Great write up. My heart breaks for those who lost coins. I do see so many folks who didn’t lose coins completely ditching the Cold Card Q and other newer models. I was lucky enough to have generated an old school dice roll and make my seed phrase. The Cold Card Q is still a fantastic air gapped cold storage device. Some folks act like it can never be used ever again. What they did with this bug though can not go without some type of consequence (little to no sales or winding down of the company) trust has clearly been lost and it will be very interesting to see how Coin kite and Cold Card handle this going forward.
Um, which risk category does someone fall into if they used the full number of recommended dice rolls, as in the coldcard paranoid setup guide? I would argue 🟢 but I think it’s a weird omission in your post.
Most likely green, however out of an abundance of caution, I would personally say Medium. I did consider that case, but I also felt it was safer to lean cautious and put them in Medium (because it's hard to verify and folks may not remember if they did the full 100 rolls etc).
Dice rolls are precisely meant to deter this type of exploit, and in theory 50+ dice rolls gets you the 120+ bits of entropy you need -- In practice, it depends on how their code ingest and layer this entropy, so that's a question for someone who did read that part of the code since blind trust isn't an option there.
I referred to the coldcard paranoid setup guide where the dice rolls provide the full 256 bits of entropy. The procedure is deterministic so you can verify the way the coldcard is converting the rolls into seed words by doing a test run with a small readable script doing the same. Alternatively, you could just print BIP-39 word list and do the rolls->words conversion/lookup process with pen and paper. Read here
Thank you for the explanation! For your information, entering your seed phrase into another system, and especially a computer, is weaking your security model from hardware wallet to a software wallet level (you don't know whether Tails is trustable, entirely secure, same for the computer -- rootkits, hardware keyloggers and firmware backdoors exist)
In find Coldcard inviting users to do so is grossly neglectful, because they promote bad practices, and it shows a lack of understanding of self-custody security models.
From the guide it states multiple times not to use your seed on the Tails machine.
> Understanding that it is not advisable to use your actual dice rolls to validate the dice roll math is important. Meaning that a user only should enter a few dice rolls, write them down, and generate the list of 24 words and then verify that information. This is only to satisfy one's curiosity that the COLDCARD is producing a list of seed words that accurately represent the random dice rolls that the user entered. Once that curiosity has been satisfied, then the process should be repeated without typing the dice rolls into a computer. By typing into a computer the actual entropy used in calculating seed words that will be funded, the user risks potential loss of funds if the computer has been compromised. Additionally, this would diminish the benefits of having an air-gapped cold storage wallet since the computer is a network connected device. Typing seed words or dice rolls for an actual wallet that the user plans to fund is a bad idea. Simply use this information as a guide to understand that the COLDCARD is doing what it purports to be doing and then do the actual wallet creation with information that is never typed into the computer.
Again at the end of the section
> Once your curiosity has been satisfied that everything is working as expected and advertised, now repeat the process with you actual dice rolls on the COLDCARD and do not enter them into the computer when you're done.
They simply recommend Tails to make sure running of the verification with the test seed itself is not compromised, not to protect the actual seed material.
The place where I disagree with the guide is this:
> Meaning that a user only should enter a few dice rolls
“a few” rolls would mean the ColdCard could have different dice roll math for “a few test rolls” versus “50+” or some similar heuristic to try to differentiate potential test rolls from the final rolls, to attack people who think they are verifying the rolls, but too lazy to do lots of rolls. Such a trick would probably get discovered by the community. But I’d anyway recommend not being lazy and just following the same number of rolls for your verification run versus your final/real rolls.
I’d also recommend carefully reading rolls.py, considering the entropy could be truncated there in some stupid or nefarious way.
At some point it might be easier to just print BIP-39 word list and do fully paper & pen seed generation via dice rolls. But either method can work.
My bad, I went over quickly and made wrong assumptions. I agree with you that doing the seed phrase by hand would be faster though! That would be the logical way to get a 100% certainty about the entropy.
Ive never used one, so cannot speak to it directly. I mentioned it as one of the three, but I didn't want to take a position on hardware at this time as I can only speak to devices I have personally owned.
Definitely get yourself one. It will be the only thing you recommend to anyone after you see how easy AND secure it is! I will personally cover the cost for a Bitkey for you and every member on your team. Just email me at my subscriber email address or message me on Telegram. I’m an Orange member. I’ll send you the bitcoin to cover the cost for a Bitkey for you and one for every member of your team.
Hi James, great write up. Your most advanced option with 3 keys looks great. For the ledger there is an option to make it bit better by using the 25th passphrase option, if already have ledger then gives you option to have 24 seedphrase and 25th word in 2 seperate locations, I know not the best but good interim solution
Another good detail is for people to consider diversifying wallets and custodial arrangements. If you’re going to self-custody bitcoin it literally means being your own fully-reserved, non-fractional reserve bank. Take it as a really serious responsibility.
I use seed signer met the guy who invented this at Bitcoin conference in las Vegas he was employed by FBI and LA police department to break into seized phones and laptops. I believe his system although complicated is excellent
I'll reply with the same as noted in a similar question above:
Most likely green, however out of an abundance of caution, I would personally say Medium. I did consider that case, but I also felt it was safer to lean cautious and put them in Medium (because it's hard to verify and folks may not remember if they did the full 100 rolls etc).
Just to add: if you have a 2 of 3 multisig with one coldcard, you are fine. I would still move coins (as one key is compromised) but there is no rush. If you have 2 or 3 coldcards in that setup you obviously will be drained and have to move coins asap / now.
Also: do not save on fees. Try to get into the next block. Pay a little more. People will be getting their transactions sniped...
God, this sucks, I love(ed) the cold card devices.
Could you add a Chinese audio track to your YouTube videos? I noticed that audio tracks are available in 21 other languages, but Chinese isn’t one of them. I’m curious—why is there no Chinese audio track?
Great write up. My heart breaks for those who lost coins. I do see so many folks who didn’t lose coins completely ditching the Cold Card Q and other newer models. I was lucky enough to have generated an old school dice roll and make my seed phrase. The Cold Card Q is still a fantastic air gapped cold storage device. Some folks act like it can never be used ever again. What they did with this bug though can not go without some type of consequence (little to no sales or winding down of the company) trust has clearly been lost and it will be very interesting to see how Coin kite and Cold Card handle this going forward.
If CoinKite is going to survive, I can’t see them surviving without making everything 100% open source.
Um, which risk category does someone fall into if they used the full number of recommended dice rolls, as in the coldcard paranoid setup guide? I would argue 🟢 but I think it’s a weird omission in your post.
Most likely green, however out of an abundance of caution, I would personally say Medium. I did consider that case, but I also felt it was safer to lean cautious and put them in Medium (because it's hard to verify and folks may not remember if they did the full 100 rolls etc).
Dice rolls are precisely meant to deter this type of exploit, and in theory 50+ dice rolls gets you the 120+ bits of entropy you need -- In practice, it depends on how their code ingest and layer this entropy, so that's a question for someone who did read that part of the code since blind trust isn't an option there.
I referred to the coldcard paranoid setup guide where the dice rolls provide the full 256 bits of entropy. The procedure is deterministic so you can verify the way the coldcard is converting the rolls into seed words by doing a test run with a small readable script doing the same. Alternatively, you could just print BIP-39 word list and do the rolls->words conversion/lookup process with pen and paper. Read here
https://coldcard.com/docs/paranoid/#verifying-the-dice-roll-math and the following section on generating the seed.
Thank you for the explanation! For your information, entering your seed phrase into another system, and especially a computer, is weaking your security model from hardware wallet to a software wallet level (you don't know whether Tails is trustable, entirely secure, same for the computer -- rootkits, hardware keyloggers and firmware backdoors exist)
In find Coldcard inviting users to do so is grossly neglectful, because they promote bad practices, and it shows a lack of understanding of self-custody security models.
From the guide it states multiple times not to use your seed on the Tails machine.
> Understanding that it is not advisable to use your actual dice rolls to validate the dice roll math is important. Meaning that a user only should enter a few dice rolls, write them down, and generate the list of 24 words and then verify that information. This is only to satisfy one's curiosity that the COLDCARD is producing a list of seed words that accurately represent the random dice rolls that the user entered. Once that curiosity has been satisfied, then the process should be repeated without typing the dice rolls into a computer. By typing into a computer the actual entropy used in calculating seed words that will be funded, the user risks potential loss of funds if the computer has been compromised. Additionally, this would diminish the benefits of having an air-gapped cold storage wallet since the computer is a network connected device. Typing seed words or dice rolls for an actual wallet that the user plans to fund is a bad idea. Simply use this information as a guide to understand that the COLDCARD is doing what it purports to be doing and then do the actual wallet creation with information that is never typed into the computer.
Again at the end of the section
> Once your curiosity has been satisfied that everything is working as expected and advertised, now repeat the process with you actual dice rolls on the COLDCARD and do not enter them into the computer when you're done.
They simply recommend Tails to make sure running of the verification with the test seed itself is not compromised, not to protect the actual seed material.
The place where I disagree with the guide is this:
> Meaning that a user only should enter a few dice rolls
“a few” rolls would mean the ColdCard could have different dice roll math for “a few test rolls” versus “50+” or some similar heuristic to try to differentiate potential test rolls from the final rolls, to attack people who think they are verifying the rolls, but too lazy to do lots of rolls. Such a trick would probably get discovered by the community. But I’d anyway recommend not being lazy and just following the same number of rolls for your verification run versus your final/real rolls.
I’d also recommend carefully reading rolls.py, considering the entropy could be truncated there in some stupid or nefarious way.
At some point it might be easier to just print BIP-39 word list and do fully paper & pen seed generation via dice rolls. But either method can work.
My bad, I went over quickly and made wrong assumptions. I agree with you that doing the seed phrase by hand would be faster though! That would be the logical way to get a 100% certainty about the entropy.
Bitkey has BY FAR the fewest trade-offs of any secure setup. Just curious, why don’t you recommend Bitkey much more explicitly?
Ive never used one, so cannot speak to it directly. I mentioned it as one of the three, but I didn't want to take a position on hardware at this time as I can only speak to devices I have personally owned.
Definitely get yourself one. It will be the only thing you recommend to anyone after you see how easy AND secure it is! I will personally cover the cost for a Bitkey for you and every member on your team. Just email me at my subscriber email address or message me on Telegram. I’m an Orange member. I’ll send you the bitcoin to cover the cost for a Bitkey for you and one for every member of your team.
Appreciate you James!
Hi James, great write up. Your most advanced option with 3 keys looks great. For the ledger there is an option to make it bit better by using the 25th passphrase option, if already have ledger then gives you option to have 24 seedphrase and 25th word in 2 seperate locations, I know not the best but good interim solution
I do believe Ledger supports passphrases, yes.
James, you are truly remarkable. Thank you so much.
Thanks James.
Another good detail is for people to consider diversifying wallets and custodial arrangements. If you’re going to self-custody bitcoin it literally means being your own fully-reserved, non-fractional reserve bank. Take it as a really serious responsibility.
Bitcoiners will get through this.
I use seed signer met the guy who invented this at Bitcoin conference in las Vegas he was employed by FBI and LA police department to break into seized phones and laptops. I believe his system although complicated is excellent
I would love to hear your thoughts Cheers Terry
Seed Signer is very complicated for non technical fgolks. Certainly an option, but it is not for most people imho.
Medium risk- dice roll on a coldcard? My understanding was with a dice roll 100x your entropy is fine, even if on coldcard.
I'll reply with the same as noted in a similar question above:
Most likely green, however out of an abundance of caution, I would personally say Medium. I did consider that case, but I also felt it was safer to lean cautious and put them in Medium (because it's hard to verify and folks may not remember if they did the full 100 rolls etc).
https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/
Fewer than 50 rolls is a problem, 50-98 provides 128 bit security and >98 is 256 bit security
Appreciate your focused clear triage of how to handle this situation James. For anyone interested, Marty did a more technical dive into the issues (providing very similar assessment/advice). https://www.tftc.io/coldcard-rng-vulnerability-what-to-do-now?attribution_id=6a6d52f2706d5e00019f1032&attribution_type=post&ref=martys-bent-newsletter
IBIT it is …
Just to add: if you have a 2 of 3 multisig with one coldcard, you are fine. I would still move coins (as one key is compromised) but there is no rush. If you have 2 or 3 coldcards in that setup you obviously will be drained and have to move coins asap / now.
Also: do not save on fees. Try to get into the next block. Pay a little more. People will be getting their transactions sniped...
God, this sucks, I love(ed) the cold card devices.
Thanks James
Could you add a Chinese audio track to your YouTube videos? I noticed that audio tracks are available in 21 other languages, but Chinese isn’t one of them. I’m curious—why is there no Chinese audio track?
I believe it should render eventually. Youtube sometimes takes a little bit of time to work through all the languages, but it will appear eventually.