Co-Founder Coinkite. Programmer.
Canada
Joined October 2010
- Tweets17.5K
- Following406
- Followers3.6K
- Likes1.1K
DocHex retweeted
even if we all get our dicks ripped off by robots like fuckin honeysuckles, how crazy is it that we get to live through it. there were like 1k year stretches where mfs just started fires and gathered shit and then died. and here we are like the white trash jetsons.
DocHex retweeted
Happy 18yrs #BitcoinWhitePaperDay 📃
For the next 24hrs enjoy 15-20% off many products of our store including #COLDCARD, #BLOCKCLOCK, #SEEDPLATE and #TAPSIGNER
store.coinkite.com/store
DocHex retweeted
A quick primer on #Bitcoin multisig:
Multisig allows you to take custody of your BTC in a way that eliminates any single point of failure.
With multisig, you will not lose your BTC if you lose a key, or if your house is broken into, catches fire, or floods.
The most common type of multisig setup is a 2-of-3, meaning 2 out of 3 keys (hardware wallets) are required to sign a transaction to move/spend the BTC.
With a multisig setup, you need to keep track of your keys and a descriptor file.
Keys:
These are typically hardware wallets that come with a paper backup for the seed phrase.
With a 2-of-3 setup, you can lose one of the keys and still be safe.
Best practices are to (1) store all 3 keys in separate geographic locations, (2) use a different hardware vendor for each key, and (3) back up each hardware wallet's seed phrase on steel instead of just paper.
Descriptor file:
This is essentially a backup of the multisig wallet configuration.
The descriptor file should be saved securely and/or printed out (as a QR code).
If an attacker gains access to the descriptor file, they can recreate the multisig wallet and view the BTC balance, but they can't move the funds unless they actually have access to at least 2 of the keys.
If the descriptor file is lost, it can be restored, but it requires gathering all 3 keys to recreate it.
DocHex retweeted
COLDCARD is a Bitcoin-only signing device. It does not require a COLDCARD account or mandatory companion app. Pair it with compatible wallet software and keep the signing key offline.
coldcard.com/mk5
DocHex retweeted
My top three HWS in order, explained. I intentionally left out DIY to keep this simple so the DIY people don't need to come at me but I respect you 👍
1. COLDCARD Q @Coinkite - My prized possession. I play with the Q all the time, becoming more obsessed as time goes on. The Q immediately makes most other hardware irrelevant IMO considering all the features and functionality, especially not requiring a companion app for initial setup. There really is something special about the full QWERTY keyboard... I have never regretted buying a CC and features are still being added 🐦🔥
2. Frostsnap @FrostsnapTech - By far the best multi sig option there is, as SIMPLE as it gets. Perfect when you don't only have yourself to think about as long as they are geographically distributed properly. These devices give me the same excitement as the Q even though I use them much less. You don't have to worry about internal batteries. They appear as single sig regardless of how many are used. The setup, signing and restoration are magical. Seriously love these things... ❄️
3. Blockstream Jade Plus @BlockstreamJade - I gave Blockstream a hard time for months after the release of the Jade Plus because of my issues with the camera but that was eventually fixed after 2 or 3 firmware updates. The Jade does not actually force you to use an app although most people are probably better off hosting their own oracle when they can for better reliability. I enjoy the simple, small, lightweight form factor while still incorporating some features like a passphrase, BIP 85, OTP, and stateless which most people don't realize is an option. I do occasionally use liquid too so it's great for that. The oracle is not perfect but I respect @Blockstream for doing something different. The alternative theme options scores the Jade some Aura points. I do feel bad for attacking Blockstream so much in the past so hopefully they will appreciate it still being in my top 3 😇
DocHex retweeted
@PremiumBusiness having issues with access to premium business support, please DM back.
DocHex retweeted
“Security is like Tetris: Your successes disappear but your failures pile up.” — Mikko Hyppönen
DocHex retweeted
The fun fact about the eMudhra certificate leak is that the numbers were so low that only an AI or a flawed/test script would have found them. No sane human would have thought that a fellow human could have done something that stupid.
DocHex retweeted
Anthropic says one of its internal Claude models identified how the seeds for NIST's ECDSA elliptic curves were generated.
→ The seeds, supplied by the NSA without explanation in the 1990s, had long prompted suspicions of a backdoor
→ Anthropic says the seeds were produced by the lrand48 random number generator, seeded with timestamps from 1997 and 1998
→ The company says the finding is not a cryptographic break or weakness in the curves
→ It published code to reproduce the results, and some seeds and base points remain unexplained
Source: anthropic.com/research/ecdsa…
DocHex retweeted
First they came for the software engineers, I said nothing for I was not a software engineer.
Then they came for the mathematicians, I said nothing for I was not a mathematician.
Then they came for the product managers and I said "make sure you get all the product managers"
DocHex retweeted
Which manufacturer can you truly trust 100%?
Coldcard had a real multi-year RNG coding error that got exploited. It was found, fixed, and they added mandatory user entropy (dice rolls) so the same class of failure is impossible.
Ledger is currently dealing with physical implants in reseller units that read seeds off the screen and pass Genuine Check—harder to spot without opening the device. Jade had its own firmware issues; Liquid (same org) lost ~4k BTC to a software cache bug. Older Trezor One has long-known physical extraction paths.
Every major wallet has had problems. Coldcard just gets the loudest dumping while offering the clearest path to user-controlled entropy and the most obvious tamper evidence.
Find, fix, move on.
DocHex retweeted
We know exactly what the Coldcard problem was: a firmware issue that was identified, publicly documented, and fixed. Current recommended firmware routes seed generation to the hardware RNG, includes boot-time checks that fail closed if the path is wrong, and requires additional user entropy for new seeds. Independent reviews and device tests have confirmed the fix. Updating does not repair old seeds generated on vulnerable firmware—those still need migration.
A known, fixed firmware bug is also an infinitely easier problem to address than an undetected supply-chain implant of malicious hardware, which is far harder to discover and remediate.
Coldcard was ahead of its time in offering a clear case that lets anyone examine the hardware without needing to disassemble it. That transparency is useful for checking that the expected components are present and that nothing has been physically swapped or added.
