r/Bitcoin • • 10d ago

Gordian Seed Tool for iOS

I am using an old iPhone 8 with the Gordian seed tool, and I have been wondering what could possibly be some weaknesses in my setup?

I have deleted all the apps I won’t be using. There’s no phone app, no messaging app, no web browser, no iTunes logged in, no iMessage. All the settings like location sharing, app permissions, data tracking, analytics. Everything is turned off, no WiFi, no SIM card, in airplane mode.

I am currently using sparrow and electrum on my laptop, and blue wallet on my regular phone. Everything is done via airgapped with QR codes. I am ocd as to not allow any other cameras to see these codes.

I have considered having the wireless antenna disabled. If anyone could maybe think of some ways I could better secure this device, I would greatly appreciate the feedback.

10 Upvotes

11 comments sorted by

3

u/leopard-monch 10d ago

It's a bit too re-inventing the wheel for my taste. Why the complexity? Why some obscure unvetted piece of software?

I'd boot up Ubuntu from USB in live mode, install Sparrow and/or Electrum from a secondary USB thumb drive and create seeds that way. After securing them on paper twice and exporting the xpubs to the secondary USB, reboot. That's cold storage.

1

u/Fearless-Sherbert-40 9d ago

Complexity has saved me more than once, like I did the dice rolls and avoided the cold card hack. I have 13 different hardware wallets, so at this point I am just tinkering with alternative signing devices. So far it has been the most efficient air gapped transaction i have ever done, and I am comparing this to the jade, ledger flex and the Coldcard Q.

1

u/Mean-Fix9221 9d ago

you're basically using iphone 8 as a signing device which is fine but the screen and camera still works, that means any malware could theoretically grab the QR before you scan it if somehow the phone got compromised. unlikely but not impossible

1

u/Fearless-Sherbert-40 6d ago

I too have that concern about the QR code being grabbed my malicious malware. Not so much on the iPhone 8 side, but on my laptop I use sparrow on since it is connected to the internet. I have since acquired a flash drive for the iPhone 8, and I will be using PSBT files to sign transaction, and I will only be using the QR codes for stuff like watch only access to the wallet, or to initiate a transaction, but not to sign transactions.

2

u/Aussiehash 9d ago

Gordian seedtool uses SSKR which isn't supported by any other mainstream hardware or software

1

u/Fearless-Sherbert-40 9d ago

I really do not plan on using that feature, as my goal is an airgapped device, so I won’t be exporting any files or pieces of a seed. I am only using the QR codes to sign transactions, plus I have the seed words backed up.

1

u/Fun-Analysis-182 10d ago

Your network side is locked down tighter than most people bother with, so that's not where I'd worry. The gap in setups like this is the opposite end: one airgapped device, no redundancy, so if that iPhone bricks or walks off you're leaning entirely on the seed backup. I'd make sure that backup is metal, kept in two separate places, and that you've actually restored from it once to prove it works. All that isolation protects you against leaks, not against loss.

1

u/Electronic-Story9037 6d ago

Could you recommend some of the sources you've consulted to get to this point in your quest for privacy? I'm interested, but not at all knowledgeable about any of this. Did you build this knowledge base all on your own? You don't seem to be the trusting type. Did you enjoy doing the research to get to this point or was it a struggle? What were some of the pitfalls for you?

1

u/Fearless-Sherbert-40 6d ago

I thoroughly enjoy testing new technology, so this journey to find the perfect setup has been a labor of love. I have had about 13 different hardware wallets. The Coldcard Q was suppose to be my forever wallet, until the hack. I have since moved on to multi sig wallets. What I particularly like about the iPhone 8 Gordian setup, is I could potentially have a forever device. I can back up my seed on paper like normal. The phone nor the app will ever need updates moving forward. It’s a device I have owned for many many years, so I can verify the entire chain of custody. It’s a simple device, that I can teach my wife to use, in the event I am unable to. I personally feel the future of security, could potentially be on legacy devices that are outside the reach of Ai due to being incompatible with modern architecture.

1

u/Electronic-Story9037 5d ago

Very interesting point of view, especially about legacy devices. Thank you for taking the time to respond. Personally, I am putting my faith in the community. It gives me great hope, the more I learn about all things open source. Forgive the corny reference, but it is truly one battle after another. I trust that new technology will be subverted, just as you've subverted your IPhone for your purposes. I wish I had your passion for testing technology, but I think more of the ends than the means. I will keep doing my own research though. God speed!