pull down to refresh

203 sats \ 5 replies \ @optimism 30 Jul \ parent \ on: User reports their coldcard wallet being drained on Reddit bitcoin

Doesn't matter. Everyone with a Claude subscription can reproduce it now. Move funds.

write
compose
147 sats \ 4 replies \ @028559d218 30 Jul

Just to be clear, if a user 'mixed in' 100 dice rolls into the coldcard's RNG... they're OK right?

I don't use single-sig for much just a couple sats but I'm not in the position to move them lol

reply
274 sats \ 0 replies \ @optimism 31 Jul

100 dice rolls is about 258 bits of entropy, so yes. I checked how it's applied and that looks ok (it does a stream of ascii 1-6 to update() through sha256, one byte of ~2.6 bits entropy each roll)

reply
22 sats \ 2 replies \ @Artilektt 30 Jul

That's what I'm hearing yes that's safe...if you rolled enough and/or had a strong passphrase you are okay.

reply
126 sats \ 1 reply \ @KiwiBitcoinGuide 31 Jul

maybe so, but jeez. do you stay with any coldcard after this, if it's true that it's a device vulnerability. or is any RNG at risk? i remember how "safe" i felt after learning how big a 256 bit number was, hope that's still the case.

reply
134 sats \ 0 replies \ @optimism 31 Jul

This was a firmware vulnerability, not hardware. Using the dice and the BIP-39 passphrase isn't a luxury. RNGs are often weak, also - and especially - the on-chip hardware ones on small devices.

A good set of dice always beats a hardware RNG, unless maybe when you've got a SiPM.

reply