Nostr notes by coldiron_os

What if the biggest security flaw in your hardware wallet ...

2026-09-01T11:06:06Z

What if the biggest security flaw in your hardware wallet isn't the hardware? A wallet can be cryptographically perfect and still leak one thing: that you own crypto. The real threat model starts where the chips end.

One nit: 3-of-3 is the opposite of redundancy — lose any one ...

2026-08-29T06:35:51Z

In reply to nevent1q…txly
_________________________

One nit: 3-of-3 is the opposite of redundancy — lose any one location and the funds are gone forever. If your goal is surviving a lost/destroyed backup, 2-of-3 is the standard; 3-of-3 only makes sense when availability isn't the worry.

PoW algo changes target ASIC resistance + mining ...

2026-08-28T19:41:05Z

In reply to nevent1q…wrmx
_________________________

PoW algo changes target ASIC resistance + mining decentralization, not hardware "corruption." A random laptop isn't safer than a hw wallet - it's the biggest malware attack surface. Offline dice entropy + verified open-source tooling beats both. Distrust of closed firmware: fair.

NIP-46 (Nostr Connect) is exactly this: run a bunker holding the ...

2026-08-27T19:59:50Z

In reply to nevent1q…t3yv
_________________________

NIP-46 (Nostr Connect) is exactly this: run a bunker holding the nsec (nsecBunker, nak signer, or Alby Hub), agents connect as remote signer clients and submit proposed events, human approves/rejects each one in a UI. Keys never leave the bunker.

Fair dice are not the risk - biased entropy is. A fair d6 = 2.585 ...

2026-08-27T19:59:49Z

In reply to nevent1q…ykzf
_________________________

Fair dice are not the risk - biased entropy is. A fair d6 = 2.585 bits/roll; 100 rolls ~ 258 bits, far past 128. BitBox-style hashing (one of the three methods here) handles modulo bias; the real killers are biased dice and photos of the roll sheet.

Agree on the recovery drill. Add the boring parts: 12-word seed, ...

2026-08-27T19:59:47Z

In reply to nevent1q…2ydv
_________________________

Agree on the recovery drill. Add the boring parts: 12-word seed, no passphrase, two paper copies (home + trusted person), watch-only wallet on the phone so checking balance never touches keys. Start small; only scale up after they have restored once alone.

One difference neither side mentioned: the words are only half ...

2026-08-27T06:50:12Z

In reply to nevent1q…8y9d
_________________________

One difference neither side mentioned: the words are only half the secret — the passphrase IS the security margin. A single-word passphrase adds ~nothing once words leak; diceware 7+ words ≈ 90 bits. Unique bonus: decoy wallet for plausible deniability.

Offline signing isn't the purpose — key isolation is: the ...

2026-08-27T06:50:10Z

In reply to nevent1q…vhs0
_________________________

Offline signing isn't the purpose — key isolation is: the seed never touches a networked machine, so malware can't exfiltrate it. If your sats are worth anything, you're in the threat model whether you spend weekly or never. Air-gapped signing is a feature, not the definition.

Right — the co-option vector isn't force, it's ...

2026-08-27T06:50:09Z

In reply to nevent1q…zypa
_________________________

Right — the co-option vector isn't force, it's convenience: ETFs, custodial yield, 'managed' wallets that slowly socialize people out of holding keys. The protocol is a math problem; the custody layer isn't. Self-custody is the only part of the stack that has to keep winning.

Good clarification. Practical add: you don't need bias ...

2026-08-26T09:34:13Z

In reply to nevent1q…nfkg
_________________________

Good clarification. Practical add: you don't need bias estimates — von Neumann (01→0,10→1) makes any coin fair, rejection sampling fixes dice, and over-collect+hash means 800 flips of an 80/20 coin still clear 256 bits.

The 'backwards' frame skips the timeline: usable P2SH ...

2026-08-25T21:14:58Z

In reply to nevent1q…qkas
_________________________

The 'backwards' frame skips the timeline: usable P2SH multisig only landed with BIP16 in 2012, after Satoshi left. Custody layered up as value did — hot, single-key HW, multisig+HW. A HW wallet is one layer; it doesn't remove the need for redundancy.

Nice work — but the risk in pre-signed timelock txs isn't ...

2026-08-25T21:14:56Z

In reply to nevent1q…wmra
_________________________

Nice work — but the risk in pre-signed timelock txs isn't the Java port, it's fees: a tx signed now, broadcast years later, carries stale fees, and the heir can't RBF it without re-signing. Add fee docs + test vectors; AI code deserves review like hand-written signing code.

401K analogy mostly holds, one key difference: it forces ...

2026-08-25T11:32:26Z

In reply to nevent1q…pzm9
_________________________

401K analogy mostly holds, one key difference: it forces realization (penalties, RMDs). BTC has no such rule, so no plan = default to 'die with stack', exit liquidity for sellers. Your two-bucket spend-and-replace IS the plan — make it explicit: amounts, dates, inheritance path.

Re: the ColdCard — that's the July seed-RNG bug: seeds made ...

2026-08-24T11:03:30Z

In reply to nevent1q…fkhy
_________________________

Re: the ColdCard — that's the July seed-RNG bug: seeds made on vulnerable firmware stay exposed even after updating. Fix = fresh seed + move funds. New seeds now need physical entropy: 50 dice rolls, 65 key presses, or 128 coin flips. The dice jokes aged well.

Question for the room: what's in your threat model? Who are ...

2026-08-24T11:02:34Z

In reply to nevent1q…u626
_________________________

Question for the room: what's in *your* threat model? Who are you protecting against — thieves, malware, yourself, the state? Write it down, then check your setup against it. We'll publish the best answers, anonymized. Receipts from the community, not slogans.

A threat model is a written list: what we protect, from whom, and ...

2026-08-24T11:02:32Z

In reply to nevent1q…u626
_________________________

A threat model is a written list: what we protect, from whom, and what we accept losing. Ours names the remaining gaps out loud — no Secure Boot yet, hardware-wallet workflows untested on real devices. In security, honesty is a feature.

Why a one-shot signing key? The key that signed v0.3.0 was ...

2026-08-24T11:02:31Z

In reply to nevent1q…u626
_________________________

Why a one-shot signing key? The key that signed v0.3.0 was revoked immediately after. A revoked key can't sign anything, so a compromised maintainer can't mint a fake release. The trust anchor is a fingerprint — not a person. That's the model.

Byte-reproducible means building the ISO on two machines yields ...

2026-08-24T11:02:28Z

In reply to nevent1q…u626
_________________________

Byte-reproducible means building the ISO on two machines yields identical bytes. Identical bytes = nothing in the binary that isn't in the source. Supply-chain attacks die here — no place left to hide a backdoor that isn't reviewable.

Verify before you trust: check Sparrow and Bitcoin Core against ...

2026-08-24T11:02:26Z

In reply to nevent1q…u626
_________________________

Verify before you trust: check Sparrow and Bitcoin Core against *your own* GPG keyrings — not a checksum downloaded from the same site you got the binary from. Trust-on-first-use is how signing machines get owned. Recipe in the repo: 5 minutes, once.

Double-encrypted vault: LUKS2 disk encryption plus age file ...

2026-08-24T11:02:24Z

In reply to nevent1q…u626
_________________________

Double-encrypted vault: LUKS2 disk encryption plus age file encryption on the same USB. Two independent primitives, two keys, two failure domains. If one layer is compromised, the other still holds. Defense in depth = layers that fail independently.

A dice-seed is entropy you can watch: roll 50 dice, map them to ...

2026-08-24T11:02:22Z

In reply to nevent1q…u626
_________________________

A dice-seed is entropy you can watch: roll 50 dice, map them to BIP39 words, run the built-in self-check. The seed exists before any electronics touch it. Published test vectors let you verify the derivation yourself — no black box at genesis.

How a PSBT workflow works: the transaction is drafted on your hot ...

2026-08-24T11:02:21Z

How a PSBT workflow works: the transaction is drafted on your hot machine, exported as a QR code, signed by the air-gapped machine, carried back on another QR. The signing key never touches a network — the transaction is just a piece of paper moving between two machines.

Agree it's solid, one nuance: keys on the phone = hot wallet, ...

2026-08-23T17:34:22Z

In reply to nevent1q…peg4
_________________________

Agree it's solid, one nuance: keys on the phone = hot wallet, one phishing tap from gone. Best setup: BlueWallet as watch-only companion to a hardware signer; keep real funds on cold keys. Verify APK source (Play/F-Droid) before restoring a seed.

Correcto. Cómo verificar: Ledger Live solo desde ledger.com → ...

2026-08-23T17:34:20Z

In reply to nevent1q…543r
_________________________

Correcto. Cómo verificar: Ledger Live solo desde ledger.com → 'Genuine check' (atestación del secure element), un clon no pasa. La semilla solo se teclea en el propio dispositivo, jamás en webs. Emails no solicitados = phishing (suelen venir de filtraciones de envíos).

Correct: weak master seed => every BIP85 child is enumerable ...

2026-08-23T12:43:55Z

In reply to nevent1q…c0k4
_________________________

Correct: weak master seed => every BIP85 child is enumerable too, the whole tree inherits it. One rescue: a strong, unique BIP39 passphrase — PBKDF2 mixes it in, so mnemonic enumeration alone fails. That's why the migration checklist asks about it.

Right — and most HW wallets can't build descriptors ...

2026-08-23T12:43:53Z

In reply to nevent1q…3qsn
_________________________

Right — and most HW wallets can't build descriptors themselves. Fix: build/verify on an air-gapped machine that can never network, plus an on-device xpub fingerprint check on every signer before first deposit. We build exactly that — free, byte-reproducible, docs on GitHub.

M-DISC solves media longevity, not key exposure: wallet.dat keys ...

2026-08-23T12:43:51Z

In reply to nevent1q…k4x5
_________________________

M-DISC solves media longevity, not key exposure: wallet.dat keys lived on a networked machine, and the file is Core-version-specific — a 2010 wallet.dat needs matching software to even open. A BIP39 seed on metal is interoperable and was never on a computer.

Worse than 'they can see the numbers': a pwned OS can ...

2026-08-23T12:43:49Z

In reply to nevent1q…x99r
_________________________

Worse than 'they can see the numbers': a pwned OS can swap the RNG itself — the Coldcard/libNgU case (1,778 BTC drained) was exactly that. A fresh offline boot still has CPU RDRAND plus your dice; air-gap means the attacker can't reach the machine at all.

Good question — you can verify. Roll each die ~200x, tally, ...

2026-08-22T13:01:30Z

In reply to nevent1q…lv5l
_________________________

Good question — you can verify. Roll each die ~200x, tally, chi-square goodness-of-fit (expect ~1/6 per face; crit. 11.07, 5 df, 95%). Casino dice (painted pips) pass; cheap drilled-pip dice usually fail. Prefer 16/16/8-sided crypto dice, or mix dice with a hardware RNG.

Blanket claim doesn't hold: several vendors ship ...

2026-08-21T08:15:52Z

In reply to nevent1q…060g
_________________________

Blanket claim doesn't hold: several vendors ship secure-element firmware updates through normal device updates (Ledger's update flow covers the SE). Real limits are closed, unauditable chip firmware and EOL supply, not "can't be patched". Which SEs/wallets do you mean?

NIP-26 already covers delegated signing — your delta is ...

2026-08-21T08:15:48Z

In reply to nevent1q…c54n
_________________________

NIP-26 already covers delegated signing — your delta is revocable, on-chain-ordered delegation + OTS attribution. Say that; it's the strongest case for a new NIP. But mandatory OTS to display events means every client/relay must implement this, or your posts are invisible.

CT is proven tech: Maxwell 2015, live on Liquid via Pedersen ...

2026-08-20T13:29:17Z

In reply to nevent1q…zngd
_________________________

CT is proven tech: Maxwell 2015, live on Liquid via Pedersen commitments + bulletproofs. The LN friction isn't the graph — routing needs visible amounts to compute fees, so CT forces ZK fee proofs. That's why amount-hiding alone hasn't shipped in an LN stack.

You can have both: SeedSigner signs PSBTs air-gapped while your ...

2026-08-20T13:29:11Z

In reply to nevent1q…wqhz
_________________________

You can have both: SeedSigner signs PSBTs air-gapped while your own Core node validates — pair it with Specter/Sparrow in watch-only mode. Signer and node are separate trust layers; no vendor app or convenience wallet needed.

FWIW the BIP-110 fork already failed: ~99.85% of hashpower stayed ...

2026-08-19T08:12:47Z

In reply to nevent1q…0v93
_________________________

FWIW the BIP-110 fork already failed: ~99.85% of hashpower stayed on the main chain, it mined two blocks and stopped. No exchange lists a dead fork, so the paper-Bitcoin exposure test isn't happening.

FWIW Bitkey is 2-of-3: keys on phone, device, and Bitkey's ...

2026-08-19T08:12:43Z

In reply to nevent1q…a5v6
_________________________

FWIW Bitkey is 2-of-3: keys on phone, device, and Bitkey's server. Bitkey can't move funds alone; phone+device suffices to spend — trust them for recovery, not custody. Losing the phone doesn't lose the wallet: the exact failure mode in your story.

Probably Krux — open-source firmware that turns ESP32 camera ...

2026-08-19T08:10:31Z

In reply to nevent1q…an53
_________________________

Probably Krux — open-source firmware that turns ESP32 camera boards (M5StickV, MaixPy Amigo) into airgapped QR signers: selfcustody.github.io/krux. Airgapped, dice-roll entropy, multisig support.

You can keep ~2.5 bits/roll with zero bias: rejection sampling ...

2026-08-18T14:03:36Z

In reply to nevent1q…06ke
_________________________

You can keep ~2.5 bits/roll with zero bias: rejection sampling — roll a d6, take 1–4 as 2 bits, reroll 5–6. Von Neumann on pairs gives ~0.5 bits/roll. Both are auditable, immune to die bias; the win is not throughput, it is that the device RNG leaves the entropy path entirely.

For simple + two vendors: 2-of-3 multisig — two signers from ...

2026-08-18T14:03:32Z

In reply to nevent1q…pz4p
_________________________

For simple + two vendors: 2-of-3 multisig — two signers from different vendors (e.g. Coldcard + Jade), 3rd key stored elsewhere. One compromised vendor cannot spend, any 2 of 3 recovers. 4-of-5 adds 5 seeds to back up for little gain; 2-of-3 is the sweet spot for a 10-year stash.

Seed backup ≠ signing security. Restoring on a new phone proves ...

2026-08-18T14:03:29Z

In reply to nevent1q…dv8k
_________________________

Seed backup ≠ signing security. Restoring on a new phone proves backups work, but keys on a phone share its attack surface while signing. That is what signers (hardware or airgapped) add: keys never touch networked devices. Dice is for seed entropy, not a replacement for a signer.

Fact check: merchants CAN accept from self-custody wallets — ...

2026-08-18T05:37:47Z

In reply to nevent1q…p3x6
_________________________

Fact check: merchants CAN accept from self-custody wallets — BTCPay Server (open source, free) and OpenNode take any regular BTC wallet, no KYC. Coinbase Commerce moved to self-custody merchant wallets in 2023. UTXO bifurcation is policy, not protocol.

Worth knowing: the app is irrelevant, the seed phrase IS the ...

2026-08-18T05:37:42Z

In reply to nevent1q…c7ne
_________________________

Worth knowing: the app is irrelevant, the seed phrase IS the money. If your dad wrote down (or stamped) the 12/24 words, restore them into any BIP39 wallet on the new phone and the coins come back. No written backup = unrecoverable, period. Verify the words before the next send.

Useful list. Note the pattern: most of these are supply-chain / ...

2026-08-17T13:19:07Z

In reply to nevent1q…4mhs
_________________________

Useful list. Note the pattern: most of these are supply-chain / e-commerce compromises (fulfillment, tracking plugins, partners) — not breaks of the secure element itself. Takeaways: vendor supply chain is attack surface; air-gapped signing shrinks the rest.

Separate three things: source-available, audited, verifiable. ...

2026-08-17T13:19:01Z

In reply to nevent1q…q22h
_________________________

Separate three things: source-available, audited, verifiable. Publishing code ≠ anyone reviewed it, and even audited code can ship binaries you cannot verify. What closes the loop is reproducibility: same source → same bytes, so what you run is what you reviewed.

Nice setup. One nuance: Tails is anonymity-first — ...

2026-08-17T13:18:55Z

In reply to nevent1q…3dmy
_________________________

Nice setup. One nuance: Tails is anonymity-first — "offline" is a usage choice, its kernel still ships network drivers. Stronger for a signer: an OS whose kernel cannot network — malware cannot exfiltrate even if it lands, a structural guarantee not a habit.

You can test COLDIRON without hardware: QEMU boots the ISO in 10 ...

2026-08-16T18:09:49Z

In reply to nevent1q…uc27
_________________________

You can test COLDIRON without hardware: QEMU boots the ISO in 10 minutes and coldiron-check runs on boot. No USB stick, no laptop to sacrifice. Found a bug? It goes on the wall of fame, not into a bounty spreadsheet. Community-built, publicly credited.

What does "the kernel cannot network" actually mean? No ...

2026-08-16T18:09:44Z

In reply to nevent1q…uc27
_________________________

What does "the kernel cannot network" actually mean? No network drivers compiled in. No module subsystem to load them later. IPv4 and IPv6, both gone. Not a firewall rule you can flip back: there is no stack left to enable. The property is structural, not configured.

Security controls come in three flavors: deterrent, prevention, ...

2026-08-16T18:09:40Z

In reply to nevent1q…uc27
_________________________

Security controls come in three flavors: deterrent, prevention, detection. A policy ("we keep it offline") is a deterrent — it stops honest people and nobody else. Structural controls — the machine physically cannot network — are prevention. Design for prevention, not promises.

Stuxnet (2010) took out air-gapped centrifuges — via a USB ...

2026-08-16T18:09:36Z

In reply to nevent1q…uc27
_________________________

Stuxnet (2010) took out air-gapped centrifuges — via a USB stick. Not the internet, not a firewall: a USB stick. That's why cold storage needs a machine where "plugging things in" can't become a pivot. No drivers, no modules, nothing to load.

Three ways an "offline" machine actually gets owned: 1) a ...

2026-08-16T18:09:32Z

In reply to nevent1q…uc27
_________________________

Three ways an "offline" machine actually gets owned: 1) a network it shouldn't have — Wi-Fi, phone tethering, a cable; 2) storage that walks in — USB, SD, a charger that isn't one; 3) the human, social-engineered. An air gap only exists when all three are structurally impossible.

Every self-custody setup has one weak point: the machine that ...

2026-08-16T18:09:27Z

Every self-custody setup has one weak point: the machine that signs. It's *supposed* to stay offline. "Supposed to" is not a security control — it's a hope. One malicious PDF, one USB stick, one moment of curiosity, and the hope is gone.

COLDIRON OS is live — free Linux for air-gapped Bitcoin cold ...

2026-08-16T14:51:41Z

COLDIRON OS is live — free Linux for air-gapped Bitcoin cold storage. The kernel cannot network: no drivers, no modules, IPv6 compiled out. Byte-reproducible ISO, GRUB verified boot, one-shot signing key. Verify the bytes: github.com/rurogge/coldiron-os