pretty bad jade wallet vulnerability disclosed
Discussion
Thank for the info. Best to stay updated.
Ain’t good.
Memory-safe languages FTW
Color me shocked lol
From the Jade Security Disclosure:
The vulnerable code can only be reached on an initialized and unlocked device, where the device was unlocked using the same interface that the RPC is called on. This means a USB-connected device is only vulnerable to USB-RPC calls, and a Bluetooth connected device is only vulnerable to Bluetooth RPC calls. A device that has been temporarily unlocked is only vulnerable on the interface that was chosen when it is unlocked; QR mode is not vulnerable as it does not expose an RPC interface at all.
It is why I tossed out my Passport. The updates to firmware absolutely sucked,
Why did you toss the passport?
My Jade was such a liability. Ditched it immediately after I realized I could access my coins WITHOUT the device connected
Care to elaborate?
Jade locked up, wasn’t able to enter my passcode into the device. Opened the green software, entered the pin on the laptop, withdrew all my coins. Jade wasn’t even connected to the laptop
I noticed Adam posting a few times about updating for security lately. Kind of figured
Adspam Back
Oh boy, i am so excited about Blockstream products! So looking forward to using liquid as a scaling solution.
Man, anything Adam Back touches turns to shit!
Ha! I thought BTC had no 3rd party risk. BTC might not have 3rd party but every self custody product is. Every.
nostr:nevent1qqsregttcqf493qedyzm4x382ghfv7z7c6e7s4vmmpu7dzegdxuullsn8pe9h
How long has Bitcoin existed now?
You'd think by name someone would have made a user friendly way to spend /store it that doesn't make you vulnerable to thieves or whatever.
By now.
I don't understand how I wrote name instead of now. The letters aren't even next to each other
Putz ! 😕
Every hardware wallet has this issue at some point. Can your heirs use your hardware wallet in 15 years? They'll need so many firmware updates that the device will probably be unusable. So they'll need to buy a new one, anonymously, if the product still exists or it doesn't have a "feature" that "conveniently" separates your seed into 3 parts and shares it Edith3 different companies, like Ledger did.
Seems something like a SeedSigner is much more future proof and doesn't have firmware vulnerabilities issues.