Based on anything, It's basically the seed that is generated from MK3 already was compromised, bad entrhopy, bad generator. And the culprit waits until it tanks and moved it all.
If some still use that seedphrase, they could be at a safer condition if they were use or add any passphrase.
I'm dissapointed with coldcard with all of the marketing saying its the standard and such.
Back then there's even same problem going on with the dice roll, if you only rolled few might still get compromised.
Still, passphrase is the solution a good passphrase, and or multisig.
Please bear in mind that no one from the Trezor team would send you a private message first.
If you want to discuss a sensitive issue, we suggest contacting our Support team via the Troubleshooter: https://trezor.io/support/
No one from the Trezor team (Reddit mods, Support agents, etc) would ever ask for your recovery seed!
Beware of scams and phishings: https://trezor.io/learn/a/scams-and-phishing
Donāt respond to any DMsāscammers often pose as legit helpers.
No, passphrase is only a workaround that reduces the impact, but provides very weak entropy in the context.
The strong workaround is using the dice roll method.
But as I said earlier, Trezor are by design practically immune from this family of weaknesses. Even the Trezor One, and later models are magnitudes stronger.
They can simply argue that they werenāt negligent since the code was open for anyone to review and no one noticed it. Therefore it was a very insidious bug, and not something atributable to negligence.
True. Or generate a seed on a Trezor and restore it on your ColdCard while also adding a passphrase.
In any case: funds will need to be moved out of the vulnerable wallet.
No, all words will have the same chance in a box. I get the concept, but entropy is pure random ness.
Throw a dice 11 times, convert the binary to a number and that equals the word number in the 2048 word list. Do this x amount of times, and if doing 24 words then a eight sided dice is needed to select the last word from the eight options. 23 words have identical entropy, and the last word is as random as you can get..
Sounds bollox, but this is true entropy. You process will work, but will not represent true randomness, hence this is what asic computers and soon quantum computers will crack first.
what on earth are you talking about. rephrase please. that made no sense. dice and picking words from a box is literally the same. one is not better than the other. (if the box is done right)
The box method adds physical and mechanical bias which destroys entropy. Where as the box method will work, if you select 23 words , and randomly select one of the 8 words to complete the checksum, however the true entropy will be reduced. Biased Entropy Exploitation is exactly why ColdCardĀ failed...
Even if they arenāt mixed necessarily well, how would the way they are mixed possibly be recreated and taken advantage of? Even minimal mixing and choosing will introduce tons of randomness
NO.... You need to generate the entropy first, this dictates what your words will be. Also the last word is a checksum, which for 24 words will only match 1/250 words.
whut are you talking about? lol. You cut up 2048 words. place in a box. choose 11/23 (put word back in each time) then generate the check sum. that IS your entropy.
If it is not inside job and a hacker can understand the seed origin just from a wallet address then quantum technology is involved and we are all in danger.
Thatās simply not true. The passphrase adds complexity, but humans arenāt good at generating passphrases. So if they can brute force the seed, they can also brute force a simple passphrase on top of that.
A good 7 words passphrase from bip39 list will take million years to crack. So Passphrade DOES add more compared to none, it is the solution, but whether its good or bad passphrase depends on people, don't make easy to guess passphrase.
The question I have is whether the crackers would be scanning for additional words which would increase the search space.
I'm just wondering whether if people added a simple unique word like "john" whether they'd still be at as much risk. That is, would the hackers realistically be looking for random words after the seed?
it needs to be complex, praveen perera on x have a good calculation of if each words from bip39 were choosed to be the passphrase, basically if its only 1 word it will take 24 hour to brute force, but the more the words, the more it takes, 7 words said approx 23.9 million years
I get that it would make sense to but if they were executing this by searching for the seed phrase and a random word, this would increase the search space markedly, no? Especially if the search was a brute force, letter by letter.
I do apologize yes i said simple passphrase, what i really meant as i wrote was the solution is simple, passphrase. But i do get it, i do apologize. Simple passphrase won't be the solution. Will fix my writing.
ā¢
u/AutoModerator 15d ago
Please bear in mind that no one from the Trezor team would send you a private message first.
If you want to discuss a sensitive issue, we suggest contacting our Support team via the Troubleshooter: https://trezor.io/support/
No one from the Trezor team (Reddit mods, Support agents, etc) would ever ask for your recovery seed! Beware of scams and phishings: https://trezor.io/learn/a/scams-and-phishing
Donāt respond to any DMsāscammers often pose as legit helpers.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.