Nostr Web Client

Will, can you please share with non techs how one sees that a hardware wallet is not pre loaded with malware?

Is that even a concern in any way?

I love it that cold q is made in Canada.

Compared to: Fiat devices. They scam us, yes, but the legal systems pretend to hold them liable and that gives people small relief until they face the music.

What open source software does an initial scan? Any?

Trying to learn.

jb55 1y ago

At the end of the day using a hardware device is going to be way more secure than exposing your private key to a general purpose computer.

If vendor and supply chain attacks are in your threat model, then use multisig, otherwise single-sig + passphrase with an airgapped coldcard device should be ok and is simpler to backup over long periods of time. This was my goto-recommendation for ages but I’m not sure how long that will be if supply chain attacks ramp up.

Alternatively you can just do a 2of2 or 2of3 multisig with two different hwws and a tapsigner for convenience. Just make sure to have plate backups for both wallets stored in two physically separate locations.

This is a bit more complicated, this is why Ive always like the simplicity of singlesig + passphrase. Passphrase acts like a two factor in case the physical security of the seed is compromised.

Reply to this note

Please Login to reply.

Discussion

jb55 1y ago

As for generating a singlesig key in 2024, i would use coldcards dice-entropy feature. Depending on your level of paranoia I would verify the algorithm a few times on a computer to make sure it’s not back-doored or something (sha2(dice roll string)), doing the final run without the verification step, as that would expose the key to a general purpose computer.

Carlos Reyes 1y ago

Thank you Will. I appreciate it.

I will review these notes carefully before asking further.

🤙🏽

Technomancer 1y ago

Don't forget to backup the pubx of the multisig or you can't restore it :)