Quote from: BlackHatCoiner on April 26, 2022, 07:23:00 AM

I know it sounds paranoid
~
Couldn't one of all these hardware wallet companies implement something like that and steal millions of dollars worth of BTC, in just one moment?

That's always on my mind too. I use hardware wallets, but it always feels like I can't fully trust them.

Quote from: Welsh on April 26, 2022, 09:33:06 AM

I'm not sure how plausible this kind of attack would be though.

Not knowing is what makes me paranoid Wink

Quote from: bitmover on April 26, 2022, 05:20:15 PM

I took a look at ledger nano and trezor hardwares. I found that there is a certification called AIS31-certified RNG which is the best in the world when talking about entropy.

Quote

embedded in the Secure Element

Can you check if it's actually in there? What if some of the devices are shipped with a compromised RNG?

Quote from: BlackHatCoiner on April 27, 2022, 12:25:07 PM

If, say, Trezor is proved to generate predictable entropy and steals everyone's funds in just one moment, it'll harm the entire bitcoin economy.

Isn't it much more likely to happen from a software wallet? Say someone manages to push a compromised update, that uploads the wallet when it gets unlocked.

Quote from: NeuroticFish on April 27, 2022, 12:31:12 PM

In theory if they do this, the seeds the devices will generate will be a rather small subset of all the possible seeds (so they can brute force them in a reasonable amount of time).
However, if this would happen, there's a very big chance collision would happen, and rather often, between different users' seeds/wallets. If this happens, most do post about it (especially if it's them losing money).

This is a good point. To prevent a collisoin, the number of possible wallets has to be much larger than the square of the number of wallets they sell. So, say they sell 10 million wallets and want less than 1% chance of a collision, there should be at least a billion different combinations per existing hardware wallet. That's still possible to brute-force, but doing all of them would mean 10¹⁶ combinations.

Quote

Imho for now it's pretty safe to assume they did play fair until now.

I think so too.

Quote from: kaggie on April 30, 2022, 08:07:24 AM

The best route imo is to color one kind of randomness with other kinds of randomness. If one sensor is mostly random, then are two sensors more random?

One easy way to do that is by creating a split-key vanity address. If you create both parts on different hardware with different software, it doesn't matter if one of them is compromised.

I find it easier to trust generic hardware (and software for that matter), than anything dedicated to Bitcoin. Just like I find it easier to buy generic hardware than buying a hardware wallet. I don't mind that any shop knows I own a printer, but I wouldn't want them to know I own a hardware wallet.

Quote

The generation of random numbers is too important to be left to chance.
Robert R. Coveyou, Oak Ridge National Laboratory