matt
Matt Corallo

I mean as a simple v1 we could just replace it with BOLT 12 as-is? It’s pretty simple to swap in, and BOLT 12’s reusability + proof of payment means you could still announce the zap on nostr.

2024-08-22 17:04:50

Today you can see the lightning nodes that ship fixes for novel attacks quickly (eclair and LDK, which did some force closures as a result of the fix) and those that don’t respond to security issues after months.

2024-08-07 22:34:32

- reply

I mean the power available to do that from inside a hardware wallet is probably not gonna make it far enough for much anyone to do much with it, doubly so if you only have a relatively limited time to get it through before you run out of power.

2024-08-06 21:38:42

- reply

Sadly no implementation exists for Taproot AFAIK, but the BitBox folks have a PR to secp256k1-zkp at least.

2024-08-06 21:37:52

- reply

Yea, I mean it’s not like anti-exfil is perfect it doesn’t have UX challenges in some specific use cases, would be great to have someone who doesn’t use it on, eg the Jade folks only use it when plugged in, not in air gapped mode.

2024-08-06 21:37:06

- reply

Not as a full-timer, but I’ve helped several hardware wallets in the design stage and have built Bitcoin wallets (and basically every other kind of Bitcoin protocol) over the past ~14 years.

2024-08-06 21:36:11

- reply

Yea, someone probably should. Probably one of the hardware wallet vendors who are complaining that there’s no standard and that’s why they never bothered to implement it (nevermind that it’s implemented in secp256k1-zkp and can be done at the HWI driver layer, but indeed it’s be better as a PSBT field).

2024-08-06 21:30:37

Look like @npub1az9…m8y8 is avoiding opinions he disagrees with on his podcast, so which one should I go on instead to talk about hardware wallet issues? https://image.nostr.build/e73fac49e7e40f67b1d0f2842f63ed3dd96e23649cf60a85575481177c88a847.jpg

2024-08-06 21:21:47

- reply

The issue with exfil is that the computer can’t detect whether the nonce is malicious or not, so it can’t block the attack. What you really want is for the nonce used to sign to be provably random, by simply having the computer add some of its own randomness to nonce, plus some deterministic message+pk hash from the hardware wallet (ala 6979). That way the HWW cannot exfil.
While you’re at it you should also include randomness from the computer in the seed generation process so that the private keys themselves don’t rely on only the HWW.
Neither of these are complicated, FROST is built around the same kind of nonce agreement protocol and including the randomness from the computer in key gen is just a matter of adding a second private key.

2024-08-06 20:38:27

- reply

I understand the data to be signed and tied to an Apple ID. It may well also be tied to some per-device factory-sealed key. I mean you can always buy 256 real AirTags but hardware modifications are much more likely to be detected than software ones.

2024-08-06 20:11:04

- reply

My point was I’m not sure you can pretend you’re *any* devices without being an Apple device. In any case #nevent1q…8fpa

2024-08-06 20:10:06

- reply

If you sign on two devices and check that they match, yes, that addresses the issue, but now you have two devices with your seed and a very annoying UX (that might also fail due to fine signature grinding differences).
Really HWWs need to implement anti-exfil and generate keys with computer randomness - there’s no excuse for the fact that hardware wallets are trusted, they don’t need to be!

2024-08-06 20:08:12

- reply

You can definitely include a GSM chip for cheap, but now the device board actually looks visually different, which people can identify, even if admittedly relatively few would. Still, if you did this en-masse it’d likely be discovered before too long, whereas a malicious firmware likely would not.

2024-08-06 19:05:08

- reply

It’s also implemented in secp256k1-zkp.

2024-08-06 19:04:34

- reply

Any method of cooperatively building a nonce (eg stuff things do for FROST, it’s the same problem).

2024-08-06 18:50:44

- reply

In theory, but I’m not sure if you can transmit arbitrary messages over that without being Apple.

2024-08-06 18:46:43

How about you have me on your bitcoin review show and we chat about it in detail so we can get into all the technical details and how realistic various attacks are :). #note1ftm…k6qd

2024-08-06 18:45:47

- reply

AFAIU you can implement it entirely in the driver rather than in the wallet itself (BitBox apparently did this for their HWI driver).

2024-08-06 17:35:07

- reply

Except you aren’t…it’s very (cryptographically) easy to build a hardware wallet which cannot steal your coins*! But no one does, that’s absurd!
* without cooperating with your computer/phone.

2024-08-06 13:37:39

- reply

No? Sparrow supports anti-exfil with BitBox Afaiu.

2024-08-06 13:37:12

- reply

You can just download those software packages once and rarely upgrade and you’re safe. Unlike a compromised HWW which can lie to you about the status of its firmware.

2024-08-06 13:36:07

- reply

Multisig is, passphrase is not.

2024-08-06 13:35:45

- reply

That’s not a scalable attack. In that model the attacker has to be kinda nearby when you use the HWW.

2024-08-06 00:13:49

Oops, sorry, I forgot we can fix both sides of malicious hardware wallets - a malicious hardware wallet should not be able to steal your coin, it’s not complicated to force attackers to compromise both your computer *and* hardware wallet, but current devices just…. Don’t. That’s embarrassing!
(Except for multisig setups). #note1m80…ga9y

2024-08-05 22:38:11

- reply

A Laptop is not a device purpose-built to store millions of dollars in bearer-assets. It’s a much less juicy target.

2024-08-05 21:35:20

- reply

Yes, hence why I’d call them “incompetent bordering on malicious” :)

2024-08-05 21:34:44

- reply

#nevent1q…5896

2024-08-05 21:23:02

- reply

With verified software, much better than most hardware wallets.

2024-08-05 21:15:28

- reply

Nope.

2024-08-05 21:08:58

To be fair to BitKey and one or two others, this attack doesn’t apply to Multisig wallets, anti-exfil doesn’t actually matter if you’re not doing single-sig.
So the acceptable-security hardware wallet list is BitKey, Jade, and BitBox. #note1m80…ga9y

2024-08-05 21:07:01

Hardware Wallets are devices designed to hold bearer assets which can be trivially stolen if you leak the private key(s). There’s many, many people involved in the manufacture of each hardware wallet, each of which might wish to make free money by backdooring the hardware wallet. For every other hardware wallet, you’re blindly trusting Amazon/UPS/five factories in China/the webserver you got the firmware from/etc/etc. Sure, most hardware wallets have tried to be robust against these attacks, but there’s frankly just not that much that can be done.
Wouldn’t it be nice if you didn’t have to trust the device at all, but rather an attacker would have to compromise *both* your hardware wallet and your computer? Well, we’ve had the tech to do this for many, many years! The fact that only two hardware wallets bothered to implement this boggles my mind. It’s impressive incompetence, bordering on maliciousness, honestly. #note1674…l5y4

2024-08-05 21:02:28

- reply

Any hardware wallet could have implemented anti-exfil signing at any point in the last 5 or more years, with minimal/no UX change. The fact that none bothered is sheer incompetence bordering on maliciousness.

2024-08-05 21:01:09

- reply

They bothered to implement anti-exfil (provably random nonces). This means that a malicious firmware or even malicious hardware wallet can’t steal your coin! For every other hardware wallet, you’re blindly trusting Amazon/UPS/five factories in China/the webserver you got the firmware from/etc/etc. The idea that none of these parties have anyone working there who might want to go steal people’s coin is absurd, frankly.

2024-08-05 20:56:03

Stop using hardware wallets that don’t take security seriously (sadly, all of them except Jade and BitBox). This is a novel construction, but the class of attacks is very old.
A laptop purchased in person, immediately installing Linux without ever connecting it to the Internet is a much better way to store coin than hardware wallets. Which, frankly, is just embarrassing incompetence for the hardware wallet industry.
https://darkskippy.com/

2024-08-04 21:09:20

- reply

It’s the “custodial” requirement here that gets you no answer. Ignore that and there’s a few Breez SDK wallets, some LDK-node ones coming soon, plus Mutiny, Phoenix, etc. custodial wallets aren’t legal without KYC most places in the world…

2024-08-03 06:36:00

Nothing beats left-side LaGuardia approach on a clear day/night.
(This is a wide-angle lens, you’re really right over Manhattan) https://image.nostr.build/75c7c981ea09f36adf001e0d5f8db8d47e914710036fa255d84ad3599dc269b1.jpg

2024-07-28 23:24:14

Final reaction: wow, Trump’s team really doesn’t understand bitcoin at all. So much for them being assisted by bitcoiners. #note1e0e…34m2

2024-07-28 03:24:56

- reply

I can never tell if this is just the pain of being a bitcoiner or if we’re just wrong…

2024-07-24 14:30:51

Remember that there are likely to be many Bitcoin Whales in Nashville, making its prime target. Leave your keys at home. Assume your laptop will be backdoored if you leave it alone. Be aware.

2024-07-23 17:01:10

- reply

No #nevent1q…syl7

2024-07-23 17:00:47

- reply

He dropped out a long time after the assassination attempt (in political time) - after the RNC and getting covid (which may well have him quite sick right now). He also dropped out at basically the last possible minute before the (now-delayed) online delegate voting for the formal Democratic nomination starts. The pressure for Biden to drop out got its loudest late last week, right before he dropped out.

2024-07-22 23:45:13

- reply

Sadly it’s on-chain or, in the future, BOLT 12. Some wallets support lnurl for this but it’s a bit spotty and don’t think it’s growing.

2024-07-22 23:44:09

- reply

Wrong lol

2024-07-22 23:43:57

For those impacted by the Swan news, I’m sorry. Layoffs suck when you did nothing don’t.
But, Spiral is still hiring for LDK engineer(s) as well as the “wizard” role!
[email protected]

2024-07-21 23:16:09

- reply

You can vote write-in and vote literally “none of the above” (or anyone, my grandfather has recently taken to voting for his friend down the street).

2024-07-21 02:07:40

- reply

Its the “selecting a custodian you trust” part that makes the UX impossible to build :(

2024-07-18 21:18:46

- reply

Not if we get Dimon at Treasury. That would be worse than Mnuchin, probably, and definitely worse than Yellen.

2024-07-18 21:00:36

- reply

I mean I’d call Oblivious-(DNS-over-)HTTP a VPN/proxy? People can do that if they want.

2024-07-18 20:58:46

I’m already worn out from Nashville and I haven’t even gone there yet.

2024-07-18 17:25:18

- reply

Meanwhile tons of bitcoiners are still frothing at the mouth for him after the news that he’s considering someone who hates Bitcoin for the role which impacts Bitcoin the most 🤦‍♂️

2024-07-18 14:30:32

- reply

Then bitcoiners need to fundamentally change what they work on. Mining centralization is a joke, mints creating more custodial operations 🤦‍♂️…. People keep saying this but bitcoiners are not building like it’s true.

2024-07-18 14:27:22

- reply

😂

2024-07-18 14:22:51

- reply

Absolutely, without question, worse.

2024-07-18 13:35:20

Ha, if this is true another Trump administration will be worse for Bitcoin than the current Biden one 🤦‍♂️ https://image.nostr.build/17daa5d6e6e976744ddd064c437e2c3c135db0d5abed093108151c1399e5d46c.jpg

2024-07-17 14:49:51

- reply

Ah, I missed the header/author, sorry! I don’t disagree with his conclusions, but my point was rather different :)

2024-07-16 22:00:42

- reply

You might be surprised :)

2024-07-16 21:43:58

A lot of people talk about “attacks on bitcoin”, but they’re usually just people doing something you don’t like. In rare cases, though, these things can have severe consequences for the entire Bitcoin system.
This is what an attack on Bitcoin looks like https://github.com/rollkit/rollkit/issues/761#issuecomment-2195853303

2024-07-16 21:42:24

- reply

Have you ever taken a serious look at TLS/X.509/Certificate Authorities/DNS Poisoning/BGP Hijacking……..? :)

2024-07-16 21:27:55

- reply

Bitcoin is comparatively simple! Lightning maybe less so 😅

2024-07-16 20:31:48

- reply

They is a political standards organization that is the successor to the people who invented http :)

2024-07-16 19:38:15

- reply

They’re moaning about people having to make sure their site works with TLS? Seems like a weird complaint. My issue is that TLS is an overcomplicated beast of a protocol (okay somewhat better with 1.3, but even still), which is the enemy of security, we have like 100 “roots of trust” in the form of CAs, most of which have a long history of being terrible, it relies on too many pieces of an increasingly huge stack, etc….

2024-07-16 17:42:27

DNS is so much less complexity/attack surface than HTTPS. HTTPS/TLS are terrible protocols that should be constrained to web browsers. #note1rqz…kqc7

2024-07-15 00:21:14

- reply

The one good thing GDPR did was make almost all domain whois private by law.

2024-07-15 00:19:53

- reply

Yea super trivial…

2024-07-14 05:43:37

- reply

Get any domain, enable DNSSEC, add a Bitcoin: URI to username.user._bitcoin-payment.yourdomain in a TXT record. Done.

2024-07-13 16:07:19

- reply

You can also now use https://satsto.me which should give reasonable error messages (currently says “The server indicated the records we needed were not DNSSEC-authenticated” for the example name you gave).

2024-07-13 14:09:53

- reply

Don’t have a specific one to recommend, but googling “bind authorative server” should turn things up.

2024-07-13 00:25:42

- reply

For what? Running bind?

2024-07-13 00:21:24

Curious about this new BIP 353/Human Readable Names thing but don’t have a wallet that supports it yet? Want to see if you set it up right?
Head over to https://satsto.me/ to resolve them to legacy addresses!
It’s not just BOLT12, either, any reusable bitcoin addresses can go in there (but preferably ones that don’t cause on-chain address reuse)!

2024-07-12 19:18:29

- reply

I have seen no performance issues hosting a few million records on RPis for https://bitcoinheaders.net/
But, BIP 353 does contemplate doing multiple users in a single wildcard record.

2024-07-12 19:17:17

- reply

There’s absolutely no limit. Some hosting providers add arbitrary limits but even the entire Bitcoin header tree in DNS records running in BIND is like 1G of memory…
https://bitcoinheaders.net/

2024-07-12 19:16:10

- reply

That’s a technical/encoding detail that’s not really relevant. In practice a TXT record is a blob of data. Whether it’s encoded as multiple blobs or not doesn’t matter, things work just fine :)

2024-07-06 17:32:17

- reply

Why not just go the LNDK route and use the LDK BOLT12/onion message code (which is usable directly without the rest)?

2024-06-29 18:19:11

- reply

Go reread the op :)

2024-06-29 14:05:46

- reply

If you think the American Red Team are pro-freedom and the American Blue Team are anti-freedom you may want to get checked for brain worms. Neither is even remotely close to that consistent and both are pro- or anti-freedom on various specific issues. Bitcoin can absolutely speak to both of the American partisan teams depending on which features and groups of people you focus on.

2024-06-28 20:14:14

- reply

Suggesting that Liberals (not liberals) have nothing to like about Bitcoin is short-sighted and lacks creativity. There have been literal books written on this topic.

2024-06-28 04:45:31

Absolutely without question. The worst thing for bitcoin is that it continues to be more and more a partisan issue. #note1umd…6rz2

2024-06-25 21:01:44

- reply

Ah, yea, okay, .xyz gets used by spammers a *ton* so I think they did this to fix their spam problem (lots of people just block *.xyz these days), but what a terrible idea…

2024-06-25 20:59:30

- reply

When in doubt, use .org for infra domains, always.

2024-06-25 20:59:10

- reply

Oh wild, seems that registry is super obnoxious. 🤦‍♂️

2024-06-25 16:35:25

- reply

Is there any more info available here? I’m somewhat surprised to hear (and Google doesn’t seem to have any results for) a TLD seizing a domain outright. I could see a shitty registrar (GoDaddy or whatever) doing so, however.

2024-06-25 15:03:00

- reply

Shouldn’t really be a huge deal? The node will just connect outbound from a new IP instead.

2024-06-24 23:21:11

- reply

Only you deserve it.

2024-06-24 22:49:41

Y’all don’t deserve a bull market

2024-06-22 07:47:33

- reply

Sooo…no one who isn’t super pro-OP_CAT?

2024-06-18 04:23:45

- reply

It’s always how slow CI is, but somehow when I run it on an RPi it still never fails. I struggle to understand where GitHub gets machines as slow as Actions runners, but I guess we get what we pay for.

2024-06-16 14:49:03

- reply

Like Dann Francisco during burning man, where you can find street parking everywhere. Aka Parking Man.

2024-06-11 13:15:20

- reply

Sure, creative lawyers are great, but my note was this doesn’t scale, not that it can’t be done. After a certain scale creative reinterpretations of the law results in jail time :(

2024-06-11 04:37:40

- reply

Right, this isn’t buy-and-withdraw, this is operating a server that enables people to exchange funds while remaining wholly custodial…. Let’s not get excited, this cannot scale without jail :(

2024-06-10 17:15:12

- reply

Is there a jurisdiction where a bank could run a mint? I’d think operating a mint clearly violates AML regulations in every reasonable jurisdiction in the world.

2024-06-10 03:19:18

- reply

Human-Readable names as a part of it, hopefully :). Then there’s one recipient name and it can pay both SP and BOLT12 instructions.

2024-06-08 03:27:02

Make Plebnet Great Again

2024-06-06 16:48:15

- reply

What if (though no specific proposal I’m aware of does) something were to enable that while also offering some great bitcoin scaling solution that allows for fast noncustodial transactions without regulatory questions or onboarding fees?

2024-06-06 16:38:37

- reply

I don’t think it’s quite that simple. Things may have value to both camps.

2024-06-06 14:59:32

I legitimately can’t tell if the Taproot Wizards people are trying to tank any chance of OP_CAT activation by running around claiming their for-profit company is going to forcibly activate a bitcoin soft-fork or not. https://image.nostr.build/ea501b727543d8d43b9deef73c44976f622e2a43393d83f8589a4a762c00dd7f.jpg

2024-06-06 13:36:09

- reply

Indeed, may legitimately be the case.

2024-06-06 04:31:34

Rollup sequencers are MSBs.

2024-06-03 02:50:01

- reply

Of course, I agree with you, we need something more than just lightning, but we haven’t found it yet, covanents or no.

2024-06-03 02:49:12

- reply

I’m not convinced any of the options “opened” by CTV are going to hugely move the needle, honestly. There’s some marginal gains to lightning and mayybbeee timeout trees are compelling, but there’s big regulatory questions there and the trust model isn’t as great :/

2024-06-02 17:03:31

Yay we’re back to segwit2x with fork proponents pushing their narrative in the press. https://archive.is/20240601112759/https://www.bloomberg.com/news/articles/2024-06-01/bitcoin-debate-heats-up-over-software-revamp-to-add-new-features