Kyrian Alex on device and software trust
Qualified agreement, with continuing hardware, OS and seed-generation risks.
One limitation I spent quite a bit of time on while writing on @Cointelegraph's last self-custody report, was was device trust.
Can we build trustable hardware?
Hardware wallets are designed to reduce the amount of trust you place in a connected computer, but they do not remove trust completely. You still have to trust that the physical device you received was manufactured, assembled and delivered as intended.
As we have now seen with the recent developments around Ledger wallets, that is a very hard problem to deal with. For softwares, it can be open-sourced, independently compiled and checked against reproducible builds. For hardwares, even when the design is public, most users cannot independently verify that the secure element, PCB and other components inside the device in their hands actually match that design.
Now, i agree with what @Ssaasquatch has written here. But i'm still worried because it also draws my attention to the Coldcard incident that happened some months back.
Affected Coldcard firmware was supposed to use a hardware true random number generator to create wallet entropy. Instead, because of a firmware error, seed generation could fall back to a deterministic software PRNG seeded from a much smaller set of values. The resulting 24 words looked perfectly normal, but the randomness underneath them was weaker than users believed. Attackers could generate candidate seeds elsewhere and compare the resulting addresses with the public blockchain.
This now changes how I think about this "people should simply move their crypto to a dedicated offline iPhone." An iPhone has an excellent security architecture, but using one does not eliminate the trust problem. You now have to trust Apple’s hardware and operating system, and also have to trust the wallet software to use those security primitives correctly when it creates your seed.
Remember when Ledger’s Donjon found that an early version of the Trust Wallet browser extension used a non-cryptographic Mersenne Twister implementation for wallet generation? The effective entropy was only 32 bits. A wallet could look completely normal while its possible seed space was small enough to enumerate.
There is no point at which trust simply disappears. You choose your risks, then try to make that trust as narrow and verifiable as possible.
Page 15: s3.cointelegraph.com/reports/the-fu…