They say that when you don’t like something, you should build your own. Well, Satoshi Labs (the company behind the Trezor hardware wallet) has announced the launch of Tropic Square: a new project which aims to create truly open-source and transparent chips.
This sibling company would effectively remove the need to sign NDAs and trust third parties, by integrating public peer-review and helping the end-user avoid blind trust in certifications that they can’t verify themselves.
Tropic (TRuly OPen IC) will support the development of more secure Trezor hardware wallets, and also advance the entire chip-manufacturing industry. If the project succeeds, then all hardware wallet companies will benefit from this type of innovation because everything is transparent and open source – just like the Trezor devices have been since launch.
The story of the Tropic Square project echoes the spirit of many Bitcoin ventures: a group of disillusioned people can’t find off-the-shelf chips to satisfy their transparency demands, isn’t not happy with the idea of signing NDAs (non-disclosure agreements), and therefore they decide to start doing the research necessary to build their own chips.
“We want to provide access to design specification, verification, and testing without obscurity”, says Tropic Square’s launch video. And it’s going to be interesting to see to which extent the company succeeds in delivering chips that fit this philosophy.
What does Tropic Square mean for Trezor and hardware wallet security?
Trezor has always prioritized transparency and accountability over hardened physical security on their devices. As co-founder and inventor Slush has explained in S4 E8 of the Bitcoin Takeover Podcast, there’s a huge tradeoff involved in using secure element chips and it works against both the company building devices with the chip and the customer who blindly trust certification.
Yet this came at the cost of receiving bad PR each time someone gained physical access to a device and extracted the seed phrase from the chip. The wallet.fail team has hacked the Trezor, Josh Datko and Chris Quartier have exposed vulnerabilities during the DEFCON 25 conference, and more recently the Kraken Security Labs have brute force attacked the PIN of a device.
While it’s true that Trezor has never claimed to be physically secure, their competition has quickly moved on to adopt more or less transparent secure element chips. Ledger is at the lack of transparency extreme with a black box design (that, to their credit, wasn’t hacked yet), while BitBox, Coldcard, and Cobo use a hybrid approach which open sources some parts of the design.
As he revealed during his Bitcoin Takeover interview, Slush did create a secure element prototype of the Trezor. However, he wasn’t happy about the verifiability tradeoff. At the time, he said: “I have a Trezor with secure elements on my table. We have R&D in this area. But we still don’t think any of these solutions is strong enough to really deliver this product and say to people: you can trust this.”
By launching Tropic Square, Satoshi Labs will be able to do more research and development in the field of security chips. If they succeed, they won’t have to trust a third party with NDAs and other agreements, and can truly design the kind of physical security that users can trust specifically because they are able to verify it.
Right now, potential customers, security experts, and investors can sign up to Tropic Square’s newsletter and find out the latest information about the project. While the scope is ambitious, there is still a long way to go until we have security element chips that are uncompromisingly verifiable.
Yet it’s still endearing to see attempts to improve existing issues with the power of open source development. This is what we mean when we say “Bitcoin fixes this”.
Donate to Bitcoin Takeover!
3D7zYdeLfBehap8tXd1P19uMjQtq5cfpvL
Bitcoin Takeover is an independent project which aims to deliver Bitcoin content (podcasts, articles, and videos) of uncompromising quality. By making a donation, you are incentivizing me to continue and spend more time working on it.
If you’d rather dump your dirty criminal fiat on me, you’ll find a Patreon option which also grants you some membership benefits: https://www.patreon.com/bitcointakeover
And if you prefer the convenience of the Lightning Network, use Tippin. Hopefully soon I’ll raise enough funds to get a Raspberry Pi and run BTCPay server (so I don’t have to rely on a custodian service): https://tippin.me/@TheVladCostea
Lixin Liu is the creator of the Cobo Vault: a device which benefits from military-grade physical resistance and includes lots of interesting security features.
Currently, the Cobo Vault costs $479 and is designed for the needs of Chinese miners who operate in extreme weather conditions and also need reliability.
However, Liu is looking into expanding the Cobo Vault into foreign markets by targeting mass consumers who hold bitcoins. A second-generation Vault would tone down on the military-grade robustness, while focusing on desirable features. The upcoming Cobo Vault will offer an air-gapped wallet that is exempt from remote attacks and also takes into consideration physical security with a secure element chip.
During the interview, Lixin Liu also mentions the newly-launched Cobo Tablet metal plate for cold storage and explains why the product is designed to be more practical and intuitive than the Crypto Steel or Billfodl. The irony is that the Cobo Tablet is the most affordable steel plate product on the market, while the Cobo Vault is the most expensive hardware wallet available.
Liu also answers all the tough questions about open sourcing the software and the current state of auditability, the privacy provided by the Cobo Vault, and how the hardware wallet devices measures up against the Trezor, Ledger, BitBox02, Coldcard, and KeepKey.
1:08:08 – Does Cobo Vault connect to your own full node?
1:10:40 – Cobo Vault privacy
1:18:33 – Closing words on 2nd Generation Cobo Vault
Special thanks to LXMI and Phemex for sponsoring this episode!
LXMI Ad:
“LXMI is a European Cryptocurrency exchange whose name is inspired by Lakshmi, the Hindu Goddess of Wealth, Good Fortune and Prosperity. It’s one of the regulated and legal Cryptocurrency exchange.
On LXMI you can buy bitcoins with most fiat currencies and you can also do the trading for top Altcoins.
They follow the “Not your keys not your bitcoins” philosophy with their integrated non-custodial wallet which helps you manage your own private keys. So if you’re into trading, then you don’t have to worry about having your Crypto frozen by whatever political decisions, since you’re empowered to hold and move your coins around whenever you wish.
It’s great to have new players like LXMI that respect your financial sovereignty.
LXMI is launching in 2020 for more information please check out – www.LXMI.IO/
If you’re not trading, it’s recommended to move your coins to a hardware wallet or some other form of cold storage, and in this episode, you’re about to find why.
Please keep in mind that this is just an ad for a sponsor of this show. It’s not meant to serve as financial advice, and you’re responsible to do your own research before buying anything and act according to your own decisions. Embrace your financial sovereignty with agency and precaution.
Phemex Ad:
“Phemex is a Bitcoin exchange with derivative trading options which focuses on speed, robustness, and maximum uptime. Built by former Morgan Stanley executives, it manages o bring simple and accessible Bitcoin trading. In 2020, Phemex will also add S&P 500 stocks, stock indexes, FOREX, commodities, and more.
Sign up today at phemex.com/bonus and receive a bonus of up to $72.
Please keep in mind that this is just an ad for a sponsor of this show. It’s not meant to serve as financial advice, and you’re responsible to do your own research before buying anything and act according to your own decisions. Embrace your financial sovereignty with agency and precaution.”
Hi there and welcome to the Bitcoin Takeover Podcast. I am Vlad and my guest today is Lixin Liu from Cobo, which is a company that focuses on your private key protection and they have quite some premium services and products which are connected to hardware wallets and cold storage. And I think on their website they even sell the whole package, which allows you to have both the hardware wallet and the steel plate for cold storage. So Hi Lixin.
Yeah. So we should talk about the products of Cobo and what makes you stand apart from the crowd. But before that, I will ask you the question that all the guests of this season have answered and Why should Bitcoiners use metal plates for cold storage and hardware wallets for their private keys as opposed to other methods like brain wallets, paper wallets and other DIY methods?
Okay. First I can talk about brain wallets. And actually for brain wallets I have kind of a horrible story to share with you guys. The CEO of Cobo, whose name is DiscusFish (@bitfish1), he told me a horrible story happened on him. The story is he once had 12 recovery phrase words memorized just in his head, as others use the brain wallet. He’s a very disciplined guy. The very first thing in the morning he got up was to try to repeat the recovery phrases in his head. The days went by doing this. He was 100% sure he wouldn’t mess up those recovery words, but he was totally wrong. The following story is, he and his wife, they raised two bulldogs and his wife was actually training the bulldogs to play skateboard at home.
One day she was playing with one of the dog and left a skateboard at the entrance of a room. But after that DiscusFish walked out of the room and he accidentally stepped on the skateboard and he flipped over and hit the back of his head on the ground. After that his first reaction was to check his memory of the recovery phrase, but unfortunately he couldn’t remember it. He went to the hospital and he spent one day there and he was diagnosed of concussion. After those diagnosed and for the next three days, he was trying really, really hard. And finally he came up with the lost recovery phrase. So I think for brain wallets this kind of story is a very vivid reminder that if you have a significant amount of crypto assets, please don’t trust their brain. There are all kinds of different accidents that could mess up your memory and no matter how hard you train your brain or you memorize it every day and repeat it every day, just accidents happens and your memory will be messed up.
Yeah. Most of the times we perceive hardware wallets and steel plates as protections from other people who might be interested in stealing the coins, but they are also protection from ourselves. Because we are only as good as our biological bodies allow us to be.
Definitely. For me, after I know this story I would recommend that no one—if anyone asks me any recommendation on brain wallets I would say no, never trust your brain. It’s not that reliable.
Plus, even if we take care of ourselves and make sure we never get into accidents and stay at home most of the time, there is also degradation over time.
Oh, you also asked me like paper wallets, right. I didn’t talk about paper wallets. For the paper wallets I think it’s obvious that the metal solution is a better choice, because if you put your recovery phrase on a piece on metal, it’s waterproof. It’s also fireproof and corrosion proof. And also there are always a lock hole on the metal plate so that you can lock your recovery phrase with a padlock.
But I’ve also seen some suggestions on Twitter that some people say that if you put your recovery phrase on two piece of papers and duplicate them, which means duplicate them on two pieces of paper and that is safer. But actually from me, my personal perspective, I don’t recommend these kinds of storage, because even with paper wallet—you duplicate them—that will increase your robustness against natural disasters like flood or something. But that will also increase the chances of theft. So if you don’t worry about safety, you can duplicate it. But if you worry about someone breaking into your home and steal your recovery phrase that way, I think that’s not a good choice for most of us. That was for paper wallet. And you also ask the DIY methods, right?
For DIY methods, I have some friends, they do the metal thing by themselves. If you are a DIY person, you can buy something like a engraving pen. You can easily buy these with around $30-40 on Amazon, find a piece of metal and create your own metal storage for the recovery phrase. For people who don’t want to play around with the hassle of the DIY stuff, you can buy some metal storage like a couple tablets or other products. I think that’s the main difference between these different kinds of methods.
Yeah, that’s right. But at the same time, do you think that hardware wallets and metal plates are adversarial in their purpose or are they complementary? Is it either or, or is it better to have just one or have both at the same time?
Actually I don’t see these products as they are like competing each other. No matter if you use a hardware wallet or a software HD wallet, you still need to deal with your recovery phrase. So the metal plate thing like Cobo Tablet, they supports all the recovery phrase for any BIP39 hardware or software wallets, and you also can see that Trezor’s official store, you can buy Trezor bundled with CryptoSteel, so you can definitely use them together or you can use the metal plate or metal storage with your software wallet. They’re both okay. Or even if you use any desktop or mobile wallets, you can use that. So I think it’s complementary.
And that’s reasonable, if you want to get the best security possible. You don’t want to just rely on that piece of paper, which comes with your hardware wallet or some kind of notebook that you buy yourself and take notes in it.
Yeah. And sometimes the cloud service automatically gets your pictures if you have the wrong settings in your phone—you take a picture and you’re not even aware that it goes into the cloud, and that’s how you essentially get hacked.
So let’s talk about the Cobo Vault, which is your solution for everything, basically. It has a hardware wallet, it has a steel plate, and it costs almost $500, which I think is the most expensive product on the market.
Okay. So for the Cobo Vault, hardware wallets is a very niche market if you compare that to laptops and the mobile phones. But even in a niche market—all the hardware wallets—they should have their distinct positioning. When we designed the Cobo Vault, we were targeting the miners in China actually. For those who are not familiar with the mining industry in China, all the mining farms here in China are always built in very isolated places because in those places, the miners can get the best price for the wind or the water electricity. So as the miners would take the Cobo Vault into these isolated regions and rather than just put them at home or put them in a safe or in a deposit box—when we designed the product, we want to maximize the security and also the durability of the device.
And that comes with a lot of costs. For example the main body of the device is made by aerospace aluminum and it has a four inch big screen and it also comes with a metal case so that you can put your device into that. And also the product passed a lot of durability tests. Like it’s IP68 waterproof and also it’s IK9 drop resistant. And also we even did an American military-standard durability test on it, MIL-STD-810G. So all this form factor stuff took a big portion of the pricing of the product. And also user experience wise, because we are creating a product for the miners, they’re very extreme on the security side. So we create a totally air-gapped experience for those miners, which means we have a camera on the device.
So you can do QR code scanning to get the un-signed information into the Cobo Vault, and then the Cobo Vault can do the signing, do the cryptographic calculation and the algorithms and do the signing work and it generates QR code again. So then you can use your—we call it hot device—which is connected to the blockchain. You use your hot device to scan the QR code to get to the signed message, or the signed information, and then you can broadcast it to the Internet. So that’s the main attraction of the Cobo Vault. And because we use the QR code, because we have the camera, if you wanted to support the camera, you need to have a much more premium chip. And all of this comes with a cost and all these costs results in maximized security and durability, and that’s the design thinking behind the Cobo Vault.
That’s kind of fascinating. I never really thought about products designed specifically for miners. And I suppose that when you run a mining operation, maybe next to a windmill or a water wheel or something, then you’re going to require some sort of resistance to natural disasters.
Yes, definitely. Maybe I can introduce some more about the background story of Cobo: so for our CEO, his name is DiscusFish. He was one of the earliest Bitcoin evangelists in China and he was like the community leader among the miners and he’s also the CEO of F2Pool, which is one of the biggest mining pools currently in the world. So the team I’m leading that’s working on the hardware wallet, we were designing the whole product for people like him. And in order to get more user insights and in order to know more about the miners, he introduced me to pay a visit to one of his mining farms in Xinjiang in China. Oh, that journey was really interesting.
Like I flew for five hours, and then I took a train, and then I took a car, and then I walked for a long time and got to the mining farm. At that place in winter there is a lot of snow, you cannot walk there. And also he has another mining farm, which is in Sichuan province in China. And that province is really rainy. So you get wet all the time, not only your clothes but also your home. So you have to use some hardware wallet that is waterproof to get into those kinds of scenarios.
I never really thought about this because basically I come from a country where you don’t have to worry about this kind of situation, but it makes sense. I don’t think a Trezor is resistant to water and natural hazards. I haven’t tried that actually. They’ve tried to smash them and stuff like that, but I’m not sure if they’re tested against humidity and weather conditions.
Yeah. Actually different hardware should be built for different places, different people and different scenarios. One thing I can also share is that when we launched the Cobo Vault we sent it to one of the KOL. And he drove his car over a Cobo Vault, and come and back for several times and the Cobo Vault survived those kinds of extreme test. And that is how we design the product and where we put our thoughts into the scenarios of this products.
That seems reasonable. I feel like we should get back a little bit to the Cobo Tablet as it’s the latest product that you’re launching. And it’s also the product for which you sent me some documentation to explain how it works and basically help me ask you questions about it. So what is special about it as compared to CryptoSteel and Billfodl and other similar metal plates for cold storage?
For Cobo Tablet, as I just mentioned, the metal storage can work with hardware wallet and software wallet. So the metal storage should be more widely used because we think it is compatible with every decentralized wallet. So when we were trying to develop the Cobo Tablet, we took the price as the first priority to benefit a wider community. So it’s totally different from Cobo Vault. Cobo Vault we were designing for the miners and they need to maximize the security and durability, but for the Cobo Tablet we want to benefit—the more people the better, so the price is the most important. And thanks to the strong manufacturing capabilities here in China actually in Xinjiang, you can see that the price for Cobo Tablet is approximately half of CryptoSteel’s and the Billfodl’s price.
The price is the first biggest difference between Cobo Tablet and other competitors, and the other big difference is ease of use, if you get a closer look at the product. During our development we asked several random HODLers to come to our office to do a blind test on how much time they need to set up a Cobo Tablets or a Billfodl, and all of them has no prior experience with these kinds of products before. So they’re like very fresh people. And the result was really astonishing. The average time for setting up the Cobo Tablet was around 7 minutes, and setting up Billfodl took on average 12-13 minutes.
And the biggest difference for user experience between Cobo Tablet and CryptoSteel or Billfodl is that for CryptoSteel and Billfodl you need to slide in the tiles from the right side. So it’s very hard for you to put a tile into the perfect position, as the slot for the tile is very narrow and tight. And if you find one tile was wrong, you need to take out all the tiles that you have put in and redo the whole process again. So that’s why using CryptoSteel or using Billfodl is not that very user-friendly, but with Cobo Tablet you just open it and you just put the tiles in. So that’s much easier. And maybe I cannot explain the experience very well with words. I think if the audience is interested you can check out a YouTube video which is detailed, describing this difference between the products. The YouTuber’s name is Crypto Guide and you can find the video there. It clearly shows the difference.
And here I want to share: if you are using these kinds of products like Cobo Tablet or Cryptosteel, I want to share another note for every one of you. You need to pay attention to the tiles left after you set up this stuff, because no matter Cobo Tablet or Cryptosteel, they all have a fixed amount of the tiles for each letter. So if you don’t dispose of them properly, someone could figure out what letters you have used for your recovery phrase. So it’d be much easier for them to brute force your 24 recovery words then. So for people who use these kinds of products, you need to really pay attention to how you deal with the left over tiles.
I never thought about this, but it makes sense if somebody wants to hack you, they just look at the letters that you used. And after that they just input the letters into random word generators. And I guess the harder part is to figure out the order, but it’s still not impossible.
Yeah. The order, if they have figured out the 24 words, the order is not that hard because the 24th word is the checksum of the other words. So they just do 2 hash and then they can do the checksum, they even don’t need to check the private key and public key to see whether there are some cryptos on that. They just do the checksum. It’s very easy.
Right. So on the Cobo website I can see that you have two different types of—you call them tablets—but that’s a bit misleading in my mind because when I think of tablets, I think of stuff that has a touchscreen and works like an iPad, but it’s actually like an enclosure which has all the letters to create your cold storage backup on a metal plate. And you have the Cobo tablet and you also have the Cosmos tablet. What’s the difference?
The Cosmo tablet is a co-branded version of the Cobo tablet. So we just built that version together as a swag for Cosmos community and functionality-wise, they are 100% the same. One thing I can share is currently we’re also talking with Coldcard. We may have a co-branded version for Coldcard and maybe people later can buy a co-branded version of the Cobo tablet on Coldcard’s official website. I’m just talking about that with NVK now.
Yeah. You may ask his opinion on the metal storage or something. He told me that he was not a big fan of this tile version, but he really liked the punch version. Mainly there are two kinds of metal storage today. One is the tile version like Cobo tablet, the other is punch version. So you have a hammer and a metal plate and you also have a punch stick. So you use your hammer to punch the letter onto the metal. For that kind of interaction, it’s not that elegant or it’s not that easy with things like Cobo tablet, but they are cheaper. So according to our original principle of developing Cobo tablet, which is bring the best product, with the best price for as many people as possible in the community. So we’re also developing a punch version. It would be much cheaper. For Cobo tablet it’s around $39 now, and for the punch version, we will control that under $25.
Yeah. It’s interesting to me that you have the least expensive steel plate storage device on the market, but at the same time you also have the most expensive hardware wallet.
Yeah. Again, the reasoning behind this is product positioning because we’ve tried to position to different people. Another story I can share here is that, last year I went to Bitcoin 2019, and I talked to a lot of normal HODLers there. I found that 95% of them don’t care about the product. That is very interesting I found, because I only interviewed the miners before. I never interviewed normal HODLers in the United States. So I asked them whether they were afraid that their home could be flooded if a water pipe explodes or that any natural disasters would damage their hardware wallet, as there’s a lot of forest fires in California which threatens people’s homes.
But the answer from them was very interesting. They said, yes, they are afraid of those things, but they see them as very low possibilities. Even if something were to happen, they said they would just buy another hardware wallet, because it’s only $100. From those conversations, I think you can tell that positioning a hardware wallet for miners and for HODLers is totally different. After coming back from the conference, our team began to design a product for the normal HODLers. We spent almost one year on that and I think we’re going to launch that product around late April or early May, and we call it the second generation for Cobo Vault. For this new generation, the Cobo Vault will compromise on the durability side, but it doesn’t compromise on the security.
Just like the current version—which is the first generation—the second generation will still be totally air-gapped and comes with a camera. It can do QR code transmissions. We will also support PSBT, and an open sourced secure element, which is the first one in the industry. For the pricing, we are trying really hard to control our second generation in the $100-$200 range so that it’s affordable for most of the normal HODLers.
I guess you’re going to need some kind of rebranding there because if it’s Cobo Vault, gen two or V2, some people will assume that it’s better than V1 when it just has some extra features, but at the same time it’s not as resistant and tested as the first generation.
Yeah. After we launch the second generation, the first generation will still go on because there’s still a lot of miners and also some institutional users—they want the first generation. But we won’t call it like first generation or second generation. We may have other naming or branding for this product. Yeah, what you said is very right.
So let’s say that somebody discovers Bitcoin today and possibly buys a few hundred bucks worth of Bitcoin on an exchange. And at some point, maybe in a few months, they figure out it’s a bad idea to keep their Bitcoins on the exchange because of Mt. Gox and other events that happened before. So first of all, what is the thought process in regards to choosing a hardware wallet in your opinion? And why should they go for the Cobo Vault?
I think maybe it’s better if we take this Cobo Vault as the second generation because I think the first generation is too pricey for a normal HODLer. If we talk about the second generation of the Cobo Vault, if you asked me to give advice to some people how to choose their hardware wallet I think (1) the first thing people may ignore is that you really need something with a bigger screen. So I think a lot of people have suffered from the little tiny buttons of Ledger or Trezor or other products. I think it’s really hard to use those products because some people’s hands, they’re really clumsy. With these kinds of tiny buttons, it’s really not easy to use them. Another benefit for the bigger screen—if you want to type in your passphrase or your recovery phrase, it’s easier.
Another benefit which is brought by the biggest screen is that you can clearly see your address and the amount of money—amount of crypto—you are going to send. So it’s quite clear for you to check the information, which also increases the security of your crypto. I think that’s one thing most of the suppliers or vendors of hardware wallets didn’t recognize. The big screen is very important. (2) The second thing I want to emphasize is the secure, element. For the secure element I have some contrary opinion to the market, which is: actually a secure element can be open source. A secure element is a must. And if the hardware comes with an open source secure element, then it’s much better.
Also with our second generation, we’ve open sourced the firmware of the secure element. Those of the most important two things. (3) The third things I think is really important is how air-gapped is your product. Currently most of the products, they are connected through a USB cable to your laptop or it’s connected to your phone through Bluetooth. But we all know that for Bluetooth, if you search for keywords like “Bluetooth vulnerability” on hackernews.com, this kind of website, you will find there a lot of accidents or vulnerabilities for Bluetooth, like man-in-the-middle attack, this kind of stuff. So for Bluetooth it’s not a very good choice. But also for USB cable because your laptop can have some malware. I know that in early days a hacker can perform a side-channel attack on the USB cable on a Trezor. But it’s an early thing—Trezor has fixed that. I just want to say that the USB cable is an attack vector for the hardware wallet. So three things. The first is bigger screen for ease of use and better security. And the second thing is the air gap. The third thing is the secure element and if the secure element is open source, then it’s much better.
Right. I have had this discussion with Slush in the previous episode and his opinion on secure elements is that they’re a waste of time because they’re bound to get hacked. And if you focus too much on hardware and physically securing hardware wallets, you’ll just end up in a situation where you have to release a product each year or something just to keep up with what’s going on. And he thinks it’s a better approach to just focus on the software and make it proofed to attacks through stuff like Shamir backup and passphrase and whatever Trezor is innovating right now. So first of all, what is your stance in regards to this? And secondly, how is this secure element really open source? Because usually the criticism about them is that you cannot see all of the code that goes into them.
Here I want to emphasize again that I think Trezor is a very great product and they really have contributed a lot to the community. But I think Slush is a little bit biased about the secure element. Just as you said, the main conflict in the community is that a secure element is like a black box with better defense of physical attacks, and the general-purpose MCU is more like a white box, but with see zero defense from the physical attacks. First, one saying on Twitter I can share is that, if you are paranoid, then you can be 1,000 times wrong and you still got your crypto. But if you are not paranoid, you can get one time wrong and your crypto would be gone.
I don’t remember the exact word, but it’s just the meaning I think you’ve got it. For the secure element, it’s definitely a plus to help you to better protect your crypto. Even with some software tactics as Shamir secret sharing or the passphrase, you can still use a secure element, and you can add those kinds of tactics to your hardware. It’s not about using the software tactics so that you can forget about the physical attack. Personally, I really don’t agree with that. And also mentioning the open source for the secure element, I think most people would be interested in that, because currently all the people in the industry will say that you will sign an NDA with the secure element vendor and you cannot share anything of the secure element.
Actually, this is not the truth because it’s like a negotiation between the hardware vendor and the secure element vendor. If you are strong enough, or if you pay enough money you can still open source the secure element. So our situation is that we cannot open source the whole design of the secure element. But here one noted that if you use a general-purpose MCU, you still cannot open source the whole design of the MCU. You still open source the firmware on the general-purpose MCU, which is just as Trezor did. For us, we choose a secure element and we negotiate with the vendors of a secure element and we open source the firmware of the secure element. So with the firmware people can see that (1) first the entropy comes from a true random number generator, TRNG, from the secure element.
(2) The second, how your mass private key is generated. (3) The third how your child private keys are derived from your mass private key, and (4) the fourth, every cryptographic calculation or cryptographic algorithm happens within the secure element. And (5) the last is that your private keys never leak out of the secure element. So from the firmware you can see everything, you can see how it works in the secure element, and also you can verify the code. So I think by doing this we are adding a much stronger, or an extra layer of transparency, to the secure element and also later we will allow people to modify the firmware of the secure element and you can upload your customized secure element firmware onto the secure element, which means you can just build your own hardware wallet on a secure element.
I also talked to Slush. Slush also criticizes this like, Oh, you cannot share the datasheet of the secure element. But actually if you have strong enough negotiation power, you can share the datasheet. Later, if someone wanted the datasheet of the secure element, they just need to do very simple online paperwork. If a cypherpunk or a geek wants to get the datasheet of the secure element, they just need to sign an online NDA with us and we can share that with him. And also he or she can purchase a development board of the secure element from us so that he can almost play anything on the secure element. So that’s how we do the secure element open source. We cannot open source the whole thing. Even the general purpose MCU cannot open source the whole thing and the secure element doesn’t. But what we can do is open source the firmware and you can see how it is working and how everything is going on within the secure element. That’s our strategy of open source.
So Ledger published an article 2 weeks ago and it’s called “Not All Chips are Born Equal,” and I think it got quite popular on social media around the time. And in their classification they say that the stuff that Coldcard and BitBox use are not really secure elements, but they’re actually safe memory chips, which are not as secure as their design for the secure element. And their argument basically is that you cannot quite have the security of a secure element with full transparency. So how do you make that work?
Actually, for the first part you ask whether ColdCard or BitBox are using a secure element. I think the main conflict is your definition of the secure element. From our perspective, Coldcard and BitBox are definitely using a secure element, but they’re not using a very premium secure element, which means their secure element is more leaning towards better storage of some sensitive information rather than some cryptographic algorithms on that. I think that’s the main difference. So the Ledger secure element can do the cryptographic calculation, but the Coldcard and BitBox, their secure element is not that premium so it only does the storage work. But you cannot say that they are not using a secure element. They are using a secure element. We cannot mess up the truth here.
So that’s the first thing. The second thing is, for the transparency for the secure element, just like I said, if we open source the firmware, it’s just like Trezor open sourced the firmware of a general-purpose MCU, because for the design of the normal MCU and the design of this secure element, they both cannot be open source. But it’s easy to verify the secure element with the open source firmware. Here, the logic may be not that easy to understand, but for the secure element, if we open source the firmware, then there are two important things. One is the true random number generation. So this is not in the firmware. This is like the implemented library—implemented function—in the secure element, but actually you can bypass that true random number generation just like what Coldcard did—they allow people to generate their own entropy with a dice.
So you don’t need to trust the true random number generation of the secure element, you can generate your own entropy with the dice and from the entropy you type into the device, the device will do the cryptographic calculations and algorithms to generate your private keys based on your entropy rather than the true random number generator on the secure element. So that part is black box. But this black box, you can bypass that. You can do that by yourself. And for the second part, people may think the black box on the secure element is—again, if you open source the firmware of the secure element, the second part of the black box is the cryptographic algorithm. So for that part, it’s very easy to verify that because all the cryptographic algorithms are universal.
Just like ECDSA, they are universal algorithms. You can easily verify the results of those algorithms by another device. Or even with some Python libraries—you can easily verify that. So the most important two parts: one is true random number generation, and then the cryptographic algorithms, they are in the black box of the secure element, but one can be bypassed. The other can easily be verified. So again, jumping back to our open source strategy. If we open source the firmware of the secure element, then the secure element is just as transparent as a general-purpose MCU. So it’s almost totally a white box then.
Our secure element just has more RAM and more memory in the secure element. And there’s some cryptographic algorithms pre-installed into the secure element. So after we open source our firmware of the secure element, you will see that in the firmware we just call a function. It’s just like we call a function which is pre-installed into the secure element as the cryptographic algorithm. So it’s just like a pre-installed function in the firmware, and the function can be verified easily. Our secure element supports those kinds of pre-installed cryptographic functions and it has more RAM, so it’s more premium than the secure element that Coldcard is using and also than the secure element that BitBox is using.
I feel like we have clarified this part about hardware and there’s definitely going to be some interesting stuff going on with the second generation of the Cobo Vault with the camera and QR code scanning and the air-gapping. But what about the software? How much of the software in the current generation Cobo Vault is auditable and open source, and how much of it is going to be open source in the next generation?
For the next generation, I think you know that open source is not like a one-day work. So for the next generation first we will open source the whole code—we call it on the cold end—which is on the Cobo Vault. For the app currently we are using iOS and Android mobile app to support people do the QR code transmission and to get the balance from the blockchain and to broadcast the transactions. Currently we don’t have a clear timeline to open source that part, but the point is, because Cobo Tablet has the QR code here it’s very easy to decode the QR code or encode the QR code. So Cobo Vault can definitely be used with third party wallets just like Electrum. If you don’t trust our mobile app because it’s not open source and you don’t trust it, it’s okay. We will also make some Electrum plugins for people to easily decode or encode the QR code so that you can use the Cobo Vault with third party wallets like Electrum.
Yeah, that’s definitely useful. And I think you should also integrate with Wasabi as that turns out to be quite a popular choice because of Tor routing and all of that privacy extra.
Actually we will also open source the QR code protocol so that you will see how the raw transaction is assembled, and what’s the default format of this QR code. So any third party wallets can integrate Cobo Vault very easily. You just need to follow our format to assemble the unsigned transaction and to generate the QR code. And then you can use Cobo Vault to scan the QR code to then sign the transaction. So it’s very easy. Also Cobo Vault will support PSBT. PSBT is definitely for the scenarios of CoinJoin and also PSBT will support Multisignature between different hardware wallets, so even without our app, which is the app on iOS or Android phones, you can definitely use Cobo Vault with any third party wallet if they support the QR code thing.
Currently for the first generation of Cobo Vault, we only open source the secure element code, but we didn’t open source the upper layer software on the Cobo Vault. So currently the first generation of Cobo Vault is not fully open sourced.
Okay. I’m happy about the clarification because my next question is about building your own. If you’re going to follow this philosophy that Trezor and also Coldcard recently have pursued to basically make a list of the components that you need to build your own and also offer you the software just in case you’re in a part of the world where you cannot order their product and you want to build your own. Are you ever going to allow people to build their own Cobo Vault?
So for building Cobo Vaults we’ll offer another route, which is much more hardcore. It’s that, just like I mentioned, we will offer people the development board of the secure element. So I just offer you a raw secure element on a circuit board, and you can manipulate the whole circuit board and the secure element by yourself. So I think that’s a much more hardcore way of open sourcing the whole thing. You don’t need to build your circuit board for the Cobo Vault, we just give you the development board of the secure element and you just build your stuff upon the secure element. You see what I mean? So we don’t ask people to rebuild a Cobo Vault. We ask people to build their own based on the secure element that Cobo Vault uses.
All right. Sounds reasonable to me. So we have discussed about the hardware, we have discussed about the software and I guess we should talk about more stuff about the competition because everyone else has done it who has been in this podcast. So I have challenged everyone who participated in this season’s podcast to say something nice and something bad about other competitors. And Cobo is competing right now with Trezor, with Ledger, with KeepKey possibly, with Coldcard, and also BitBox02. So let’s get them in some sort of order and you get to say something nice and something bad about them. Let’s start with Trezor.
Okay. Just like I mentioned, I love Trezor the most among all these products, not only because it’s the first hardware wallet, but also they’re just a giant. We take Trezor as a giant and we take all the other hardware wallet vendors, we stand on the shoulders of this big giant to build better products for the market. Another thing I want to emphasize for the reasons I like Trezor the most is the transparency of Trezor. If you look closely at Trezor’s blog, it explains the details about the bugs and vulnerabilities, you can see that they even disclose how much time they spent on each bug or vulnerability. I think this kind of transparency is really good and makes people trust this brand, trust this product.
Trezor is like a teacher for all of us, for all the other hardware vendors. But just like I said, what I cannot agree with Trezor is the security structure that comes without a secure element. That’s also the reason I won’t purchase a Trezor to store my personal assets on it, because without a secure element it cannot survive from physical attacks. I think the second best one in my mind is Coldcard. I like Coldcard mostly because of NVK, because he’s the most paranoid guy I’ve ever known in this industry. And in order to make something like Coldcard—because you need to think about all the attack vectors in advance—you really need some strong imagination.
And NVK is that kind of guy who’s very paranoid and who really has some imagination, especially on the attack vectors. And they have some very interesting features like anti-phishing PIN input. I’m not sure you know that. For that feature, you just input the first half of your PIN and then you see a word. If the word is cracked, you input the second half of your PIN. So this kind of tactic can prevent evil maid attacks if a evil maid exchanges your product into something with malware on it. You can call the paranoid, but this kind of feature really helps people to protect them from different kinds of attack vectors. If you ask me to criticize Coldcard, I think the bad part for Coldcard is that my wife cannot use it.
But as NVK said he’s designing Coldcard for himself and for people who are like him. I think that is not a disadvantage. It’s the product positioning. So NVK is just trying make a product for himself—not for my wife—so it’s not a disadvantage. But if it’s more user-friendly, I think it’d be much better for Coldcard. For Ledger, I really admire Ledger because they introduced the secure element into the industry. But I think if ledger can open source more on the secure element—like the firmware, I think that would be great. Yeah, that’s, that’s full ledger. I’m a user from the first generation, Ledger Nano S, and one disadvantage is that you need to install the apps into your Ledger Nano S to support different kinds of coins. And usually the memory is not enough. So sometimes if you wanted to add one more coin into the Ledger Nano S, you have to delete some old one. So that’s a disadvantage of the Ledger.
The BitBox—I was not a user for the first generation. Yesterday or the day before I just got the BitBox02. So I cannot share too much about that because I haven’t got time to put my own hands on the product, but I think BitBox, they are very clever by separating the product into two versions. One is for the multi-chain version and a second one is BTC-only. I think the BTC-only version brings some simplicity into the product for people to have a better feeling for the product, because simplicity always brings security. So I think that’s very smart for BitBox.
Yeah. Actually I’ve been using KeepKey in early days, but I didn’t follow KeepKey’s later updates too much. In the early days I used it. I still can remember that KeepKey’s software wallet experience is much better than Ledger, because it’s very simple and easy to get your hands on it. If I remember correctly, it only supports Bitcoin, Ethereum, Litecoin, and another coin—only 4 coins on it, and it’s super easy to play with. You don’t need to worry about the different apps. You don’t need to worry about different features. It’s very simple to start to using it. So it’s very user-friendly I think. But again if you asked me to criticize KeepKey, I think the downside is that it doesn’t come with a secure element. I think that’s the worst part, because from my perspective, a secure element is a must.
Yeah they began as a clone of the Trezor, but provided that large screen which shows the entire address and that’s nice. It’s robust. It’s nice. I didn’t like that it has that connectivity issue, which they never fixed. Sometimes when you connect the cable it just doesn’t work.
It happened to me and then I went on YouTube and I saw that somebody else had the same issue and I said, Okay, it’s common—I didn’t get a defective unit or something. But it’s solid and it’s very robust and the cheapest on the market right now.
Yeah. I still remember one little detail of KeepKey that is you need to long-press the button to confirm a transaction. If you stop during the full-circle, the signing stops. So that’s very interesting, this kind of little interaction on the product.
So I wanted to ask you something else about the Cobo Vault software. Will you allow connection or connectivity to a full node that is owned by the user to minimize the amount of data that gets shared and increase privacy basically.
Currently for the first generation software, it’s connected to our node. I think Trezor is doing the same thing because just like Trezor, we are a multi-chain wallet, so if you are building a multi-chain wallet, software structure wise or development structure wise, it’s easier to send a message to your own server and ask your own server on your own node—or the vendor’s node—to give the user their balances. And the other verification information. It’s much easier to build the multi-chain wallet on this structure. So for Cobo Vault first generation, we follow this structure currently, and also it’s a mobile app. So we’re not supporting connecting the software, wallet to a full node or something like that.
For the second generation, for the most normal or average users, we will still follow the strategy, but like I said, the QR code is easy to encode and decode. So you can easily make it compatible with Electrum or with your full node, with your Bitcoin Core, it’s very easy. Also for the second generation, in our roadmap we are going to develop a SPV software wallet on the mobile site for Bitcoin only. It would be SPV so it will have better privacy protection than the normal version of the software wallet, but it’s not as good as full node. Again, if you wanted to play with the full node with Cobo Vault, currently I think the solution for you is do it with Electrum or Bitcoin Core.
Right. And speaking of privacy, I want to ask you something else. So let’s say that I go on your website right now and I ordered a Cobo Vault for $479. That’s the price right now. And are you going to store my home address or does the Cobo Vault have a serial number that you can track and associate with me as a user?
The website where you place the order, this website is built on Shopify. It’s not built by us. Shopify is a Canadian company that provides this eCommerce platform, or you can call it an eCommerce solution, for companies like us. You can also take Shopify to WordPress if you wanted to build your own blog. So it’s just a platform. Your order information is not stored in our server, but it is stored in Shopify’s server. And here another thing I can share is that Shopify has a really strong bounty program. If I remember correctly, Shopify has the highest paying bounty program on hackerone.com.
So you can take Shopify as a eCommerce platform that is the most secure eCommerce solution currently in the world, even though it’s not very cheap—it is much more expensive than other competitors. So we use Shopify and your address is in Shopify’s server, not in our hands. And for our second generation, for your serial number, we never transfer your serial number back to our server. So that means, if you use the software wallet on the mobile site, we will see that the crypto moves from here and there, but we cannot associate those funds with a specific serial number of the hardware device. And later after we open source the firmware, after we open source all the code of the second generation Cobo Vault, I think it’s very easy to verify that we didn’t transfer any serial number back to our server—this kind of thing. It will be very transparent.
All right, so there is no way for your company to know that it’s I who owns like 0.5 Bitcoin and know that because I connect to your servers basically.
Yeah. We know that someone is using Cobo Vault and he has 0.5 Bitcoin. We only know someone does but we cannot associate this 0.5 BTC to a specific serial number or to a specific address. We cannot do that.
Yeah. I think everyone of us should pay attention to the privacy because the privacy is like the future of your security. If you don’t pay attention to your privacy one day you or your assets would be lost.
Yup. It’s like a predetermining factor. If you give away too much information, people can just collect it and figure out patterns and see stuff and they can social engineer to find out more about you and what you do and any kind of information that you can also put into passwords and stuff like that. It can get hacked. And with Bitcoin it’s even more delicate because unlike your bank account where your money can be recovered by the bank, there is no third party that can recover your Bitcoins ever. So I guess this is the worst kind of hacking. If somebody steals your TV from your house, I guess you can find that TV by serial number.
Yeah. And usually I look at this whole community and I realize that Bitcoiners are much more cautious about both their security and their privacy. And sometimes I ask myself, why doesn’t this happen to the Ethereum people? Why do they seem to be so confident about their light wallets on their phones? And they don’t care much about running their full notes to validate their own transactions and be sure that the balance that they have is actually real and is verifiable according to their own full nodes. Why do you think that these altcoins holders don’t care much about custody and security?
I think for Bitcoin and for altcoins, just like you said for the chips, they’re not born equally or they are not born in the same situation. So for Bitcoin it was born to fight against the bad privacy situation under your governance. And also the purpose of Bitcoin is to give you full financial sovereignty. I think that’s the whole purpose of Bitcoin. And after the birth of Bitcoin, everyone is trying to improve Bitcoin to achieve that. So from my perspective, privacy and the security of your assets is naturally born with Bitcoin and everyone takes that for granted. If I own some Bitcoin, I want to maximize my security, my privacy to better protect my assets from other third parties. But for other coins like Ethereum or EOS or TRON or anything they were not born for this purpose. They were born for building another world computer or they were born to build another ecosystem for something else rather than for security and privacy. All the coins, BTC or other altcoins, they have their own positioning. For Bitcoin it is helping people to gain your personal or your financial sovereignty. So that’s why I think BTC HODLers care that much about security and privacy.
All right. So Lixin, I’m not sure if I have any more questions for you at this time. So I want to thank you for your time and I know it should be kind of late in China right now.
I think we have done that a lot of work on the second generation and with the first generation Cobo Vault it’s proved with the miners here to be the most secure hardware wallet in China. And with the second generation we see—with a better price, with PSBT, with QR code completely air-gapped interaction—we want to help more people in the States or in Europe to better have their crypto in security hardware wallets. That’s what we want to do. And also we’re open to cooperate with any third party wallets to make the products work together and also we are open to any opportunity to co-brand on the Cobo Tablet. I think that’s the final word. Thank you.
Yeah. Thank you too. Thank you so much. By the way, I really liked the intro music of your podcast. It makes me feel really futuristic and something very cypherpunk. I really like it.
Here are two reasons why Slush is a pioneer: his documented involvement in Bitcoin dates back to 2010 when he launched the world’s first BTC mining pool, and he also co-founded Satoshi Labs – that company that developed the first hardware wallet prototype in 2012 and brought Trezor to the masses just a year later.
He wears the badge of honor of having made Satoshi Nakamoto himself respond to his groundbreaking approach to mining, and the industrialization of BTC mining (which deems Satoshi’s “one-CPU-one-vote” idea obsolete) is also owed to his contributions.
In this episode, Slush talks about his sustained efforts to deliver greater Bitcoin security with Trezor. Throughout the interview, the Czech bitcoiner explains why he believes that physical security is an illusion, and makes the case for strong encryption software (passphrase, Shamir Backup) as an alternative to the hardware limitations.
Also, Slush expresses his opinions on Trezor’s main competitors by highlighting a positive part before presenting his criticism. The companies involved in this discussion include Ledger, Coldcard, BitBox, and KeepKey.
30:40 – What can’t be verified about the Coldcard?
33:23 – Is physical security a marketing trap?
35:56 – What’s to like about the BitBox?
37:30 – What are the tradeoffs of the Trezor?
38:23 – Shamir Backup
45:10 – SLIP doesn’t stand for Stephan Livera Podcast
46:48 – Software before hardware
48:01 – Why is the Trezor so expensive if it’s so basic?
48:55 – Other companies taking Trezor’s open source software to create cheaper hardware wallet clones
54:12 – Is there demand for the BTC-only firmware?
55:33 – Multisig on the Trezor
1:00:39 – Who should use a multisig setup?
1:02:30 – When should you get a hardware wallet?
1:09:10 – Local software application for Trezor
1:12:00 – Running your Trezor with Electrum or Wasabi
1:13:05 – Does Trezor collect any user data?
1:16:30 – Trezor doesn’t know who you are
1:18:23 – What are Trezor’s future plans?
Special thanks to LXMI and Phemex for sponsoring this episode!
LXMI Ad:
“LXMI is a European Cryptocurrency exchange whose name is inspired by Lakshmi, the Hindu Goddess of Wealth, Good Fortune and Prosperity. It’s one of the regulated and legal Cryptocurrency exchange.
On LXMI you can buy bitcoins with most fiat currencies and you can also do the trading for top Altcoins.
They follow the “Not your keys not your bitcoins” philosophy with their integrated non-custodial wallet which helps you manage your own private keys. So if you’re into trading, then you don’t have to worry about having your Crypto frozen by whatever political decisions, since you’re empowered to hold and move your coins around whenever you wish.
It’s great to have new players like LXMI that respect your financial sovereignty.
LXMI is launching in 2020 for more information please check out – www.LXMI.IO/
If you’re not trading, it’s recommended to move your coins to a hardware wallet or some other form of cold storage, and in this episode, you’re about to find why.
Please keep in mind that this is just an ad for a sponsor of this show. It’s not meant to serve as financial advice, and you’re responsible to do your own research before buying anything and act according to your own decisions. Embrace your financial sovereignty with agency and precaution.
Phemex Ad:
“Phemex is a Bitcoin exchange with derivative trading options which focuses on speed, robustness, and maximum uptime. Built by former Morgan Stanley executives, it manages o bring simple and accessible Bitcoin trading. In 2020, Phemex will also add S&P 500 stocks, stock indexes, FOREX, commodities, and more.
Sign up today at phemex.com/bonus and receive a bonus of up to $72.
Please keep in mind that this is just an ad for a sponsor of this show. It’s not meant to serve as financial advice, and you’re responsible to do your own research before buying anything and act according to your own decisions. Embrace your financial sovereignty with agency and precaution.”
Hi there and welcome to Season 4 Episode 8 of the Bitcoin Takeover Podcast. I am Vlad and it’s very hard for me to contain my excitement, but my guest today is Slush, who is responsible for creating the world’s first mining pool for Bitcoin back in 2010, and also he’s a co-founder of SatoshiLabs, which is responsible for developing the Trezor hardware wallet. And it is because of his efforts in this field that we nowadays have this whole industry of private key security and hardware wallets and all these feuds between companies and that all started from him and his ideas. So thank you very much for your efforts, sir. And welcome to the Bitcoin Takeover Podcast.
It’s an honor. So before I proceed with the questions that I sent you via email—and that was standard procedure for all of the guests this season—let me just ask you, how did you first come up with the idea of creating the hardware wallet?
Yeah. When I started with Bitcoin in 2010 I spoke to many people who was also considering getting into the Bitcoin and analyze it. It’s harder and harder to explain—for them—how to do proper security setup because most of the people connect to Windows or they are not tech savvy at all. And I found out that the Bitcoin is not ready for mainstream because it’s too technical to do this properly. So I am thinking how to solve this issue and bring some solution—not necessarily the hardware—but some solution which could solve this and give these people easy way for managing the lifecycle of managing private keys—so-called Bitcoins. So we are thinking about this with Stick (@pavolrusnak), we met already in one Bitcoin meet-up here in Prague, and we are thinking that some hardware device like we know it now, but we really didn’t want to start hardware startup because it’s just too hard to do hardware properly. So we were waiting, if somebody else will come with something like this, and in 2011 there was I think the first conference in Prague. It was 2011 Bitcoin conference and there was some guy talking about the hardware Blackberry I think on Arduino or something like this. And we were like, Okay, so he’s going to do this—we are not interested anymore. And actually one year later we met again and we both realize that his project failed—he isn’t going to make this happen. So we were like, Okay, let’s do it. We took some points, like we decided to use HD like BIP32 wallets instead of importing separate private keys and so on, which was the best standard BIP in these days. And long story short, we are here with some product which created a whole industry.
Yeah. And that’s very admirable. What’s interesting about the Trezor in itself is that it uses very common parts that you can outsource by yourself. If you find yourself in a country that cannot receive shipments from outside and you just want to create a hardware wallet for yourself, you can just build it from common parts that you find in electronic stores or various places where you find chips, right?
When we were thinking about the Trezor design, we were considering all the options like general MCUs, secure elements, and so on. Our idea or our mission was to bring some solutions which are really in line with the Bitcoin philosophy, which is built on open source and auditable codebase. No gatekeepers. You know, Satoshi pulled himself out of the project, eventually. So this is our really strong thesis, really strong philosophical motives, and we wanted to be as close to these motives as possible. So we end up with the parts which are not bound with any secure element agreements and so on. And yes, you can buy your own parts and put your own Trezor together and audit all the code from our GitHub and then run it on your device and you are completely independent to us.
Yeah, that’s really admirable. And before I move on and ask you the questions that I sent you—and there’s 10 of them—I just want to make a remark that’s based on my experience doing this Season 4 podcast that has been entirely about hardware wallets and cold storage. And I have spoken to Peter Todd and also LazyNinja, who is a guy who attacks hardware wallets, and they both said that if they were to choose just one hardware wallet to use then it would be Trezor because it’s the most transparent, it has been around for the longest time, and it has been the most tried and tested all these years.
Yeah, that’s great to hear. I also know that Peter Todd is not using hardware wallets and it makes complete sense for a person like him because he knows so much about the security and about his threat model and about the programming and so on. Maybe he can secure himself even without consumer products like hardware wallets. I completely get it. And as I told just before, the aim is basically to pack all this knowledge, all this security into the device which can be used by people without all these skills. Still there is a long mission of educating the users how to do this properly. Like all the phishing techniques and so on. They are mostly nontechnical issues, they are why people have to understand how Bitcoin works. And they still need to know what’s the private key and what’s the recovery seed and that they shouldn’t write down the recovery seed into Messenger and send it to anybody. There’s still so many things to do, but at least there are hardware wallets which can make it much easier even for the masses, for everybody.
Yeah. So this leads me to my next question, which is why should Bitcoiners use a hardware wallet and not resort to something like cold storage on a paper wallet or a steel plate or a brain wallet or something?
Yeah. I think paper wallets and things like Coldcards are a great thing, but they don’t solve the whole lifecycle of the product or of the private key. Like, SatoshiLabs, or Trezor, assisted and gave feedback to CryptoSteel, how to design the steel backup for the recovery seed but still it’s just a device for preserving the recovery seed. But the lifecycle of the recovery seed is much more complex. At first you need to create the recovery seed in this safe place in [inaudible] that way the entropy is not broken. It’s actually a really hard thing and there are even issues with some Android phones and with some desktop computers which had broken hardware random number generator. So even this part may be tricky and even if you have a paper wallet or you created your CryptoSteel with that, at some point of time you will want to spend these Bitcoins.
And this is also really tricky, because you can be safe all the time, but once you need to sign a transaction or even discover the UTXO from the blockchain which are yours, you need to do cryptographic operations and you are likely going to do them in your head. So the hardware wallet itself, complete lifecycle of private key and also the hardware wallet itself is designed in the way that it has as much a small an attack vector as possible. Like the codebase is open source, so it’s auditable. It’s actually pretty short. It’s really possible for a single researcher or a single guy to read through all the source code and verify that it does exactly what it should, which is quite popular. We have so many contributors and external security researchers doing this and helping us to make the code stronger and remove all potential doors for any attackers and so on. So the hardware, what makes all of this, are the users.
All right. So let’s say that I just got into Bitcoin because I saw the price increase and I think that this is the future of money or something. And I want to buy a hardware wallet to secure the $500 of Bitcoin that I just bought. And why should that device be a Trezor and what makes it special compared to the competition? Because if you go on Twitter right now, it gets very confusing for newcomers.
Yeah. I think it’s pretty easy, but even for me, it took me quite a long time to realize—how to say this in an easy way? For me the main difference between Trezor and basically any other hardware wallet is the parts which we are using. And actually, using secure elements—I will answer this later—is so tempting, because you can just buy some chip which manufacturers tell you is secure. You put it into your hardware and tell to your customers, Okay, we use secure elements so our solution is secure. So you can rely on it with your security. And that’s basically what people want when they are finding out the proper solution. But there’s so many things in the middle of lines and it’s necessary to understand better how all the chip industry works.
And what I want to say, all the difference is called NDA. NDA means nondisclosure agreement. And this is some sort of contract in between the chip manufacturer and the company using these chips in their product. And the main difference is that Trezor doesn’t use any parts which use any NDA-covered chips. You can have full data sheets. You can buy these chips freely and also the most important part, you are not, you are not to bound with the manufacturer in any way that you can’t tell about what you know about the security of the given chip.
So when I explain this from another side, if I build, if a solution with an NDA-protected chip, close agreements with the manufacture which prohibits me to talking even if I realize that there are some particular issues with the chip, talking about this publicly to the parties which do not sign this NDA, this is a huge failure for this industry. Like, so far and we use this many times, when some researchers reveal there’s some issue with the Trezor, we are free to talk about this on our blog and we do, we did this many times. It’s all about the incentives of us as the manufacturers because as we don’t know any venture capitalists and nothing like this behind the Trezor. Our customers are, we want to make a product which is absolutely in line with the interest of our customers so it’s a very difficult question, if we can tell them how they should improve their security. But if you sign the NDA and you get to know about something, you are on the opposite side, you must comply with the manufacturer. And this is something which we don’t want to do.
Yeah, that’s definitely a plus for the Trezor because everything transparent and you can even build one yourself and it’s very easy to audit and to tell if there is a security issue and it’s also faster to fix issues if you find them.
Yeah. There’s so many details or answers to this, like we started to work on Trezor with the understanding that the hardware itself, like any hardware, is broken. The industry works in general in a non-transparent way. The hardware industry is like 20 or maybe 30 years behind the software industry with all the open source companies and all the open standards, which we see in the software industry. This is nothing what you can follow in the hardware industry itself, it’s all banged together with intellectual properties, all with the contracts. It has, so it’s very non-transparent itself and we just refuse to bind ourself into all this industry which we don’t simply agree with. So we actually know, once you understand that the chip itself is broken and we never promised any physical security of this particular chip because even the manufacturer never promised this, we built the threat model around the Trezor in the way that if you care about the physical security, if you can solve it and do not rely on the promises of the vendor, or the other hardware wallets, basically saying, We use secure elements and you can rely on some level to this security promise, but they don’t give you any advice.
They don’t give you any tool how to evaluate this promise. So me as a user, when I’m modeling my threat model, I really don’t know if I can rely on the secure element for $1,000, $100,000, $1 million? I really didn’t know how to evaluate it. So if I care about the physical security and I see that I can’t audit the chip, when nobody can audit the chip, I had to have some other solution to protect myself from possible insecurities or possible backdoors in the chip. And this answer to all these questions since the beginning, since we designed the Trezor, was passphrase. And what is changing is our understanding about the chip security. Like 10 years ago, there were no specific ways how to read out some chips and they are here now. So this changed, but the original philosophy is still staying strong because with the passphrase you actually can calculate the attack cost of your device because you can calculate the price of the brute forcing the passphrase itself. You cannot do this with secure elements, and it’s just about your trust into all this supply chain to what level you believe all of their marketing claims. And in the extreme philosophical case, you are in Bitcoin, which is strongly anti-government, and these cypherpunk concepts which happened to be a reality. And then you are buying the device which is certified by a government agency that it’s secure? That’s my concern. So I don’t want the trust, I want to verify and secure elements, or all the chips, not only the secure elements, all the chips are, from my perspective, broken by design. You can’t verify this. So let’s build the security with this in mind and provide a solution which don’t promise what you can’t prove, basically.
Yeah, that’s definitely an interesting point of view. This leads me to my next quasi-question because it’s a series of questions and all the guests from hardware wallet manufacturers have been asked to say something nice and something terrible about their competition. So do you have any preference regards to the company with which we should start?
Well, I usually don’t speak about the competition unless they speak about me and I have to somehow defend my objectives and my sense. So I don’t know where to start basically.
Yeah. So I think their approach is great for the masses, they have a perfect product designed for masses. There’s everything as it should be when you are buying into the product. From this perspective, it’s okay. The bad stuff is that philosophically I don’t think it’s aligned with Bitcoin. And that’s the point. This is a point which everybody has to answer by himself: why I am here, and if I am here for trusting somebody else. You see, it’s my point. As I said, with all these NDA secure elements, I simply don’t get that the Ledger is using “Don’t trust, Verify” motto together with using NDA secure element chips audited by government agency. I would rather see any way than this.
Okay. Well, what about to KeepKey because it’s kind of a clone of the Trezor and that doesn’t have a secure element, but at the same time it’s owned by Shapeshift and I think nowadays it doesn’t even have a proprietary software of itself and you connect directly to their platform and you KYC and I gave away some details but can you say something nice and something bad about KeepKey?
Honestly, I don’t think that KeepKey is a serious player or a legit player in the field anymore as they are [INAUDIBLE] development on the fundamental development for years. So I don’t consider this as a serious player.
Yeah, the BitBox and the Coldcard use basically say, physical, like the same design, security design. And I think this design is quite good, but it’s still selling the snake oil. When you check the Coldcard homepage they are promising the security that they can’t prove it, period. So a Coldcard with the form factor is a great story for geeks. I think they have many interesting features which are available for advanced users and so on. So I think there’s space for this and a BitBox is much more mainstream. I think they are in this way. So, so far, so good. I still have a issue that they are promising what they can’t prove.
Okay, that’s interesting because when I was at Bitcoin Magazine, I wrote an article about Coldcard open sourcing their designs so that you can build your own from parts. So I guess they took some inspiration from Trezor from this point of view and they want to look more transparent. But what is it about the Coldcard that you cannot verify?
Yeah, there’s the secure element chip which is used for physical storage, storage of the seed, and basically this chip is free for sale. And the short data sheet is public but still for getting the full data sheet, which has some useful information for integrators, you still need to sign NDA. And this is all about the same. Also they are claiming that it has this chip, this secure element, and it has some specific parameters that they can’t out of this, it’s still a blackbox, and this is an important part. I admit that even if the chip is [INAUDIBLE] then the security is as strong as a Trezor. Like if you consider the secret element [INAUDIBLE], then the physical security falls back to the Trezor. The difference there is a huge difference because we admit that this is a possibility, that the hardware is hacked. So we build the user experience around this and we had the passphrase support and we speak about this quite openly. Now if you are considering physical threat as an issue for you, you should use the passphrase. On the other side Coldcard is not saying this, and they are relying on the security of this chip. And so this can create false sense of security, which is really, which may be turned to be provable.
Okay. So I got to ask you, because I also saw some tweets about this from you and you think that this part about physical security is just marketing crap because I remember somebody from Ledger once said that their devices are so safe that you can buy them from eBay and are going to work. But it doesn’t really work like that
Yeah. Oh, well nobody really knows if it is safe. That’s the point. And yeah, I feel like I’m repeating myself. I hope I was clear what’s my attitude and in recent days I read it. Okay, you should stop talking about secure elements [INAUDIBLE] because you are really like 7 years with the product, the Walkman, behind others, which already has secure elements. This is complete misunderstanding of our concept. Like I have Trezor with secure elements on my table. We have R&D in this area. But we still don’t think any of these solutions is strong enough to really deliver this product and say to people: you can trust this. So even if we will deliver some solution with secure elements, we’ll be talking about the passphrase, educating about physical threats in the secure element. And in the end I think it’s pointless to add secure elements at this stage of the chip industry because if you add this into the hardware design and don’t promote it as a, as a solution for physical security, why even bother to put it into the Trezor. Yeah, I mean we really made our homework, we are in the in the business for many years and we made our homework and a lack of secure elements in the Trezor is not the result of our inability. It was our decision.
Right. Let me just get back to the BitBox because I feel like you left them behind a bit and you just put them in the same basket as Coldcard. And when I had Jonas Schnelli and also ??????, they spoke very nicely of Trezor. So I feel like you should at least, even though you’re going to be critical, just say something specific about what you think about BitBox
I think that BitBox is doing it well, like I think they are recognized players on the market and that they were so far very cooperative so this is what I like. I like the product. Yup.
Yeah, of course the story is, it’s still the same. I understand why they put it there. I understand that it’s easy marketing to just check. Secure element: Yeah, yes we have. You are safe. But that’s the point of the [INAUDIBLE] Unless you can audit it, not necessarily you, but unless anybody can audit it and unless anybody can calculate the attack into this stuff, I don’t think the secure element is [INAUDIBLE].
Okay. Let’s move on and talk about something that people usually point out when they talk about hardware wallets and this is trade-offs. And do you think that the Trezor in its design has any kind of trade-offs?
Of course. I would like to have impenetrable hardware because it will give you much better user experience and your user experiences is something we take really seriously. And of course the passphrase itself is making the experience much worse. But yeah, we know the reality. So I think we will need to live with passphrase for many years unless something magically changed in the hardware industry. And this is a downside of our design. Yeah.
What about Shamir backup? I remembered that was a very big improvements when it first came out and it was a massive discussion that was started in the community and I think, up to this point, Trezor is still the only company that has that implemented.
Yeah, this is a really good point. I think that current situation of hardware wallets, it’s stuck on the discussion about the secure element itself. If a full secure element certified by foreign government agency is the best solution or if the physical storage is the best solution or if the general MCU is the best solution. Generally I think this is very minor. This Shamir has a small place in the overall threat model. And I understand this is a topic because it’s quite easy to communicate to users. That some hardware wallet has something better than others. So it’s easy to talk about this, but I think that overall threat model is much more complicated. And what’s not discussed enough in my opinion, is the lifecycle of the recovery seed itself. Like why do you talk all the time about the secure elements when the hardware wallet print out or generates for you, the recovery seed, which you have in your pocket and it’s not covered by secure element, you’re not covered by the passphrase. It’s just a piece of the paper which holds all your millions in Bitcoin.
So I think the security of recovery seed is a second part of the story of hardware wallets. You know, hardware wallets, or Trezor, solves the biggest issue of these things, like moving the private keys from ordinary environment to the secure hardware with limited attack vector, with auditable code with all this research on the on the hardware possible and so on. But it’s not the end of the story. You still have to put private keys somewhere because the hardware itself, like the standard consumer electronics is really unreliable and you can’t count on the faith that it will survive like 10 or 20 years. It’s clearly possible that in 10 years if you turn on your hardware wallet, it will be just blank, it won’t boot up. So we move the private keys from the online world to the really limited hardware and yeah, we are discussing all the security issues with the chips and so on.
But the next part of the story is to solve what to do with the recovery part itself because that’s the most vulnerable in the whole story. And our answer to this complex topic is the Shamir backup, because until now, until we release the Shamir backup, users were really creative about what would do with the recovery seeds. Somebody just doesn’t care, which is probably not great, but somebody even, and that’s the worst when the user thinks that he is a power user and he’s going to create some custom security setup, which I never recommend, they like shuffled the words in the, in the order they want to remember. And when they forgot the pattern, how they shuffled the words they are screwed or they will try to split the recovery seed into two or three parts, hiding the parts on different places. But they usually don’t understand that it may be possible to calculate like those last few words.
So we introduced the Shamir backup to improve the situation and give another tool to the users how to manage the recovery seed. And basically it allows a cryptographic soundwave to split the recovery seed into more chunks, more shares, in the way you can customize how many shares you need to recover and how many shares is in total. So it allows [INAUDIBLE] and it also allow geographic backups. Like you can split your seed and have all your share in other city or even country. And even if somebody’s steal a small portion of small portion that is defined [inaudible], they can’t go or anything from this share which can help them brute force the rest of the shares. So I think this is really important. I explained it. Other wallets will somehow implement this or some similar [INAUDIBLE] in the future. I know that there are some [INAUDIBLE] working on support of SLIP39 into their solutions and I think it makes complete sense. And for that reason we make it, again, for the open source because we really want to encourage the industry to [INAUDIBLE] the standard because we believes it’s another important step in the development and evolution of the [INAUDIBLE] security.
Yeah. And for the people who are not aware of slip doesn’t stand for Stefan Livera Podcast. It’s actually Satoshi Lab’s improvement proposal. I feel like sometimes you get lost in explanations and maybe that the average user will not be aware that there is a huge development laboratory that you have with SatoshiLabs and you’re trying to constantly find new ways to improve security for hardware wallets.
Yeah, we are spending quite a lot of time, uh, researching all these standards. Like we back in days we created BIP39, which is now used by absolute majority of all the wallets. It’s like a widely used standard, and also standards for derivation paths for Bitcoin or altcoins [INAUDIBLE] and so on. So this is where we really want to move the industry forward and actually we are living from selling the hardware, but if we see the hardware itself just as a piece of the much bigger picture and we are spending a lot of time thinking through all the cycle, how to improve all the industry and we just don’t want to insist on fighting over the details in the hardware itself.
Yeah. Because you have said it from the beginning, when you first started with the Trezor, you’re actually thinking in terms of software and you were reluctant into getting into hardware because it’s complicated.
Yes. In this big picture, it makes sense to make a limited hardware, as cheap hardware, with no special inside, because it will make work. Basically Trezor is a reference diagram of the microchip—MCU with two buttons—and the display—there’s no magic in it. All the magic is the software and the security design in this software, which cover all the attack vectors, including the physical attack vectors. There is no magic soup in the Trezor.
Yeah, and some people will look at the Trezor and they will say, Okay, so if it has this cheap microcontroller unit and it just has buttons on the screen, then why does it cost €120 or something for the Model T? The answer is that they pay for customer support and development and research and all that stuff, right?
Yeah, exactly. The other one cost I think $49. So it’s not $100 anymore, but people underestimate the effort in R&D which we put into the software part. I always say that SatoshiLabs is software company. The hardware for us is just a tool. It just needs to do the thing. But all the magic is in software, which is for everybody.
This was a topic few years ago when KeepKey started when all the Chinese clones started—that’s interesting—I didn’t know, but my colleague told me two days ago that they made research and there’s around 40 clones of Trezor, like some international vendor doing hardware wallet based on the Trezor scheme and so on. I didn’t know this. I suppose this is part of the open source and all the standards and all the code and all the electronics—which is open source—and back in years we were worried about this a bit—if we can do sustainable business on fully open source everything. And I think the conclusion is that, yes, because in the security industry you probably don’t want to save 10 bucks on the knock-off hardware, like clone of the hardware, when you are going to put thousands and more dollars of Bitcoin into the device. So we were a bit afraid of this, but it turned out that the people care about this.
They listen about the possible security issues which comes with buying cheap clones and in the end I think this was a winning strategy. I really believe in open source. Contrary to what @BTChip from Ledger told you that he doesn’t think that open source solves all the issues, I think the opposite. Let me explain. We have so many people watching our hands and doing the security research and even breaking the Trezor and they are all the white hat hackers which are then reporting issues to the product and if you check our security page, there’s a lot of reports which we responded to with some fixes in the software. I believe that this is the result of the open source, because without this, with any obstacles in this, dissuaded hackers won’t do this.
The activity of the researchers is a indicator of the living community, and we were asking a few of them why they spend so many time on the Trezor—and actually not on the competition—and answer was quite interesting for us because to really innovate the chip, or hold the solution which includes the NDA chip, they would need to sign the NDA with the manufacturer, which means that if they will find out something they wouldn’t be able to tell it publicly which won’t give them the social credit which is usually why they are into the research in the first place. For me this was eye-opening moment and I realize that, Okay this is interesting. Most likely the Trezor is most attacked hardware wallet on the market, just because we are basically transparent and it attracts the researchers to do the job.
Yeah, and also LazyNinja—who was the only hacker that I was able to get on the show—also said that he did spend some time on the Trezor, but it takes a lot of time to find some kind of vulnerability because there are too many people doing this and there are lots of eyes on the software and on the device itself and that’s why possibly it’s the most secure of all hardware wallets.
In my opinion, this proves the open source actually works because if it attracts white hat hackers which are then reinforcing the product, it makes the whole industry much stronger and much better.
Now there is one marketing point from which sometimes Coldcard attacks you for example, because you support lots of altcoins and you add them to the software implementation. And you also have a Trezor Model T that is Bitcoin-only and I have to ask: is there demand for that, is it sold just as well as the other models?
The BTC-only software? To my knowledge, it’s supported also for Trezor One and Trezor Model T. We are Bitcoiners in heart so this was a natural thing to do when there was a request from our users. And I completely agree with this, but if you are asking me about the sales numbers, I don’t think it’s measurable or it made any impact. I believe this is important for this small portion of the user base, but it’s not like mainstream requested feature.
Yeah, sometimes people can be mean on Twitter. And that’s why I raised this specifically. So I saw a presentation last year with Stick (@pavolrusnak), who is the co-founder of SatoshiLabs and I think he was in Malta—Tone Vay’s conference. And he showed how you can set up a Multisig where the Trezor and the Electrum software and that was so fast and so simple, but at the same time there are people who criticize the security model and say that the average user should not do that, and Multisig is only for people who require it and not just something that individuals who don’t hold too many Bitcoins should pursue. So what is your stance on Multisig?
Multisig it’s great tool for the multi-user funds. Like if you’re a company, you need to hold some Bitcoins, then it’s great for have co-signers which are different parties, different people, and it’s perfectly fit for this purpose. I think that many people who are using Multisig in the way that they are the only co-signer and they have only multiple devices and so on, I think it’s a bit overkill, and all this is about usability, and so in the increasing complexity of the setup it’s so easy to shoot yourself in the foot with the Multisig. I don’t think it’s necessary for the single user to use Multisig because I saw this from the perspective: if you are user and you want to use these accounts daily then you have proper [INAUDIBLE] backup, distribution of these units.
Plus, of course you still need to care about the backup because I would never rely with my Bitcoins which have private keys stored on the devices, because I understand how bad these devices are in remembering any data, like flash memory can fail at any time. So it’s much more complex and downgrades the user experience because if you use this daily, you need to use multiple devices and do this ceremony all the time you are going to send Bitcoins. And on other side, if you are HODLer like longtime HODLer, you don’t need Multisig either because in this case you probably don’t want to even have the seed loaded in the hardware wallet. What I would recommend for a longtime HODLer is to do the Shamir setup or even Super Shamir setup, which is even more complicated like you can have Shamir out of the Shamir shares itself. So you can have really crazy stuffs here which are really for many advanced users only.
But this isn’t the point. Let’s go back to the story. If you want to HODL Bitcoins, then just generate the Shamir backup, store the seeds properly with the CryptoSteel, taking on the safe place, or give it as a social backup for people you really trust—two people which actually didn’t even know each other or something like this—and then you can wipe the hardware wallet, which will be completely empty and you don’t need to care about all the firmware updates and all the hacks—all these things which we were talking all the time in this podcast—anymore, because you have the metal backup which can survive centuries and software security is not in your threat model anymore. So this is all about not making the setup complex but actually about limiting the attack surface to the state that not only do you don’t have Multisig setup but you don’t even need the hardware wallet at all. And I think this is much, much better solution.
Okay. So at the end of the day, who should use a Multisig? Like should somebody who owns $500 of Bitcoin set up a Multisig or is it for companies that have multiple parties?
Yeah, it’s mostly for companies for use-cases where more users need to co-sign the specific transactions, and I don’t see such a big use-case for single individuals. Of course, there’s so many projects that will co-sign or keep some of your shares for you and ultimately they will co-sign or they will authorize you and so on. But it actually makes the threat model much more complicated and much more foggy than doing this on your own because when you create your wallet with some other party, even if it’s an established player in the field, still they have to know about your—you wrote something, maybe they need to know stuff, so they know you most likely and they know how much money you had, which may or may be not a problem for a threat model—depends on how rich you are and how paranoid are you. But I just want to say that every time you add the Multisig into your setup, it solves some kind of issues, but in my opinion it adds much bigger complexity than the normal user can really evaluate and evaluate the risk.
Now here’s an interesting question that usually pops out, especially when it comes to newbies who get into the space because nowadays it seems like hardware wallets and nodes in a box and all these products are kind of part of the lifestyle of a Bitcoiner, and if you want to be a true community member you have to get one of these, and sometimes you see these small groups of people—I think one is established with Casa and one is established with Coldcard and you see them on Twitter all the time. And when is the point when you should be considering buying a hardware wallet? Let’s say that you have your coins on Coinbase and you’re thinking about getting a Trezor, but is there a specific amount or a specific moment when you learn more about Bitcoin, when you should get a hardware wallet?
I understand that most of the people get into the Bitcoin in the way that they buy something on the exchange and it lies there for some time. And many of people ends there, like the journey ends here for them because they have Bitcoin and they speculate on this or whatever. I think it requires some kind of personality to really want to dig more into what the Bitcoin is. And at this point—when the curiosity starts to appear—then the hardware wallets, the Trezor, is here for them. It’s really convenient and mainstream to just buy Bitcoin on the exchange and leave it there, but you know, Not your keys, not your Bitcoins. So I don’t consider these people Bitcoiners really, they just have another bank account which is denominated in Bitcoin.
And as I said, I’m quite a cypherpunk. I like cypherpunk philosophy and I build everything around this. I think the Bitcoin is changing for the 10 years since I’m in the project. I think it’s becoming more obvious that the privacy is an issue. I honestly don’t think that this was always like this. Like of course there were all the time people paranoid about their privacy, but I didn’t think it was mainstream in the terms of the Bitcoin a few years ago—the mainstream concern. Because the Bitcoin was so small. Even for governments, for everybody. So people didn’t feel threat from this side. Now governments and states are recognizing Bitcoin more and more and it’s getting more probably that there will be some actions like, “Now all the government stuff, IRS and all the American agencies and so on—are we going after the Bitcoiners to tax everything properly and so on?” And I think it makes much more sense to think about the privacy and I think the Bitcoin mainstream is going to realize this more than before. So for this I think it’s also bigger challenge for the Trezor because so far we have been solely on the security part. The security and privacy are two completely different things. Like you can be secure. You can have the private keys but your xPubs may be completely public and you are still secure, from some perspective. Of course you are not secure from the social attack vector and so on, but let’s consider that definite possibility. And to be honest, years ago we are focused mainly on bringing the security to the Bitcoin mainstream user.
So we built the wallet as a web application because it was the easiest way of on-boarding the users because they are used to use a web browser and so on. But as the industry is changing—and we see this—we are developing for one year intensive for last one year we are working complete new solution for the application—frontend—for the Trezor which will sit on the user computer or mobile phone, and eventually use local or remote users on a Bitcoin node. So I think this is the next part of the mission, of self-sovereignty of the user. So far the users can’t buy Trezor from the security perspective—like everything was open source and it was all auditable, but still the user was open to use Electrum or now Wasabi and so on. But still it was not the main application, like main user experience from the Trezor, and now we are working on a solution that this will come out of the box with the Trezor. So we want to give first person experience with software for every user.
Speaking of this, when I wrote that long three-part review of hardware wallets in November for Bitcoin Magazine, I was not able to find a software application that is installed locally and does not that browser extension that is usually the most popular way of interacting with your Trezor device. And I was unaware of the software that you released in 2016. I don’t know why I didn’t find it, but I also know that right now you are working on another piece of software that gets installed on your computer and it’s supposed to provide more financial privacy.
So the client that you were using to interact with your Trezor and it was something that you would install on your computer and you would generate the addresses and keep your transaction history on your hard drive. Just like a full node.
Yeah. Definitely is, we have our backends fully open source, even backends for other coins and Bitcoin, all the altcoins which Trezor supports are fully open source and you can download and install on your computer so you can—even now—be completely independent to SatoshiLabs, which to be honest is quite different story than with, for example—Ledger—has these backends closed source. So if you have some coin there which doesn’t have alternative clients, which just support for the hardware wallet, you can be easily locked out of your money once the Ledger shut down their backends, but Trezor has all this completely open source. But on the other hand, I have to admit that it’s not for normal users. Like you need some little skills to start this and sync it with the network and so on. So our focus is to do this in a way which is suitable for every Trezor user to actually install on the computer with backend of his choice to be completely independent of anybody else.
I’m completely fine with this as no solution fits all. Actually I’m big fan of both Electrum and Wasabi, because Electrum was a huge inspiration for us when we started with Trezor, we learned so many things, how wallets work inside. So I love both products and so I have no problem with people using Trezor with other clients. But on the other hand, I think the user experience is not so great. Of course normal Linux user or power user can do this, but it’s not the user experience which we would like to see when you invest $100 for your security setup.
Now I’m going to have to ask you about privacy and the growing market for user data, because the companies like Chainalysis getting bigger and even though they laid off some employees they get contracts with governments and the IRS and the United States. And when you use a Trezor by default with the browser plugin that you have to install, does Trezor collect any kind of data regarding to your IP address, e-mail address, stuff like that, metadata about your transactions? Can Trezor see how many Bitcoins are owned by the users and stuff like that?
The important thing on the Trezor design is that we can’t distinguish devices each to other when we are shipping them. Like there’s no technical way how we can join the order with the specific device when you connect it to the computer. So at no specific time we knew your real identity even if you buy the device from us. I don’t think—and I think I already explained part of this—is if a typical user is connecting the device to our web application, which is using our backends, which are open source but still they are run by us, so technically we may know balances of the users, [INAUDIBLE] of the users and so on, but on the other side, we don’t do this—it’s our social contact—I think that we have this even on our somewhere, but we don’t do this, it’s not here for us [INAUDIBLE] your metadata, but it’s for the people to have the easy onboarding experience. But we are, as I said already, we are actively working on the solution where you don’t want me to connect the Trezor to our servers at any point of time. So this is to prove that we are quite serious in this and so we don’t want to be the gatekeepers and we don’t want to know anything about you.
That’s fair. Because when I look at the KeepKey right now it costs about $20 and it was $200 like 3 years ago or something, and their business model is to sell in large numbers but you also have to KYC with them. So you sign up with your data when you order and they probably find a way to sell that data. I’m just assuming here, I don’t know if they do that but there is probably a market for that kind of data that they’re collecting and it’s reassuring to know that Trezor cannot associate the order number or the device production number with the user. It’s reassuring to know that Trezor doesn’t know who bought what device. You cannot associate a serial number for one device with the user who ordered it.
Exactly. This is the [INAUDIBLE] part, like you can check the software that it’s not really relaying any serial number or anything over the protocol so we can’t link the specific device with your order. Actually, there is generated some ID which is in the protocol because in the application you need to identify with it, you need when you connect it for quick [INAUDIBLE] details but this ID is generated again every time you generate the wallet. So it’s generated once you connect it the first time into your computer. So we cannot know this prior the shipment. So this is the part we can prove because it’s baked in the open source software, another part which we can’t prove— yet—is that we don’t collect any financial data from our Bitcoins. It’s just our promise. I’m quite open about this, but we are working on this to solve so we can be able to tell that you can verify it’s yours.
All right. So Mr. Slush, We have been speaking for nearly 2 hours and I am just going to ask you one last question and that’s it. And it’s also very general. So what is Trezor planning for the hardware wallet market in the future and what should we expect in the coming months or years?
It’s quite a wide question and I will try to summarize. I think that I already said this during the interview. The remaining remaining topic is the usability of the products and the usability of the whole concept, so it will be more available for bigger parts of the Bitcoiners because it’s our mission to secure as much people as possible. So the usability part is still a remaining issue which we don’t think it’s solved yet. Another big topic which we are working on is the privacy and self-sovereignty, which comes out-of-the-box. So no crazy setups with some Linux boxes and so on because we think this can be, this can go out of the box with Trezor itself. And the last part is that, we didn’t hang up with the hardware security. As we spent the first half of the interview talking about the hardware, I think currently there is no better solution, which can be provable better than Trezor on the market from the chip perspective. And still we are not satisfied with the current situation. We are working on some specific projects which could make this better because we think that Bitcoin deserves more transparency on all layers of the software and hardware stack. And I think I will be talking about this on Bitcoin 2020 in March, so if you are an interest this part, you should follow all my speech.
Yes. And even if you’re not able to come to San Francisco—and I will not be able to come to San Francisco because it’s very expensive—you can still watch that on livestream I think.
Intellectually speaking, Peter Todd has been a bitcoiner before Satoshi Nakamoto even emerged on the cypherpunk mailing list. As a cryptography and computer science enthusiast, he would try to solve the double-spending problem with Hal Finney and Adam Back when he was just fifteen. His work and credentials definitely qualify him as a cypherpunk, but it’s his relentless critical spirit and adversarial thinking that make him stand apart.
As a true iconoclast, Peter Todd is not afraid to ask the questions that defy canons and would definitely call out the emperor for his nakedness in spite of authoritarian pressures to recognize the existence of clothes.
For these reasons, Todd is the perfect critic of hardware wallets, and the right kind of person to explain how ideal security setups should function. Though he avoids giving specific advice, Peter Todd does promote the development of a critical thinking mechanism which adapts to threats and preemptively phases out possibly disastrous scenarios.
The inclusion of Todd in season 4 of the Bitcoin Takeover Podcast marks a significant shift in tone, as for the first time during the series the guest has absolutely no involvement in the hardware wallet or cold storage business. By having no skin in the game, he can be brutally honest.
Throughout this two-hour interview, the cypherpunk is candid and merciless when it comes to criticizing the lack of transparency that certain manufacturers show.
And when he doesn’t explain why hardware wallets are terrible and how cold storage is best maintained, Peter Todd also talks about his latest project: Proofmarshall. If you’re able to help build the project (also described during the podcast at 1:17:00) or would like to audit it, feel free to contribute on the public GitHub repository.
1:01:23 – Is memorizing your private key a good idea?
1:01:56 – Security from yourself
1:03:30 – Physical vs digital data security
1:05:20 – Does Peter Todd like weed?
1:06:16 – Bitcoin and drug sales
1:07:41 – Peter Todd’s prediction for Bitcoin’s success
1:09:50 – One day, Bitcoin will go to 0
1:10:00 – The US dollar will fail before Bitcoin
1:12:50 – David Gerard and stories that exist just because they have an audience
1:16:22 – Peter Todd’s Proofmarshall project
1:17:10 – Practical applications of Open Timestamps and Proofmarshall
1:23:30 – Why Peter Todd thinks Bitcoin should have inflation
1:24:51 – Replace By Fee (RBF) according to Peter Todd’s initial design
1:27:00 – Why it’s profitable but disingenuous to sell tokens
1:28:00 – Ethereum’s marketing was a scam
1:30:20 – We can’t replicate Bitcoin
1:31:30 – Post-profitability Bitcoin mining
1:37:40 – Does Peter Todd think Bitcoin will be around in 40-50 years?
1:39:40 – Why is Peter Todd not Satoshi?
1:40:30 – Does Peter Todd have anti-Bitcoin ideas?
1:41:30 – Gold is inflationary
1:46:25 – Does Peter Todd like the HTC Exodus 1s full node phone?
1:48:30 – Android is messed up
1:48:15 – Are iPhones more secure?
1:50:00 – Is Tails OS really safe?
1:50:40 – Why it’s good to have dedicated devices
1:52:30 – The mobile operating system choices we have are terrible
1:54:00 – Tor on Blockstream Green iOS
1:55:10 – VPN, Tor, or both?
1:57:30 – Should we run Tor exit nodes?
1:58:30 – Closing notes
Special thanks to LXMI and Phemex for sponsoring this episode!
LXMI Ad:
“LXMI is a European Cryptocurrency exchange whose name is inspired by Lakshmi, the Hindu Goddess of Wealth, Good Fortune and Prosperity. It’s one of the regulated and legal Cryptocurrency exchange.
On LXMI you can buy bitcoins with most fiat currencies and you can also do the trading for top Altcoins.
They follow the “Not your keys not your bitcoins” philosophy with their integrated non-custodial wallet which helps you manage your own private keys. So if you’re into trading, then you don’t have to worry about having your Crypto frozen by whatever political decisions, since you’re empowered to hold and move your coins around whenever you wish.
It’s great to have new players like LXMI that respect your financial sovereignty.
LXMI is launching in 2020 for more information please check out – www.LXMI.IO/
If you’re not trading, it’s recommended to move your coins to a hardware wallet or some other form of cold storage, and in this episode, you’re about to find why.
Please keep in mind that this is just an ad for a sponsor of this show. It’s not meant to serve as financial advice, and you’re responsible to do your own research before buying anything and act according to your own decisions. Embrace your financial sovereignty with agency and precaution.
Phemex Ad:
“Phemex is a Bitcoin exchange with derivative trading options which focuses on speed, robustness, and maximum uptime. Built by former Morgan Stanley executives, it manages o bring simple and accessible Bitcoin trading. In 2020, Phemex will also add S&P 500 stocks, stock indexes, FOREX, commodities, and more.
Sign up today at phemex.com/bonus and receive a bonus of up to $72.
Please keep in mind that this is just an ad for a sponsor of this show. It’s not meant to serve as financial advice, and you’re responsible to do your own research before buying anything and act according to your own decisions. Embrace your financial sovereignty with agency and precaution.”
Hi there and welcome to Season 4 Episode 7 of the Bitcoin Takeover Podcast. I am Vlad and today my guest—and it’s very hard for me to compute that I’m having this kind of high-profile guest—but it’s Peter Todd who is a cryptography consultant nowadays. He used to be a Bitcoin core developer and if you look at the list of commits on GitHub, he is still one of the highest ranked in terms of activity, and nowadays he works on different projects and possibly he doesn’t want me to mention that he has also worked on that privacy cryptocurrency, which—whatever. Okay. He goes to conferences, he talks about dishonest developers and explains how ethically developers should conduct their activity. And also he writes interesting stuff on Twitter. Part of the reason why he is here is because he commented on the Trezor which got hacked very fast by the security team of Kraken, and that was quite a big debate on social media. And people have started asking questions and, essentially, I guess the main idea is that we should not trust hardware wallets for their physical security, right?
Yeah. I think there’s a range of threat models you might want to have. But the most important thing about a hardware wallet is that it’s not a pile of software on a compromised computer—not that it’s protecting you against ninjas who are breaking into your apartment.
Maybe we should blame the marketing departments for making some claims about what hardware wallets do? One of the examples that comes to mind was one where one executive of a certain company said that you can basically buy one of their devices on eBay and it’s still safe.
Really? I mean I spoke to Jonas and Douglas of ShiftCrypto—they do the BitBox—and they said it’s a bad idea. And their perspective on hardware wallets is that they should be like toothbrushes.
I think the toothbrush brush analogy isn’t necessarily so good because sharing your hardware wallet isn’t necessarily so bad, but you really want to know where the hell you’re buying it. Whereas I’ll go buy toothbrushes about anywhere where you can find them.
Absolutely. And not just can be, we have concrete examples of this, although the way that the attacks have gotten publicity, happened—is hilariously simple—which is you go and take out the little seed card that you’re supposed to go write down your seed on, and then just go pre-fill it. And that’s enough social engineering to go fool people into using that seed.
No, actually I don’t. I mean I own some, but I don’t actually go use them. What I do instead is I just go run regular wallets when I need to securely store a fair amount of Bitcoin—I just go run a regular wallet on a computer that I don’t use for anything else.
Yeah, you have been around at least since 2001 and it’s interesting that nowadays owning a hardware wallet is part of becoming a Bitcoiner. They have turned it into some kind of lifestyle. And to some people it’s impossible to conceive that you withdraw your coins from an exchange—where you buy them—on anything else except for hardware wallets. So my question to you is how were you people dealing with Bitcoins in the early days?
In the early days, people didn’t have that much money in Bitcoin. So all the standards are very different. But I think the more interesting thing is: what do you do these days? And first and foremost I’ll go point out: if you’re withdrawing your Bitcoins from an exchange, how do you even know that the withdrawal happened? Like where did you enter in the address to do the withdrawal? You get all kinds of questions but this, that can break your security long before it ever gets to the hardware wallet. Similarly, if you do have a hardware wallet, how is it exactly that you verify that there’s Bitcoins on it? The hardware wallet itself probably doesn’t have a full node.
Essentially on all my day-to-day use computers, I run Qubes. So I have multiple independent virtual machines I can just go and spin off and they’re all separated from each other and so on. So it’s very easy for me, for instance, to run a Bitcoin node for a wallet. And then you can have that virtual machine connect to a separate node that can also run as a firewall. There’s many options there.
Yeah, if you’re able to do it, there’s no reason to not do it because you know exactly what’s going on there and you understand security. But what about somebody who has no idea what he’s doing or she’s doing and maybe just gets a hardware wallet. Do you have any kind of recommendations in regards to what they should be learning?
Honestly, the advice I’ve actually given people is just go and get an iPhone from a somewhat reputable source that couldn’t go and target you and just install a wallet on it, or get an Android phone, install a wallet on it and don’t use the phone for anything else. And that’s actually not that crazy advice, you know? And if I am going to tell them to go get a hardware wallet, frankly I’d actually trust Trezor more because they do have a design that is based on more off-the-shelf chips than other people do. The problem with something like the Ledger is—to get all these fancy security chips—you have to go sign NDAs and then people can’t easily reverse engineer your devices and figure out if they’re actually doing what they should be doing. You’re actually putting much more trust into the manufacturer than you are on a Trezor, or let alone a phone.
Yeah. But to people who have been holding their coins on Coinbase or Kraken or whatever, sometimes it seems natural that they have to trust somebody and they’re going to say, Okay, I’m going to trust this company that they will provide the security that they provide. And they seem to be also pretty high up in terms of market ranking—Ledger is the bestseller right now.
Remember, the economics of a hardware wallet is that they’re selling a device that costs money, which then gives them the ability to go and pay for marketing and people to go sit on podcasts and all kinds of things. That possible set of solutions is always going to have more support simply because they’re the ones who have the budget to actually go and push their solution. The unfortunate thing with regular wallets on software is that it’s actually hard to monetize them.
Yeah. Also, I suppose there is the market for the data that gets generated when you’re using a hardware wallet, which connects to the servers of the company. They’re going to know your location, your e-mail address, your IP and possibly you also connect to your full node and they’re going to see all of your generated addresses and transaction history and there’s a market for all that data.
Yeah, that’s absolutely true. Although at least with a hardware wallet, there is a income stream in the form of the hardware. Other than that—see from that threat model a pure software wallet is actually more worrying, because they don’t have any other income stream, with exceptions like say, Blockstream’s Green Address/Green bits, where that’s just an add-on service to other things that they’re making money off of. But if you’re looking at a company whose only thing they’re doing is creating a wallet, well you gotta ask, well where’s the money coming from to actually do that?
Well, the Electrum developers, I’m pretty confident it’s just an open source project. But certainly the Electrum servers people run, chances are a lot of them are run by Chainlysis companies. Electrum’s model of having a bunch of servers that you pick at random—where you don’t know who they are—actually really worries me. You’re much better off—in a situation like that—actually having very centralized, well-known servers. This is the irony of it: decentralization for privacy doesn’t necessarily work, because of Sybil attacks.
I’ve never really thought about this, but it makes a lot of sense. Just like how we spoke with @nopara73, who developed Wasabi wallet, and he told me that Coinbase is actually a very good mixer.
Well depending on your threat model, he’s not wrong. Most exchanges that have hot wallets, they’ll be very good mixers depending on your threat model. If your threat model is, I don’t want some guy off in Syria to go and be able to go figure out what my Bitcoins are, well that guy off in Syria is subject to sanctions and probably won’t be able to get Chainalysis to go pick up the phone. On the other hand, if my threat model is someone who can get a Chainalysis feed, well, chances are CoinDesk is just dumping their database right off to a Chainalysis database. I don’t think they ever actually denied that.
I’ve seen evidence personally that Chainalysis probably is getting feeds from various Bitcoin exchanges. Whether or not that’s true now, it’s really hard to know. But it seems pretty damn likely to me based on the stuff I’ve seen.
About hardware wallets, I’ve seen that Shapeshift is selling the KeepKey right now for about $20 and they even give it to you for $5 if you sign up to their exchange and you KYC, which is interesting because this only proves that they’re the market for your data and they can make enough money to sustain the operation, whereas the KeepKey used to cost $200 about two years ago.
Sure. But I’m saying Shapeshift probably would be doing this KYC no matter what. The point is—seeing the hardware wallet get added onto that—I wouldn’t necessarily read too much into it. To me that sounds like a marketing exercise as in, here’s how you go and get on to cryptocurrencies and have some security. I wouldn’t jump to the conclusion of that being malicious or anything. Having said that, depending on which servers your Shapeshift keys are going to, well, then they’d be able to get more data out of it. But I’d want to actually check details like that first.
I think I read some comments on Twitter and somebody wanted to know if you are using a Coldcard and you said you’re not using any hardware wallets, so would you please disappoint?
Well I have a Coldcard, I played with it, but it’s not what I’m using to go and store my riches, to the extent I even have them. I’m just dubious about all these devices to be honest with you, and again, that comes out of the threat model. I’m not terribly worried about—well I shouldn’t quite say I’m not worried at all. But rather I think if someone gets to the point where they’ve physically broken into my apartment or my safes and stuff like that and have physical access to my wallets—a hell of a lot of stuff has probably gone wrong. And they could probably go and get my Bitcoins another way. Like once someone breaks into your apartment, they can also leave hidden cameras as an example.
They can go and try to go get your backup seeds in other ways. It just doesn’t seem to be the threat I’m worried about compared to the much more benign threat of—well, you get some malicious software on the same device that you have your wallet on. Similarly, remember that the way you interact with all these wallets is not purely through the wallet. Like where do you get the Bitcoin address to actually send coins to? That comes off the device—it can also be compromised.
Well Ledger has this issue and it’s doubly glaring with Ledger because they have marketed before saying, Well it’s okay that they go ship their devices without any tamper-resistant packaging, no tamper evidence at all. And that’s just crazy because anyone can go take a Ledger, take it out of this box, pop the case off and do whatever they want with it. It doesn’t matter that the keys are in a little secure element. All of your way of interacting with the device is insecure.
I mean ironically with that regard Trezor is better because at least it’s a sealed case that’s ultrasonic welded if I remember correctly. Same thing with Coldcard. They ultrasonic weld their cases. So it’d be quite a lot of work to take a Coldard, tamper with it, then go put it back together. You’d have to invest in a bunch of tooling and stuff. On the other hand, by the time you’re intercepting packages to screw with Coldcards, well maybe making a new ultrasonic welded case isn’t actually that expensive.
Yeah. Also Coldcard does something interesting with marking a number on the packaging. So when you open it up you see that number and when you boot up the device for the first time, it asks you to verify that the number on the screen corresponds with the one on the packaging.
But you realize how silly that is. You’re verifying it against the device that could have been compromised by the attacker. Yeah that doesn’t actually work.
The way you do that that would actually work is to verify a number against a signature checked by your computer after hooking up to the Coldcard. But if you’re going to have a system that actually works, that needs to be the default users do—just having people check a number on the packaging to a number on the chip is totally meaningless.
Yeah. I mean it’s different in the sense that you can just connect the Coldcard to a power supply and you’re never connected to your computer, but you do have to backup your data on an SD card and then put your SD card inside the computer.
Well let’s be clear: you are connecting it to your computer. You’re just doing it through a higher latency way. The other thing is the physical wires connecting it to your computer—they’re not the thing I’m worried about. The thing I’m more worried about is the fact it’s communicating to your computer at all, because the most likely exploit you would get there would be say a bug in their transaction parsing code where you can go and do a buffer overflow on the Coldcard. And saying it’s not connected to your computer doesn’t help that situation at all. I’d be perfectly happy to have a Coldcard-to-USB interface.
I think the added security of the SD card isn’t that much. Now one thing you can do with an SD card, which is kind of nice, is you can go and—for really high security stuff—you can go audit it. The way you do that is you write to two SD cards. And then you put one aside, use the other one to then do the communication, and now you have a record of what actually went into the device and can go and have some attempt to auditing it. But you’d really need on the Coldcard side—I don’t think their firmware does it—to have the option of writing the transactions to separate SD cards as well.
When I was involved in the Zcash trusted setup there was that same kind of auditing consideration where the trusted setup scheme was designed to leave an audit trail of all the communication that actually happened with the compute notes and that audit trail was done in the form of burnt DVDs. Although again, you had the same problem where people think DVDs are write-once and they’re actually not, because even if you close out the session, you can still modify the data on them at a low level. So in theory, it didn’t actually meet that requirement, but again, that’s the idea: leave that audit trail.
Yeah. I was about to ask you, you said you recommend to people to just get an old phone that they can wipe and install some sort of wallet. But if you were to recommend just one hardware wallet, which one would it be? The Trezor?
Probably, yeah. Because they’re the ones whose overall design and marketing seems like the least voodoo silliness. There’s nothing about Trezor that makes me want to correct them. Look at Ledger, where the marketing of, You can just go and get this without tamper-resistant packaging is just wrong, or Coldcard, where this initial number setup thing just doesn’t make sense. Whereas Trezor—there’s nothing like that I can go point and say, All right that doesn’t make sense. Trezor is a fairly straightforward design and it has its limitations, but I think from what I’ve seen it’s reasonably well understood and I would trust it in the scenario where I wasn’t expecting it to be physically secure, which I think is fine. If you really want the physical security part of it, use a passphrase with it.
Yeah. That’s a fair criticism and I’m happy I got you because you are a big critic of the whole concept of hardware wallets, which is awesome. I got so much positive input in regards to how they work and possibly I think when I first started doing this whole season—which is going to be 10 episodes just about hardware wallets and cold storage—I thought I would make it easier for people to decide what they want to buy when they get a hardware wallet. But now I think I just made it a lot more difficult. But that’s for the better.
And I think what would make it even more difficult is having more hardware wallets support PSBT and also more software on the computer side as well. Because Multisig does change things with this and it changes what you’re actually using it for. Like when all the key is in one place, it’s effectively like, that’s the security model using. Whereas when things are Multisig, you get much more nuanced control over what exactly your security model is. Also, to point out, there’s a difference between security with intent of avoiding loss and security with the intent of auditing and figuring out how you lost something. In corporate environments for instance, a lot of security is actually about auditing: you accept that someone might go break in, but you’re much more concerned about understanding how the break can happen, so you can go stop it.
I’ve heard some people who say they store private keys on devices like the YubiKey, which is a small flash drive which stores any kind of passwords from e-mail to whatever kind of accounts you might be having. And you just put it in your USB and I think it has some sort of fingerprint scanner and that’s how you authenticate with the device.
Yeah that’s not what they are. The YubiKey is effectively a smart card in a different form factor. And the password thing you’re thinking of I think is—well first of all, the YubiKey can store a very limited number of passwords, which is an older style authentication mechanism, but the thing that they’re more used for these days is Fido and UTF where, on the YubiKey there’s an ECC key that then—similar to actually how Bitcoin addresses get derived in hierarchical wallets—you do the ECC maths then derive the key for a particular website that then gets used to sign on an authentication token. So that acts as a second factor to your login and they’re quite useful. I have one that’s sitting on my keychain right now. Okay, five of them—for various reasons—but I use one day-to-day for login and I think they work great. But in the context of Bitcoin they don’t understand the Bitcoin transactions. All they’re useful for there is auditing.
No, I wouldn’t say that. I’d say they’re very friendly, it’s just they offer very little security in the context of Bitcoin. They’re great for securing your Kraken account, and I do use YubiKey to store the 2FA for my Kraken account, but because they don’t have a user interface, they can’t really help that much in protecting your actual Bitcoin. Putting a private key on a YubiKey for your Bitcoins doesn’t really make that much sense.
Yeah. I think there was somebody who was actually asking in regards to this idea that any kind of Bitcoins you’re holding should be associated with a full node. And he asked if it’s possible to set up a watch-only wallet with a pruned node for hardware wallets?
I’m not too familiar with how much software exists for that, but certainly that’s possible to do. Bitcoin Core is an example: it does have watch-only features, so it’s very easy to—at least at the API level—to have watch-only wallets on Bitcoin Core. As an example, some of the CoinJoin wallets actually use this like JoinMarket—that’s just how they manage their wallets. Joinmarket then keeps all of its private keys separately.
I’ve also seen exchanges do this too where in their internal wallet implementation they’ll use this watch-only wallet by Bitcoin Core but then do private key managements in some totally other way, like maybe an HSM.
Well, I mean I’m not necessarily that worried about it. The thing with Bitcoin Core is there’s a ton of people looking at that codebase and auditing it, which is one of the big worries I have actually about a lot of hardware wallets especially non-Multisig ones where you’ve got to ask, How many people are actually looking at that codebase? How many people are reviewing changes to prevent mistakes? We’ve had people lose plenty of Bitcoins just because their Bitcoin wallet screwed up and, say, sent Bitcoins to an unspendable address or something like that. That might actually be the bigger threat overall. So in that regard, Bitcoin Core doesn’t look so bad anymore. Also again, it’s not that hot of a wallet if you do something like run two Bitcoin Core nodes and then have one firewalled by the other. Similarly, if you have a wallet, a good advice is: run your Bitcoin Core node over Tor. So it’s very difficult for anyone to actually go target you.
Yeah, that’s fair. And actually in two weeks I will be interviewing Slush. And his argument for using hardware wallets is that he has seen so many people lose their coins in the early days. That, to most people, it’s just a lot more convenient to have one device where you store it and you have a piece of paper or possibly a metal plate where you engrave your seed words.
Well, I mean that argument isn’t unique to hardware wallets. Just to give an example: I use Eclair with Lightning. Eclair, for the non-Lightning part does have a seed that you go write down and that’s exactly what I did when I set it up. That said, there is something to be said for the psychology of having a piece of hardware that you know to go keep safe. That may be something that helps some people.
Okay. You actually reminded me about something I’ve heard from Douglas Bakkum from BitBox when he said that a lot of the stuff going on with security in the hardware wallet space is just theatrics—they’re doing it just to make you feel safe, but in reality it doesn’t make much of a difference.
Yeah. Like I say, the entire hardware wallet industry, it’s a weird one because it’s a unique way to go make money by creating a wallet. So right there you’re going to have more focus on hardware wallets than is probably actually strictly necessary, just because it’s a way to go make money. It’s like the ICO market where everyone wanted to go and create protocols and have tokens. Well why did they do that? Because that’s the only way to make money off of creating new protocols. It doesn’t necessarily mean it’s good idea, and it’s not to say it’s never a good idea, but there’s certainly going to be more focus on it then is really necessary.
Yeah, that’s a fair point. For example, there are some terrible cold storage solutions like, I’m not sure if you heard about Ballet? It’s created by Bobby Lee and it has the shape of a credit card and it’s basically just a card with a pre-printed private key. Half of it is printed in China, the other half is printed in the United States.
Yeah. A particularly bad example that I saw was where some existing high-security government printer that would normally be printing paper notes and so on. They’ve decided to get into the Bitcoin business and of course they did what they know, which was to go and pre-print private keys on high-security paper. You’re basically better off just doing this by hand on your printer at home. Again this is driven by what they’re able to do, regardless of how much sense it makes security-wise. Similarly, if you want your really bad version you go to a bitaddress.org—I don’t know if they’re still around—but it was just a simple website with some Javascript allegedly running where you’d go to it and print out private keys. Of course if anyone goes and hacks into the server, they can do whatever they want with it.
But see you go talk about the mouse cursor bit and that was probably the most secure part of it. Moving your mouse cursor around is probably a pretty decent way to go generate keys. That’s not actually the issue. The issue is you’re downloading source code every time you go to it, off some not-very-secure server.
Yeah, that’s a fair criticism. I just generated a new key. I’m not particularly happy with this legacy address, but other than that it was fun. It reminded me of what they did with the Coldcard that you get a dice and you roll a dice and input different values as many times as you want to generate more randomness.
Yeah. I don’t know. Randomness generation is another one of those things where there’s so much gimmicky stuff up there. In certain cases for instance, generating them with dice and stuff like that makes sense but only where people are actually auditing how these systems go work. This came up again with Zcash trusted set up where what you’d like to do is have a system where you can audit the full chain of entropy input to public key output. So in that environment, entering in some dices can make sense, because in theory someone can go in, generate a set of die numbers, enter them in and then double-check that the calculation was done correctly. But that only makes sense if all of that is documented and easy for someone to go replicate.
I mean security is such a complex topic and I think there are various stages in somebody’s life when they discover something that’s out there, in terms of threats and how to overcome them. And it’s just like, I suppose owning a house at first you don’t worry much about what’s going on and you say you’re in the nice neighborhood and then as time goes by you see someone scratching your door and you’re going to have to find ways to prevent something more severe from happening.
But, the Get off my lawn thing. That’s security theater. Those neighborhood kids being on your front lawn doesn’t matter. It’s much more important to go worry about other threats.
That’s fair. But sometimes when you’re inviting some non-threats, you’re basically giving away some information about yourself and you might seem more open to actual threats of which you may not be aware.
Nah. Being the crotchety old neighbor who yells at all the kids to get off your lawn, just makes you look like a target. Besides the kids on your lawn, they might go and notice a real threat.
That’s a good point. That’s why I like you Peter, because you have this adversarial type of thinking. Maybe you’re doing this just for the sake of playing devil’s advocate, but it’s never void of substance.
Or maybe I actually have a secret consulting contract where someone wants to figure out how to go in and protect their lawn from neighborhood kids most effectively.
Well, the funny thing about all this is I don’t do cryptography consultancy per se. I do applied cryptography. What I do is figure out how to apply cryptography to your problem. And that’s actually not that related to cryptography. Cryptography is like the math of creating all these fancy schemes, which usually once you get into academic cryptography where the schemes don’t even have to go work.
I feel like I’ve learned something new just here right now. I mean, I wouldn’t have thought about the difference between applied cryptography and cryptography. In my mind it was just, Oh, you take cryptography and you put it into practice.
Yeah, that’s surprisingly hard. I’ve helped clients do quite a few interviews with candidates and it’s quite sobering when you realize how many people with cryptography degrees do not understand how to go apply their cryptography to any real problem. One of the interview questions I come up with where you keep seeing people fail at is basically, Well, all right, how would you go and design a simple PGP? How does the PGP web of trust work, right? These should be very simple questions, but they’re actually hard for people to grasp because they’re not really mathematical. They’re much more about, Well, what does crypto actually mean in the real world? And that’s surprisingly hard for people to figure out.
Yeah. Also I forgot to ask objectively the best question that I received on Twitter: Which steps would you take if you’re the top dog of dev ops for Trezor or Ledger and wanted to steal Bitcoins from people’s hardware wallets?
I hate to say this, but this would be a very easy thing. All I would be worried about is getting caught. If my goal is purely to go steal the Bitcoins, you’d just go push your software update that backdoors the random number generator for instance, or backdoors the signing algorithms so it creates broken signatures. Now the real question is, Well, can I do this and not get caught? And that really comes down to how exactly is source code managed at these companies. And I’ve never actually looked at that into too much detail. I’ve looked at it in detail for clients, but not as in how those companies actually do it, and if you want to defend you against that you basically have to have individual programmers signing code commits and so on. And chances are your most likely way to get away with that would be to quite literally go walk up to one of your coworkers’ computers when they’re not looking or something and then backdoor it and then get their computer to go in and check in a code commit under their digital signature—assuming this is even used at all—so that they’re the one with their name on it. And I suspect what I just told to you is kind of fanciful in that you wouldn’t even need to go that far.
I think it’s easy to do and probably easy to get away with it too. But remember, we’re talking about criminal charges here, so if I was in that position to actually try to do that, I would be quite careful about not having my name on the code. But frankly, even if my name was on the code that resulted in a big Bitcoin loss, these days, you wouldn’t necessarily get much liability. Your issue there would be figuring out how to essentially launder the earnings that you got—which probably wouldn’t be that hard—make sure the Bitcoins eventually get back to you over time. And I think what this really says is source control tends to be really terrible at companies. And I’ve seen this in my consulting where, to give a somewhat anonymized exampleI did some consulting for a company that held a very large amount of Bitcoins for other people and I realized quite quickly that their Git Repos weren’t signed and they were hosted on the same infrastructure where the rest of the system was, which all happen to go feed their Multisig scheme.
This is the sort of thing that happens, and unfortunately, modern software development just isn’t up to the task of this. And it’s the same issue, like why are we running source code? Why are we running the code—compiles from our source code—in the same security environments as we’re editing the code? Because the moment you do that—if you run Git Pull and review a code change and then run that code—if you don’t catch a security flaw, someone will go backdoor your development environment and then commit whatever the hell they want. Most software developers just don’t protect against these attacks. I’ll be honest, I don’t protect against them that well myself because none of the toolings are set up for this. At least I have different virtual machines for different projects. But most people do a really bad job of this.
Well, funny enough I was the one who figured out that there was no Santa Claus and I told my parents, I thought Santa Claus sounded ridiculous. Apparently I was 6 or 7. Obviously I was destined to be security engineer.
I had these moments myself, but they would always find some kind of arguments and say, Yeah, but there’s something magical about this and I would give it the benefit of the doubt. It’s presents. Why would you bother to think too much about it? You get them.
I’m happy that you ended up doing this because your insights are actually useful. And one idea that I got while you’re explaining how you can basically steal people’s Bitcoins—if you’re Trezor or Ledger—was that if you have 1 million users you can roll out an update and just take the equivalent of $1 from each user and it’s very unlikely that they will know this and it’s even more unlikely that they will proceed with some sort of legal charges.
No, that’s a terrible idea, I think. You’re much better off taking everything from one user. Because if every user loses a little bit of money, that’s incredibly suspicious. The common factor is the software. Whereas if one user loses a ton of money, the common factor—well there isn’t one. I mean maybe the user just screwed up.
Yeah, that’s also fair. But when you said they can steal the funds from users, I was thinking they can liquidate all the accounts of all their users. Like if they have a million users and the average user holds about say $200 of Bitcoin, they can just take everything and just run away.
But again, from a point of view of getting away with it, you’re much better off when the number of victims is small and they lose everything. They may be very pissed off, but it’ll be harder for them—depending on how you go pull off the attack—to actually notice anything’s wrong. Your ideal situation is to lock out and get one user with a ton of money on their device who isn’t very technically savvy.
Well like, first of all, who’s checking that the source code actually matches the binaries that wind up on these devices? Indeed. And some of them, like—how can you even check that? Because these devices are unsecured hardware, there is no easy way to even dump the firmware on a lot of them. Like secure chips are not designed to let you just hook up a programmer and dump the firmware. That’s not the goal, usually. Which unfortunately is exactly the opposite of what you actually want for real security.
Bluetooth isn’t inherently bad. The real issue there is a chance that you’ll have a Bluetooth implementation that’s very complex and running on the same environments—same CPU, same microcontrollers as an example—as your wallet code. And if your Bluetooth implementation came from a microprocessor vendor—which it probably did—it’s not going to be very secure. On the other hand, say you had a separate microcontroller that then communicates to the real one over a simple serial interface, that’s not so bad. But overall, if I really wanted the most secure hardware wallet, I would probably put an RS-232 interface on it, because RS-232 is so simple that anyone can go dump a full log of what’s happening over that device. And this is actually easy to do because USB-to-RS-232 adapters are easy to get.
Yeah it’s fast enough. It’s a very, very, very old interface, but it’s simple. It works. I used to use it all the time when I was doing microprocessor development. I used to do electronics and RS-232 is just the standard.
It can be faster than USB 1.0, but basically any modern USB it’s far slower. On the other hand, hardware wallets don’t need much speed. The amount of data that they’re passing from the wallet itself to the computer is minuscule. So it doesn’t matter. As for why you’d use it—because it’s dead simple and very easy to go audit. Like you can literally buy RS-232 adapters that have three ports on them—input, output and then tap—and then the tap, electrically, is totally isolated from everything else. It can’t communicate but it can get you a full dump of everything that goes on. That’s great. That’s exactly what you want for auditing.
I feel like we should be having a larger discussion about this type of security as there are some people who recommend, even when you’re running Bitcoin Core on a computer that never gets connected to the Internet—and they keep their private keys there—that they also use Faraday cages, that way all of the connection ports, anything that can be compromised—
If they’re running Bitcoin Core and it’s not ever connected to the Internet, what the heck are they actually doing? You need somehow to get blocks into your Bitcoin Core to actually do something useful. So you’d want to look at the details of a setup like that, see if it actually made any sense.
Yeah, but remember, keys themselves are not enough to actually verify Bitcoin transactions. You need to go use those keys to verify transactions and sign transactions. You will need to communicate to the Internet somehow. You can go do it in better and worse ways such as very auditable communication like we did the Zcash trusted setup or potentially like RS-232, but the point is setups like that, where you’re starting to use extreme measures like Faraday cages—very rarely are those measures the low-hanging fruit. Now in some cases, they could be, in theory, like again the Zcash trusted setup: if they had botched software, the Faraday cage I used on the compute node would have actually made sense. Unfortunately it wasn’t, because as usual it was actually software that was the low-hanging fruit and they botched that software.
If you were to make a list of advice that you’d give to Bitcoiners, what would that include? To only use, for example, cables for Internet connection and not WiFi, and wired keyboards and stuff like that?
I think that would be part of it. But honestly, the biggest piece of advice I’d give you is: actually learn how the stuff works and how to go think about security and what this means. Unfortunately Idon’t have any easy answer there, but understanding that may actually be the most important thing people do. And maybe the most important part of that type of security is really how to think about threats. What could the attacks be? Can you go draw a diagram of what attacks could happen on your wallet? What are the scenarios? That’s probably the most important bit of advice. Canned things like Don’t use WiFi or only use cables or whatever. I don’t know if that’s as important as just understanding what your threats actually are and what you’re trying to prevent.
Yeah, because usually we get security advice but we have no idea what they are for and we don’t associate any practical usecase with them. We are being told don’t do that and we will take it for granted. And this doesn’t just happen with private keys, it’s all over.
Yeah. Well, security’s a lemon market. Most people buying security in the various forms you can get it have no way of verifying they’re actually getting what they paid for.
Have you ever looked at YouTube’s lock-picking section? Locks are the most hilariously bad example of security. There’s YouTubers who basically—their whole channels is lock-picking videos. And for the ones who are half-decent at it, the locks that they say are really good, they go and lock-pick in real-time on YouTube in like a minute. Lock-Picking something in a minute is considered to be a really good lock. We can do better with computer security fortunately. But yeah, locks happen to be a particularly bad example of this.
If you actually use it. Again, my canned advice to people is just set up another computing device of some kind, stick a wallet on it and don’t use it for anything else. And think about where you’re getting your payments info from, because if you log into Kraken on a compromised computer, that computer has full control over everything you’re going to do there. For instance it can go and rewrite the addresses that you see on screen. So when you send your $10,000 worth of Bitcoin to go buy a new jacuzzi or something, that address may not be the one you think it is.
So @isnotgood asks you, How should he secure his private key apart from writing it down or memorizing it and is memorizing your private key a good idea at all?
People are terrible at memorization. If you actually try memorizing that, there’s a decent chance you’ll find out that you’re actually not good enough to do it. People can memorize 128 bit keys, but only if they actually practice it, and most people aren’t going to do that. I’d suggest writing it down and keeping that piece of paper somewhere safe.
I also like to think that in the situation where God forbid you get tortured and you have the private key memorized, I mean it’s kind of easy to extract. I’m not sure you should be risking your life for money.
Well, again that gets to threat modeling. If that’s the type of threat you have, chances are your Bitcoins aren’t actually the thing you should be worried about. Of course, the flip side of that is if that’s the kind of threat you have in your area, there may be no way to protect yourself. Because if you go give up your keys, how do they know that you gave up the full set? And this is why key disclosure laws in general, it’s just so insane because the way crypto works is that you can’t prove that you gave up keys to things.
Well the point is you can only do that because a car is a physical thing that is limited number, right? When you’re talking about giving up decryption keys for data—because encrypted data is random stuff, there’s no good way to go prove it. And the second part that really makes it ugly with the key disclosure laws is it’s so easy for cops to go and just plant encrypted hard drives, say in your apartment. It’s effectively the equivalent of planting drugs and you just get an encrypted hard drive full of random data, stick it off in your apartment and say, Well why did you do crypto? We found it in your apartment. What’s the key for it? Of course you don’t know and then you wind up in jail for it.
And it’s just one of these very, very obvious threats. And you can get microSD cards the size of your thumbnail that have capacities of half a terabyte, it’s just so trivial for cops to just stick a microSD card in their pocket and then go drop it on a scene. It’s just something that you cannot have in a free society. It’s too easy to abuse it and we can’t trust the police. We know that they could plant drugs on people. They’ve been caught on their own police cams, and every time you find a case like that, remember there’s probably another hundred that didn’t get caught. It’s just a very ugly thing. But I think the Bitcoin relevance of that is, if that is the type of threat you’re worried about it, there may be nothing you can go do.
Yeah. In Canada, completely legal. I can literally go to an Ontario government website and order weed with my credit card, yet if the US finds out I can get banned for life. And especially crazy, remember when I ordered it with my credit card, that information goes through a US server. The Ontario government really should be accepting Bitcoin for this.
It probably still is really, maybe not. The numbers I’ve heard which is taken with a grain of salt is probably like 1% of Bitcoin transactions are related to drug sales, or like 0.5%. That’s the kind of numbers Chainalysis throws around.
Hang on. When you say, “that bad,” what would be bad? What’s wrong with people getting drugs that they want to, if they’re not harming anyone other than themselves. I’m fully for legalization.
No, obviously, but when you’re trying to frame Bitcoin as something for criminals, you’re going to point out to drugs and to prostitution and whatever else is illegal and possibly immoral in the views of some.
Yeah. I feel like we should go back to Bitcoin for a moment because @hodl_american, and I’m not sure if you know his meme, but he recommends people to HODL 6.15 BTC and he has—
I can assure you it isn’t, because the units don’t match up. Bitcoin’s a unitless number and the size of his dick would involve either length or volume, maybe weight. I did enough physics to know this just doesn’t make sense.
I mean, I’m pretty sure he uses the Imperial system, possibly. If it’s the metric system, then that’s bad, man. That’s like two inches. But anyway, he says that @TheBlueMatt has upped his Bitcoin success prediction from 5% to 50%. Do you have any prediction in terms of percentage for success?
Well, the point I always like to make is Bitcoin can mean critical success just by forcing the rest of the world to do better things. Like if Bitcoin forces PayPal to more reasonable policies, Bitcoin’s a success, even if it doesn’t actually get used that much.
That’s really more my definition of success. And at the same time, I also like to point out how, in the long run, everything goes back to zero. One day Bitcoin will go to zero. It will eventually fail. Like everything else—in the really long run—one day the last populated Bitcoin blockchain will get deleted.
It’s just reality. All these things are temporary. Now I think where I would say Bitcoin is a success is I couldn’t tell you whether it’s the US dollar that will fail first or Bitcoin. I don’t have a sense for what the probability for those two are. And I think either one could happen, whereas if you’d asked me that maybe at the very beginning, I’d be more dubious. But certainly at this point, it’s totally plausible Bitcoin could outlast the US dollar.
Have you seen the history of fiat currencies? They often do just fine till they fail. All it would take is the US to elect some crazy president who does something particularly stupid. So far Trump isn’t sufficiently crazy and stupid enough to get the US into that situation. But that’s the kind of thing that can go happen. If you’d ask people 15 years agohow well Venezuela was doing, they’d probably say, Just great, look at all this oil money.
Well, it changes the probabilities, but that can change. Lots of people predicting China’s currency will become the reserve currency. Equally, people who would have said, Oh yeah, China’s going to do well. I mean, that may also be false. It’s not that predictable. But I think what we can say is, it’s certainly plausible for Bitcoin to outlast these. But even if it does, I mean eventually it’s still going to fail. Just take enough time.
That’s the sort of number I could imagine. See [INAUDIBLE] compare me is someone like David Gerard who has been saying Bitcoin will go fail since forever. And the only thing failing is really his predictions.
Well that might tell you something about why he has that view. I don’t think that view is really based on any [INAUDIBLE] analysis. I think it’s based on: he has an audience that likes that view. I think the same thing’s true with a lot of anti-Tesla analysis where, while certainly some parts of it are factual, it’s because of an audience and sure enough the audience for anti-Bitcoin and anti-Tesla actually seems to overlap a lot. Both of those audiences seem very annoyed that neither dies.
This also tells us a lot about the media landscape in general and how you have some sort of opinion which gets propagated all the time just because it has an audience but has no scientific or factual grounds.
Absolutely. And I think it’s just as true of hardware wallets as it is of media. Why things become popular has got very little to do with how good they are sometimes.
I feel like you have blown my mind quite a few times in this interview and there’s a lot to digest there. You get into this space and I’m not the most technical person—I don’t claim to be, but I’m not going to go debating people and having very strong opinions like McCormack while claiming not to be technical, but there’s a lot to be learned and really people like you don’t really go out giving advice randomly and selling courses and stuff like that because you have much more interesting stuff to do with your life. I suppose you’re actually successful in doing consultancy for applied cryptography, but you’re going to have people who apply this old saying about, “Those who cannot do, teach.” They’re going to sell you bad classes about security and teach you bad advice essentially.
Exactly. Yeah that’s the hard thing about this saying, “Those who can’t do, teach,” there’s certainly value in teaching and teaching—especially in the form of consulting—can be a nice stable line of work with less risks that lets you go do more things and have more influence. If I can go and help 10 companies go do something, I may have a much bigger lever to go make changes to the world than if I’d gone and focused on my own project.
Well not sure if I have funding for it, but I have been working on my ProofMarshall stuff on and off lately. And of course there’s my Open Timestamps thing and both of the projects really boil down to making truthful statements about dataOpen Timestamps makes a very simple statement of proving something existed in the past. And then ProofMarshall extends that by saying, rather than just existence, we’ll go say it’s the only thing that existed in some category. And those two classes of statements turn out to be quite powerful.
A really simple one is with digital signatures. Let’s suppose you have a digital signature on a document and the private key gets leaked. How do you verify the signature? Now the attacker could have made it. Well if you have a timestamp and you can go show that the timestamp proves that the document existed prior to the private key leak, you now can still verify the signature even though the key was compromised. That’s Open Timestamps. That’s probably the simplest use case for it. And as an example—Bitcoin core repo—there’s various committers to it who use Open Timestamps with their Git commits, so you have this constant timestamp of when code was added to Bitcoin Core and you can go back and go verify these signatures.
You also see this in evidence in general, very often you can go rule out certain types of attacks by just saying it existed in the past. Maybe as an example, you have a contract with a company and when the contract was signed, there was no reason to do anything malicious about it. But after the fact someone finds that, hang on a second, we would have been in a much better position had say this clause being changed, say it’s a farming contract and you want to go back in time and go add a clause about damages due to bad weather. Of course, you don’t know that bad weather will exist in the past. But if you find out later, well suddenly you want to go change the contract and having that timestamp on that contract, amongst with other verification of it, can be quite valuable to say, hang on a sec. No, no, this is what actually existed. Now in that case, depending on the circumstances, you could go do something where you actually has two different versions of contracts. And you timestamp them both. That’s where ProofMarshall comes in, because it can go rule out the existence of conflicting versions of something.
Well, what I’m really telling you is that ProofMarshall lets you create those Turing-complete smart contracts using this much simpler primitive. See, most of the complexity of ProofMartial would actually be using it to create smart contracts. But the core primitive that it needs is just uniqueness. Once you have a unique set of actions and you can say, All right, that’s what happened. You can always run a program on those actions and then come to a conclusion about what your current status. For all this nonsense about Turing-completeness—that’s what Ethereum is: a big shared set of actions, a set of data that you run a program over and it comes to the same conclusion as everyone else’s. It’s just in Ethereum actually running that program’s really hard because Ethereum has hardly any full nodes that blowed up their blockchain and ProofMarshall can be much more scalable than that because you only need the data for your particular application. You don’t care about anyone else’s contracts.
Well, yes and no. One way to go put it would be to say it lets you create your own blockchains bootstrapped over other blockchains. Blockchain itself—a chain of blocks—is a very useful data structure. People have overloaded that term to go mean a whole bunch of other nonsense. But the idea of having a chain of blocks is really valuable. And my goal with ProofMarshall is in part to make it really easy to make chains of blocks when they make sense. Maybe you need an audit log for something—a chain of blocks would be very useful. And if you can make that chain of blocks be unique by tying it back to something like Bitcoin using something I call a single use seal—then that’s very valuable. But to get there you need a whole bunch of infrastructure. You need a whole bunch of software to write and so on. It’s a much harder thing to implement than say, Open Timestamps where timestamp proof is very simple by comparison.
Anyway, it’s really interesting that you’re working on this and you’re not really stuck into the mainstream conversation about Bitcoin nowadays—you’re thinking outside of that box and that’s useful in itself.
Particularly this reflexive, you know, “Bitcoin not blockchain” thing that a lot of people have. I think it’s understandable given the craziness of the ICO space. It does sort of throw out the baby with the bath water.
Yeah. Some people would argue that your talents would better be used in Bitcoin Core, but people criticize you for stuff like RBF—the idea that Bitcoin should have inflation and stuff like that. Unpopular opinions that you expressed.
Well I think the inflation one’s kind of funny because yeah, I I would say quite, you know, I would say quite concretely that Satoshi made a mistake there. On the other hand, the difference between zero inflation and a fixed 0.5% or something isn’t very big. After all the current Bitcoin inflation rate after the having it would be 2% or something? Obviously having inflation isn’t deadly to Bitcoin, but probably the really funny one is just the RBF nonsense. People forget that the type of RBF that actually got implemented in Bitcoin Core is not the type I wanted.
I argued for quite a long time—many many years—that replace-by-fee should just be: nodes accept whatever’s a higher fee transaction, end of story. What actually got implemented is an opt-in thing. So the previous zero-conf behavior of—Well there’s this vaguely, slightly secure thing that doesn’t actually work—does exist. And you always were able to create transactions that could be double-spent. You just do this by broadcasting a transaction with a low fee followed by a high fee and enough nodes will reject the low fee one—and ignore it—that the high fee one will probably get mined. I’ve got a blog post actually on this where I tested this prior to opt-in RBF getting widely implemented. And on top of that, at least when I tested that, wallets were so bad at handling double-spends that often, for instance, not even recognize the double-spend after being mined. This business about, Oh I screwed up zero-conf something just completely ignored reality of just how bad wallets actually work. I think where that really came from is just people who were lying to each other about what Bitcoin is good for.
And people were still stuck. Some people were still thinking of Bitcoin as a cheap way of transacting and they are the same kind of people who moved on to Bitcoin Cash afterwards.
Which, if anyone actually used it, would be an expensive way of transacting. The irony is nobody uses Bitcoin Cash. Anyone with a shred of common sense or technical chops would understand that Bitcoin Cash and BSV models don’t make sense. Bitcoin so obviously doesn’t scale. I think the problem we had in the Bitcoin space in the wider cryptocurrency space is: making things that actually work is hard, and it’s quite a bit harder to make them profitable by selling tokens. It’s much easier to sell the token when you have this unscalable shared consensus model.
Selling a token for Lightning is kind of hard. It is hard to imagine Lightning with a made up token attached, other than of course Bitcoin itself, but you can’t bolt on another token to Lightning and have it make sense. So if you want to be a scammer and just make a bunch of money with an ICO, the type of architectures that work don’t make sense for you and you’re not going to push them. Proofmarshall is an example. It’s completely unimaginable how the hell I would add a token to it. Open Timestamps, same thing. How would I add a token to Open Timestamps? It makes no sense. Of course Tyrian did try to go do that and Tyrian was marketed as a scam, end of story.
Well I wrote a blog post on this, like Tyrian’s marketing was a scam. They lied about what Tyrian could actually go do. This unfortunately is just a very, very clear cut thing. And it’s funny too because the way they lied about it, even went a little beyond the minimum they needed like one of the key things being, they compared it to Open Timestamps and saying they had lower latency than Open Timestamps, and they didn’t need to do this for the purpose of selling an ICO token. But I think part of this is, you’re in a mode where you’re going to lie about the necessity of your tokens, you also might as well go lie about the performance of your system.
I wouldn’t say I was ever friends with him. I met him quite early on, but I never really liked the guy. He always seem dubious to me. He always gave the impression of being dishonest.
Well I think that’s actually put-on thing to try to distract people from—the times he’s marketed Ethereum with lies as an example. They keep on having to go pivot to new variants of Ethereum precisely because they were never able to admit, Well yeah, Ethereum doesn’t scale and we don’t know how to make it scale. That’s just not how it was advertised in the beginning. And that was a lie. They knew damn well that it didn’t scale and they had no path forward for that. But this is how you go and sell ICO tokens.
Look at it this way, when you’re committing securities fraud, and the SEC could throw you in jail for it, lying about the details of how your system works—that’s a really technical thing that not many people understand—you might as well do that too. The additional bit isn’t going to get you in much more trouble than you’re already risking.
Well, yeah. It’s not good for society if Bitcoin gets replicated a ton of times, you only needed to create one made-up token out of thin air to do what Bitcoin needs to do and there’s some minor things that I would want to see change. My big one is, I think Bitcoin should have a small bit of inflation and the difference between—my argument only becomes relevant maybe another 20 years anyway, so it doesn’t really matter that much right now.
Yeah. It’s going to be interesting to see how the security is going to be maintained. Sometimes I think that mining will no longer be profitable at some point and the developments of ASICs is going to stagnate and people will do it because it’s a hobby.
Well hang on, it’s okay if the development of ASICs stagnates, that’s probably a good thing for us. The issue is really a tax, based on there not being enough money going into mining. And if mining isn’t very profitable that’s okay too. All that matters is, there enough money being spent on proof-of-work for Bitcoin to be secure? And in a system where your inflation reward eventually goes down to zero, you’re now relying on transaction fees and there aren’t good reasons to think they actually will work out. Yes, you certainly could pay for security with transaction fees, but there’s all kinds of weird game-theoretical stuff about, Well maybe I won’t mine a block now, we’ll wait later, and so on. It’s just a much simpler, easier to analyze system if there’s always an inflation reward. Relying only on transaction fees is a dangerous thing.
I guess we’re going to have this debate, as you said 20 years from now, but do you think that at some point mining will be much more decentralized if adoption grows? So for example, sometimes I think there’ll be a return to that initial one CPU, one vote model and people will just run a mining rig under regular computers.
Their incentive to run a node is, if they don’t run a node, they can go be attacked by the person who they go trust to run a node for them. Now that’s a very simple, clear-cut thing and if you make running a node to be cheap enough, then it’s makes sense to go and do that rather than risk that attack. That’s what it comes down to. A lot of people don’t run nodes and they risk that attack. Running the node, and actually using it.
Keep in mind, just running the node isn’t enough. If you run a node off in a corner of your apartment but don’t actually use it, you might as well not be running a node. But if you run a node and use it for your wallet, then you’re protecting yourself against attack. Whereas mining doesn’t really protect yourself against attack. It just uses up energy to maybe create a block once in a while—there’s no direct benefit to you other than the profitability of it. Now maybe if you need the waste heat, then it could make sense. But the question there is do you need the waste heat and is the equipment to do mining cheap enough to make that a good economic argument?
Well mining will always wind up being fairly decentralized because cheap power is inherently relatively decentralized. Mining is a race to the bottom and the cheapest power is available in relatively small amounts spread the world. That’s just the nature of cheap opportunities for power. And part of cheap means also being able to get rid of the waste heat and do something useful for it. That inherently doesn’t lend well to centralization. It’s much cheaper to get rid of a megawatt of heat, than a hundred megawatts of heat, because a megawatt of heat—first of all, you can probably go do something useful with it, maybe warm a greenhouse or something—and secondly, like just basic physics: it is easier to get rid of a small amount of heat than a large amount. Similarly, getting a megawatt of cheap electricity, that’s going to be easier than getting a hundred megawatts of cheap electricity, all things being equal. Because if a hundred megawatts of cheap electricity existed, someone will go use it for something else.
This is why Bitcoin mining tends to be done in weird locations with somewhat stranded hydro resources. Particularly stranded in a regulatory sense. There’s rules for what you can go use power for, where you can go connect things and—Oh, well there’s few megawatts there for some hydro plant that really should have never been built in the first place. Well, how do you use it? You go stick a mining rig next to it.
China did happen to have a ton of that because China’s communists central planning and geography meant there’s a whole ton of hydro-power in all kinds of weird locations. It didn’t really make much sense. And you’re seeing some of that happen again in other places. You’re also seeing things like doing Bitcoin mining with flared gas from oil rigs and so on.
I’d give it a high chance, probably like your 50/50 type of thing. But all this stuff’s hard to predict. Like human civilization might not be around that long if we fuck it up enough.
Well we’re not likely to screw up the environment that quickly, but you certainly could imagine nuclear war breaking out, and it would not take much nuclear war to really screw up most of humanity. And this is not to say that we would actually be extinct, but if in 40 years civilization doesn’t exist as we know it, I could certainly imagine that. It would take like one nuclear war to do that. The problem we have is industrial supply chains are just so diverse and they span the planet and they’re really hard to replace. It wouldn’t take that many countries going to war with each other to screw all that up. Who knows, maybe we’ll see a bit of this in miniature as this coronavirus stuff progresses.
Yeah. That’s going to be interesting to see how it plays out. Here in Romania I already see people wearing masks in public, which is kind of excessive.
Yeah, I mean it’s probably not at a harmful thing. Probably good in terms of face recognition. I think more wearing of masks would probably be good for society. Certainly things like shutting down borders is probably the right move. And part of the issue there is, we don’t really have a good handle on what’s really going on, because China lies. The Chinese government is an authoritative dictatorship.
Yeah. I think I have two more questions for you. And we have been going on for almost two hours and I’m not sure if listeners have gotten up to this point. I hope they will. And if you do just tag us on Twitter and say, Hey, I have heard that part. One of the questions that come to mind when you talk to somebody who has been around for such a long time and obviously you’re a talented person in security and coding—why are you not Satoshi?What is your general reply to that?
No, I am Satoshi, and in this grand tradition of Craig Wright, I will give you absolutely no evidence to suggest that’s true. If it’s good enough for Craig Wright, obviously I’m Satoshi. Also, I’m Craig Wright. Just to be clear about this. That other Craig Wright is a total scammer pretending to be me.
Possibly. But seriously though, you have quite some points of contention and some ideas that are very anti-Bitcoin, like inflation. But if you’re Satoshi, that would be the perfect cover-up, right?
I think that’s something we have in common—economist fathers. I also tried to explain Bitcoin to my father and was like, What’s the point of having a fixed supply?
No, no, no. With my dad it was totally different. It was more, Oh well obviously this is going to be valuable. He didn’t need much convincing. The digital gold argument is a very simple one. Of course, keep in mind—gold is inflationary.
Yeah. And gold has the problem that the supply isn’t bounded. As an example, if you took all the gold on the earth and transported it to the surface, it would cover the entire planet in a layer, if I remember correctly, about a meter and a half thick. There is a lot of gold out there. Far more than we have access to right now and we don’t know how much gold technology will be able to mine in the future. Maybe we’ll find a gold asteroid somewhere. Gold does not have a strictly limited supply.
I agree with that and it’s going to be interesting to see how our civilization ends up perceiving money in the end because in the last 40 plus years—50 it’s been that long—since ’71, almost 50, 49, we have had a different model which is based on consumption and excess and a lot of development around the world has happened because of this. Just because they had the power to print more money and give it to develop—
Well I wouldn’t talk about that in terms of consumption and excess. The way I’d go talk about it is very simple. You are taxed on savings and you are forced to invest. That’s not the same thing as consumption.
Yeah, that’s a fair point. But in my country, more than 50% of the GDP is generated by internal consumption. So if people start saving at some point and they say, I don’t need to buy the latest iPhone, I don’t need to buy that. Why don’t I just save the money? The whole system is going to collapse under its own weight.
No, I would say no. And the reason why I say no is it’s quite possible to go put that money into investing. It’s not so simple to say that we have to have consumption like the standard economic arguments about this are actually about investment. You want to go tax unproductive savings and then stick them off into investing, where do they go do something productive and push society forward. I think the bigger issue is just we’ve pushed interest rates so incredibly low that they might as well be zero and all this stuff gets out of whack.
The other aspect of that is, inflation is incredibly regressive in that it doesn’t affect the rich because the rich can go park their money in investments that aren’t affected by inflation at all. Inflation is much more about the poor.
I’ve never really thought about it in these terms, like inflation is about the poor, but it does make sense. I mean, it’s kind of a system which preserved the establishment.
Well, again, I wouldn’t talk about in terms of preserving the class establishment or any of that. A lot of that’s just, it’s kind of inherent. The moment you have a complex economy, you’re going to wind up with classes because achievements are hereditary to some extent, and the curves on your return on investment of achievement are just so extreme. It’s structurally unthinkable to get rid of that. I think the more interesting thing is just really, I’d say issues of fairness. The simple reality is if you have a system where there is no way to invest your money other than investments in the standard way, you’re really narrowing your choices for people. Like you can’t go and save money in a piggy bank the way you used to be able to.
I feel like for the last question, I should get back to the initial topic and I remember in Berlin, you saw the new HTC phone One S, and I wrote a review about it. I wasn’t happy about what I discovered. I feel like the full node is kind of gimmicky and there’s nothing you can do with it outside of their native wallet. So what is your opinion on the phone. You tested it, right? You bought one?
Yeah looked at it a bit and honestly the very fact that the case back has got a laser-printed Bitcoin logo type thing. I mean, to me that already screams gimmick, and I think part of the issue here is it’s just like other hardware wallet stuff, only by a less reputable manufacturer, and I say less reputable, not because HTC in general is less reputable, but obviously they don’t have much expertise doing hardware wallet stuff. So why would I trust them with it?
Well, the fact that you’re not even sure about that I think answers your question. Regardless of the answer to that, that the answer isn’t clear is part of the trust problem.
No. No. I only got one because I thought it would be a neat thing to go have and be able to go take a look at, and I had a nice excuse to do a big Lightning purchase with it, which incidentally the Lightning transaction works just fine.
Yeah. I mean it’s a decent phone. I suppose it’s priced fairly but it has old specs and runs an old operating system, which I don’t think gets any updates.
Yeah. Now Android in general is a mess that way. The way Android really should have worked is like Windows or Linux on normal PC hardware where everyone just does an open standard, and you just install the software. But unfortunately that’s not what happened. There’s no easy way to just load a standard phone distribution if you will, where you would on a PC.
Is that why the first recommendation that you give to people to install wallets is that they should buy an iPhone, because it has more security updates?
Exactly. Yeah. And it’s unfortunate because there’s a lot of reasons to not trust Apple, but overall you’d probably have a little more good luck with Apple than Android. The other possibility there is to go and buy Google Pixel. But that recommendation is out of practicality really. The one I would recommend maybe even before that is get a ThinkPad and go install a Linux distribution on it then go put a wallet on it. Or you know, use TEOS. But the audience for that is a bit more narrow than just a very generic recommendation that anyone can do.
Well, I mean I don’t think that that threat is what I’m worried about as much. Like to use Bitcoin in general, you have to go use the Internet. For a variety of reasons I just don’t think that’s the biggest threat I’m worried about for your basic advice. Now the more important thing is just don’t use the computer for very much, don’t go off using it to run games and stuff like that.
The fact that you have to give that advice is a massive failure of computer security. You know, we shouldn’t have to give that advice. It’s a bit ridiculous really. But because we’ve done such a terrible job at computer security, if I had a more sophisticated audience, I would say install Qubes, but for that very generic advice, yeah, Apple phone is probably a decent option. It’s advice I’ve given to some friends and family who were very nontechnical. There aren’t good options here. And again, remember, the issue with all of this is how do you actually go use your Bitcoin? The moment you log into Kraken you have this compromised device issue anyway.
Mobile is a very tough thing to develop for because so much effort needs to be put onto good UI design. It is tough to make good touchscreen interfaces and companies like Google and Apple put a ton of research into it and a ton of money. It’s much easier to write a command line application.
It’s also interesting that in this space where the buzzword for such a long time has been, Let’s decentralize, even though it doesn’t make sense most of the times, but we recommend companies that have a good record for security like Apple and also have a more ethical collection of private data.
But don’t think that’s saying that centralization is good. That’s just saying that overall, the choices we have are so terrible that that still winds up being the best for some classic users. Like my more sophisticated advice for more technical people is very decentralized. It’s get a PC and install a Linux operating system on it. Like that’s a very decentralized type of advice made possible by the very decentralized PC market. But unfortunately, you know, because of lack of investment and so on, that market is kind of getting pushed out. Also it’s partly a monopoly thing. Apple and Google would love if PCs stopped existing,
Look how on iOS, there is no easy way to write programs for it without Apple permission. That’s an incredibly locked down environment, but there aren’t good answers.
Yeah, that’s still good. And I know for a fact that even for Bitcoin wallets, it’s very hard to add features. I know that Blockstream has had to work for months to be able to implement Tor. I think right now Green Address is called Blockstream Green, but they did manage the implement Tor and they are the only ones that were able to do it.
Well on Android you couldn’t run anything through Tor actually with the Orbot proxy. Again this comes down to choices in your operating systems. It’s so easy for Google to go shut this down and if I remember correctly, Apple doesn’t make it possible to write Orbot at all, which is ridiculous, but you know, what can you do about it? These devices are just so locked down these days, there aren’t good alternatives to this and that’s unfortunately a type of thing where government regulation is probably one of the few options. Ultimately this is an anti-trust issue.
Okay. One last question and I wouldn’t have made this so long if I didn’t enjoy it because I feel like I have learned a lot and this was maybe selfish, but there is a lot of discussion in regards to the difference between VPN and Tor and sometimes people recommend that you should use both at the same time. What is your take?
It depends on your threat model, but certainly using both can be the more secure option. Tor has a different type of threat model than VPNs. It also depends a lot on like what VPN you use. I personally use a Mullvad because I’ve personally met the people behind Mullvad and I’ve talked to them about their philosophy and their business model and it’s reasonably convincing to me that their business probably is just being a VPN and selling privacy. Whereas like a lot of other VPNs, probably their real business model is—especially anyone that’s free for example—their real business model is very likely to be selling logs.
Tor has this issue. All the architecture’s different because Tor is run by a nonprofit, ultimately a large part funded by the US government. And at least if your threat isn’t the US government, for a lot of reasons, Tor is probably pretty trustworthy. And even if your threat is the US government Tor seems to work pretty well.
Yeah. Remember the US government needs Tor to exist for a variety of reasons. Part of it’s regime change, part of it’s for their own internal people use it. And for all these reasons, having Tor actually work and actually get used by a ton of people helps them out. So it’s really no surprise that you get that funding source and it’s not exactly a hidden thing. I mean, they’re quite open about it and it’s been true for ages, but I think the bigger one is more just the VPN market where it’s pretty clear that a lot of VPN services are really sketchy. It’s just the nature of the thing. Like you can undercut your competitors on price by making money selling logs.
Well in theory, yes. But have fun doing that. The unfortunate thing is, depending on your jurisdiction, you can get in a lot of trouble for running the Tor exit node. Tor has a good set of guidelines to try to do it, but it’s the kind of thing where it’s not something you really want to recommend people do just willy-nilly. On the other hand, running Tor routing nodes, that is not the exit nodes, but the inner nodes, that’s totally fine nearly anywhere. I’d recommend people do that. I’ve done that before myself quite a few times. Plus you don’t need exit nodes to use Tor. Like Tor has Bitcoin support as an example. It doesn’t need exit nodes to work. So having more bandwidth on the Tor network for inner routing nodes helps everyone.
So thank you for doing this interview. I know you don’t do a lot of podcasts. I know it’s pretty difficult to get you and I’m happy and fortunate to have you for these two hours.
This Bitcoin Takeover Podcast uses cookies to improve your experience. In order to generate statistics, data about your country of origin, browser, operating system, and the content you access (which pages and for how long) will be stored and processed.AcceptRejectRead More
1 BTC =
9272.57000 USD
9272.94000 USDT
8217.33000 EUR
7382.81000 GBP
13384.1400 AUD
12591.1600 CAD
993809.0800 JPY
65144.3300 CNY
Recent Comments