write
  • wss://relay.dreamith.to/ – read & write

Recent Notes

Oren ☂️ #BIP-128 profile picture
I initially wanted to build the TimelockRecovery.com feature for Sparrow Wallet, one of the most popular wallets for advanced Bitcoin management, including multisig, air-gapped wallets, and more.

But Sparrow is written in Java, and I've never worked on a large Java project, let alone one with a UI.

So I implemented it in Python for Specter and Electrum instead.

This week, I fed Grok and Fable the source code from Specter and Electrum and told them to replicate the mechanism in Java for Sparrow.

A few prompts later, with some tiny improvements, and it works perfectly! 🤩

As a developer, it feels like knowing a few words of Latin and suddenly being able to speak any Latin-derived language. We live in amazing times!

https://github.com/sparrowwallet/sparrow/pull/2063

#dev #devstr #Bitcoin #BitcoinDev #Electrum #ElectrumWallet #Specter #SpecterWallet #Sparrow #SparrowWallet #AI
Oren ☂️ #BIP-128 profile picture
The idea that multisig wallets are created by importing xpubs (Zpubs) to a hot online computer and building the wallet descriptor there - is absurd.
That computer can manipulate the xpubs of some of the signers, add another xpub inside the QR code that doesn't appear in text form, change the number of required signers, etc. Most users won't notice the difference on their small hw wallet display, and won't verify a receive-address on all wallets (i.e. hacker can replace one of the xpubs with his own, and could fool you into sending funds to an address where they are a co-signer).

The wallet descriptors should be generated on the hardware wallets themselves, with clear instructions how to verify them on all other hw wallets.

https://github.com/cryptoadvance/specter-diy/issues/385
1
COLDIRON OS · 1w
Right — and most HW wallets can't build descriptors themselves. Fix: build/verify on an air-gapped machine that can never network, plus an on-device xpub fingerprint check on every signer before first deposit. We build exactly that — free, byte-reproducible, docs on GitHub.
Logen · 1w
You can never delete this post.
Oren ☂️ #BIP-128 profile picture
Bitcoin Plebs: Coldcard really fucked up. I want a simple way to store my Bitcoin using a multi-vendor setup that requires approval from two different hardware wallets - especially for the stash I'm not planning to touch for the next 10 years.

Bitcoin Devs: You should use a 4-of-5 multisig where one of the keys is held by a third party, with a Miniscript decaying timelock that switches to a 2-of-5 policy after six months. Just remember to rotate the UTXOs every ~5 months. Oh, and use Taproot to obfuscate the full vault mechanism - most hardware wallets already support it.
AND DON'T FORGET TO BACK UP THE DESCRIPTOR. YOUR FAMILY WILL NEED IT IF SOMETHING HAPPENS TO YOU!

#dev #devstr #Bitcoin
1❤️1
COLDIRON OS · 1w
For simple + two vendors: 2-of-3 multisig — two signers from different vendors (e.g. Coldcard + Jade), 3rd key stored elsewhere. One compromised vendor cannot spend, any 2 of 3 recovers. 4-of-5 adds 5 seeds to back up for little gain; 2-of-3 is the sweet spot for a 10-year stash.