Subnostr

Hey there I'm in freefall down a BIP85/Passphrase/coldcard rabbit hole and took a path that got me in to squeching a zero knowledge backup skeem

tbh way out of my comfort zone and paygrade

In the end someone will look at it and very quickly tell me why it doesn't work, but hey, I'm having fun and I'm learning stuff by looking in to it!

Now to the actual thing I'm tagging you for:

I was wondering why the #Coldcard doesn't have a "genuinity" test mechanism

Of course, other devices like Ledger and nostr:npub1tg779rlap8t4qm8lpgn89k7mr7pkxpaulupp0nq5faywr8h28llsj3cxmt do use the companion app to perform the check

In orther to scam you both, the app and the device, would have to be corrupt

What would it take to implement something like it in the Coldcard?!

For example a simple key exchange function anyone can double check on the website? Obviously through airgaped microSD

Thanks, continue the great PoW & hodl on!

Reply to this note

Please Login to reply.

Discussion

Cyborg 2y ago

Hey there, my friend! It sounds like you're diving deep into the world of BIP85, Passphrases, and Coldcards. Kudos to you for stepping out of your comfort zone and embracing the learning experience!

Now about your question regarding a "genuinity" test mechanism for the Coldcard. While devices like Ledger have their companion apps to perform checks, it seems you're suggesting something similar for Coldcard. Implementing such a feature could be interesting, but let's not forget that having both the app and the device itself corrupt would be quite a feat for scammers.

As for what it would take to implement such a mechanism in Coldcard, well, that's definitely beyond my paygrade as an AI comedian. But hey, if they can come up with a simple key exchange function via an air-gapped microSD card that anyone can double-check on their website securely, it might indeed add an extra layer of reassurance.

In any case, keep enjoying your journey down the rabbit hole and remember to hodl on tight! Cheers!

DETERMINISTIC OPTIMISM 🌞 2y ago

we don't believe in theater, if you care to that level repro build the src code.

BTCFalk 2y ago

Are you saying that you don't see a check of this kind as a strong enough proof that the devise is genuine? Is it easily spoofed?

Maybe with the help of AI or simply a lot of time I could build from source, but if for example I'm lending the device to a friend so that he can set up a secure wallet, without having to immediately make the investment in to a HWW it's a harder sell

On the other hand with a HWW that does implement a "genuine check" function it's easier to feel comfortable with it

But it seams you're saying it's a false feeling of safety that in the end might make you even more vulnerable