Quote from: Meuserna on February 13, 2025, 06:50:11 PM

How can it be hacked if it's not connected to the internet and if the seed & all user data gets wiped when the device shuts down or reboots?

I don't know. Hopefully, it can't and never will be. Remember the saying, "where there is a will there's a way." BobbysTransactions mentioned one possibility in his post just above yours.
[/quote]

I think you might be confused by my post since I said I use a hardware wallet you're not familiar with.

Krux is basically SeedSigner, with encryption and more options. If you have a SeedSigner already, you can do what I do by using the Earthdiver SeedSigner fork, which adds encrypted Seed QR and passphrase QR to SeedSigner.

Here's what BobbysTransactions said:

Quote

This is all irrelevant if the Kendryte K210 chip on your device is hard-coded with a back door to leak your private key subliminally in a signed transaction.

He's not familiar with this stuff at all.

First, K210 devices aren't hardware wallets. They're primarily used to make DIY toy robots and old school 1980s style handheld video games. The devs at Krux realized some K210 devices have a camera and a large screen, which makes the ones with no radios perfect for DIY airgapped hardware wallets. Remember, we're talking about devices that cost as little as $35 (though I don't recommend the $35 ones. They're tiny and don't have a touchscreen - they're more like a Jade).

Second, unlike some hardware wallets, not only is every line of code open source... the device also shows you everything on a large screen, and the output is plaintext converted into a QR code.

Don't trust the QR code? No worries. Turn it into text and check it. As the saying goes: "Don't trust. Verify."

Also, Krux isn't an app. It's the OS, which means it's not being run on top of some other OS. That's a benefit too.

As for encryption of the seed phrase QR: your choices are ECB or CBC, Iterations: 100,000 which you can raise.

Krux is legit. 100% open source. They've won grants from OpenSats and have even received high praise from NVK among others (which is kind of funny since Krux is more advanced than ColdCard, at least in some ways).

I think people fall into the trap of being brand loyal. It's like how they join team red or team blue, politically, and end up fighting against their own interests because they're on team elephant, or whatever. There's so much "For the brand" stuff these days. I'm not that guy at all. I also see a lot of guys who care more about cool gadgets than actual security. We see this every time a new hardware wallet is released. I can't relate to that at all. At least, not for securing my Bitcoin.

When it comes to securing my Bitcoin, I look at the challenges - and there are many. I then research to figure out the best model that suits my needs.

Weak passphrases are easily hackable, but most hardware wallets make entering a passphrase annoyingly hard, so most people use weak passphrases. Not me. No way.

Saving your seed on the device means needing to secure the device, because any device is hackable. And if the seed is encrypted on the device using a PIN code... yikes. That's just a few numbers to secure a wallet. It's fine if that's good enough for somebody else, but it's not for me.

Trusting any closed source code is a no for me. Bitcoin is open source. The code I use to secure it is open source, including both my hardware wallet and also the watch-only companion apps (BlueWallet, Sparrow, and occasionally Electrum).

Having deterministic backups adds a layer of redundancy if anything goes wrong. I think that's a huge benefit, though it's definitely advanced stuff. It's also only for redundancy in my setup. It's not my primary backup.

Last but not least, it's important to me that I never have a copy of my seed in unencrypted text form anywhere other than locked in a safe or safe deposit box. And even the seed in my safe & safe deposit box requires a passphrase.

If you've never tried SeedSigner, I'd highly recommend it. Krux is like a deluxe or a pro SeedSigner.

Remember the feeling you had when you first understood Bitcoin? That sort of "Oh, wow" feeling, when it suddenly made sense? That's what I felt when I found Krux. It was like, "Oh, wow. This feels so obvious." Fully airgapped, with options to also be Stateless, Deterministic, and Encrypted. And yet, it's super easy to use because they stuck to Bitcoin standards and best practices rather than using proprietary ways of doing things. It's great.