Nostr notes by WalletScrutiny

#naddr1qv…0twy Thank you very much for your support!

2026-08-25T16:45:15Z

quoting naddr1qv…0twy

NEW YORK (August 25, 2026) — The Human Rights Foundation (HRF) is pleased to announce grants totaling more than 500 million satoshis from its Bitcoin Development Fund (BDF). This round supports 16 projects advancing open-source Bitcoin and Nostr development, self-custody and wallet security, censorship-resistant communications, merchant and mobile money payment integrations, and research and education for people living under authoritarian regimes. Grantee projects will strengthen the Bitcoin protocol, expand practical Bitcoin access across Africa, Asia, and Latin America, facilitate secure messaging and community infrastructure for dissidents, and grow grassroots education and design capacity worldwide. Together, these efforts help human rights defenders, journalists, nonprofits, and everyday people communicate, organize, save, and transact more freely under repression.

HRF’s grantees for Round II of 2026 include:

BITCOIN PAYMENTS

BitSpenda

Across Africa, cross-border money transfers are often slow, costly, and rely on intermediaries. BitSpenda, a mobile money-to-bitcoin bridge, offers a non-custodial, account-free tool that lets people in Nigeria, Kenya, Cameroon, Uganda, and Ghana send bitcoin from a Lightning wallet directly to a mobile money account, where it is received in local currency. With HRF’s support, BitSpenda plans to expand its payment tools to make cross-border payments faster, cheaper, and more accessible in the region.

Project Island Resilience

In parts of the Caribbean, power outages and authoritarian repression can cut people off from both communication and access to money. Project Island Resilience builds on Flash, a Bitcoin and Lightning wallet created by Jamaican developer Dread. After Hurricane Melissa devastated Jamaica in late 2025, the app raised and distributed more than $10,000 in bitcoin within 72 hours. Now, the project plans to add offline payments to Flash using Bluetooth, near-field communication (NFC), and ecash, creating a model for how Bitcoin can continue working in adversarial conditions. HRF’s grant will support this next phase, helping build practical Bitcoin infrastructure that can be used during protests and internet shutdowns.

Bitzed

In Zambia, mobile money is commonly used, but buying bitcoin still usually requires banks or centralized exchanges that maintain identity records and control individuals’ assets. Bitzed, created by Bitcoin educator Humphrey, is an account-free platform that connects mobile money networks directly to Bitcoin in Zambia. Users can buy bitcoin using existing mobile money accounts and receive it straight to their own Lightning wallet. HRF’s funding will help expand this self-custodial path into Bitcoin for Zambians excluded from traditional banking and subject to financial repression.

BITCOIN DEVELOPMENT

Libbitcoinkernel

Many Bitcoin applications have to rebuild the protocol’s most complex security rules from scratch, which increases the risk of catastrophic errors. Libbitcoinkernel is a software project pulling the core security and transaction rules directly from Bitcoin’s original code and turning them into reusable software modules. This will allow freedom tech developers to build more secure and independent wallets, services, and infrastructure without having to duplicate Bitcoin’s critical code. Support from HRF will help developer yuvicc continue this foundational work, strengthening the foundations of Bitcoin tools on which people under financial repression rely.

A Node in Every Wallet: Utreexo Wallet Integrations

Most Bitcoin wallets still rely on centralized servers to access balance and transaction history, compromising user privacy. Floresta is a lightweight version of a Bitcoin node that embeds directly into wallet apps, reducing the storage needed to verify Bitcoin transactions, so wallets can then check data locally and privately. This grant will support developer Luis Schwab in ensuring that wallets cut out the middlemen and interface directly with the Bitcoin network.

BDK-Dart

In many authoritarian countries, mobile wallets are the most practical way to access Bitcoin. But building apps that give users full control of their funds without relying on a central authority remains a challenge. BDK-Dart is a toolkit that gives developers pre-built Bitcoin wallet-building blocks for Flutter, a popular framework to build apps for any device. The toolkit allows developers to more easily build secure, custodial Bitcoin wallets using a single, shared codebase across platforms. Supported by HRF, software developer John Osezele will make a major release of this software and a reference wallet, lowering barriers for developers to build self-custodial Bitcoin apps worldwide.

WalletScrutiny

Most Bitcoin users have no way to check whether a wallet app actually matches the open-source code it claims to run. WalletScrutiny is a project that audits Bitcoin wallets for transparency and verifies that the distributed software matches its source code. Funding will support expanded review of wallet dependencies and third-party frameworks, helping activists, journalists, and changemakers choose trustworthy Bitcoin applications in authoritarian contexts. HRF has supported WalletScrutiny before, and this grant continues that work as the recent Coldcard hack underscores the importance that the software running on a Bitcoin wallet is actually the software users expect.

NOSTR

Vector Privacy: Privacy by Principle

In high-risk environments, private messaging requires more than just encryption; it also means avoiding account creation, metadata trails, and censorship. Vector is an open-source messenger built on Nostr (a decentralized communications protocol) that is permissionless and uses end-to-end encryption. HRF’s grant will help Vector launch on iOS and desktop, release encrypted voice and video calls, and provide journalists, activists, and whistleblowers with a stable, censorship-resistant tool to communicate and coordinate without fear of being tracked or silenced by dictators.

Flotilla Chat

Civil society groups and communities often rely on centralized communications platforms that can delete forums, remove users, or shut down networks with little warning. Flotilla Chat, built by the Nostr client Coracle, is a Discord-style platform built on Nostr that separates a user’s identity from the hosting provider. On Flotilla, organizers control their own infrastructure. Meanwhile, members keep portable identities across the network, reducing censorship risks. HRF’s funding will help develop features such as role-based access control, voice chat, and Bitcoin-native funding tools to make online assembly more resilient under autocratic regimes.

OpenAlert: Decentralized Critical Alerts for Nostr

Critical emergency alerts often depend on centralized push notification services — such as those run by Apple or Google — which can be easily blocked, monitored, or fail during a crisis. OpenAlert, created by software developers Fernando Diego Pergolini and Jorge Carlos Franco, is an alternative notification platform to deliver urgent alerts. Its main layer uses the decentralized Nostr network to issue alerts via anonymous text and audio messages, with end-to-end encryption and programmed self-destruction, protecting user identity from censorship and repression. HRF’s support will cover hardware and personnel costs to develop a tool that helps human rights defenders receive urgent alerts about what is going on around them.

0xchat

Activists and journalists need private, reliable communication tools, but many existing apps still expose users to surveillance and censorship. 0xchat, created by software developer water783, is a messaging app built on Nostr that offers fully encrypted chat, file transfer, voice, and video calls. It features an integration with Tor, a technology that masks internet traffic to protect a user’s physical location and identity. 0xchat also includes a built-in Cashu wallet for private Bitcoin payments. HRF’s support will help advance this communication tool so people can coordinate more safely without relying on platforms vulnerable to authoritarian intervention.

BITCOIN MINING

256 Foundation

Bitcoin mining hardware is still dominated by a few manufacturers using proprietary technology, which can limit participation and the way the network is secured. The 256 Foundation is a nonprofit working to break this oligopoly by open-sourcing every part of a Bitcoin miner: from the hardware to the software that runs them. Making mining tools more accessible and transparent reduces the network’s reliance on centralized manufacturers. Backing from HRF will strengthen network decentralization while also supporting one of the most private ways to acquire bitcoin under a dictatorship.

BITCOIN EDUCATION

My First Bitcoin

Financial education is often shaped by state institutions, leaving little room to question how monetary systems work, let alone to explore alternatives. My First Bitcoin is an educational initiative providing free, open-source educational resources through a global education node network: a group of independent educators active in more than 40 countries, including India, Uganda, and Indonesia. HRF’s support will help grow the educators trained through their Educator Training Program, from roughly 60 to 120, with a focus on communities living under authoritarian rule achieving financial freedom.

Agora: Bitcoin Lightning Activation & Civic Infrastructure Pilot

In Venezuela, activists, independent journalists, and civic organizers face blocked platforms, surveillance, and difficulty receiving international support. Agora is a decentralized activist platform built on Nostr and Bitcoin that supports coordination, censorship-resistant communication, and peer-to-peer financial support for communities under authoritarianism. Agora includes a non-custodial Bitcoin fundraising component that enables people anywhere in the world to support individuals and causes directly, with contributions sent directly to recipients’ wallets. Developed in part through an HRF-supported hackathon, this grant will support Agora’s 9-month pilot deployment in Venezuela, demonstrating how Freedom Tech functions as practical civic infrastructure in an authoritarian environment.

HODL: Hands On Design Lab

Many Bitcoin tools remain hard to use because their interfaces do not clearly guide users through the critical steps of self-custody, privacy, and security. HODL: Hands On Design Lab is an education initiative that runs structured cohorts for early-career designers in India. HODL prepares them to contribute to apps, projects, and tools across the Bitcoin ecosystem. This will help close a usability gap in Bitcoin by training UI and UX designers to directly improve how people interact with it in practice. Funding will support personnel and three cohorts over 12 months to help make Bitcoin easier for everyone to use.

Hack4Freedom

Women in Africa and Latin America often face exclusion from the education and technical training needed to contribute to freedom tech. Hack4Freedom, created by Evento founder Brianna Honkawa d’Estries, is a two-week developer education program that trains women in Africa and Brazil to build on Bitcoin and other open-source freedom tech projects. With cohorts in cities such as Lagos, Nairobi, and São Paulo, HRF’s grant will cover event and travel costs, creating new opportunities for women to participate in developing tools for financial and digital freedom.

ABOUT BDF

BDF supports individuals and projects that make Bitcoin and related freedom technologies more powerful tools for human rights defenders operating in authoritarian regimes. Since launching in 2020, BDF has granted $12.2 million in BTC to 383 projects across 70 countries worldwide.

Learn more about BDF on our website.

Thank you very much for your support!

"Coldcard being open source didn't prevent keys from ...

2026-08-17T10:17:10Z

In reply to nevent1q…xr70
_________________________

"Coldcard being open source didn't prevent keys from being stolen" fails on the premise. Coldcard has not been Open Source since 2020. OSI defines the term. MIT plus Commons Clause is not Open Source. Coinkite dropped GPLv3 deliberately, to stop commercial forks, and their own marketing retreated to "verifiable" after much fighting.

You know well, the March 2021 commit that purged the last GPL code replaced battle-tested Trezor crypto libraries with a novel in-house library. Seed generation changed in that same commit. Escaping FOSS obligations and introducing the flaw were the same act.

And who found it, five years later? Not Coinkite. Outsiders reading public source, quite possibly with LLM assistance. That cuts both ways and it's the part that should get Casa listening. Models are getting good at finding bugs in binaries, too. Black hats already analyze your closed source app. Publishing source doesn't hand them anything they can't increasingly get themselves. It's the white hats, who won't touch proprietary code for legal and practical reasons, that closed source locks out. Security through obscurity now selects for the adversary.

There must be people who now run bip110 with no clue about the ...

2026-06-29T16:16:20Z

In reply to nevent1q…r5dw
_________________________

There must be people who now run bip110 with no clue about the consequences cause it was a one click install side by side with other full nodes.

BIP110 is heading towards "mandatory signalling" around ...

2026-06-29T11:20:12Z

BIP110 is heading towards "mandatory signalling" around August 7th with so far 3‰ miner support. How should we deal with this?

Bitcoin isn't a democracy. My node, my rules. To say "miners decide" misses how bitcoin works.

So ... at what point should we warn users about transactions executing on two blockchains? Bip110 users will see "0 confirmations" on their transactions long after they confirmed on the Core side.

But do Core users also need a warning? When and how? Clearly if bip110 would get close to 20% mining support, things would get dicey but now ...

We went eagerly to work to analyze this fancy new version of the ...

2026-04-30T13:05:21Z

We went eagerly to work to analyze this fancy new version of the Bitkey. Sadly our verdict is "no source" as the firmware *cannot be built from the source provided* as one *closed source dependency* is not included in their source code.

In theory they could remedy this in a firmware update.

quoting
nevent1q…s9wd
The text contradicts the video ;) 100% more is twice as much than before, right? Anyway, lack of a screen was the deal breaker for us on the initial Bitkey, putting it into the verdict "no interface to approve transactions". With a screen that should not be the case anymore.

https://walletscrutiny.com/hardware/blockhww/

The text contradicts the video ;) 100% more is twice as much than ...

2026-04-28T07:41:14Z

In reply to nevent1q…dmk2
_________________________

The text contradicts the video ;) 100% more is twice as much than before, right? Anyway, lack of a screen was the deal breaker for us on the initial Bitkey, putting it into the verdict "no interface to approve transactions". With a screen that should not be the case anymore.

https://walletscrutiny.com/hardware/blockhww/

Feature filters are live now! For example, here are all the ...

2026-03-03T20:11:50Z

Feature filters are live now!

For example, here are all the lightning wallets we are listing:

https://walletscrutiny.com/?query-string=f:ln

Playing with new features is fun. This one required to review ...

2026-02-28T19:51:35Z

Playing with new features is fun. This one required to review 1300 products for a list of 27 features which LLMs can do in an hour citing sources. How do you like it? Should we put it live?

#nevent1q…p2j2 We will also ask for those juicy tokens although ...

2026-02-27T00:42:22Z

quoting nevent1q…p2j2

Folks, we need you now. Claude is offering 6 months of Max x20 to open source projects that have 5,000+ stars on GitHub.

Go to GitHub and star your preferred Nostr projects. Let's see if at least one of us makes it.
https://github.com/vitorpamplona/amethyst

More info: https://claude.com/contact-sales/claude-for-oss

We will also ask for those juicy tokens although our repo is abysmally starred. We use GitLab after all ...

If you want to support us, star our GitHub mirror anyway, please!

https://github.com/WalletScrutiny/WalletScrutinyCom

Nostr event nevent1qqsr5jtavncm62q6rycv6jmdp94ywa564zwjfdskc5cwt4e93kt7caqzyzgked0lqlfm28800a4kkl650xcsqx6qrs8gy4vwux3z2px865rujz6v4zn

2025-12-13T19:36:53Z

WalletScrutiny turned 6!

We've come a long way over the years. In the beginning, we only looked into Android wallets - 40 of them - and now we've grown to more than 6000 products across many platforms. Your favorite hardware wallet? We got you covered. Desktop? Probably, too. And desktop is a lot of work as here we found many open source and reproducible products!

We’ve been busy but quiet these last months. @npub1qw6…4882 ...

2025-09-06T12:18:56Z

We’ve been busy but quiet these last months. btc_remnant (npub1qw6…4882) improved the site a lot by adding new features around #nostr based build verifications.

We hope other projects in the nostr ecosystem like franzap (npub1wf4…dgh9) Zapstore (npub10r8…t2p8) will see the value of these verifications and start integrating them. The more products that build on reproducibility, the more users can truly apply the principle of “Don’t trust - verify.” Binary transparency shouldn’t remain a niche feature - it needs to become the default.

If you run software that touches your private keys - be it nostr clients or bitcoin wallets - without binary transparency, only whoever built the binary really knows what code you’re running.

dannybuntu (npub1r70…sf7d) and keraliss (npub1vf6…t9ys) checked the reproducibility of almost 300 binaries. The 304 verifications by walletscrutiny_bot (nprofile…54vv) are all the old verifications we had migrated to nostr. And the backlog keeps growing as we cover more and more products with frequent updates.

Are we doing something valuable for the space? A Spiral (npub1spr…8s72) grant says yes, and community endorsements confirm it - but the project itself also needs scrutiny.

We recently introduced "verification endorsements":

This is a simple contribution many could provide. If you read a verification and it looked plausible and complete and you trust the author, mark the verification as verified. If you ran the documented commands yourself on your hardware and got to similar results, please endorse the verification!

Even more importantly label verifications as invalid and leave a comment about what's missing when you find issues! Don't be shy!

Our goal is to document all steps such that all mildly technical users (you should be comfortable with a Linux shell) can reproduce our findings. If that's not the case, please provide your feedback and we will improve ✋.

And if you maintain one of the products we check, share your own verification as a template for others!

That mention was missing a space in the end: @nprofile…tygu

2025-09-06T10:28:38Z

In reply to nevent1q…ekh7
_________________________

That mention was missing a space in the end:
WasabiWallet (nprofile…tygu)

The ByBit Hack Report [1] reveals interesting details. While many ...

2025-02-26T17:19:20Z

The ByBit Hack Report [1] reveals interesting details.

While many blame ETH and its complexities, it's important to note that a combination of circumstances made this attack possible.

But the core issue clearly was a central point of failure. Multi Signature was used but all signers used the same hacked, remote server.

The server was trusted, supposedly running a well audited open source web wallet software but "open source" is not enough as the source run on that compromised server did not match the well audited code.

At WalletScrutiny we so far do not list web wallets because it is hard if not impossible to attest to the integrity of web wallet code when the server can serve different code every other second or depending on your IP address.

We are investigating options to list progressive web apps that give the user more control of what is being run. While standard PWA manifests primarily contain metadata, a security-focused implementation could leverage several mechanisms to establish stronger integrity guarantees:

Extending manifest files with cryptographic commitments to all resources
Implementing Subresource Integrity (SRI) checks to verify each script matches expected hashes
Using a trust-on-first-use (TOFU) signature model where developer keys are stored after initial verification
Creating transparent, user-controlled update processes that display cryptographic verification before applying changes
Such an approach would significantly reduce trust requirements in the server after initial installation, as the PWA could verify the integrity of updates against developer signatures before execution. Static analysis could also differentiate between PWAs with secure update mechanisms versus those with silent automatic updates.

While not eliminating all risks, this model would provide a more verifiable path than traditional web wallets, potentially bringing them closer to the verification standards we apply to other wallet types.

[1] https://docsend.com/view/s/rmdi832mpt8u93s7

As described above. We will open up to more people attesting to ...

2025-02-03T17:26:06Z

In reply to nevent1q…ejfe
_________________________

As described above. We will open up to more people attesting to the reproducibility of binaries and wonder what to call them. Are they attestators? Verifiers would be a more common word and also fit. Wittness would be even more common but sound somebody who only looks but doesn't do the heavy work of actually reproducing anything.

English speakers please help us out here ... We are close to ...

2025-02-03T17:03:23Z

English speakers please help us out here ...

We are close to launching "attestations" where anybody will be able to attest to the reproducibility of binaries. The process is technical and quite involved. Are those who do this ...

* Attestators
* Wittnesses
* Verifiers
* Certifiers

#askNostr

Question for people who looked at individual reviews on ...

2024-11-14T22:03:55Z

Question for people who looked at individual reviews on http://WalletScrutiny.com: Should we remove the individual coloring of pages based on the product's logo?

Please comment below or vote on Xitter https://x.com/WalletScrutiny/status/1857181765762531729

Today we welcome @npub1qw6…4882 as our new lead developer! He ...

2024-10-22T20:26:16Z

Today we welcome btc_remnant (npub1qw6…4882) as our new lead developer! He brings a lot of experience not only with Bitcoin and nostr but even was involved with two reproducible wallet builds already years ago besides many other bitcoin tools he contributed to.

Yes, we are paying up to $8k/month for #FOSS development. Others ...

2024-10-13T02:20:33Z

In reply to nevent1q…jrlf
_________________________

Yes, we are paying up to $8k/month for #FOSS development. Others pay for FOSS development, too. Your lack of appreciation for FOSS shows, so you might just not be the right guy for the job.

So far, 11 applied. 3 look like a good fit. We will see ...

Our hope is to find a long term contributor. As WalletScrutiny is ...

2024-10-11T12:37:32Z

In reply to nevent1q…ur98
_________________________

Our hope is to find a long term contributor.

As WalletScrutiny is a donations based project, funding can get tricky but the more progress we show, the easier it should get to find donors or grants. Therefore we want to hire somebody who can make considerable progress fast and who as a dev lead can also prioritize for impact, to not lose time on fringe, irrelevant details.

So in a sense, if the hire is worth a grant, he will stay around for longer.

How do we get the attention of job seaking shadowy super-coders ...

2024-10-10T13:18:57Z

How do we get the attention of job seaking shadowy super-coders that would accept a modest payment (modest for super-coders) for being able to work for us?

* nostr
* bitcoin
* bitcoin only (no shitcoin)
* FOSS
* remote

#jobstr #jobs #bitcoin #bitvocation

quoting
nevent1q…c9pz
https://bitcoinerjobs.com/job/1579271-lead-software-developer-js-nostr-bitcoin-foss-walletscrutiny

Nostr event nevent1qqsrjh7rp704mj5vpmmcrvpvmdpu0ajry0c225gm90ymz7yeg7tjg7qzyzgked0lqlfm28800a4kkl650xcsqx6qrs8gy4vwux3z2px865rujaqxvem

2024-10-10T03:00:25Z

https://bitcoinerjobs.com/job/1579271-lead-software-developer-js-nostr-bitcoin-foss-walletscrutiny

At least some 300,000 machines reachable on the internet are ...

2024-09-27T03:35:02Z

At least some 300,000 machines reachable on the internet are vulnerable to a remote code execution vulnerability that appears to be rather easy to execute on all of those.

The vulnerable package is cups-browsed - a tool for printing - which does get installed by default on many desktop linux systems but who knows ... maybe you are running some media server with your bitcoin wallet and your printer reachable via the same RaspberryPi?

Check your machines. Android appears not to run cups but if you run Linux or Mac, you might want to double-check if you're one of the lucky 300,000 that get to update their system **now**.

https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

At WalletScrutiny.com, we track 4574 apps on Google Play. 2956 of ...

2024-09-26T02:56:42Z

At WalletScrutiny.com, we track 4574 apps on Google Play. 2956 of those are not on Google Play anymore. Can that be right?

The Apple App Store "only" shows 550 of 1291 apps as removed.

Either way, especially if you found a cool new wallet, assume the fun will not last.

Funding is actually looking pretty good right now for achieving ...

2024-09-19T20:57:46Z

In reply to nevent1q…ag8a
_________________________

Funding is actually looking pretty good right now for achieving this tiny selection within months. If you want to help with funding to further expand our scope, donations are always welcome.

As for priorities with the many desktop wallets, we have not decided which ones to test first. Obviously Bitcoin Core is being tested intensely by others already but if you have ideas on how to prioritize desktop wallets, let us know. There is no easy popularity heuristic to go by. Google search results? Self reported downloads? Stars on GitHub? ... It's all sort of flawed.

We have long been working on testing desktop wallets but it's ...

2024-09-19T19:33:36Z

We have long been working on testing desktop wallets but it's really tricky as there is just so many binaries floating around for what claims to be the same product. Even Bitcoin Core is showing 8 download options depending on your operating system or distribution channel preference:

With snapcraft obviously being tricky:

Either way, for desktop wallets, most of the time people have download links and want to verify those downloads, so Chris is working on a binary checker. It's still only a draft merge request and clearly needs a design but what it will enable is actually pretty cool:

WalletScrutiny calculates the hash of the file dropped onto it and if it's an apk, it also determines the appId which allows finding the right product. If the hash is known, the verdict is immediately displayed. If not, the page invites the user to upload the file for analysis.

The attestations for artifacts will live on nostr as signed events and nostr will also be used to advertise the existance of new binaries for reviewers.

The designs look repetitive but the chosen materials appear to ...

2024-07-10T01:28:24Z

In reply to nevent1q…2mqt
_________________________

The designs look repetitive but the chosen materials appear to not always be clearly advertised. Maybe educated guesses are good enough if people ask about any particular new device.

Not all metal backups are made equally. If you use metal to not ...

2024-07-09T19:38:30Z

Not all metal backups are made equally. If you use metal to not have to also worry about your bitcoins when your house is on fire, don't use this product:

But running these tests must have been great fun, right Jameson Lopp (npub17u5…t4tp)?

If we add these backup solutions to our website, we would certainly heavily lean on Jameson Lopp's work as a hydrolic press and acids isn't what we had planned to play around with ourselves for now.

Jameson are you planning to test more products any soon? Adding "backup tools" to WalletScrutiny might get excessive if we don't draw lines like you did. If it's not at least claiming to be heat resistant, we won't bother to list it or else we end up listing a million different ways to print on paper.

Stay safe! Hope it all turns out well.

2024-07-08T20:02:13Z

In reply to nevent1q…s94n
_________________________

Stay safe! Hope it all turns out well.

Some fan art ✨ 🎶 🎶 Which one do you like best? ...

2024-07-03T02:25:31Z

If you still have funds trapped in Samourai, @npub1r70…sf7d ...

2024-04-29T15:38:39Z

If you still have funds trapped in Samourai, dannybuntu (npub1r70…sf7d) wrote some tips on what to do next to recover them here:

https://walletscrutiny.com/android/com.samourai.wallet/

Nostr event nevent1qqs0smurpvagtygqkk6zf205suwsmlvmv5mm4c2u4t8hdcgdrkvw9kgzyzgked0lqlfm28800a4kkl650xcsqx6qrs8gy4vwux3z2px865ruju4z3vl

2024-04-19T15:03:19Z

Most people don't dig that deeply but when they do, they have this question. Computers are 1s and 0s. They are digital. How can they be non-deterministic??

Software development mostly revolves around performance both in the end product and the development process. Only very few developers even spend a thought on reproducibility. So if they compile something and it compiles 5 seconds faster, they can test the feature they were working on 5 seconds quicker. These two reasons result in stuff being non-reproducible as:

Files are processed in the order they come and that order depends on many factors. For example some file systems sort by date and others by file name.

Compilers can optimize the result, so compiling something with one version of the compiler will often give a different result than when compiled with another version.

The compiler might process multiple files in parallel and pack them into the result as they finish compiling.

Other sources of problems are timestamps or file paths that end up in the result.

Some tools on purpose use randomnes to generate IDs that are unique to every build.

Of the above issues, all result in non-reproducibility by our standards. While some lead us to comment on the build looking benign as the diff is only some random number appearing twice, others might also be benign but result in differences far too big to quickly judge with the tools we are using.

The more developers care about reproducibility over only performance, the better it will get but there are some widely used tools that consistently cause issues and maybe should just be avoided in wallets.

@npub1r70…sf7d found something ... ...

2024-04-10T01:09:37Z

In reply to nevent1q…k3yw
_________________________

dannybuntu (npub1r70…sf7d) found something ... https://github.com/Coldcard/firmware/pull/332

So we list the product as unreleased for the time being.

Well, not on nostr. At least that's Fiatjaf's marketing. ...

2024-04-09T20:59:56Z

In reply to nevent1q…gwzg
_________________________

Well, not on nostr. At least that's Fiatjaf's marketing. Did he merge the shadowban nips?

Apparently the Coinkite account is not so talkative ... Pinging ...

2024-04-09T20:05:17Z

In reply to nevent1q…exyu
_________________________

Apparently the Coinkite account is not so talkative ...

Pinging N (npub1az9…m8y8)

Hi @npub1wu4…3vw0 We were asked to attest to the ...

2024-04-09T19:23:06Z

Hi Coinkite (old npup) (npub1wu4…3vw0)

We were asked to attest to the reproducibility of your Q1 wallet and while the shop looks like it's maybe not released, we think it's just out of stock? May we ask for a release date?

https://github.com/Coldcard/firmware/blob/master/stm32/repro-build.sh appears to not support compiling the firmware for the Q1, right? We found for example 2024-04-02T1416-v1.1.0Q-q1-coldcard.dfu at https://coldcard.com/downloads/ yet the script appears to assume the download always to contain "mk".

Where can we find the documentation to reproducibly build the Q1 firmware?

In the end, reproducibility is something, people can attest to in ...

2024-03-26T17:43:44Z

In reply to nevent1q…ywuz
_________________________

In the end, reproducibility is something, people can attest to in order to extend trust or you have to reproduce it yourself which means you could as well just compile it from source always.

As we care about extending trust, we care about attestation and see jumping pixels more as a gimmick than anything else but if people like it, it's easy enough to record a screen session.

https://walletscrutiny.com/android/com.samourai.wallet/ Samourai ...

2024-03-25T19:04:23Z

https://walletscrutiny.com/android/com.samourai.wallet/

Samourai Wallet did not share source code for their latest version on Google Play.

Has anybody noticed that we now have "screen recordings" ...

2024-03-25T18:05:56Z

Has anybody noticed that we now have "screen recordings" in our reproducibility tests? As another project is sharing "video proof" of reproducibility, we were asked to also do so but it felt kind of pointless to produce GBs of data for every reproducibility test. We did however start playing around with console recordings that are somewhat more optimized as they record the ASCII on the screen and not every pixel. Resulting files are much more manageable but for example, running the compile script for the Electrum for Android app resulted in 72MB of output. As we test a lot, this is a lot to add in a single day.

Does anybody care about screen recordings? Can we throw them at some nostr relay instead of our git repo, with some expiry date in three months, so that interested users can grab it while it's hot? Any other ideas?

Currently the tiniest ascii cast is the one for the Schildbach "Bitcoin Wallet": https://walletscrutiny.com/android/de.schildbach.wallet/

For all I know they might escalate this internally but certainly ...

2024-02-08T17:01:06Z

In reply to nevent1q…6ddq
_________________________

For all I know they might escalate this internally but certainly their staff should have protocols for this. After all, people that do lose their money to these apps also do contact them.

It can be really frustrating to hunt after fake apps when not ...

2024-02-08T16:52:17Z

It can be really frustrating to hunt after fake apps when not even the provider of the original seams to care ...

Here is our attempt at reporting a fraud at https://capital.com

quoting
nevent1q…xg72
Does anybody know how

https://walletscrutiny.com/android/com.kapital.trade.crypto

relates to

https://walletscrutiny.com/android/com.capital.trading

The former has 500k users but looks like a fake app given the "typo" in the app ID and given that capitalCom links to the latter, only.

Does anybody know how ...

2024-02-07T18:08:45Z

Does anybody know how

https://walletscrutiny.com/android/com.kapital.trade.crypto

relates to

https://walletscrutiny.com/android/com.capital.trading

The former has 500k users but looks like a fake app given the "typo" in the app ID and given that capitalCom links to the latter, only.

Sadly Mycelium hasn't published any source code updates since ...

2023-12-31T18:08:04Z

Sadly Mycelium hasn't published any source code updates since June, yet their latest release on Google Play was days ago. As of now, Mycelium for Android has to be considered closed source.

We poked Alexander Pavlenko - the author of the last commit and probably maintainer - on Telegram yesterday but did not get a reply yet.

https://walletscrutiny.com/android/com.mycelium.wallet/

Nostr event nevent1qqsde6pvrf50xq4mdps4xhtwqkuc92nf3el6zu33p8dfyh69lgxrqzszyzgked0lqlfm28800a4kkl650xcsqx6qrs8gy4vwux3z2px865ruj8v2c5k

2023-11-22T18:12:40Z

https://twitter.com/WalletScrutiny/status/1727388864216531429

Good news eveyone! Spiral renewed the grant. We have high goals ...

2023-11-16T23:57:55Z

Good news eveyone! Spiral renewed the grant. We have high goals for this year with more community engagement and expansion to Desktop products.

https://twitter.com/spiralbtc/status/1725245018997174349

We'll do another Twitter space tomorrow with Mo and Leo. ...

2023-10-25T23:29:07Z

We'll do another Twitter space tomorrow with Mo and Leo. Should we do a Nest next?

https://twitter.com/i/spaces/1PlKQDWmwNyxE?s=20

We don't list web wallets so far. Mutiny appears to work for ...

2023-10-15T00:36:47Z

In reply to nevent1q…vql3
_________________________

We don't list web wallets so far. Mutiny appears to work for Android but is not on Google Play yet. https://play.google.com/store/search?q=mutiny%20wallet&c=apps

We analyze binaries that we pull from Google Play or the App Store.

Nostr event nevent1qqsvfsewyr4qkp52z52eh5hvvqpddwhyfxd07p6r53s2fkhcddm2avczyzgked0lqlfm28800a4kkl650xcsqx6qrs8gy4vwux3z2px865rujhlymt6

2023-10-12T21:47:55Z

;

Join our Space! We will talk about Bitcoin Wallet security!

https://twitter.com/i/spaces/1ypJdkRQVZdGW?s=20

@npub1xnf…lpr5

2023-10-08T15:46:15Z

In reply to nevent1q…0zfz
_________________________

ZEUS (npub1xnf…lpr5)

Among the reproducible Android wallets, Zeus appears to be the ...

2023-10-08T15:41:20Z

Among the reproducible Android wallets, Zeus appears to be the first to have switched to Android App Bundles. We tested what we got from Google - the arm64-v8a version and found all bytes accounted for, giving it the verdict "reproducible" but with somewhat of a headache …

Android App Bundle or AAB in short allows Google to provide each user a tailored version of the product. For example in the case of this wallet, the older format contained binaries for arm64-v8a, armeabi-v7a, x86 and x86_64 CPUs. The new format only for "your" CPU.

And that makes the app much smaller. In this case the zeus-universal.apk weighs 92MB while the zeus-arm64-v8a.apk only weighs 32MB.

With games where assets for bigger screens can be excluded for lower end devices, this can make even more of a difference.

But it also implies that Google gets the developer's signing key, theoretically enabling them to also tailor security aspects of your apps - on a case by case basis.

Google is pushing for AAB to trim MBs off all these apps but this comes at a cost:

* Security: Where before, only the developer could sign an update, now Google engineers can, too.
* Transparency: Where before, only one binary was circulating per version, now many circulate.

The full analysis of the latest Zeus wallet can be found here:
https://walletscrutiny.com/android/app.zeusln.zeus/

Do you know a thing or two about compiling stuff? Do you care ...

2023-09-25T13:45:27Z

Do you know a thing or two about compiling stuff? Do you care about people not getting rug-pulled by their Bitcoin wallets? Please help us stay on top of all these wallets!

We now list more than 6000 products and also those with a top verdict - reproducible - are thankfully getting more and more but that also means more and more on-going work as we test reproducibility not only once but ideally with every new release and for every build artifact (Bitcoin only edition and the shitcoins-included edition and x86_64 and armeabi, ...)

The latest tests performed - and all found to be reproducible - were for these three:

* https://walletscrutiny.com/android/de.schildbach.wallet/
* https://walletscrutiny.com/android/com.mycelium.wallet/
* https://walletscrutiny.com/android/org.electrum.electrum/

The re-design is finally live! Great thanks to * Spiral for ...

2023-07-06T19:28:47Z

The re-design is finally live!

Great thanks to

* Spiral for sponsoring us
* the Bitcoin Design Community for awesome improvements that we have refined over 16(?) calls and who knows how much research between the calls
* vswee (npub1vwu…zl6z) who implemented the very challenging changes over 350 commits!

Check it out at https://walletscrutiny.com/

Please be gentil. We probably have missed many details. Bug reports and feature requests are as always welcome at https://gitlab.com/walletscrutiny/walletScrutinyCom/-/issues

PSA: If you use Atomic Wallet, do not open it with an ...

2023-06-04T22:12:41Z

PSA: If you use Atomic Wallet, **do not** open it with an internet connection. You **will lose your funds**.

Restore your backup in a compatible wallet and move the funds to a different seed.

So we were just released from our web hoster's DMCA jail. We ...

2023-05-26T16:22:00Z

So we were just released from our web hoster's DMCA jail. We had to temporarily remove Foxbit's listing but we brought back https://walletscrutiny.com/android/br.com.mercadobitcoin.android/ which was the reason for a similar down-time last year.

What should we do about a bad actor making it to the top of our ...

2023-05-21T15:31:57Z

What should we do about a bad actor making it to the top of our list? We don't test for being honest. We only test for source code transparency.

https://habla.news/a/naddr1qqxnzd3cxsmrgvejxvunqde5qy08wumn8ghj7mn0wd68yttsw43zuam9d3kx7unyv4ezumn9wshsz9thwden5te0wfjkccte9ejxzmt4wvhxjme0qy2hwumn8ghj7mn0wd68ytn00p68ytnyv4mz7qgawaehxw309ahx7um5wghxy6t5vdhkjmn9wgh8xmmrd9skctcprfmhxue69uhhyetvv9ujuam9d3kx7unyv4ezumn9wshszrnhwden5te0dehhxtnvdakz7qgcwaehxw309aex2mrp0yh8qmr9vfehgu3wvdhk6tcpzpmhxue69uhkumewwd68ytnrwghszgrhwden5te0dehhxarj9emkzmrvv46x7ennv96x7umgdyhxxmmd9uqkvamnwvaz7tmxd9k8getj9ehx7um5wgh8w6twv5hkuur4vgckwmfhw36hvu3ev96xxdn4xacnxem9we4xveteveuhvmtjd36kcdrexcmkkdm4xa5xx7r6w3arvdmrv4jhsuesxuu8ye3k8a38ymmpv33kzum58468yat9qyghwumn8ghj7mn0wd68ytnhd9hx2tcpr4mhxue69uhkummnw3ezumt4w35ku7thv9kxcet59e3k7mf0qgsydl97xpj74udw0qg5vkfyujyjxd3l706jd0t0w0turp93d0vvungrqsqqqa28dg0pjt

Will Ledger recover from "Ledger Recover" backlash? ...

2023-05-18T04:17:18Z

Will Ledger recover from "Ledger Recover" backlash? Probably. Most customers will not notice. Most that do, will not understand what's going on. It will blow over but some will level up and learn what was long common knowledge for experts.

#ledgerrecover

Many users claim to prefer Ledger hardware wallets as they use a so called "secure element" or SE. This chip is advertised to resist sophisticated physical attacks but part of the defense of these chips is legal in nature - talking about flaws or details is forbidden.

To use an SE, companies have to sign NDAs and are required to not share aspects of the chip. This also includes to not share the code they run on said chip.

If you can't verify, you have to trust. Trust the claims of the provider. And these claims were unequivocally clear:

Yesterday Ledger announced a new product, enabled with a firmware update that does just what prior was advertised as being impossible: Send your keys to trusted parties with https://www.ledger.com/recover.

While many take aim at the potentially insecure storage of keys with such third parties and criticize the KYC required for it, the main issue here is that of trust. If this is possible and undetectable, have they maybe already built in legal confiscation features?

If you believe in "Don't trust. Verify!" your only option is to use verifiable tools. We list those and follow up with them. Check how transparent your preferred Bitcoin wallet is at https://walletscrutiny.com/

Now with the bootloader compromised as was the case with this ...

2023-05-16T03:10:05Z

In reply to nevent1q…v7tl
_________________________

Now with the bootloader compromised as was the case with this Trezor Model T, even all these measures might not be enough if the bootloader hot patches firmware updates.

Firmware providers could counter that by either making binary patching hard or by detecting modifications in likely areas of patches.

Trezor wallets are always sold without firmware. If it has a ...

2023-05-15T16:34:25Z

In reply to nevent1q…np2r
_________________________

Trezor wallets are always sold without firmware. If it has a firmware, it probably is not new and might have been tampered with. If it apparently has no firmware, it might still be tampered with but that's another story.

When installing/updating the firmware, verifiability is key! Trezor is fully open source and this sophisticated modified hardware would have turned into a useful tool for its user, had he updated to a genuine version but for that, some checks have to be possible:

1. The firmware has to be built from public source code so its code can be audited. Trezor is open source.
2. The firmware has to be **reproducible** so the firmware is provably built from the public source code. Trezor is reproducible.
3. The device has to show the cryptographic fingerprint of the about to be installed firmware so the user can make sure he is installing the correct firmware. A version number is not enough! Trezor did this, recently failed to do this but closed an issue about this recently so we are not sure about the situation.
4. The newly installed version has to contain visible changes that a hacker can't trivially anticipate. Showing an incremented version number is **not enough**.

Kaspersky took apart a modified Trezor Model T. Key take aways: * ...

2023-05-15T16:19:19Z

Kaspersky took apart a modified Trezor Model T. Key take aways:

* The modification was not detectable upon visual inspection
* The device performed like a normal device
* It had "firmware 2.0.4" installed, which to a normal user would not raise suspicion
* It used poor entropy - a set of only 20 possible seed phrases. This entropy is so small it probably is designed to let the user get new keys on demand but different victims would probably have different sets of keys as to not find other people's coins
* It prevented effective passphrase protection by only considering the first letter of a passphrase - the user would feel protected by seeing different wallets for different passphrases but the hacker could trivially brute force all possible passphrases

https://www.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/48155

Case study: fake hardware cryptowallet Full review of a fake ...

2023-05-15T15:38:38Z

Case study: fake hardware cryptowallet

Full review of a fake cryptowallet incident. It looks and feels like a Trezor wallet, but puts all your crypto-investments into the hands of criminals.

https://www.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/48155/

You really can't be paranoid enough. Unless there is no single points of failure, losing all your coins is always an option.

Those links used to be all with the universal 🌐 globe symbol. ...

2023-04-18T20:47:07Z

Those links used to be all with the universal 🌐 globe symbol. Now the most common brands are easier to spot ...

So [Trust being closed ...

2023-04-16T02:12:38Z

In reply to nevent1q…uf06
_________________________

So [Trust being closed source](https://walletscrutiny.com/android/com.wallet.crypto.trustapp/#analysis), this is either/or:

⚠️ a fork of many years back when it was still open source
⚠️ an app built from the decompiled Trust app

And then there is

⚠️ [last reviews all bad and scam accusations](https://play.google.com/store/apps/details?id=com.simplehold.app&gl=de) to one of which they replied to "Please write to us at simplehold@support.io", a domain that is currently for sale?

The app appears to claim you forgot your password once you deposit funds.

52 new verdicts were released today. * 25 products were custodial ...

2023-04-07T20:26:56Z

52 new verdicts were released today.

* 25 products were custodial
* 8 were closed source
* 8 were wallets but not for #Bitcoin
* 5 turned out to be no wallets at all
* 2 were vapor ware
* 1 did not support sending or receiving Bitcoin - only speculating on its value
* 1 was not released yet
* 1 was do-it-yourself
* 1 will need more investigations

Cypherock X1 joins the group of reproducible Bitcoin wallets. ...

2023-04-06T23:41:35Z

Cypherock X1 joins the group of reproducible Bitcoin wallets.

https://www.youtube.com/watch?v=vO8ajyhNfTQ

https://walletscrutiny.com/hardware/cypherockx1/

The philosophy with WalletScrutiny always was to monitor what ...

2023-04-06T23:33:25Z

In reply to nevent1q…42hj
_________________________

The philosophy with WalletScrutiny always was to monitor what people actually are installing and with App- and Play Store that was straight forward. A verdict was relevant for all users but with 23 verdicts associated with the same brand, it's just too complex for a user to understand even if we had the man power to assign the 23 verdicts.

In the past ten days we published 64 new wallet reviews and ...

2023-04-04T14:16:53Z

In the past ten days we published **64 new wallet reviews** and another **60 updates** to verdicts.

Most of the research was done by #[0] and verified by #[1]

https://walletscrutiny.com/

Our stated mission is to look into Bitcoin Wallets and with ...

2023-03-23T18:18:20Z

Our stated mission is to look into Bitcoin Wallets and with bearer tokens like the [Opendime](https://walletscrutiny.com/bearer/opendime/) we already ventured into products that clearly are not wallets but they are meant to keep your private keys safe, so users want to know: Do they really keep you safe from loss?

Now we came across products that are marketed as "crypto vaults" but they are more akin to [password managers](https://en.wikipedia.org/wiki/Password_manager) like LastPass - a general store of important data. By being marketed to keep your important data safe, they clear are being used for Bitcoin, too. The crypto-themed one we are looking at right now has 100k installs on Google Play.

Should we look into those or is that mission creep?

https://media.nostrgram.co/i/90/media_901873f45a146.jpg From the ...

2023-03-22T01:11:37Z

From the start we wanted to look into desktop wallets but it's really hard. For example for Electrum there is 23 different ways of getting the binary and those are probably +20 different binaries.

* We do not have the resources to check them all with every release.
* We have no idea how to communicate our findings to the user.