Oddbean new post about login | logout @NVK has thoughts. 😅 For me personally, after talking to LOTS of bitcoiners who are deeply technical and very committed to open source AND still will only use a Coldcard, I'm never going to use anything else. Call it social heuristics if you want, but I guarantee that 99.9% of bitcoiners (me included) have no idea how complicated it is to keep keys properly secure. If "verifiable source" is the tradeoff required, so be it.
It is written there already. Use Trezor, the real open source hw wallet.
With easily available tools you can extract keys from a trezor one in minutes, this attack has been publicly demonstrated many times. https://m.youtube.com/watch?v=Y1OBIGslgGM
You can do the same with Coldcard, it's just not published because of NDAs.
"I" can't, can you? If yes then how?
So use passphrases and/or upgrade to a safe 3 or 5.
I think it is a dick move, which has nothing to do with security.
Well, this post of yours will likely start a flamewar, but I’m on the side of you with ColdCard, primarily because it’s Bitcoin-only. “Open Source” means a lot of things, and I think it shouldn’t be exclusive to the GPL3 purist language. But the Bitcoin-only focus of ColdCard means it won’t try catering to the real fraudsters, the cryptobros. Hence, better security, EVEN IF there’s some level of code obscurity with ColdCard. Besides, ColdCard’s documentation is top notch in my book.
"Open source" has had a commonly accepted definition since at least the mid 90s when I started working with it. It's mostly non-developers (and NVK) that are confused about this There are plenty more FOSS licenses than GPL3, which is actually quite unpopular. MIT and Apache are the most used by far and provide users with maximum freedom
>"If "verifiable source" is the tradeoff required, so be it." How are you equating a company telling you, in order to have a secure device we will not be sharing the source code? Aren't you just accepting the "trust me bro" attitude, because the company told you it's more secure if they don't share the code?