2026-08-12T20:57:33Z https://njump.cloud.vinney.xyz jimbocoin https://njump.cloud.vinney.xyz/npub1v9qy0ry6uyh36z65pe790qrxfye84ydsgzc877armmwr2l9tpkjsdx9q3h https://pbs.twimg.com/profile_images/1363154381454127107/EBqT-12s_400x400.jpg https://pbs.twimg.com/profile_images/1363154381454127107/EBqT-12s_400x400.jpg https://njump.cloud.vinney.xyz/nevent1qqs2pc3zzn0907rngqqz9vkzm0wc5auvyj6eme98z5wl5tqa4z48ptczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62qj0n6n In reply to <a href='/nevent1qqsggqrgkuxwfzz67kwdpd5m0m7fne062njkx592t9g99gzyw74lcugxfjw0l'>nevent1q…jw0l</a><br/>_________________________<br/><br/> <img src="https://image.nostr.build/add23aa53901ca2845d21682cde8cfdd22bdafec253f6e2761ff33b26e037139.jpg"> 2026-08-17T14:10:38Z https://njump.cloud.vinney.xyz/nevent1qqs2rzmclcyvscpmymaj036zfedtyqql9m72qxw9wypyzr6jcm84e4qzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62ch252k In reply to <a href='/nevent1qqs0x8m8r5n9runvekpyl7lv4xe4gm5mc04r44gynyp3f7r8ml2858spz3mhxue69uhhyetvv9ujuerpd46hxtnfduuj7x30'>nevent1q…7x30</a><br/>_________________________<br/><br/>My argument was that 2-of-2 with one software seed (the coordinator) and one hardware was better than just single-sig on hardware.<br/><br/>I agree with you that 2-of-3, 3-of-5 etc. are better than either 2-of-2 or single-sig.<br/><br/>The benefit of 2-of-2 software+hardware (compared to single-sig) is that it protects against the ColdCard class of vulnerability without requiring any new equipment. 2026-08-17T12:13:13Z https://njump.cloud.vinney.xyz/nevent1qqsqrrs9ndn0u0ty5yk3umy0y2pjmnt283wgd3l6yt3s0qj3fc09z5czyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62g6suue In reply to <a href='/nevent1qqs8deaq9ssm390cltk8zl22hndee28axyxk7xv3z7f5w5rqxj5j9wqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduxmm969'>nevent1q…m969</a><br/>_________________________<br/><br/>Yeah, I don’t know what I’m gonna get around to fixing that. It may be quite a while. 🙏 2026-08-12T20:57:15Z https://njump.cloud.vinney.xyz/nevent1qqsq70g9lmqjzcqvpkl9xaf3xy26c68z3t3667gxtc04rggp5nll8gqzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx625g3qjr In reply to <a href='/nevent1qqsqe4swqny08wes8ec597ltdpw07khz5csrkajt9579nnm6rf95vncpz3mhxue69uhhyetvv9ujuerpd46hxtnfdudnpvma'>nevent1q…pvma</a><br/>_________________________<br/><br/>Correct. It’s not as simple as just adding a BIP39 passphrase to a single-sig.<br/><br/>In BIP39, technically speaking, every seed has a passphrase, it’s just that usually the passphrase is the default value, the empty string “”.<br/><br/>So, for each of your signers in your multisig, they’re already using a passphrase, and could be configured to use a different one. 2026-08-12T20:44:55Z https://njump.cloud.vinney.xyz/nevent1qqspp9sek3ea3srd27l2q0jjvzehzfy6nc9m9ayhtmv4307g2stmasszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62jhlwc3 In reply to <a href='/nevent1qqswlce9zlzgrglj9zf4f7rx579c7fu4k9fwjthmrm2qygsqdcqg5sqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduf2ps7h'>nevent1q…ps7h</a><br/>_________________________<br/><br/>I’m not sure what you mean. Passphrases are indeed compatible with multisig.<br/><br/>The passphrase gets combined with the other seed material early in the process. So your multisig signers can be based on seed + passphrase, if you want.<br/><br/>If one were so inclined, one could even use the same signing device (same seed) with different passphrases to create a multisig wallet. 2026-08-12T17:41:16Z https://njump.cloud.vinney.xyz/nevent1qqszvvh3twx6a5gu3g2uh563nrehlspgl7e45k0klygy3pvrzqru8nczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62c5yz2s In reply to <a href='/nevent1qqs8kru8zl3n6hw9tyhz5aeyrrprcuahkf3dlnm2yfd4jfflrgpqztcpz3mhxue69uhhyetvv9ujuerpd46hxtnfdu40e8cn'>nevent1q…e8cn</a><br/>_________________________<br/><br/>Seems good! The only thing I’d recommend is strongly advising 24 words and not 12.<br/><br/>While 12 words is usually fine, the 12th word in a BIP39 seed phrase encodes 7 bits of entropy. So the user, ideally, should be picking those too. Otherwise, if the calculator just gives the first viable checksum, it could have those bits zeroed out, and the user only has 121 bits (before we discount any bias in their drawing mechanism).<br/><br/>Once you’re at 24 words, the final word only has 3 bits of entropy while the other 23 words encode 253 (with pick-and-replace) so it’s not a big deal if the calculator assigns those three bits a default value (000).<br/><br/>If you’re at 24 words anyway, pick-and-replace isn’t as crucial. The difference between pick-and-replace for 23 words and pick-without-replace is 253 bits vs. log2(2048!/2025!) = 241.8 bits. Still way above the 128 bit threshold. 2026-08-04T04:38:01Z https://njump.cloud.vinney.xyz/nevent1qqspj5dhyg0et4ytyjm3efc8q0m9x5r2qncz7e02up5zw0fnxpf7l3szyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx6229xazg If you’re using a signing device (hardware wallet) you already have two things: the signing device itself, and some other software wallet.<br/><br/>It is not a big lift to upgrade to 2-of-2 multisig where one is the device and the other is your software wallet.<br/><br/>But this simple set up protects you from any single vendor bug. #Bitcoin 2026-08-03T22:58:00Z https://njump.cloud.vinney.xyz/nevent1qqsg0s8t4tdpwksftj698p7nsurl7f4yzzyul3l2re3uru88twpn8tczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62et38dk In reply to <a href='/nevent1qqsqqqpttr653qrcm4426jqmqga5qs80ettt0ms253kdl25aaw9cgcqpp4mhxue69uhkummn9ekx7mqqy7ek0'>nevent1q…7ek0</a><br/>_________________________<br/><br/>It happens 2026-08-03T22:21:17Z https://njump.cloud.vinney.xyz/nevent1qqs0wt37tw7alq0jr0h9n2cma8lr4hv5chk3zyqpl9hrtthqnkq28eszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx627kluur In society, ownership is what the law allows. The State licenses you to take limited actions.<br/><br/>Freedom means taking control and responsibility. People don’t want freedom. They want license.<br/><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/nevent1qqsqqq9a6v3hhchctkfnq5g9fy7gzmn9sje5txl93nqw4kjmajhxg2cpp4mhxue69uhkummn9ekx7mqpzpmhxue69uhkummnw3ezuamfdejsz9rhwden5te0wfjkccte9ejxzmt4wvhxjmczyzkuznar44vss4ka3wqgzhfk0a7puee445q0mx9gd5qzl05lk567zqcyqqqqqqg65kav4" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">nevent1q…kav4</a></span> </div> My takeaway from this coldcard situation is that self custody doesn’t remove the need for responsibility.<br/><br/>It multiplies it.<br/> </blockquote> 2026-08-03T22:20:49Z https://njump.cloud.vinney.xyz/nevent1qqswl03vwqsgqzktu7yzg2kskr3hygfr0f3vzhwrh2vte0ampt0xnpczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62sg9nd6 In reply to <a href='/nevent1qqsx88uf20j2lsrfy4l5jdadkccndwtpn26q0rph0hcc32w9v6535kgpp4mhxue69uhkummn9ekx7mq6lhdlg'>nevent1q…hdlg</a><br/>_________________________<br/><br/>We’re gonna need more dildos 2026-08-03T21:42:10Z https://njump.cloud.vinney.xyz/nevent1qqs0e5uhcs3nv4aawzkkn8f8fh62hrxcs44qra8x7c9aeeez72a9maczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62dxrgh7 In reply to <a href='/nevent1qqsqqqy2k8rvfy8hcavjtfac5fu5zwsnt0uccn7kjwc6funlj9qyahqpzpmhxue69uhkummnw3ezuamfdejs39ak06'>nevent1q…ak06</a><br/>_________________________<br/><br/>Agreed. Random number generation is not an important feature for a signing device to have. 2026-08-03T21:39:52Z https://njump.cloud.vinney.xyz/nevent1qqsrxgu806qmh5kmr5962sv2rd8umnwa9gmwdxf0jjnt047rhn4t4dgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62phukvn A hardware wallet has ONE JOB: to protect your seed material from leaks during use.<br/><br/>A lot of people were using their devices for more than that, to their detriment. #Bitcoin 2026-08-02T15:49:26Z https://njump.cloud.vinney.xyz/nevent1qqs97lxt060dg50fqg5rlkhvysra5scw54elx3a4le9q22m67ajz5rgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62mfj6hy In reply to <a href='/nevent1qqs0qq46y3j20a7egm3c4l3jjmlm4rp76um0knk0f25weuqzru7j7hspp4mhxue69uhkummn9ekx7mq9pqr0p'>nevent1q…qr0p</a><br/>_________________________<br/><br/> <img src="https://image.nostr.build/bee022991ff712fa430ea043424c0c6d9beeffb08b5c1adff7c5393379fb9d4e.jpg"> 2026-08-02T15:45:58Z https://njump.cloud.vinney.xyz/nevent1qqs2s98ws7lw90qqfascvg532y7dhnhg4pquh7sul8zsfl8jv3fzgeszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62atk4cp In reply to <a href='/nevent1qqsvhn95zqcafzk0jsn7z2jxe4nu0vaz0rq6y303kgqeqgdu7yhh7zspz4mhxue69uhk2er9dchxummnw3ezumrpdejqg6sm3q'>nevent1q…sm3q</a><br/>_________________________<br/><br/>There are plenty of ways of assessing if a specific bit stream is “random”. It basically comes down to measuring diversity of values and looking for patterns.<br/><br/>The simplest check is “all zeros” or “all ones”. Those are obviously non-random at the scale of a Bitcoin seed (128 bits plus).<br/><br/>But a repeating pattern is also non-random. So alternating zeros and ones (“010101010…01”) is also obviously non-random as is other alternating patterns (“00110011…0011”).<br/><br/>The problem in the ColdCard case is that all of the seeds they produced would have passed these checks. The problem wasn’t in the diversity of zeros and ones in the seeds, or patterns resident within a specific seed.<br/><br/>The problem was the distribution of seeds. No local check on the produced values can assert a global problem like that. The only way to detect that class of problem is by auditing the code, which no one sufficiently did until now. 2026-08-02T15:39:42Z https://njump.cloud.vinney.xyz/nevent1qqsyhmngacwxmgcz680x2nee40g2hkjux5jh2g5fznlzurf6gtg9qzgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62whqhvv In reply to <a href='/nevent1qqs86srnn602s3ry88m5qvwpn4hgxdhcrln707d8rpux5vy97w8cefspz3mhxue69uhhyetvv9ujuerpd46hxtnfduxvswuw'>nevent1q…swuw</a><br/>_________________________<br/><br/>If you’re going to those lengths anyway, I’d encourage you to consider multisig.<br/><br/>A very simple multisig setup would be 2-of-2 where one seed is in software, and the other is resident on a signing device. A desktop wallet like Sparrow makes this relatively easy to set up.<br/><br/>If you use Sparrow, one of the seeds will just be in the encrypted wallet file already, so it’d not any more difficult, practically, to sign than if you only had the signing device.<br/><br/>A 2-of-2 multisig doubles the bits of entropy in your system, making it significantly more secure than single sig.<br/><br/>Everyone’s trying to figure out how to put all their eggs in the most secure basket. Multisig is basket-diversification. 2026-08-02T15:33:18Z https://njump.cloud.vinney.xyz/nevent1qqsqm47xk94qt374wnspatapwv8mtl9j3qt9e7wxh5jxhkm8mk63wwqzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62t0twlh In reply to <a href='/nevent1qqstm2sd4g0yslwywckc9g7nrg7ez555pr282nd37wtyhprl93qh6tspz3mhxue69uhhyetvv9ujuerpd46hxtnfduafasnt'>nevent1q…asnt</a><br/>_________________________<br/><br/>I’m not familiar? If you send me a link I’ll take a look and provide feedback. 2026-08-02T15:17:42Z https://njump.cloud.vinney.xyz/nevent1qqs8rker2jngfw7khs6s9famgez6hykuh8ypfwgtzekqsl3a22tdw0czyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62nj0tnh In reply to <a href='/nevent1qqsv9qm6tyasadyhe4zqu89u82rvz0fvkdhrg8ueptahqy9uvkmjjsgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduxk6tfg'>nevent1q…6tfg</a><br/>_________________________<br/><br/>Yeah definitely. I think it’ll depend on the person. Some people like you and me take it super seriously and are sweating bullets in a sound dampened bunker. Other people are lazily throwing dice in their dining room (“this is neat! Now I’m bored”).<br/><br/>Dice are a good source of entropy. But the problem is the human element. The system does not consist of the entropy source alone. It’s the source + the person + the tech.<br/><br/>So with respect to dice, it can fail in any of those three ways. The dice could be bad (unlikely). The person could get lazy or otherwise fuck up (likely). The hardware could have been tampered with or have a bug (unlikely).<br/><br/>I designed my SeedPicker Solitaire solution to be:<br/><br/>1. Easy to perform.<br/>2. Hard to fuck up.<br/>3. Fast.<br/>4. Produce enough entropy.<br/><br/>People say do 100 dice rolls because that’s prudent and gives you a buffer. But it also causes people to get bored and skip steps.<br/><br/>While dice are good sources of entropy proper, they’re not as good sources of compliance as they could be. Hard to do (effort). Easy to fuck up (laziness). Slow.<br/><br/>Anyway, that’s my rationale for inventing a deck-of-shuffled-cards based system. A shuffled deck of cards has enough entropy. The skill of shuffling is widely dispersed and easily learned. The Solitaire technique yields enough entropy even if the user fucks it up in one way or another. (It takes multiple categorical fuckups to reduce your entropy to an attackable level). 2026-08-02T15:08:33Z https://njump.cloud.vinney.xyz/nevent1qqswshztp9euwwcc54dmacxp7zpemc22a6h7vrz63lex6kru2pux67czyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62lagw0e In reply to <a href='/nevent1qqswmlr7gz0cnl8036cvcueyqhxp732ekkclepat6esud07tye0w43spz3mhxue69uhhyetvv9ujuerpd46hxtnfduff852a'>nevent1q…852a</a><br/>_________________________<br/><br/>No worries! Don’t worry about the zaps. My node has been down for months and I’m too lazy to fix it. Maybe someday. 2026-08-02T14:29:58Z https://njump.cloud.vinney.xyz/nevent1qqs2kdmecvx7ul3uzkcgmlfz9jh080xm3ef02nuyas36le8yenuaycczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62plpy6c In reply to <a href='/nevent1qqszjrrk9sk5y74fh8ujcdkrr2hrgmrnjdead579gp9qeysx4zsc6vcpz3mhxue69uhhyetvv9ujuerpd46hxtnfdua2pur3'>nevent1q…pur3</a><br/>_________________________<br/><br/>The sufficiency comes from the number of dice rolls.<br/><br/>If you roll one die, you get 1, 2, 3, 4, 5, or 6. (6 options)<br/><br/>If you roll two dice, you get 11, 12, 13, 14, 15, 16, 21, 22, 23, 24, 25, 26, 31, 32, 33, 34, 35, 36, 41, 42, 43, 44, 45, 46, 51, 52, 53, 54, 55, 56, 61, 62, 63, 64, 65, or 66. (6 x 6 = 36 options)<br/><br/>If you roll three dice, you get 111, 112, 113, 114, …, 663, 664, 665 or 666. (6 x 6 x 6 = 216 options)<br/><br/>And so on. Each dice you roll multiplies the total number of options by 6.<br/><br/>So if you roll 100 dice, the number of options is 6^100 = 6.533×10⁷⁷ This is an unimaginably vast number.<br/><br/>Vetting that the rolls produce the seed is secondary. The important point is that each roll multiplies the search space, and 100 is plenty. 2026-08-01T20:41:24Z https://njump.cloud.vinney.xyz/nevent1qqsqmscx29z6v3spml5rwkxuej7v0at779dcuxk4kmt4djcdgsge60szyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx6243m8cm #Bitcoin #memestr<br/><br/> <img src="https://image.nostr.build/f81c382804d208fc76b64e3243e486d6a5ccb8687098ea595b4a16bc6e97efb2.jpg"> 2026-08-01T14:38:58Z https://njump.cloud.vinney.xyz/nevent1qqs8c8k9g2f8yk2m5wawwpwaqdtj0xsdtdrd6f8a64tn4t8wkfpdhtgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62ae8qr7 E N T R O P Y<br/><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/nevent1qqs0tspn50jgyph4t6qyk4tfq0549n0cp9sezjemqxddt6ssg7h8p9cpz3mhxue69uhhyetvv9ujuerpd46hxtnfdupzqwxmhxc8myuxr4qxyzkk94ztr28g0pwlpxt7adz9fufdy9cy3n2uqvzqqqqqqysuaz3h" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">nevent1q…az3h</a></span> </div> Entropy </blockquote> 2026-08-01T00:18:00Z https://njump.cloud.vinney.xyz/nevent1qqs9upejdjflvdhulkt87vvnqygamrdpj77tkr7nknv39gznl4c7ndgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx6249tae3 In reply to <a href='/nevent1qqsz8lc5yme4wkf4mznpptash5x68vusuf8r3v5yuddskxvfmvp5qccpzpmhxue69uhkummnw3ezuamfdejs6hczn3'>nevent1q…czn3</a><br/>_________________________<br/><br/>The point of the airgap is to reduce the likelihood your seed leaks during signing.<br/><br/>The alternative is to plug the device into the machine (USB) or have it communicate over some other channel (BlueTooth, camera + QR codes).<br/><br/>Airgapped with PSBT or QR is the least leaky available option. But again, the point is to protect the seed during signing.<br/><br/>Not to generate seeds. Not to protect data at rest. 2026-07-31T22:22:03Z https://njump.cloud.vinney.xyz/nevent1qqs22tkqegdn89t4fljqa6dq4xxyupctfchteauqf6d303c30kmxwmgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx620psr9p In reply to <a href='/nevent1qqsqzyal964rk9fzlfr8hu5qhfpsns5nx5w0e8w3zcjddn57xyhlayspz3mhxue69uhhyetvv9ujuerpd46hxtnfdux8u60w'>nevent1q…u60w</a><br/>_________________________<br/><br/>He’s saying that knowing where the coin went won’t get it back. 2026-07-31T21:01:41Z https://njump.cloud.vinney.xyz/nevent1qqsr68evn6j84acvagrs8s0cz4v3fpugwwu566tyxn80mlgyjw795kczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62qvj38u Possession may be 9/10 of the law. But it’s 10/10 of the #Bitcoin<br/><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/nevent1qqsy9g9m4994pz00g086h63ayqlxv7r90ze88s6ul30rfaewk0kegqqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduq32amnwvaz7tm9v3jkutnwdaehgu3wd3skueqzyruszct0qznr7nuu0zqafpc6q00n6n8ww2g74lt6mjlw5ly4ck8zwqcyqqqqqqgtrh998" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">nevent1q…h998</a></span> </div> Is it theft if I guess a number in your head? </blockquote> 2026-07-31T21:00:55Z https://njump.cloud.vinney.xyz/nevent1qqsztfwc9e2p6w48973dynk55w32s2gwtzykw7quf4c8hgqqjq5guaczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx629kd4q2 In reply to <a href='/nevent1qqs25fk053vuc2he7e4h4jkac3esk8cfmjerv3gyd76ruf589l7vddgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduag37pa'>nevent1q…37pa</a><br/>_________________________<br/><br/>Great question. At some point, in order to use Bitcoin, you’re going to need a computer.<br/><br/>Hardware wallets compute all the time. For example, they compute addresses from XPUBs. They compute XPUBs from seeds and so on.<br/><br/>A BIP-39 checksum word contains bits from the SHA256 of the actual entropy payload. Calculating this SHA256 sum by hand is intractable.<br/><br/>So, in my opinion, the hardware wallet SHOULD be wiling to generate a checksum word for you based on the incoming entropy. ColdCard will do this. I believe SeedSigner will as well. Last I checked, Sparrow WILL NOT do this for you. There are various other tools that may have this capability.<br/><br/>But yeah, at the end of the day, you need multiple independent vendors to perform these kinds of calculations:<br/><br/>- Generating the last word of a BIP39 seed phrase<br/>- Generating an XPUB from a seed phrase<br/>- Generating a master key fingerprint (XFP) from a seed phrase<br/>- Generating addresses from an XPUB<br/><br/>Hardware wallets are powerful enough to do these things. Whether and how many is up to the vendor to implement. 2026-07-31T21:00:02Z https://njump.cloud.vinney.xyz/nevent1qqszy3umgjy6pngg5zpj36l88qxppx9slhewut8mwjtrdd9m6qdfg6czyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62qt4za6 In reply to <a href='/nevent1qqstt5k7vav6adewmvnrtrgfrdlum30m3msvh23u3ax3vcuhcch368gpz4mhxue69uhk2er9dchxummnw3ezumrpdejqle26y5'>nevent1q…26y5</a><br/>_________________________<br/><br/>Well, I meant hypothetically 😅 2026-07-31T20:22:59Z https://njump.cloud.vinney.xyz/nevent1qqst4ux2xuhaqg6gvtpp8wjk0lhwy4rauvknnfuscq4svushqs2wu4gzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx627s56cn In reply to <a href='/nevent1qqstawdyw26f4gx0drh9xccetwsy3yvh32xk5gt9ayrr395fha9pagcpz3mhxue69uhhyetvv9ujuerpd46hxtnfdu55rx0f'>nevent1q…rx0f</a><br/>_________________________<br/><br/>You can get out in front of these by messaging your friends and family first. 2026-07-31T20:19:55Z https://njump.cloud.vinney.xyz/nevent1qqsf6xqs6chz5ftgezza2q48hmactpma4979yx0579nrlhe29a05vgczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62lfpp8l In reply to <a href='/nevent1qqs2m7ez8xr5tn4j7we27um3fuc0f89t245f5sfq7pcseyf6nrc5r9spz4mhxue69uhk2er9dchxummnw3ezumrpdejqg4z6cg'>nevent1q…z6cg</a><br/>_________________________<br/><br/>Plenty of months left in the year 🤝 2026-07-31T20:19:18Z https://njump.cloud.vinney.xyz/nevent1qqswvjv3znwd83tpcvfug9x0q6ttktap3cp9se0w3y78rd0th20rmtqzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62cvpx9c In reply to <a href='/nevent1qqswfvdtcdwa5vr0lvwmcy2a9zjqldc8dfpquj9dzwu5yyy55mjm65cpz3mhxue69uhhyetvv9ujuerpd46hxtnfdu0znsfw'>nevent1q…nsfw</a><br/>_________________________<br/><br/>That’s the right question. Ultimately, that has to be done by a computer. It can either be a general purpose computer or a hardware wallet.<br/><br/>ColdCard has a way to enter dice rolls to generate a seed. SeedSigner also has this capability. There are other implementations as well. 2026-07-31T20:18:40Z https://njump.cloud.vinney.xyz/nevent1qqsxyrmx65t5s2f0sy2hhtfx7pfmmxaslx0vvu49crp7j0px42xfzfczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx6234q894 In reply to <a href='/nevent1qqswmn60apm32a5ca9cv4f57zj4clmg4kml2ehdnu23eyxfzfqz8czgpz4mhxue69uhk2er9dchxummnw3ezumrpdejqgsuevp'>nevent1q…uevp</a><br/>_________________________<br/><br/>Ice cold 2026-07-31T19:41:50Z https://njump.cloud.vinney.xyz/nevent1qqsplkmv9h8m6qxtu6gcz4nd3w0zzm4xsy6sce8s4py5d3dh0efz8jszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62cqgynz In reply to <a href='/nevent1qqsptmpt2crjsuukv8qnuxay403n33emaan6lvggxtm67ps4p49uhkqpz4mhxue69uhk2er9dchxummnw3ezumrpdejq8q9kec'>nevent1q…9kec</a><br/>_________________________<br/><br/>Did not have that on my bingo card 2026-07-31T19:40:59Z https://njump.cloud.vinney.xyz/nevent1qqsylxxx8rc5n20ckue59dgfeplgwe7gqw0pv7qwan45w3rfu5nwzvczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62zc69r7 In reply to <a href='/nevent1qqsfcc67h884rm246jfvax220mq474u5uve80esac3s6ztq6w9henrqt072px'>nevent1q…72px</a><br/>_________________________<br/><br/>It depends on the computer. Generating good entropy on low power devices has long been a challenge. 2026-07-31T19:40:43Z https://njump.cloud.vinney.xyz/nevent1qqswx4hy964dew8dw284wra667y7v7mnlpwl6lj5jt3c42avzcydj6czyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62kqar07 Listen, if you’re leaving ColdCard due to this issue and switching to Bitkey, just know that you haven’t changed your risk posture towards this class of issue.<br/><br/>You’re still trusting someone else with your seed generation. #Bitcoin 2026-07-31T19:39:21Z https://njump.cloud.vinney.xyz/nevent1qqsq4fxqvtg3u4pd39ffwvwa0yr7pmcjlecprwev4pus5sm370yl4zgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx620g3l77 In reply to <a href='/nevent1qqsqw5grsle89g4xzwvchtlhu7xltnkszepm0l8kpuwt6xtnm4rhvvgpp4mhxue69uhkummn9ekx7mqvj2r8e'>nevent1q…2r8e</a><br/>_________________________<br/><br/>100+ fair rolls should give you the same seed and security as other comparable devices for this task, like SeedSigner. 2026-07-31T19:37:06Z https://njump.cloud.vinney.xyz/nevent1qqsyu3gqkjfn6lf9gn99450str7yferradl89ah0t7p08rp4c3dswfszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx629gf2u7 In reply to <a href='/nevent1qqs2arx6pv0aaa6ccagn0dvexxwsd4htvcsp5wcde36c6snerpkz73spz3mhxue69uhhyetvv9ujuerpd46hxtnfdu05zv6p'>nevent1q…zv6p</a><br/>_________________________<br/><br/>What? Ballet, Bitkey, Satscard… what’s the difference?<br/><br/>All of them generate seed material that you cannot observe nor override. So from your perspective, they’re all vulnerable. 2026-07-31T19:31:15Z https://njump.cloud.vinney.xyz/nevent1qqsx6z3hgsu0dpx7hmqgnlpf0qy8nn0lgdjteh5pxny60q8mxrtfq3szyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62m5ury8 In reply to <a href='/nevent1qqsfl623usl0fq50w9xd8acf7ps76gtxqg9qk8rrxvj4al9h3yetyxcpz3mhxue69uhhyetvv9ujuerpd46hxtnfdumn3cla'>nevent1q…3cla</a><br/>_________________________<br/><br/>The RNG is the only known issue, AFAIK. <br/><br/>So yes. Using a ColdCard, especially eternally quarantined (offline, PSBT) with your OWN seed material, should be just fine.<br/><br/>Even better is to add a passphrase (25th word) or upgrade to multisig. <br/><br/>For example, using Sparrow or BlueWallet, you can make a 2-of-2 with your ColdCard and a software seed as signers. This is a simple mitigation that doesn’t require any new hardware. 2026-07-31T19:30:10Z https://njump.cloud.vinney.xyz/nevent1qqsqzrnd7xf96sx00gr8pdqmldtrmpl0ydyq64mqlu8a57wmelxdukszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx620cgvl8 In reply to <a href='/nevent1qqsreysw5vr5ju7dg6ucfvuuza4e5c4wyqraed3hjcylrpulue7gugspz3mhxue69uhhyetvv9ujuerpd46hxtnfdu6hgrre'>nevent1q…grre</a><br/>_________________________<br/><br/>The lesson of this whole debacle is that the only way to KNOW that no one else has your seed is to generate it yourself.<br/><br/>Therefore, any device that does not allow you to supply your own seed is unsuitable for use. Full stop.<br/><br/>So I would NEVER put serious amounts of coin secured by Bitkey, Ballet, Satscard, etc. because I can’t verify that their seed material has not been compromised.<br/><br/>I admit that my opinion in this matter is a bit of an outlier here. 2026-07-31T19:26:00Z https://njump.cloud.vinney.xyz/nevent1qqs00qcu4arkfsmyquj37kd5zd3dyvf0u0k7qmcc9c5f7unly44ypaczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62733hrv In reply to <a href='/nevent1qqsq9gvz5w4h44hdz07q6g2ehkv9dwhmczate8frqhysjxzjn5e2segpzpmhxue69uhkummnw3ezuamfdejs3937y8'>nevent1q…37y8</a><br/>_________________________<br/><br/>Story. Of. My. Life. 2026-07-31T19:10:47Z https://njump.cloud.vinney.xyz/nevent1qqs0a7dtvl2agv3jseup78384sp5gxqx84jsmdz59sxz0887htcxh8szyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62rs3qu2 In reply to <a href='/nevent1qqszk3d9emfqq2eqscshgvg28d3n0j9xjscnv6un8sm7raqmf22vk0gpp4mhxue69uhkummn9ekx7mqnqjcug'>nevent1q…jcug</a><br/>_________________________<br/><br/>Underrated observation 2026-07-31T19:09:28Z https://njump.cloud.vinney.xyz/nevent1qqsfjqdue9lv3vt9vgqt20glgu4qtj2gcq48gumdpvc0ga220p5afxqzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx6274evt8 In reply to <a href='/nevent1qqsvlj86p6ap7yche77m3rkmrvh2ch6mq8atajlln3ddxe8rg7gfl2spz3mhxue69uhhyetvv9ujuerpd46hxtnfdu8hq5ve'>nevent1q…q5ve</a><br/>_________________________<br/><br/>Haha meant to say you don’t “provably” have a quorum. Thanks autocorrect. 2026-07-31T19:08:20Z https://njump.cloud.vinney.xyz/nevent1qqsf0j0fnry8yp05rz9ghwuxg436v0fwsudlw3nqhyacucv7gm9jqyczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx6263fzyn In reply to <a href='/nevent1qqsg0my0slywydc46wvp02wtym8s7yg3w65p5gjk2nqft5fjf7zfaqqpp4mhxue69uhkummn9ekx7mqhvuzt3'>nevent1q…uzt3</a><br/>_________________________<br/><br/>Don’t trust anyone! Build a multisig quorum from different vendors.<br/><br/>It’s very unlikely that they’ll all get fucked at the same time. 2026-07-31T19:07:07Z https://njump.cloud.vinney.xyz/nevent1qqsy88ngl8zfc598y7grcd3lsfpd83kpucm3yq5dnxpraspx27qw2hqzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62w4ztqp In reply to <a href='/nevent1qqsdkmj552p2n0fjwxz70ses0tzu2ygfsn8kqldnep3md7ch6nue80cpz3mhxue69uhhyetvv9ujuerpd46hxtnfduq9hd7k'>nevent1q…hd7k</a><br/>_________________________<br/><br/>I know the powers that be really like the Bitkey, but it’s functionally no different from the much maligned Ballet wallet.<br/><br/>The truth is that you do not probably have a quorum over your own seed material. 2026-07-31T19:04:51Z https://njump.cloud.vinney.xyz/nevent1qqsqelrwhurm9g9fa99f4rhkksjkq8scq5w8tdz3f2d779d7duwxc0qzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62c3u04p In reply to <a href='/nevent1qqsxut06e2e2wkw63mnma3djr37gagsxzde9rhq5dfltfhphlw4yqdqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduw9wax3'>nevent1q…wax3</a><br/>_________________________<br/><br/>The ColdCard problem is bad entropy generation.<br/><br/>The OpenDIME doesn’t even try to generate entropy. It leaves that entirely up to you.<br/><br/>So this current problem does not apply to the OpenDIME. You could choose not to use it for other reasons, but it’s not vulnerable to the same problem. 2026-07-31T18:58:23Z https://njump.cloud.vinney.xyz/nevent1qqsfle8scjl5ymcpy5d40h3gqfp0ludee0jcf66eh8gdlm3gac2sjdgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62949f30 In reply to <a href='/nevent1qqs8cmeg6nd8554ru2ac7gjn7czmkaknm6gac44ca9a45nmxknndnzspzpmhxue69uhkummnw3ezuamfdejsvfdluj'>nevent1q…dluj</a><br/>_________________________<br/><br/>Thank you! I hope that more people will adopt the mindset that they really do need to be in charge of their own entropy production. Everything depends on that. 2026-07-31T18:55:02Z https://njump.cloud.vinney.xyz/nevent1qqsdywsv6u6eawqukxrqhdexpnf8snnjtc6mc2uq3mlwn8s957h99cczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx625uuprf PSA: I’m available for podcast appearances if anyone needs someone to explain of the problem, describe mitigations, or discuss entropy generation approaches. 🙏 #Bitcoin<br/><br/> <img src="https://image.nostr.build/ae22194cadc095538df477bae4428b0a98c1117cbf7be1cb83e6cf4794af66fb.jpg"> 2026-07-31T18:44:42Z https://njump.cloud.vinney.xyz/nevent1qqswhutm2sl0wemggelswyk6hqks034x2p677pa48ya4smvmpcyygfczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62upg9ty DEFENSE<br/> IN<br/> DEPTH<br/><br/>#Bitcoin<br/><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/nevent1qqsycgmc5kmtfq34pafrk8leeyrw44sjnphmr6qm0cn9heeddza7phspz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dspzq40rg0n93yrn6vf0e2esqa0yk35px6dk23v7lum20ch7f7yq4ngmqvzqqqqqqyd6zhh5" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">nevent1q…zhh5</a></span> </div> multi-sig, multi vendor, multi fucking dice manufacturer, whatever it takes, we’re gonna win. </blockquote> 2026-07-31T18:39:52Z https://njump.cloud.vinney.xyz/nevent1qqsdk609lnwkp4chddygj4cfckwhprx70fqu6dxrx42utryld07k5tczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62klngk9 In reply to <a href='/nevent1qqswvk4pkj8ccwa3865dghx9jv52828uzzcycny0rps6uyqck9h8hxgpz3mhxue69uhhyetvv9ujuerpd46hxtnfdufctxp9'>nevent1q…txp9</a><br/>_________________________<br/><br/>Most people are not ready to be unplugged 2026-07-31T18:36:29Z https://njump.cloud.vinney.xyz/nevent1qqsqusdduw6tpu899aldsvqcqrjgx5h72walf7z2fn88wh4a4kwz5zszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62u8lxf3 In reply to <a href='/nevent1qqsygxzp07tk3ysrxl66v5z6kw63h4yvtes9yg0z5z883w7x25g2rkgpp4mhxue69uhkummn9ekx7mq8hh83d'>nevent1q…h83d</a><br/>_________________________<br/><br/>That might save you in a bulk attack like this. If you’re attacker is just carrying out a premeditated set of transfers, they may not be watching to RBF on top of you again. 2026-07-31T18:35:56Z https://njump.cloud.vinney.xyz/nevent1qqspqjzmzhwf59skhvp7c2hls4xfsldy4fapj2gcu4hsj5e9ywgn8cqzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62w6q8px In reply to <a href='/nevent1qqs9g6x2unaxlrpamp6s7w3dwlcpksk3txkvuynnh5g49287ffz960spp4mhxue69uhkummn9ekx7mqgpvaq9'>nevent1q…vaq9</a><br/>_________________________<br/><br/>Security is the only subject 2026-07-31T18:25:41Z https://njump.cloud.vinney.xyz/nevent1qqsd5wt4vkgjmlptukdqv2k59t8dnx76gv4rk5d3dscpyp4mm60nvmszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx6238nz65 In reply to <a href='/nevent1qqs0stvmp33lf4x6wz2sw77qx6ndm8cmuw9450hw4cugr3hd8knx0fsukhrnk'>nevent1q…hrnk</a><br/>_________________________<br/><br/>As far as I know: no, OpenDIME is NOT affected.<br/><br/>The ColdCard vulnerability has to do with generating entropy. The OpenDIME doesn’t even try. It forces you to provide the entropy in the form of a file that you drop on the device. Ideally, a photo that you took specifically for this purpose and then deleted everywhere else. 2026-07-31T18:24:00Z https://njump.cloud.vinney.xyz/nevent1qqsxp0l587heet2t0enlemda9rtq5dzlu9w603h8xzy9mckqwa72degzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62xsnq93 In reply to <a href='/nevent1qqsfxfkptel3lllztujcahn72l7js948l5q27wky50dhyhznptdcwkgpz3mhxue69uhhyetvv9ujuerpd46hxtnfdu77d5jg'>nevent1q…d5jg</a><br/>_________________________<br/><br/>Yeah, this is a nightmare scenario for them. As I have said elsewhere, and maintain, the hardware wallet has one job: to protect your seed material during use.<br/><br/>It is not your hardware wallet’s job to generate entropy. It is not your hardware wallet’s job to resist an attacker long-term with physical access.<br/><br/>But, I accept that my stance is unconventional.<br/><br/>People get into this field with the “don’t trust, verify“ mentality, but then they place all their trust in the single most important thing that must not fail. The generation of their seed. 2026-07-31T18:21:07Z https://njump.cloud.vinney.xyz/nevent1qqsx4s0tazkdcf9jah9386rgzgl3q3ffnmlf0zxz2uvutux7y04g9wqzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62ye8f0x In reply to <a href='/nevent1qqs8pfp6qk7mpamfxlp4umsgr7f7m8evfgmhevrfwdn0d6uvv0rupzspz3mhxue69uhhyetvv9ujuerpd46hxtnfdua0chm2'>nevent1q…chm2</a><br/>_________________________<br/><br/>The algorithm that ColdCard uses performs SHA256 on the list of dice rolls as a string. So “5456325…31”.<br/><br/>Making this string longer than 100 has no downside, but also makes no practical difference to an attacker. 1000 rolls and 100 rolls both become 256 bits at the end of the day. So 256 bits is the search space no matter how many more rolls beyond 100 you do. 2026-07-31T18:05:52Z https://njump.cloud.vinney.xyz/nevent1qqs2thldm8q0p7nmmuf7c4myrkfxult8gxveg6x04a3elwfswn7k2zgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx623hp9ev In reply to <a href='/nevent1qqst8feq97xa3rwzzj6w445yt0dymdlklqw500wrhd9yyqmvhssu7egpz3mhxue69uhhyetvv9ujuerpd46hxtnfdu8f5k50'>nevent1q…5k50</a><br/>_________________________<br/><br/>I looked at the code years ago, but haven’t revisited it since. It was my opinion to just cut out the middleman and make the words yourself. 2026-07-31T18:02:28Z https://njump.cloud.vinney.xyz/nevent1qqst8feq97xa3rwzzj6w445yt0dymdlklqw500wrhd9yyqmvhssu7egzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62x64lhs In reply to <a href='/nevent1qqsrutwp2c3mk39zfvv5ucjm0qmunt0vjj3duea9gygpeeqpl93qj8gpz4mhxue69uhk2er9dchxummnw3ezumrpdejqd94rv9'>nevent1q…4rv9</a><br/>_________________________<br/><br/>Could be! That would make sense. It’s not a complicated algorithm. It’s basically SHA256 of the string representation of the concatenation of dice rolls.<br/><br/>There’s some nuance in how you byte encode the string for the binary SHA256 operation, but it would make sense for SeedSigner to have adopted ColdCard’s approach as a de facto standard. 2026-07-31T18:01:07Z https://njump.cloud.vinney.xyz/nevent1qqs0uzy72qreeqlsfcpwsvyc9hrg96rxcpl7ayxmuvl9uate7e4rcrgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx624p6gne In reply to <a href='/nevent1qqsz87r4l4zwkpjhsd09l7ksnlwv34ra5z9y29gajnyxrxf8akr927gpz3mhxue69uhhyetvv9ujuerpd46hxtnfdu83y37a'>nevent1q…y37a</a><br/>_________________________<br/><br/>Great question. If your dice are fair, 100 is way more than enough. 50 is the real minimum threshold.<br/><br/>To assert that those rolls produce that seed, you need two devices from different manufacturers running the same algorithm.<br/><br/>For example, the algorithm ColdCard uses has been reproduced in Python. You could put the rolls into your ColdCard, write down the words, then put the same rolls into a computer and run the Python program to see that it yields the same words.<br/><br/>Of course, now you have a new problem: your seed has touched a general purpose computer. So ideally, you would use one that is eternally quarantined and has never touched the Internet.<br/><br/>Or, you can find another signing device manufacturer that uses the same algorithm. SeedSigner might. I’m not sure.<br/><br/>You can see now why just rolling dice is not the panacea that people make it out to be. 2026-07-31T17:57:51Z https://njump.cloud.vinney.xyz/nevent1qqs9g4zwzwq5qqgsny8d0hd9l9p8vzdenyfrjwrgtdhghv669xmf9uszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx624l2j4y Today in #Bitcoin<br/><br/> <img src="https://image.nostr.build/6a05683a73dbb776af0bfedf265f0fb05e7611310a5618db571c3ae8ef92de37.jpg"> 2026-07-31T17:52:33Z https://njump.cloud.vinney.xyz/nevent1qqspe0yukr2ltkx73pfztrywgyqh37jw2vemq8cx96uqvpadfkax36czyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62t89spt In reply to <a href='/nevent1qqsvwydp7l0aeugtvrawsdl3v7xultefwfsuw2zml6nrqe8mkjqf8rqpp4mhxue69uhkummn9ekx7mqeg9ypj'>nevent1q…9ypj</a><br/>_________________________<br/><br/>Almost. But there’s a rolls-to-seed algorithm which most people TRUST to give them the right seed for their rolls. 2026-07-31T17:48:07Z https://njump.cloud.vinney.xyz/nevent1qqsvqs6e2atgjhzcg0ahrjgr6rs2pp2xf9exyxngm22uazaqn40cwygzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62fq6vkl In reply to <a href='/nevent1qqs96g4letaetgyxnrxql3u2q88wx4jy4a0vhe4a369syt0qnfyykfgpz3mhxue69uhhyetvv9ujuerpd46hxtnfdu5gje85'>nevent1q…je85</a><br/>_________________________<br/><br/>100 dice rolls, and that there wasn’t a bug in that code path (that we know of, so far). 2026-07-31T17:44:25Z https://njump.cloud.vinney.xyz/nevent1qqs9ew89chxh7upsue70x2vqzuv2ny3ezqkdpn5fvdd5nhmg7v0mfpgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx625vm02n In Bitcoin, ownership is what you KNOW. You either know the keys and can move coins, or you don’t.<br/><br/>So, how do you KNOW that nobody that you has your seed? The only way is to generate it yourself.<br/><br/>If you trust ANYONE ELSE to generate your seed material, then you DON’T KNOW that no one else has it.<br/><br/>Therefore, you MUST generate your OWN ENTROPY in order to KNOW that it’s safe. #Bitcoin 2026-07-31T17:43:21Z https://njump.cloud.vinney.xyz/nevent1qqsrxx0dqg3zjw3plqknrxd6zxvygprnvwjghzhk9v2gap7mr36jqwqzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx626dtve6 In reply to <a href='/nevent1qqsqqqyn5pu59g7gs4p5dqnf0mvhdsckkd0mn8lr4u4ll3h5xmtt7fcpzpmhxue69uhkummnw3ezuamfdejse7fk9u'>nevent1q…fk9u</a><br/>_________________________<br/><br/>So, yes. In UX terms, the device should observe its low-entropy state and demand entropy before proceeding. Many systems do this. For example, old-school SSH key generators would have you wiggle your mouse around.<br/><br/>However, I’m going to be contrarian here and claim that STILL you should not let a machine generate your seed for you. Practically, the seed generation procedure is unauditable at the moment it’s happening.<br/><br/>To reliably generate a seed, you need to replicate the mechanism on multiple devices from different vendors. At that point, you may as well cut out the middle man and generate entropy you KNOW to be good, yourself, OFFLINE. 2026-07-31T17:40:30Z https://njump.cloud.vinney.xyz/nevent1qqsgcqfx2rch4ke3nxtgr5eucq8e9ck22s9ky3p269htaucfpe9ljzczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62gf03x8 In reply to <a href='/nevent1qqs9z248w9msc9uqehgmze8femtwa74zjk4j7fz25p9mek0ncrer8hgpp4mhxue69uhkummn9ekx7mq6qe007'>nevent1q…e007</a><br/>_________________________<br/><br/>This but unironically 2026-07-31T17:30:47Z https://njump.cloud.vinney.xyz/nevent1qqsdy4gs8r8wm4x5qa4m6g3ww2ehvkrwwltn6kt8fn5ezhhytq4nfnqzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62cqaq52 Your signing device has one job: to protect your seed material from leakage during use. The ColdCard has not failed in this.<br/><br/>People were trusting their ColdCards for an additional job: generating entropy. That was the mistake.<br/><br/>It does not help that wallet manufacturers encourage using the devices for entropy generation. #Bitcoin<br/><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/nevent1qqsx9ryhxyzu7g3ezuhjjn2ycne4pjresfgt9ykz4dn44yggt6ja2tgpp4mhxue69uhkummn9ekx7mqpz3mhxue69uhhyetvv9ujuerpd46hxtnfdupzpsptak45jk5dw03rryh6zcdqhq6ysg05s3rgzxc7sy86ced4sn6fqvzqqqqqqyzuezky" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">nevent1q…ezky</a></span> </div> Coinkite had 1 job and it failed! <br/> </blockquote> 2026-07-31T17:30:28Z https://njump.cloud.vinney.xyz/nevent1qqsvtzyt0g0qge7dt03r9yxj9zrslz8hd8skctzzgtlerny9znsjgvqzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx628x3u6p In reply to <a href='/nevent1qqsqqq80t70c0vhdwzdzgj3ftnwurg3jgxmsuqjvh0076j6vqjd862gpzpmhxue69uhkummnw3ezuamfdejsf5anpc'>nevent1q…anpc</a><br/>_________________________<br/><br/>Correct. 50+ independent, fair dice rolls produces sufficient entropy to hit Bitcoin’s 128 bit minimum security threshold. 2026-07-31T17:28:34Z https://njump.cloud.vinney.xyz/nevent1qqsgqvm20pc4atywhc6x8ll8nlmtkjkjry0hkwmrmu7nkgpngxh6wmqzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx627m8g9x For people freaking out, here are a two relatively quick mitigations that don’t require any new hardware:<br/><br/>1. Using your existing ColdCard and seed, you can set up a passphrase. This acts like an entirely separate wallet on the same device. You can then sweep the coins to the passphrase sub-wallet.<br/><br/>2. Using your existing ColdCard and seed, set up a 2-of-2 wallet using that device and a software seed using Sparrow or Blue Wallet. Your attacker would have to both exploit the ColdCard vulnerability AND hack your software wallet to move those coins.<br/><br/>Stay frosty out there. #Bitcoin 2026-07-31T17:27:26Z https://njump.cloud.vinney.xyz/nevent1qqsdksa5qhz4zq0xvasnqyjhrs6ga4xryzwaj3gl65g87pengvrgavszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62pjurjs In reply to <a href='/nevent1qqsf2hpsvtlec9k3rj9ja9q9gyttxf6cu4qz4dn8dxd2xr9dcgzclsqpz3mhxue69uhhyetvv9ujuerpd46hxtnfdu3my49r'>nevent1q…y49r</a><br/>_________________________<br/><br/>100%. Multi-vendor multisig is the way to go.<br/><br/>You can even do a simple 2-of-2, where one is on your hardware wallet, and the other is on the computer. An attacker would need to exploit a vulnerability like the current one AND hack your specific computer.<br/><br/>And that option doesn’t require and additional hardware. Just a software wallet like Sparrow or Blue Wallet.<br/><br/>Plus, the multivendor multisig stacks with other best practices. You can use pass phrases (25th words), you can use dice for generation, and these work just fine along with multisig.<br/><br/>Defense in depth. 2026-07-31T17:23:43Z https://njump.cloud.vinney.xyz/nevent1qqsx5xxjj9qhr48lqwe0p7f9aumdj8eyf8l85f47xlmsncq2540vuuszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx624v7wdr In reply to <a href='/nevent1qqsv3kh37sk0emuqqy8zu5xwtzq90pzap2dn0kh2984ry5eg9y7ncjge5h8u2'>nevent1q…h8u2</a><br/>_________________________<br/><br/>Some of us have been talking about this for a loooong time. 2026-07-31T17:20:32Z https://njump.cloud.vinney.xyz/nevent1qqsx0jr9qljw73yec99yqqhuwg6wd66mxgz7qkgxvqgs3nvde5jqluszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62qvprng In reply to <a href='/nevent1qqsgjd7plvm4ywnuaua0wte7zmaklm0w7hg57747883mqpzf4cvzmvqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduhp4rqe'>nevent1q…4rqe</a><br/>_________________________<br/><br/>The lesson here is don’t trust your seed generation to a computer, ever. 2026-07-31T17:18:43Z https://njump.cloud.vinney.xyz/nevent1qqszgfgvc4lhn4auz43rdnh5ashsf2reunm8vn4u67zduwlh5aazwnszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62vk0ypt In reply to <a href='/nevent1qqsxlnagmj20htujtk7dlfc5f3eunr893g53wfwp87q6taz4k4j0pcqpz4mhxue69uhk2er9dchxummnw3ezumrpdejqfge7sh'>nevent1q…e7sh</a><br/>_________________________<br/><br/>Yeah, the failure rate is about 1:2500. 2026-07-31T17:17:05Z https://njump.cloud.vinney.xyz/nevent1qqswpkrgdx8vlmhsjjcsk4ahx6svh2s0cx6gy5cw00r50z4aaclgshczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62855uc3 NOT YOUR KEYS, NOT YOUR COINS.<br/><br/>NOT YOUR ENTROPY, NOT YOUR KEYS.<br/><br/>#Bitcoin<br/><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/nevent1qqs8f0fm0qx472rs2qsgsvv4e3ekgras7yy6usn2gd46gkmr4c0z8nqpp4mhxue69uhkummn9ekx7mqpz3mhxue69uhhyetvv9ujuerpd46hxtnfdupzq7mx9f7prxxe9mkjje0gfrnm3xgv36jxgrr9y6m64tmpvj4yck79qvzqqqqqqy79d85p" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">nevent1q…d85p</a></span> </div> Not your RNG,<br/>Not your coins..<br/>😔 </blockquote> 2026-07-31T17:16:18Z https://njump.cloud.vinney.xyz/nevent1qqsy5dvfjdkg8yaam0e489g60pyqlmvaxgzvjxttvk9vqfstdjyn3dgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62nqfl2h In reply to <a href='/nevent1qqsw96ccjt7r6mlkc8sdazjgdmdnt0fk7jnlkvgnff5m5egwcsdzwqqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduvp2h7c'>nevent1q…2h7c</a><br/>_________________________<br/><br/>Truly sorry to hear that. 🙏 2026-07-31T17:13:42Z https://njump.cloud.vinney.xyz/nevent1qqsrh9655806t7qrv08g3u6ue59ufd5nhwg8a5vl8k34h0flc3kt7sczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62j24xlz In reply to <a href='/nevent1qqsq9272alz6vdhlh86fx20ae4ghczrz649xzunzyrfa8dfhaupvpegpz4mhxue69uhk2er9dchxummnw3ezumrpdejq2yvgk0'>nevent1q…vgk0</a><br/>_________________________<br/><br/>Unpopular opinion: Never trust a signing device using entropy you yourself didn’t produce. You have no way of knowing how many devices out there are using the same seed. 2026-07-31T15:18:24Z https://njump.cloud.vinney.xyz/nevent1qqswyjfszfmx42nmyhahss9eq7drkv6rghy7mn70vcne7vxlg7szeyszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx625y4psg In reply to <a href='/nevent1qqsqs2ffvw6q05myz50r734k2txtnuszx5xk9x5986cr5mu940ga62spzpmhxue69uhkummnw3ezuamfdejsw4j2xg'>nevent1q…j2xg</a><br/>_________________________<br/><br/>I made a few different designs. Shadowy Super Coder was the most popular. This was early in the AI slop era. Vintage slop. 2026-07-31T15:16:52Z https://njump.cloud.vinney.xyz/nevent1qqs9lpejzl09jjvq8u7pg500z7jjkmz975x07a9ys2jk8gqcwjezfsszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62rgt2xe In reply to <a href='/nevent1qqsqqqqyxm6p5yvrzerpcra4rr8pl3cgd4tcvja3rrtp2ps2gnl802cpzpmhxue69uhkummnw3ezuamfdejslnn5ve'>nevent1q…n5ve</a><br/>_________________________<br/><br/>YEAAAAHH BUDDAYYY!!<br/><br/> <img src="https://image.nostr.build/bd8d52eade343e72f268a0d8bf4636661148a5b1c61429d96d4cf29d729f5cd1.jpg"> <br/> <img src="https://image.nostr.build/9789d25ab504db543d09d515ae5e9ba290483013cf4e210ba47cfb6ffeb50591.jpg"> <br/><video controls width="100%" class="max-h-[90vh] bg-neutral-300 dark:bg-zinc-700"><source src="https://video.nostr.build/335ff1e2aefe249ca7bb995a1b122bbd321601c162bf821622f8f79925ca373f.mov"></video> 2026-07-31T15:14:21Z https://njump.cloud.vinney.xyz/nevent1qqs8m7nk57szfj6vgx7t2xj2smvast5znu2tq50e4pvauead9uy9c5qzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62hr3j7y In reply to <a href='/nevent1qqsqxjxey5g9zd46trat00cf9jzhhspk7c6w7qp9nz5jnqrkyxk6y9cpz3mhxue69uhhyetvv9ujuerpd46hxtnfdushmj9c'>nevent1q…mj9c</a><br/>_________________________<br/><br/>All things considered, a relatively simple and highly secure choice is 2-of-3 multisig using different vendors.<br/><br/>If you use Sparrow or Nunchuck to make a 2-of-3 with different vendors, it’s super unlikely that any two of them will have an active vulnerability exploited at the same time.<br/><br/>I’d still recommend rolling your own seed material, but using multisig with a quorum of independent vendors is even better. 2026-07-31T15:12:52Z https://njump.cloud.vinney.xyz/nevent1qqsf7dqxa0xzs4pphhw669f8y5lnygc0r68jwqz05yckja6pj7nx9lgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62dzhsnu In reply to <a href='/nevent1qqs2laph4zggr3pdzgxva59knlu5v7cx64j6u6fmzt4etkxgh76qh5gpz3mhxue69uhhyetvv9ujuerpd46hxtnfdurgr04t'>nevent1q…r04t</a><br/>_________________________<br/><br/>Correct. If you have two different vendors that implement the same dice-to-seed algorithm, then, yes, you can put the same rolls into them and assert that they produce the same seeds. This mitigates the vendor-vulnerability class of bug we’re talking about.<br/><br/>In fact, this multivendor approach applies to other deterministic but opaque algorithms like seed-to-XPUB. If you put a known good seed into a device and it shows you an XPUB, how do you KNOW that that seed goes to that XPUB?<br/><br/>The only way to be sure is to replicate the result on multiple independent devices from different vendors. 2026-07-31T15:08:37Z https://njump.cloud.vinney.xyz/nevent1qqs2te52edyxa58wag3ypq0xj2a3stsr3sw4m9qf3dxv63uhcw0hqgszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62j60658 In reply to <a href='/nevent1qqsta3ztga2edl5vzm0snkjfcmp5jphkn9v02ml26t9g70c7jnj52xspz3mhxue69uhhyetvv9ujuerpd46hxtnfduffwr0p'>nevent1q…wr0p</a><br/>_________________________<br/><br/>It’s not just “move your coins”. You need to generate seed material using your OWN ENTROPY.<br/><br/>If all you do is move from ColdCard to a seed generated by SeedSigner or BitBox or Trezor, you haven’t changed your risk exposure to this class of vulnerability.<br/><br/>You’ve gone from one straw hut to another. 2026-07-31T15:05:09Z https://njump.cloud.vinney.xyz/nevent1qqsxlyl4q2smnw6uerhd39v9vvpx89vsgswcgp20uhk7689m0evkd7czyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62478277 In reply to <a href='/nevent1qqs0dkze5due3pp0tlljj6ss839jresu4vqh3hs9jkwmcf9gxvr4qccpz3mhxue69uhhyetvv9ujuerpd46hxtnfduky99wz'>nevent1q…99wz</a><br/>_________________________<br/><br/>It is indeed. You can run the SHA256-based code on two different devices and thereby verify that both yielded the same seeds from the same dice rolls.<br/><br/>If the devices are from the same manufacturer, then you’ve eliminated the possibility of only one of them being vulnerable. But you haven’t eliminated the possibility of vendor-level vulnerability.<br/><br/>So you need to run the same dice-to-seed code on two independent vendors’ hardware, without mixing in RNG data, to verify that yes, those rolls yield those words.<br/><br/>If one of your devices is ColdCard, what’s your other device? It needs to use the same algorithm for dice-to-seed as your ColdCard (though not necessarily the same exact implementation). 2026-07-31T15:02:07Z https://njump.cloud.vinney.xyz/nevent1qqsrektuy90hv3pvfvaf298uwlwl26xx2fxhnrutkxaqkzt5q76vd2gzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx620j9f8f In reply to <a href='/nevent1qqsxe832g0s3clmawkrvym4z3y24xeqkz7kn06ftvf52aakva4fqnvspz4mhxue69uhk2er9dchxummnw3ezumrpdejqp38nzr'>nevent1q…8nzr</a><br/>_________________________<br/><br/>Thank you for calling out the slop. I noticed too. 2026-07-31T14:42:07Z https://njump.cloud.vinney.xyz/nevent1qqszhhzte5gq4cwrqnzg95hr4ckdukq3dm3xhw5n8q8dvta6gkcrpzqzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62vzedk5 In reply to <a href='/nevent1qqsqqqpjzkga8sj8qmklg4vca8gnnsvuulun0m3zdamg0pvhqgsf3vcpz4mhxue69uhk2er9dchxummnw3ezumrpdejqx34qjk'>nevent1q…4qjk</a><br/>_________________________<br/><br/>That tracks. The OpenDIME uses entropy provided by the user in the form of an uploaded file. So yes, a bug reducing the entropy of random number generation shouldn’t affect it. 2026-07-31T14:40:45Z https://njump.cloud.vinney.xyz/nevent1qqsdcjqs70w0r9842fzrq7pqe2q4m7spmpdpde36lpkkglcq9efvtqqzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx629sxvr8 In reply to <a href='/nevent1qqszd08tav7adqy4vu3jc2j6fj25yyxjnquxjtjcjedcn5vtg4jq9scpp4mhxue69uhkummn9ekx7mqggwrsd'>nevent1q…wrsd</a><br/>_________________________<br/><br/>Too soon 😅 2026-07-31T14:39:26Z https://njump.cloud.vinney.xyz/nevent1qqswjynrfyqk68m6rnvg08h3mwqckvj3z9rmzvecd4xw2n3zkwy2ctczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx626tkk58 In reply to <a href='/nevent1qqsf2qvmhey4ujgj2jnqrndvtpyazt839dvas4az322j5r3daf748dgpz4mhxue69uhk2er9dchxummnw3ezumrpdejqzcpy2s'>nevent1q…py2s</a><br/>_________________________<br/><br/>Think of it this way: a single dice roll produces a number from 1-6. The information content of this is log2(6) = 2.585.<br/><br/>That is, each roll produces about two and a half bits worth of entropy.<br/><br/>A 12-word seed phrase encodes 128 bits of entropy. 128 / 2.585 = 49.516. So, yes, to generate a 12-word seed phrase, you need to combine the entropy from 50+ independent dice rolls.<br/><br/>The same logic holds for a 24-word seed phrase which encodes 256 bits of entropy. For that you need the combined entropy of 100+ dice rolls.<br/><br/>BUT the key factor here that most people miss is HOW those rolls are combined. Somehow, your sequence of dice rolls (5-4-5-2-1-…-6-6-4) has to be converted into words (bacon-celery-zoo-…).<br/><br/>If that mechanism is the hardware wallet, then you’re STILL TRUSTING the device, albeit a different code path. How do you know that those rolls produce THAT seed?<br/><br/>So yes, dice rolls are a big step up from just trusting the device’s random number generator. But you’re still vulnerable to other not-yet-discovered bugs in the hardware.<br/><br/>To immunize yourself from ANY hardware bugs, you have to roll your own seed material OFFLINE. 2026-07-31T14:37:47Z https://njump.cloud.vinney.xyz/nevent1qqsq0txes28pzuzgft3j7334s9e3p36277ggcs3n4qpj7a355vmly9gzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx629797c8 #Bitcoin #memestr<br/><br/> <img src="https://image.nostr.build/4ec5d49b697b306cc106508c113c2e85939e45ea541687342ec880345d5ef92b.jpg"> 2026-07-31T14:28:54Z https://njump.cloud.vinney.xyz/nevent1qqspumzulas7hgst8dwa0gz2wsetemz4t58lqhjmxh2nzv67tj6tgwgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx6267y0yl If you roll the dice and put them in the machine to produce your seed, you’re STILL TRUSTING THE DEVICE.<br/><br/>How do you know that those dice rolls yield THAT seed?<br/><br/>You’re out here thinking you’re paranoid using dice with a hardware wallet. I’m telling you, you are NOT PARANOID ENOUGH. #Bitcoin 2026-07-31T13:56:19Z https://njump.cloud.vinney.xyz/nevent1qqsgsg9apw7flmyz6zs8fr5jxdwxfqnyjrh75r8sydhgx9t4gcyef5szyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62mnh99n In reply to <a href='/nevent1qqsg70kmfp7hr0k844lc3hxcydaldwxg5qhww3v2txkzxm6ap0ac52qpp4mhxue69uhkummn9ekx7mqhc0tgt'>nevent1q…0tgt</a><br/>_________________________<br/><br/>Hear me out, but there are at least one more level of paranoia you’re missing:<br/><br/>If you put the dice in the machine to produce the seed, you’re still trusting the dice-to-seed mechanism. How do you know that those rolls go to THAT seed? 2026-07-31T13:53:44Z https://njump.cloud.vinney.xyz/nevent1qqsrlt3yu82p9qclkgl96w6jwrktdzcz9y7098ta68tu729pypkke2gzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62c74x5v In reply to <a href='/nevent1qqsfusqq7ncft6d2wth24jlr33u3624y5uv7vtz0y4ud8tezekwsgugpz3mhxue69uhhyetvv9ujuerpd46hxtnfduyk32al'>nevent1q…32al</a><br/>_________________________<br/><br/>The security of your Bitcoin rests on the entropy in your seed. For this reason, I advocate rolling your own seed without trusting any device to do that for you.<br/><br/>There are different methods for doing this. You can cut out all 2048 words, jumble them in a hat, and pull words out one at a time.<br/><br/>Or you can flip a coin 128 or 256 times and convert those flips into seed words (there’s a 1-to-1 mapping between 11 coin flips and a BIP-39 seed word).<br/><br/>Personally, I prefer to deal words using a regular pack of playing cards. I developed a system for this. All you have to do is print out the lookup table, then shuffle and deal two cards. Each two-card tuple yields one seed word.<br/><br/>For example, drawing the eight of spades then nine of diamonds yields “celery”.<br/><br/> <img src="https://image.nostr.build/e2748be44407b33651328661eef989e9091cd31f2b3afd4532b2bf4e19d34a7d.jpg"> 2026-07-31T13:51:17Z https://njump.cloud.vinney.xyz/nevent1qqst80vmsg6824n69jwqsncgz966w72x486k8l9mj7c08kq3h5rnwnczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62mup9w4 In reply to <a href='/nevent1qqsxx2k94gr27wpq0cy2jxk6p39s7cs3jxyjs9hwutrw5q6udcezhfqpz3mhxue69uhhyetvv9ujuerpd46hxtnfdux5lj8z'>nevent1q…lj8z</a><br/>_________________________<br/><br/>Not sure what relay I need to be on, but I can’t see the message you’re replying to. 2026-07-31T13:45:09Z https://njump.cloud.vinney.xyz/nevent1qqstyp2y09ezke26e076vgqq7k820ufc7av8cv4msptylulfyruyhcszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62ec3skn In reply to <a href='/nevent1qqs85rmhpj08defymt69gg3u9l9zvg9zxjrjzgn9pwep2wpfnggne8gpp4mhxue69uhkummn9ekx7mq4udq2v'>nevent1q…dq2v</a><br/>_________________________<br/><br/>The problem affects single-sig wallets generated by the ColdCard from March 2021 onwards.<br/><br/>Defenses include:<br/>- Roll your own seed words offline<br/>- Add entropy to seeds (dice)<br/>- Use a passphrase (25th word)<br/>- Use multi-vendor multisig<br/><br/>While it’s fine to change vendors, just changing vendors but sticking to single sig doesn’t protect you from future vulnerabilities like this being discovered.<br/><br/>The single, fastest, easiest mitigation is to roll a new seed with your own entropy and sweep your coins into it. 2026-07-31T12:55:56Z https://njump.cloud.vinney.xyz/nevent1qqs0gr2qeq0yfhv4gd4t33jpc0luy47ekust5y27r2uw6xkv5pmu8vszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62q9cgjm In reply to <a href='/nevent1qqsqqqzqpv8cyen4z3795x740qgraw5fj4a2mp942uxr4kpasss0n5gpp4mhxue69uhkummn9ekx7mqn39ju2'>nevent1q…9ju2</a><br/>_________________________<br/><br/>Multi-vendor multisig is even better. Any given provider may have a bug. Multiple independent vendors means you’re protected from any particular one. 2026-07-31T12:26:21Z https://njump.cloud.vinney.xyz/nevent1qqszhhe3ey360gyfqwq7r52ek578gy8ml72vfxesyh3j3exwpmk90xczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62j5m7kv In reply to <a href='/nevent1qqsqqqz7rdkhyp3depzygw8q0yyh70g2xslwvgll5377082c438kmfcpp4mhxue69uhkummn9ekx7mq6wjvze'>nevent1q…jvze</a><br/>_________________________<br/><br/>When you generate your seeds, don’t just let the device produce it. You have to add your own entropy in some form. Many people use dice rolls. I use playing cards.<br/><br/>Multi-vendor multisig is ideal. That way, if any particular vendor has a vulnerability (as in this case) your attacker still can’t move your coin. 2026-07-31T12:23:20Z https://njump.cloud.vinney.xyz/nevent1qqsp0yfy5rad7m24g56fdv23dm6kepf48ljfl36xkyf8g5a0n2m0kzgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62m3tjlj In reply to <a href='/nevent1qqsqqqq324geymuj7q9hz8j65xfevxuyujku9xpf2v8zn3cm6nm4ntcpp4mhxue69uhkummn9ekx7mq7l7s3h'>nevent1q…7s3h</a><br/>_________________________<br/><br/>If you used your ColdCard to generate a seed from March 2021 onwards, it was done without sufficient entropy.<br/><br/>This means an attacker may be able to brute force guess your seed and move your coin. It has already happened. It’s an ongoing, live exploit.<br/><br/>Only single-sig wallets are known to have been affected so far. 2026-07-31T12:19:19Z https://njump.cloud.vinney.xyz/nevent1qqs28vx5yu8e7svj6paxxrxg8mevcwprmuk8xrsgtvahuew8skcgs7szyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx624y3p9e Worried about your #bitcoin seeds?<br/><br/>Shuffle up and deal your own. <a href="https://jimbojw.github.io/seed-picker-solitaire/seed-picker-solitaire.pdf">https://jimbojw.github.io/seed-picker-solitaire/seed-picker-solitaire.pdf</a><br/><br/> <img src="https://image.nostr.build/6d0a8e8a7fef4f0680056870ce730601f24d2d2fe3c9dedeaff1f7b27f63339b.jpg"> <br/> <img src="https://image.nostr.build/bcaf4a86fc852d4542139e7e834d8b9798f51a53cbc9665971e2022fc5816966.jpg"> <br/> <img src="https://image.nostr.build/67a5ccdb2bf3f44bece7710f0d30e931a1506932acad5bfeb73ab44ed867d7ae.jpg"> <br/> <img src="https://image.nostr.build/c5be610ada77c456c10ddfb899a9e6821461f9d197a4a5cdb86401414931eaf3.jpg"> 2026-07-31T12:16:29Z https://njump.cloud.vinney.xyz/nevent1qqsrj93ks40eyh59kezdkh7vn85pqkrdwue0rqw6jfs9q98jhwxy0dszyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62ha7xq5 In reply to <a href='/nevent1qqs0r6dpwvxzrsgjvjeqaq7k0ehupt4mfa6akl4vlvqlcu9l043avyspz3mhxue69uhhyetvv9ujuerpd46hxtnfduvq0mtl'>nevent1q…0mtl</a><br/>_________________________<br/><br/>Well, here I’m gonna be a contrarian. Never share seeds.<br/><br/>Bitcoin is the world’s premier value transfer system. Transfer Bitcoin, not seeds. 2026-07-31T11:53:01Z https://njump.cloud.vinney.xyz/nevent1qqsr3c4vmu60xjp2gru4l3gnx8843hd43xej02e5zq804tflkh585gczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62w9kwr3 In reply to <a href='/nevent1qqsgzzde7qwz0h5xewsxdeu9n5l78amfyq5ca8kc6jsl2xhefdf48lcpzpmhxue69uhkummnw3ezuamfdejs23f4um'>nevent1q…f4um</a><br/>_________________________<br/><br/>Asking the important questions. 2026-07-31T11:51:47Z https://njump.cloud.vinney.xyz/nevent1qqs0g7jpfeayv294jhyujjg0m9squqjjpshd637txnsds5x5j3xllqgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62kvd403 In reply to <a href='/nevent1qqs8yf88s4h82n9mn47nwh7wjudpxkkftjvx986agemdnaeqpjepzzspp4mhxue69uhkummn9ekx7mqfxcevk'>nevent1q…cevk</a><br/>_________________________<br/><br/>Better late than never 2026-07-31T11:47:35Z https://njump.cloud.vinney.xyz/nevent1qqsz607g2ygv6aauheeza7zm7mmclqnsn2wjy93a7wgsd969v4l02sgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx6275cucm In reply to <a href='/nevent1qqsduzwgcj0vyxukghae3yngmggnwtx5nf3m5qrt4cuh5l3lugyty0qpz3mhxue69uhhyetvv9ujuerpd46hxtnfduw5repc'>nevent1q…repc</a><br/>_________________________<br/><br/>Tit for tat with forgiveness is the optimal strategy in repeated interaction games 2026-06-24T01:39:40Z https://njump.cloud.vinney.xyz/nevent1qqs232ls3xejrhtmkxhng4ya33h59u5zumpj983mrp9mz7wtrd650vqzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62ezxmjv Where were you in 1994? #asknostr 2026-06-24T01:38:09Z https://njump.cloud.vinney.xyz/nevent1qqsppw5xcf6wnvtzk22mjgrvsrf9rkm344r44xvrpwllahw42duefwczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62aphhq0 In reply to <a href='/nevent1qqsqqqpxxaxauy2nt3resh470ecx84p4zt56hc69shap7esdsf5tnsspzpmhxue69uhkummnw3ezuamfdejs4h44tp'>nevent1q…44tp</a><br/>_________________________<br/><br/>Not on my watch 2026-06-13T01:19:39Z https://njump.cloud.vinney.xyz/nevent1qqsqjuvx5wa6p79uveu7zy8zaksms2d5xd2mtw77va3ks7ln2safkdgzyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62amsd8r In reply to <a href='/nevent1qqsy2z3e5cwf64asf8yujg0llvfqz6c9hv6khvpsej9lc4yvdkazlhqpp4mhxue69uhkummn9ekx7mqw59xys'>nevent1q…9xys</a><br/>_________________________<br/><br/>It’s working now, but it’s been less than two hours.<br/><br/><video controls width="100%" class="max-h-[90vh] bg-neutral-300 dark:bg-zinc-700"><source src="https://video.nostr.build/f4c02a86d0ff1d72b91fc3e6150a2d1dd8ca2e7649bb63853e347b80d1670708.mp4"></video> 2026-06-12T16:46:14Z https://njump.cloud.vinney.xyz/nevent1qqsf580vsvuzswat2an35sxpkyz8rh8w8p4t24gl0kr2u2u2wzxq89szyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62n3k8m3 In reply to <a href='/nevent1qqs0852kfgksz6ku8g7q96vrr8rlswtmp00unyxgnwvj23jyv3lrl5spz3mhxue69uhhyetvv9ujuerpd46hxtnfdu7lql87'>nevent1q…ql87</a><br/>_________________________<br/><br/>Hermes? 2026-06-01T22:02:59Z https://njump.cloud.vinney.xyz/nevent1qqs0fe95w7mlle63gtqptkyvj8vajetn9g8kvnl64yy6q2rhh3d4ymczyps5q3uvntsj78gt2s88c4uqveyny753kpqtqlmm500dcdtu4vx62gk73t3 In reply to <a href='/nevent1qqs9lcuayd9maww8qqe6c2gc8pjmceqwvnxph4rlx80lk3lutfpllpcpp4mhxue69uhkummn9ekx7mqrclsl6'>nevent1q…lsl6</a><br/>_________________________<br/><br/>What are you using to build this? 2026-05-31T22:25:35Z