Oddbean new post about | logout
 Hmm, which hacked hardware wallet do I bring to #btcnashville? People trust these things too much.

#hww

https://image.nostr.build/2815f23d7e6e251b8baf3040b0c47a93427d48968dab37d8076a9f97906e31ec.jpg 
 Where did you get all of this? 
 I hacked them :) I'm the cover thumbnail for the wallet fail talk. Obviously because my throw back glasses 😎

My day job is a hardware penetration tester. With a colleague, we've done probably the most paid hww audits. For example, foundation et. Al. 

https://youtu.be/Y1OBIGslgGM? 
 I say day job but it's just me, myself, and I running the shop 😀 
 Hacker as a full time job 🤩
Is there some hww that you couldn't break into? 
 So basically all of them do the thing they claim which is, they separate the key from your main computer/tablet/phone. Most of them are pretty good we've only found minor issues since we gave that talk.

In that sense, I'd like to think the industry learned a bit from us. With the exception of tamper stickers. They are worthless.

But none of them solve the really hard problems of can I truly verify and trust this hardware. And some of them do shady things with licenses and cloud servers and what not.

So in conclusion, despite me earning money from the industry, I think people don't need a hww. I think a laptop running tails with persistent is fine for most people. Boot into tails, do your thing and disappear. Tails has had more eyes on that software than any hww code base. But nothings perfect.

Honestly, this is where nostr:nprofile1qqs09jtvjlmyrxjn37zv70a89csegcz7rpyqjmnw29cveedhv7vagqqpr4mhxue69uhkummnw3ezucnfw33k76twv4ezuum0vd5kzmp0xmkjg2 kinda wins. I don't use it personally but it's the embedded version of what I just described. And it's an actual open source project, not a product.

I could audit it but it's like, it doesn't store anything. So I could verify it does that but at worst case it is a malicious signer. But that's the same threat to all hww, every vendor could push a (unintentional) malicious update.

Some hww vendors also just shit on each other all the time. It's honestly a bit exhausting.

I get a bit sad tbh because I'm in all these chats about how to do self custody and it's all these cults of people saying Coke is better than pepsi.

So I'm a bit disillusioned with bitcoin hardware at the moment. I'm hoping to make some actually fun electronic project instead of watching people cheer for their favorite vendor.

Anyway, long rant. But this is kinda why I'm doing bitpunk.fm at the moment to find my spark again ⚡️ 
 @SeedSigner is slick 
 I totally agree, thanks for your post 
 Sorry to hear that you are disillusioned. 

IMO the current state of hardware wallets is actually great (if you can put the bickering aside).

There are many design directions being explored by teams with different priorities making products that target different users and use cases.  
 This is true. I don't mind the fragmention actually or I should say the diversity of options. 

Actually I forgot to say, because I was in a rant mindset, that there is a project I'm excited about. Satoshi Labs Tropic Square company that is making it's own chip.

There are many details here, but overall, I think they are taking a risk and pushing a larger industry forward.

I think ultimately are a very personal choice and technically, they all mostly solve the one issue of key separation. But because they are a physical product you can buy, they get shilled to no end on podcasts, youtube, etc...

So that's the kind of stuff that drives me nuts.

I think, being in security, I tend to always see the negative things -- how to break this or how that will fail. I'm also a bit cynical person in general sometimes. A sincere thank you for bringing a positive reminder.