Quote from: Pmalek on Today at 03:33:23 PM

Quote from: o_e_l_e_o on October 24, 2023, 07:01:11 PM

Talking of generating a seed phrase with dice, I just stumbled across this post on Reddit: https://www.reddit.com/r/coldcard/comments/17epqk8/040_bitcoin_taken_instantly_from_my_coldcard/

OP used a single dice roll to generate his seed phrase. He rolled a 5, used that as his entropy, and had his funds immediately stolen. Obviously it's a failure on OP's part to understand what is going on, but it's also a massive failure on Coldcard's part that it let him proceed to generate a seed phrase using a single dice roll.

Very bad situation that would have been easily avoided if the user had simply calmed down, used common sense, and done some research. Coldcard has videos and documentation explaining the process of rolling dice and generating a seed from dice rolls. He didn't bother checking any of that, and was more concerned getting his money off his Ledger as soon as possible, even though there isn't an immediate threat.

Coldcard is partially to blame for allowing it, but that's what you get if you want absolute control. I am not a Linux user, but I know the system gives you much more freedom than Windows. That also means a possibility of making serious self-destructive mistakes.

Handing over freedom to users; decentralization. Still has disadvantages as self-destructive mistakes. Most cold card guides I've read suggest for 100 rolls or more, but from his responses he never looked into it. He thought it'll be just like his ledger wallet experience. I'd support one of the responses on the thread; saying that inexperienced users should use the coldcard generated seed phrase. Instead of using the rolling dice feature of generating seed phrase. He shot himself on the leg trying to increase the security or entropy of his seed phrase; make it hard to guess or brute-force. Cold card is not to blame. It's not their responsibility. As they were not present with the user to guide them physically, on how to use the dice generated seed feature. With their true random number generator in the hardware chip. The hardware's seed picking methods are still secure against attackers. Not every user can boost the entropy of their seeds using the dice. How then can CC help them? It's now a personal encounter or issue. It would have been better if the victim imported seeds from his previous wallet. The dice generated seed phrase is easy to guess if the user is not experienced at generating entropy. It'll be a better security development if they restricts users that use a single dice roll to generate seed phrase.