Worse. It took them ~10 hours to put anything on their website/blog after the Tweet.. 😅

Very odd response/handling from a project I generally like.

calle is pissing me off tbh

I mean my recommendation when this happened yesterday was nuke it and probably don't use it again

Given how they handled disclosure by just tweeting and not posting anything about it on their website or blog for more than 10 hours 😂

you only needed to rotate macaroons (from the latest statement).

How would it almost get you? These are usually pretty dumb and simply ask you to literally type out your seed phrase.

Of course, but doing that 5 years ago, with an immediate advisory and that easy path to migrate would limit the damage substantially.

Instead we had.. what we had lol.

They could have easily rolled an update that forces a seed refresh. On boot -> if seed exists -> prompt user to confirm they have existing seed words / verify that -> generate new seed -> ask user to migrate all funds to new seed (now on device), load old seed in memory transiently to allow signing the migration tx.

This is more jank tha it should because they don't have a first-party app. Something like Bitkey handled something similar in literally two clicks during the privacy upgrade update (which required a new 2-o-3 to be generated.

Requires an approved/published Google OAuth screen. I can spin it up with the testing 100 user cap and see from there.