Comment on Is the blockchain an interesting innovation, aside from cryptocurrencies ?
dragontamer@lemmy.world 1 year agoYou’re saying a lot of words and not addressing the hardware cryptocoin wallet problem I outlined above.
Lets focus on that. How do you know that a hardware cryptocoin wallet truly emits random numbers that aren’t being hacked? The trust problem in this cryptocoin world is horribly, horribly unsolved despite 15+ years.
That’s why these scams keep coming up. Because the “oh just trust the cryptocoin” approach doesn’t work. You need to think from the perspective of a security researcher.
manitcor@lemmy.intai.tech 1 year ago
you are talking to someone whos been doing cryptography since the 90s, the answer hasn’t changed since then, you cant. the ONLY was you can be sure is with old school means or controlling your own lithography system.
most people just pick what level of trust/control/effort they are most comfortable with and go with that. the more your life ends up under these keys the more youll want to move to physical storage, multiple cold wallets, etc etc.
This usability nightmare is part of whats hurt crypto’s adoption imo.
Why are insecure devices allowed to be sold? I don’t know, why do we let comcast sell routers with known firmware vulnerabilities that gets a large chunk of them infected with malware? Why do we only deal with dangerous things after they become dangerous and hurt people, esp when the danger is so damn obvious? I don’t know.
Is there a hardware wallet I like that I believe is secure? No
Do i use them? Well of course, insurance companies love them…sigh.
Do I use them for my personal stuff? No, the vast majority of my holdings are stored in physical cold wallets.
dragontamer@lemmy.world 1 year ago
So we can’t trust hardware wallets then. Isn’t that… a problem? Something that needs to be solved?
This is pretty fundamental to the entirety of blockchain. If we can’t trust that Alice is truly Alice, then where the hell is everything else built on top of this crap?
Why do you trust that cold wallet? Are you sure they didn’t leak the key somehow? We’ve already established that there’s no trust or reason to trust them.
manitcor@lemmy.intai.tech 1 year ago
yup, huge one, something I have sat across the table from the engineers of some of the leading hardware wallet companies and asking them to address. so far what I see are a bunch of companies lining up to say “trust me bro”, I look forward to better options though I suspect that no matter how you cut it, due to people wanting convince it will still be you trusting someone, its just a question of how tight your grip on thier throat is. or you go techno-hermit and build your own kit if you really need something digital.
Its a physical set of steel discs with the key encoded on them, locked in a safe with a copy locked in an off-location safe. they leak about as much as one might expect things in your safe might leak. do you control these places? I often think about systems like this looking top provide tiers of control and ownership, you own your accounts legally, physically AND technically. a data breech at a bank using this system drains only the banks accounts, yours are fine (assuming a correct fail-safe desgin)
You should get on that, I’m sure it will work really well, you realize there have been people working on satoshi’s cold wallets for over a decade? When this cryptography breaks it will be an advance in quantum tech and we will all be boned.
Wow, a band of rng guessing thieves only targeting wallets that have been lost by those who would reasonably believe they forgot or lost access to thier key, this sounds like a script hollywood will need in its new AI future!
dragontamer@lemmy.world 1 year ago
hmac(passphrase, “one”) -> seed used to create the private key.
Its so god damn simple man. Passphrase is the key. Standardize the solution so that when Hmac(passphrase, ‘one’) emits the same private key on two separate devices, we know that their code is legitimate. Run tests on commercial solutions to make sure they emit the standard answer to a set of publicly known private-keys (as well as a few personal tests to ensure it works on your end) and bam, problem solved.
You’re telling me that all the best cryptocoin wallet peeps can’t come up with a college-textbook answer like that?