Replying to Avatar Matt Corallo

They bothered to implement anti-exfil (provably random nonces). This means that a malicious firmware or even malicious hardware wallet can’t steal your coin! For every other hardware wallet, you’re blindly trusting Amazon/UPS/five factories in China/the webserver you got the firmware from/etc/etc. The idea that none of these parties have anyone working there who might want to go steal people’s coin is absurd, frankly.
Avatar
crimsonleaf363 1y ago 💬 1

I think this is also a good time to bring this up. It's possible for Nunchuk and Coinkite to have malicious actors in their supply chain. They could collaborate and compromise someone's Tapsigner.

Reply to this note

Please Login to reply.

Discussion

Avatar
Jeff Swann 1y ago 💬 2

cc nostr:npub1az9xj85cmxv8e9j9y80lvqp97crsqdu2fpu3srwthd99qfu9qsgstam8y8 👀?

Avatar
crimsonleaf363 1y ago

Anyone in the supply chain with access to the Tapsigner can take a photo of the back of it. Someone with access to Nunchuk's server can get a copy of the encrypted backup.