uncleJim21

You're not gonna harvest enough energy to transmit over LTE. I actually had a patent in energy harvesting. It's good for much lower power operations.
My design here killshots the capacitor charge strategy. It's not difficult you just need an OK integrator circuit and good param selection.
#nevent1q…v39n

2026-10-14 04:38:52 UTC

- reply

One risk is routing around the shunt (current sensor) but what I'd do is wall off all conductors upstream of the shunt and put a via right underneath it so you'd have a hell of a time.
Some craftsmen might get around it but it could turn it into a multi day project + tons of wasted time and burned thru units.

2026-10-14 04:30:14 UTC

- reply

You could make the device have a cryptographic handshake + heartbeat to make it near impossible to fake. Cryptographically bound at manufacture. If its canary goes down all bets off.

2026-10-14 04:23:22 UTC

- reply

Maybe but you could put in some neat tricks to brick the device if that's tried. I'll have to think on that. You could also make it a MEMs or a specialized IC that's part of an inline (high side current) circuit that would brick the device if removed or altered. The reason this attack could work is because STMs are so common they're like the Smiths of electronics.
This is my working design. I would also go ape shit and try to minimize power consumption of the device even if it means making you wait 10s instead of 3s for it to do a cryptographic operation. Makes it easier to detect fuckery.
Channel A detects instantaneous power if they're just total hogs and go for it (RF is incredibly peaky)
Channel B mitigates risk of them charging up a capacitor or some other energy storage and trying to surreptitiously charge up for the Big Transmit.
https://npub1g5642xjqyudstx4e9dc702m7suqqvx3djxcdyre38muz7pfwkzzsye9lcr.blossom.band/a99724d639cb33fe367af52f80468796328985279d41e608a1822cdf6e165257.jpg

2026-10-14 04:12:49 UTC

- reply

A Joule thief is a specific inductive boost-converter topology, typically using a coupled inductor. Battery imposes the same space/weight costs. That seems unnecessarily complicated for this application. But I'll steelman your argument as "some means of surreptitiously storing energy."
You can design a two-channel current detector. One channel measures near-instantaneous current; the other integrates excess current over a defined window to detect cumulative energy consumption.
A capacitor can conceal transmission peaks, but it can't conceal the energy needed to recharge it. The relevant question is whether that additional consumption falls within the device's normal power variability and the detector's sensitivity. Given control of the electronic design you could intentionally lower the power consumption of the legitimate assembly to make such detection even easier.

2026-10-14 03:48:22 UTC

https://blossom.primal.net/bb510bf3363da692870a266ed59e9c1c30fd51b7764c72878e7aaf2bd319a9f0.png
#nevent1q…r5ml

2026-10-14 03:32:44 UTC

- reply

Right. That was in a thread I found where Trezor was responding directly to this article and the researcher (Joe Grand). This looks like a story recirculating from 2023. I think Trezor is saying they haven't seen funds stolen that way.
FWIW it looks like an old story recirculating. My key takeaways:
- Hardware should be bought directly from them
- Tamper evident tape should be on device
- Upon first initializiation a firmware update from Trezor should flash -> bootloader verifies it was signed by Trezor. This one seems like it's new after the 2023 issue
No measure by itself is exhaustive. But especially the last bullet point blunts this threat vector (replaced micro, exploited firmware) .

2026-10-14 03:16:41 UTC

- reply

https://blossom.primal.net/29a078cdce25c87799e79c9295747ea8dc5a42987bc900dc6bb674309e125746.png

2026-10-14 03:13:51 UTC

- reply

I guess this is the tell
https://blossom.primal.net/48da44aab670fa86c399b7c00e81ce229fa79e7ab04e5d58967290f44dc6d1ca.jpg

2026-10-14 03:11:23 UTC

- reply

I am hesitant to take a dremel to it for these reasons:
1. This exploit simply replaces the original micro with a new one. With good craftsmanship (the same kind that would make enclosure manipulation undetectable) you wouldn't notice anything. So it wouldn't actually prove anything if you inspect visually by looking inside.
2. The way the enclosure is designed is either with one piece plastic or an aluminum backplate which appears to be designed not to be opened.
So the attackers would have to manufacture the whole imposter device from scratch. Possible but lower risk.
https://blossom.primal.net/e31912edd7c3f2e5d5142e2e3b72234736aa4d79977ef8d1d334456dc0cfc127.png

2026-10-14 02:51:33 UTC

- reply

which model did you have and how did you go about opening it?

2026-10-14 02:48:22 UTC

- reply

I don't wanna sound like a piker but my research shows that newer models like Safe 3 and Safe 5 are designed such that they can't be opened without being tamper evident. It comes with tamper evident tape on the seam and an aluminum backplate.
Not as ideal as the fully inspectable case. Imo Biggest risk seems to be if you bought from reseller with the ability to manufacture from scratch.

2026-10-14 02:30:14 UTC

- reply

Gresham's Law is powerful.

2026-10-14 02:19:42 UTC

- reply

It looks like the micro just fakes entropy and produces pregenerated seeds
Trezor should publish a tool that checks your pubkey to see if you're a victim.

2026-10-14 02:12:55 UTC

Hardware manufacturers should start detecting out of spec power consumption and treating that the same way you'd treat out of spec firmware/cryptographic checks.
This can be accomplished with an assembly that's like $0.10. Hire me. I can do it in my sleep.

2026-10-14 01:21:21 UTC

- reply

Scientists and doctors.

2026-10-14 01:03:16 UTC

- reply

I wonder if there's cryptographic wizardry someone could do (a la shielded bitcoin) that can give you best of both worlds in a multisig.

2026-10-14 00:57:57 UTC

- reply

The context is that if you never spend from a multisig, the attacker can never steal your funds because he doesn't have the requisite pubkeys to construct a transaction, even with 2 out of 3 keys for example in a multisig quorum.
The downside is, you don't know if you really set your setup correctly so you are (in my opinion) at a minimum at risk of being undertrained on how to shoot your monetary gun and at worst footgunning yourself with significant funds.

2026-10-13 19:55:52 UTC

- reply

The concentration factor is stricyly worse. Topologically they are the same so the same principles apply. Do you think it makes TOR non private?

2026-10-13 13:34:06 UTC

- reply

Specious argument. TOR is way more centralized. Are you suggesting it is "not private"? Of course not.

2026-10-11 14:29:26 UTC

- reply

No roadrunner icon??
Jk congrats guys
https://blossom.primal.net/fe8abf1c91543ef7ea9317be09cab9379114122b941728ff9815fb79eae77e87.png

2026-10-09 23:21:34 UTC

#coldkite trying to dunk on ledger right now 🤨
https://blossom.primal.net/fe57c7e21cd53aabc8599e3a08e32d0ca47ac825ddcfa8de4544796977c25e35.jpg

2026-10-09 03:27:58 UTC

- reply

ok maybe there's a distinction where im talking about athletics and you have a broad definition of sports
I like competition of many different flavors. I especially like ATHLETICS because they impose a cost of physical pain just to participate. It's like proof of work to me.

2026-10-09 02:08:24 UTC

- reply

Ok I will expend effort to be open minded and nice. I confess that esports sounds fake to me.
Explain to me what exactly it is and why it belongs in the same category as sports.

2026-10-08 18:34:48 UTC

- reply

The sky is falling oh nos

2026-10-08 18:33:01 UTC

Babe wake up, the Ivy League leftoids are unintentionally based now.
https://blossom.primal.net/b5a8b09bc353e11e4ca8d0264190bed5eab52975ec112ddcb8e61985654dbbc3.png

2026-10-08 15:03:52 UTC

Does anyone here cover/follow/discuss sports on nostr? Or is everyone here a resentful nerd killjoy? #asknostr
I love sport as a study of excellence and fortitude. The same way you would enjoy a well played chess match. Over investing emotionally is lame but imo so is writing it off entirely.

2026-10-03 14:51:09 UTC

- reply

He also commented publicly "scratched that itch".
Deeply anti social behavior imo. It could be a psychological disorder or it could be garden variety "revenge of the nerd" syndrome where he feels aggrieved the world does not award him what he is due for his "genius".
Plaintiff counsel needs to take notes and pursue aggressively.

2026-10-02 21:30:59 UTC

Ive been covertly buying coffee with Bitcoin because im pretty sure these leftoids would crash out if they knew.
Square did such a good job they dont even notice! Good tech is like good plastic surgery!

2026-07-14 04:18:57 UTC

It would be funny if the internet just crowdfunded like 30 PIs to just follow around the leadership of Flock Cameras all the time and just report their whereabouts publicly online. Built dossiers etc, ridicule them. Post youtube docs. Give them a taste of their own medicine.
You could probably get the funding just from crowdsourcing.

2026-03-31 14:30:26 UTC

Something I would watch the shit out of: an influencer going around doing a Diners, Drive-Ins, and Dives experience with Square merchants accepting #bitcoin
Who's gonna do it? @nprofile…yza6 @nprofile…fw7u ?