S15 E61: Polto & Darko on Self Custody Pro Tips
Search this conversation
0:46Vlad CosteaHello there, and welcome to the Bitcoin Takeover Podcast. I am Vlad, and today we have an interview with the guys behind Hodling.ch. If you have been listening to previous episodes, you have heard ads about them, but they were very clear in the sense that they said, we don't want this to be a boring promotional podcast and just talk about why we're great, even though they're great and they're better than Casa, by the way.
1:10They just want to talk about technical stuff that's interesting to them because they're hackers, they're people who really like self-custody, and they can help you make it better. So to my left is Polto. To my right is Darko. Hello, guys.
1:26DarkoHello.
1:28PoltoHi. Nice to be here.
1:29Vlad CosteaThank you. Before we were... you know, when we were talking to do this interview, I asked you to think about hardware wallets and which ones you think are the best, because I think a lot of listeners are interested to hear about that. We will also talk about multisigs, and maybe you can also reveal some interesting stories about your work. So I hope you're fine with that. These are the rules of the game.
1:53Now let's start with hardware wallets. If you are to make a top for your top five of the best devices, what would you include in it and why?
2:03DarkoWell, it's not easy to make a top five, because it's always about trade-offs.
2:12PoltoTrade-offs, yeah. So let's say if you want to use Bitcoin multisig, then it restricts your choices a little bit, so here we can make an easier choice.
2:23Vlad CosteaSo, okay, so I want to do a two out of three.
2:25DarkoBecause, you know, top five sounds way too...
2:30PoltoNo, okay, let's say if you want Bitcoin multisig, then probably, like, BitBox02, Jade, Jade, Blockstream, Coldcard. Definitely. That's probably, like, what supports the best. Then you have a few DIY wallets, do-it-yourself wallets, like SeedSigner, like Specter DIY. Jade can be done in also like DIY mode on some ESP32 devices. And then you have some other wallets that also have, like, secure elements and support...
3:22DarkoYeah, this is also an important distinction: whether a hardware wallet has a secure element or not. So if it does not have a secure element, you should consider it as a signing device, meaning that you should not trust it to keep your seed safe.
3:43PoltoNow there are some new stuff, by the way, like Jade. They call it virtual secure element. It's a bit of, like, marketing, but the idea is interesting. They don't have a secure element, it's a cheap device, but they encrypt the key stored on it with a PIN that is, like, partially on the server, and the server is running open-source code, so it can be self-hosted. So you see, it's, like, very different trade-offs, and you have different hardware wallets that have these different trade-offs.
4:19And one of the ideas behind multisig is that you can combine different trade-offs and kind of try to get the best out of those different worlds.
4:34Vlad CosteaIt's interesting, but what about passphrase, though? Because you can use the passphrase to mitigate the lack of a secure element.
4:42PoltoIt mitigates it kind of for some stuff, but not for everything. So first of all, like, if you want a passphrase to mitigate this risk, you need it to be, like, really large. Otherwise, it doesn't add enough entropy, and it's easy to brute force. So if you already can extract the seed in some way, so... yeah, it doesn't help for...
5:12DarkoAnd when it comes to passphrases, let's not forget that humans, we are in general bad at generating entropy. We think that it is a sufficiently strong and secure passphrase, whereas it turns out not to be one.
5:32PoltoAnd something easy to guess when you know the person, for example, or something like that, yeah.
5:39Vlad CosteaSo that's important as well. And there was one of these seed plate companies, you know, metal plates, and they were saying that you can put under plates your... they weren't calling it a passphrase, they were calling it the 13th or the 25th word. And they were recommending people to use a word from the BIP39 library for that. And that's not really great, is it?
6:02DarkoFirst of all, it's confusing, because it's not a word. It can be a... it does not have to be from the official dictionary of the 2048 words. And it can be up to...
6:23Polto120, I think so, characters. Even this limit is, like... I think it's not the max limit, but the point is that it can be much longer, yeah.
6:38DarkoAnd also something else that I wanted to mention regarding the passphrase is the question how and where you back up this passphrase. If you keep the passphrase with the original, the initial 24 or however long your seed might be, it defeats the purpose. The passphrase should be and must be stored securely away from the main seed.
7:11PoltoSo yeah, when you have a multisig, basically, multisig is complicated, but the assumptions about what has to be backed up are, like, closer to backing up seeds. You are backing up multiple seeds. So in this way, it's easier to understand, like, what's a good backup. For a passphrase, people sometimes just remember it, and if you can remember it, it's probably easy to guess, but it's also easy to have, like, a small accident or something to forget, or just to drink too much and to forget. So yeah, a lot of bad practices around passphrases, unfortunately.
7:58Vlad CosteaYeah, but BIP39 works in a way that's very interesting, as if you type in the wrong passphrase, it will not tell you that it's the wrong passphrase. There's no wrong passphrase. You have an infinite amount of wallets that can be generated with zero balance. So you type the wrong passphrase, and it's a feature, it's going to open up a new wallet with a new address, and you're going to think, oh my God, my coins are gone, because you typed something wrong.
8:25PoltoThat's good that you mentioned it, because it's actually a feature. It can be used for... how it's called? It's called plausible deniability. Yeah, thanks. So you can have as many of them as you want of these BIP39 passphrases, but it's impossible to prove that you have one additional or you don't have one additional passphrase. So...
8:51And yeah, they're all valid.
8:52DarkoMaybe it's important or useful to explain how it works, the derivation of how the wallets construct addresses. So it's simply the seed that you have, it can be 12 or more, 24 words, and then it adds simply the passphrase. So it means that any passphrase is a valid one.
9:23PoltoYeah, and you generate a new complete tree of keys of HD wallet, keys with this seed, like, generated with the BIP39 passphrase.
9:34DarkoAnd there we touched upon something also important when it comes to standardization: HD wallets, meaning that whenever you enter the same 24 words and the same passphrase, you should obtain the same result. It's deterministic. Yeah, this is the deterministic part. And this is why your setup created in a particular hardware wallet or a software wallet should work, actually must work in any other compatible wallet. Compatible meaning that it supports the right BIPs.
10:21PoltoSo here there is still, like, some incompatibilities between different wallets. Like, the one we mentioned is that not all of them support multisig properly, and some support, like, more complex multisig configurations like miniscript, some still not yet. So yeah, different hardware wallets support different BIPs, but for, like, the bare minimum, like single-sig and BIP39 passphrase, probably you can interoperably switch between different hardware wallets.
11:02DarkoAnd actually, you should do that, because that's one of the ways to verify that your setup was properly set up and recoverable. Because recovery is... we did not mention this in the beginning, but there is a set of best practices that you should stick to.
11:27PoltoLike for backups, for key backups, like the basics.
11:31DarkoChecking the recovery is one of those, meaning that as soon as you have finished setting up your configuration, even maybe before sending a small amount of coins to that address, you should try to import on a different wallet and see if the receiving address that you are generating with this new wallet is the same one that you have been seeing
12:01PoltoWith the initial wallet. And it may sound super boring, but, like, you asked for stories. We have a story around this. So, like, it sounds super boring and very time-consuming: you set up multiple hardware wallets, and you need to reset them all and to re-enter from your backups. Usually, if you do this correctly, you see the same address. So if you wrote down the address or exported it the first time, you can then reset everything, recover, and check that it recovers to the same address.
12:38But this is boring. So to make it slightly more fun, you can effectively put some funds, and then if you still find the funds at the end, then your backup works. And so, usually...
12:53DarkoDepending on your risk appetite.
12:56PoltoExactly. Usually, depending on your risk appetite, we suggest to put some little amount. And we had one customer who put, like, one little amount for him. It was $100,000 value of Bitcoin. And then he was recovering the hardware wallet, and one of the words was saying "wrong," like, not from the dictionary. So he had a little, like, sweating, but finally we explained. It was an occasion to explain him that this is why it's a dictionary.
13:31The words are carefully chosen so that you cannot confuse. So here you wrote, like, T instead of F, or read it differently, but it was a different word, so it was easy to understand, to fix. And he learned to write properly and to do backups, like, to verify them carefully, and why the verification procedure is important, as boring as it may sound.
13:54Vlad Costea[Sponsor read] Hold up a minute. Did someone just pay you in stablecoins? Swap that CBDC wannabe for free-market, scarce and provably yours BTC with SideShift.ai. Do you want to swap your BTC for something else? Use SideShift, the direct-to-wallet exchange. It's fast, it has lots of liquidity for your needs, and the fees are lower than you might expect. SideShift is also available via integrations with Trezor Suite and BTCPay Server.
14:33Check out SideShift.ai today. And yes, you can also use SideShift to dump every other coin and token to make more BTC. Keep stacking, man. SideShift.ai.
14:51DarkoSomething that I'm thinking about while he was explaining the words is the last word that is supposed to be the checksum. So if you stick to the best practices and you import your seed to some other safe device, hardware wallet, if you made a mistake somewhere, the checksum will not be the correct one. So this way you can be sure, even before sending any funds to this address: okay, you have a mistake, go and check which word is wrong.
15:27Vlad CosteaOkay, there are a bunch of OGs out there who never used a hardware wallet, and they just use their full node, Bitcoin Core software, and they say that they're fine. Some of them even walk around with hundreds of Bitcoin on their phone with Mycelium or whatever. And so far, they never lost their funds. They don't even use BIP39, I think. They just use backups. Some of them lost.
15:50PoltoYeah, first of all, we know also some people who lost and got involved some weird three-letter agencies and stuff, but... Oh, you mean Luke?
16:01Vlad CosteaYeah. Luke Dashjr, he lost 200 bitcoins.
16:05PoltoYeah.
16:05Vlad CosteaAnd he was saying he doesn't use hardware wallets, so...
16:08PoltoYeah, he only trusts stuff that he can verify, that he can read the code and understand the code. So, a position I respect and understand, but, like, not everyone reads code, so you have a lot of trust assumptions. And, like, honestly, this way of storing can be good, but for, like, extremely, extremely technical people who trust what they are doing with their IT stuff. And even, like, quite technical people can fuck up time to time.
16:42So hardware wallets are devices that are designed for producing good entropy in the first place, and then to keep your keys secure and to be kind of isolated from the rest of your computer stuff. So usually, it's meant to be more secure. For average people, I believe it's more secure.
17:11Vlad CosteaIn 2013, there were two devices that were announced on the Bitcointalk forum. The first one, I think, was the Trezor, and the second one was the BTChip. And if you go back in time and you scroll through these threads, you're going to find people who say, "Why do I need this? It makes no sense. How is it different from the software wallet that I'm already using?" And it was not obvious at the time, right, why this could be useful, and why at least the signing device can be very useful for you to double-check before sending a transaction, or to at least have a physical button that you press when you want to release these funds to the receiver.
17:51PoltoYeah, so it's good that you mentioned. So I don't remember how was the first version of Trezor, but BTChip had no screen. It was just a device isolating your key and just signing blindly whatever you give it to sign. So there are still some devices of this sort today that have some particular use cases, like Opendime, for example. But generally speaking, for, like, the wallets that we use for multisig with Hodling, at least, we want a screen to be able to verify what you're signing.
18:39Every time you sign with each of the devices. So we had a workshop here at Pizza Day about multisigs and about Specter DIY, and we had one slide that presents, like, different trade-offs between different hardware wallets. And what we said is that basically there is no, like, best hardware wallet. There are different trade-offs, and the best is the one that you understand the trade-offs of and that you are comfortable living with.
19:14So, like, for some people, a non-open-source implementation is a no-go, like an absolute no-go. So they should understand and should be comfortable with the fact that usually it comes with, like, no usage at all of secure elements, or a very, very limited use of secure elements, like only offline storage, no signing within the secure element, nothing advanced, let's say, in the secure element. So it comes with trade-offs.
19:48If you want to simplify the verification for the user, not to force him to check the hash and the PGP signature of the firmware before flashing, then you need to give up on some stuff. Like, usually it would involve some secure element, some proprietary code inside that secure element that checks the cryptographic signature of the firmware, but it would automate this for the user. So for some users, this is better. For some users, the full open-source spectrum is better. So, trade-offs.
20:26DarkoBut the team behind Trezor is working on...
20:33PoltoAn open-hardware, open-source... yeah, which is great.
20:40Vlad CosteaYeah, we're going to get to that. But before that, I got to present the advertisement for... Are you a Bitcoin maximalist? Do you want everything to get built on Bitcoin? Then read more about drivechains from LayerTwo Labs, an initiative to create a two-way pegged sidechain for every use case. Everything from Zcash privacy to Ethereum smart contracts will be available on a dedicated chain that pays fees to the Bitcoin miners and uses BTC for every transaction.
21:14But you don't have to imagine what this would look like. Go to layer2labs.com/download and check out the software. It currently runs on the Bitcoin Signet, but with your help, this grand vision of doing everything on Bitcoin will come true. layer2labs.com/download.
21:42Let's get to this point, because secure elements are convenient. They store the private key inside of them, but at the same time, they act as a black box. You can't verify what they actually do. That's the case for Ledger. And Coldcard and BitBox02 and Passport by Foundation Devices, you have the ATECC608, which is... I guess it has a GitHub repository, so you can see the code that goes into it, but it's still not open source.
22:14PoltoI mean... So for now, as far as I know, every secure element manufacturer forces you to sign an NDA, and that NDA basically makes it impossible to do firmwares that run inside that are open-sourced. So you can open-source some code that interfaces it, but not inside the secure element. So this is why, like, if you want to do stuff inside the secure element like Ledger does, like, for example, signing inside the secure element, generating a key inside the secure element...
23:02well, it's mainly, like, the operations like signing. Now, with the new Ledger, they also control the screen from the secure element, so it's a kind of trusted screen. It's much better in some security aspects, but the code has to be proprietary for now. And most of the wallets that you mentioned, they only use the secure element to store the key when the wallet is offline, and to unlock the secure element with a PIN and to load the key in the memory of the device, on the main chip.
23:39So it's less secure during the signing procedure: when you loaded the key, if someone attacks you at this particular moment and, like, freezes your wallet, they can extract the keys. But yeah, comes with trade-offs, as always.
23:59DarkoShout out to Salvatore, because you mentioned Ledger.
24:05PoltoYeah, so Ledger is really a great wallet for, like, people who don't want to care about their security. So they automate a lot of, like, security for you, but this has a price of having the most important, actually, components built into proprietary code, like key generation and signing. So yeah. We use all types of wallets, like ones that use secure elements at different levels. Today I learned, for example, that you can use Satochip with SeedSigner. So you would generate the key inside SeedSigner, push it to a smart card.
25:00Store it there and reload it from a smart card, so you can finally travel with a SeedSigner and with some key materials on your smart card, kind of safer. You wouldn't be able to do it with SeedSigner before, so it's interesting.
25:18Vlad CosteaYeah, if you're going to get a Satochip or Satodime, use promo code BTCTKVR for 5% off. I think it works. And I think the same code works for BitBox02, and you get, like, 5 or 10%, I'm not sure. BTCTKVR, use that. I'm not sure if I make any money from it, but it can save you some money that you can use to buy Bitcoin.
25:40PoltoBitBox02 is one of the good devices, definitely. Supporting Miniscript, also with Liana. And yeah, so it's really cool, cool wallets.
25:49Vlad CosteaWe're getting into Tropic Square, which is building right now the world's first open-source secure element. And I was at their HQ last year, I did an interview with their CEO. I think it's coming next year, in 2025. And one aspect of it, and it was pointed out to me by Kevin Loaec from Liana Wallet and Wizardsardine: he said that their first chip is not going to be able to sign Bitcoin transactions, and they're going to have to delegate that function to another chip that's going to be inside, probably a general-purpose one like the STM32 or something. So, a microcontroller chip. The second generation, they said they want to integrate that into the chip.
26:34PoltoYeah, it's very possible. And anyway, it will be like... the hardware wallet space is quite, how to say, boring, conservative and moving really slowly. So, like, to get, for example, Taproot or anything fancy fully supported into a hardware wallet, it takes a lot of time. So they go conservative. They start with just storing the key, unlocking the key, providing it to the MCU to do the signing, and then they will probably implement the other stuff. So yeah, looks okay, but I understand it's kind of frustrating to see that the first iteration will not be that powerful, and yeah.
27:27DarkoYeah, so to illustrate that purpose is the fact that only a couple of hardware wallets today support Miniscript, for example.
27:40Vlad CosteaAnd Ledger was the first one, I think.
27:44PoltoSpecter DIY was the first to support Miniscript, since, like, 2022 at least.
27:51DarkoAt least, yeah.
27:52PoltoNo, maybe even before. But the first commercially available wallet, yes, definitely Ledger. And this is also weird to see. Like, if someone from Ledger is listening: they have, like, really good people who allow you to use the latest Bitcoin stuff like Miniscript on a seven-year-old device. And instead of selling and promoting this, they are doing some weird NFT stuff displaying on the screen of the wallet. Yeah, it's strange to see where they put the efforts, while it could be, like, the best Bitcoin multisig wallet.
28:41Vlad CosteaOh, that's another question that should arise from this conversation, because I guess there are more people doing NFTs than using multisig.
28:49PoltoOh, definitely, definitely more. Looks like...
28:53DarkoYeah, that's the case.
28:56Vlad CosteaBut multisig is also complicated. There is not one unitary specification. There is not one BIP that describes what a multisig is. It's multiple types of multisigs with different derivation paths, and it can get very complicated.
29:10PoltoSo now it's kind of relatively standardized, but it's still moving. Like, now what is standardized is, like, SegWit multisig, but we are moving to Taproot multisigs, and there are some, like, variations of what is possible with different types of Taproot multisig. And yeah, to see that pushed up to the hardware wallet level, it will take some time.
29:42DarkoAnd you mentioned something important, talking about standardization. For example, if you create your multisig wallet today, you are expecting it to be usable in 5, 6, 7 years. And if your configuration was done in a non-standardized way, in the future you will most probably have problems, or whoever is trying to help you restore your setup, because of, for example, non-standardized derivation paths, one of the examples.
30:22PoltoYeah, so it's supposed to be all interoperable, but still, when you start your setup, you need to at least make sure that you're on the latest standard and the most, like, commonly used standards.
30:38Vlad CosteaYeah. Which one is that, by the way? Can you mention it?
30:42PoltoYeah, sure. So, like, for example, the Taproot Miniscript stuff that we mentioned, it's not standardized at all yet. So this is, like, still experimental stuff. Even if it's already on the mainnet, you should use it carefully and understand. Like, for example, if you use Liana, try to understand how to recover this. Well, Liana is an open-source software, so you should be able to rebuild it. But let's say it's completely broken and it doesn't work anymore, so how do you recover? For now, Bitcoin Core is the only option.
31:21DarkoLet's mention the other Miniscript-compatible wallet, which is MyCitadel.
31:28PoltoAnd when he says compatible, it's not, because they support different...
31:32DarkoYeah, you cannot export your configuration from Liana and import it into MyCitadel.
31:39PoltoAs of today, it does not work. So for now, if you want to use single-sig, the BIPs, the standards that you are looking to be supported are BIP39, the seed, BIP32, 44 at least, and then, depending on the wallet type that you use, legacy, sorry, Taproot or SegWit, different BIPs. And if you use multisig, then there are, like, some additional BIPs for sorted multisigs, again depending on SegWit or Taproot, different BIPs.
32:22But basically, you want to have the hardware wallets or signing devices that support all of those. By the way, we mentioned, like, some hardware wallets, some signing devices, but I forgot to say that there is also a way... like, you kind of mentioned it. Some people use phones as signing devices, and some of them are really, like, good paranoid users. So they have these phones air-gapped, like, no internet connection at all.
32:57It's just used as a signing device, and you have to use a coordinator like Sparrow or Electrum or any other to build the transaction and pass it to the device. So that's also something that some people use. But again, you have to be quite technical to use this in a secure way, compared to using a Ledger, for example.
33:25Vlad CosteaAlso, there are two components to sending Bitcoin. You have the signing and the broadcasting part. For the signing part, you can do it offline.
33:33PoltoEven before the signing, you have to prepare the transaction. And the hardware wallet doesn't have access to the internet, so it doesn't know the UTXO state. It doesn't know, like, how to build your transaction. So you need some sort of interface. For multisig, we usually call it coordinator, also, to prepare the transaction, to pass it to the hardware devices. And then when you sign, you can recompose it to broadcast. And it uses PSBT, usually, to pass on the transaction to sign, to co-sign between the users or wallets.
34:15Vlad CosteaSo let me ask you about this myth. Some people say that when a hardware wallet is Bitcoin-only, it is more secure, because it has a lower attack surface, without Bitcoin testnet, without Ethereum or Litecoin or whatever. Is it true, or is it just marketing?
34:34PoltoI think it's not only more secure, it's usually more feature-rich. Like, there are some exceptions, but usually hardware wallets that support many altcoins are supporting less features in Bitcoin, like less different BIPs, less... like, for example, well...
35:03DarkoOr are less standardized. They will do, for example, some weird derivation paths.
35:12PoltoNo, this is gone, thank God, this is gone. Now, like, the industry has at least aligned on this. But for example, multisig is not supported by many, by most devices that are doing multiple coins. So already in terms of features, it's not the same. In terms of security, for example, wallets like BitBox02, they have two firmwares: one is a multi-coin firmware, and the other one is, like, Bitcoin-only firmware.
35:52And definitely, when you have less code, you have less attack surface. So I think it's not a myth. You can maybe oversell it a little bit, but no, I think it makes sense to say that. Like, a few wallets have done this. Keystone, I think, also has a Bitcoin-only firmware.
36:20Vlad CosteaTrezor has it, BitBox02.
36:23PoltoYeah. So I don't think it's a myth. It makes sense, actually.
36:28Vlad CosteaAnd Ledger, you can also just install Bitcoin, because it works with this app system where you only install what you want to run.
36:36PoltoAnd by the way, it's also, like, a good time to talk about... for example, you said support for different coins as attack surface, because of, like, let's say, useless code for Bitcoin, but that brings also potential bugs in. But you have also this between different hardware wallets. Some are, let's say, Linux-based, so you have the entire Linux stack, like SeedSigner. It runs on a Raspberry Pi Zero, and it runs, like, a minimal but still Linux kernel.
37:17It has a camera. Pi OS or something. So it doesn't run the same version of Raspberry Pi OS; it's a very minimal Linux, without, let's say, OpenOffice or LibreOffice or, like, stuff which is completely useless. But still, they have a camera to read QR codes, so the camera needs, like, JPEG and many other, like, code, and this comes with attack surface. Some other wallets, like Specter DIY or the latest Coldcard, they opted for a QR code scanner that doesn't have all this image processing stuff.
38:03So you have less code, less attack surface inside the wallet. So I think the firmware stuff is relevant, and you can see it also at the hardware level support.
38:18Vlad CosteaIs the Specter DIY your favorite of the DIY hardware wallets? Because you also have the SeedSigner, you have the Bowser, which doubles down as this video game system.
38:31PoltoWhich one, sorry?
38:32Vlad CosteaBowser, made by Ben Arc.
38:35PoltoI haven't... well, that's the one that you can flash on the ESP32, yeah?
38:42Vlad CosteaYeah, you have a game of Tetris, and you can also switch to the Bitcoin wallet. And there was another one, which I forget, unfortunately, but also...
38:53PoltoKrux. In DIY wallets, Krux is one, also.
39:00Vlad CosteaSo why do you prefer this Specter?
39:06PoltoMost features, like...
39:12DarkoYou can build it yourself.
39:16PoltoWell, they're all DIY, but this is, like... I don't know really well many other ones, like Krux, for example, I never really dug, like, deeply. But compared to SeedSigner, the Specter DIY has at least some secure bootloader, has, like, better firmware security, allows for reproducible builds. Yeah, so there are, like, many features of the firmware that we like, but there is also the hardware itself. The screen is big enough, so it's practical to use.
40:01DarkoThere are also some features such as anti-phishing words, which are nice. When you generate the seed, there is a possibility to modify the entropy.
40:15PoltoTo add some entropy?
40:17DarkoAdd, depending on what you do. You might take away entropy if you think that you are capable of generating randomness, which we are not. And if you modify too many words, you might actually degrade the level of entropy of the device. So that's one of the nice features. And you can see, actually, that the modifications are true, because you can compare the words that you change with the official dictionary.
40:54PoltoSo if you change... this is really important, because this is, as far as I know, the only hardware wallet that allows you to add entropy in a humanly verifiable way, without the need of another hardware wallet to double-check if it works.
41:15Vlad Costea[Sponsor read] Hey, anon, have you heard of STARKs? Scalable Transparent Argument of Knowledge. It's a protocol that uses zero-knowledge proofs to make transactions more scalable and private. Currently, this tech exists only on Ethereum, but if Bitcoin activates OP_CAT, we're going to get STARKs too. Learn more about STARKs by listening to Season 15, Episode 36 of the Bitcoin Takeover Podcast with Eli Ben-Sasson. Also consider supporting OP_CAT.
41:59DarkoAnd then, of course, if you do not trust the device, you just take the same words, you import them in some other hardware wallet, and hopefully, when you enter the first 23 words, you will obtain the same checksum, and it means that the device actually uses that entropy and it's not cheating somehow.
42:26PoltoYeah, that's the danger with all these proprietary devices: that you cannot verify if they are doing whatever they pretend to be doing. Like, for example, generating entropy. Like, how do you know that it's good entropy if you cannot verify the code? So there are, like, some trust assumptions there. But again, it's trade-offs. So as we said, maybe for, like, a free software, open hardware user, he will prefer the trade-offs of Trezor or Coldcard or whatever, or one of the DIY wallets. But for some user who doesn't want to rely on verifying PGP signatures and stuff like that, Ledger is fine.
43:17DarkoOr BitBox, by the way. Coldcard is a hardware wallet that also supports additional entropy.
43:25Vlad CosteaYeah, with the dice rolls. But lots of them integrated that. For example, Foundation Devices Passport, I think. Honestly, it's the better Coldcard, because they have a nicer UI and they're truly open source. Coldcard decided to switch to another type of license.
43:46Yeah, that's really a sad story. But yeah.
43:50PoltoBut seriously, Passport, it's nice, but it has some weird UI limitations also. Like, for some advanced use cases, we had, like... somewhere we wanted to use many accounts in a multisig setup, and it only supports 10. And it's not limited by storage or whatever, but by the UI. That was, like, really weird. And we haven't basically found the solution with Passport, even talking to them.
44:24DarkoSimply because on the screen you cannot put more than 10 small dots that are supposed to represent the page.
44:31PoltoPurely UI thing problem.
44:35DarkoWhereas Specter DIY, that we mentioned previously, supports any account number or derivation. You can enter... it's really, it's really...
44:49PoltoRare use case where you would need something like that, like multiple dozens of multisigs from the same device.
44:58DarkoBut yeah, sometimes... well...
45:01Custom derivation paths might be useful for blinding, if you want to have blinded xpubs.
45:10PoltoSigners who don't know where they're participating until the last moment when you ask them to sign. It can be used for some privacy features.
45:25Vlad CosteaYeah, it's interesting for me, because SeedSigner costs, like, $50 to make, assuming that you can 3D print yourself. I think you're going to pay more for the case. Otherwise, Specter DIY is, like, $200 to build yourself, because the whole system with camera and screen... I think it's on the ESP or whatever website. You can buy it from AliExpress.
45:55PoltoYeah, you can buy from AliExpress or some distributors who distribute STMicroelectronics, who is producing this development board. STM, yeah. So it's a development board. The board itself costs something like 62 euros, I believe.
46:09Vlad CosteaReally? It was very expensive.
46:11PoltoThis is the... and this works already as a minimal signing device. So you don't have the QR code scanner, but you can exchange data over microSD card, or connect it over USB and exchange data over USB also. But you can buy, I don't remember how much it costs, additionally the QR code scanner. So you can buy that additionally and build a case around it. So that would be, like, the most common version of Specter DIY.
46:45And that's... like, I don't know how much it costs if you do it yourself, but a friend of ours is selling it on his website for 150 CHF, bitcoinstore.org.
46:56Vlad CosteaThat's like 150 euro.
46:59PoltoYeah, probably, probably. So not 200. And then you had the few that they sold initially: they produced about 200 additional boards that accommodate the secure element, a smart card for key storage. And that was not, like, really intended to be sold to most people; it was just for the development phase, and it's still, I believe, under development. But the original idea was to be able to use USB smart card readers, like any of them, and just connect them to the Discovery board, to the STM board. So it would be, like, the STM board and a cheap, I don't know, 20 bucks maximum, probably, smart card reader. And yeah.
48:00Vlad CosteaSo let's say that a client comes to you today, walks through the door and says, "Hi, Hodling.ch. I have 1,000 Bitcoin. How should I secure it?" What are you going to say to this person?
48:12DarkoFirst of all, we do not want to know about the amount. That's not important, because in the end, we are not a bank. We will just help the client to control and understand his own infrastructure.
48:26PoltoSo yeah, first we will see what's the need. Like, is it to make it more secure, but for him as an individual, not as a company? In a company, you may need a governance system over the funds. If it's just for him, it's probably just to diversify hardware wallets, to diversify also the places where keys are stored. So in this case, it would probably be, like, a simple two out of three multisig. So again, we are doing only, like, quite conservative stuff, so it would be two out of three, three out of five, something simple.
49:12DarkoOr... in many cases, it might be a single-sig. It doesn't have to be always a multisig. Everything depends on the needs, on the governance, on the risks.
49:25PoltoBut, like, for example, we are located in Switzerland, but most of our customers are from other countries also. And in some countries, you don't trust your government, and you don't trust the local bank safe deposit box to securely store your seed. So in this case, for example, you can use a two out of three with keys generated in different jurisdictions. So it has a cost, but for 1,000 bitcoin that you mentioned, it's fine to bear this cost.
50:03So you would just go and generate one seed per location, store them there. And whenever you need to sign a transaction, you need to travel to at least two of these locations.
50:18Vlad CosteaBut what if a 60-year-old man comes and says, "I have two children, and I want them to inherit this amount of Bitcoin"? How are you going to set it up?
50:27PoltoDifferent ways, depending again on the age of the children, for example. Are they capable already of signing some transactions, or do they need some external party that will help them? So it can be done in different ways. Just to give some examples: now the easiest way is probably with stuff like Liana. I wouldn't use it for 1,000 BTC probably yet, because it's pretty new. To recover, you need, like, Bitcoin Core.
51:10You don't have any other wallet for now to recover this. Very few hardware devices still support miniscript. So for now, it's a limited option, but that would be the easiest option. And that would be the easiest because you can have the main spending path that you use, and the other paths... you can have one additional or many additional spending paths, and those can be some external organizations that help your children if they're too young to recover, but at some point in time, it's even, like, them directly, or relatives directly. For now, the stuff that we use today would be more, like, simple stuff, like different multisigs that are already...
52:10That are already initialized. And, like, for example, if the kids are yet too young, you can have some pre-signed transaction to an address, to a multisig, a multi-institutional multisig, where basically these institutions will help you to recover your funds, but the transaction is not yet broadcast. So yeah, something like that.
52:39DarkoYeah, but the danger there is that whoever has this transaction simply can broadcast it, and it will be accepted by the network. So those risks need to be understood.
52:56PoltoYeah, so basically it's, like, really going through what's possible with the current Bitcoin network, and that has the expectation to last for at least the number of years that you're expecting in your use case, and suggesting what is usable now.
53:22Vlad CosteaOkay, so let's say that this 60-year-old man listened to this and says, "Fuck you guys, it sounds complicated. I'm going to buy into the ETF, and then I write a letter to my lawyer so that what's in the ETF goes to my children."
53:35PoltoSo yeah, ETF is probably the solution for some. If you want some real Bitcoin... we definitely, like, depending on the customer, we don't explain all the technical stuff. It will be technical anyway. Like, if he needs to sign transactions himself, it's going to be technical. But for, like, most of the stuff, we can just abstract it through, like, some... yeah, maybe we mentioned it, or I don't know, you mentioned this in the advertisement.
54:17So we have a network of trusted co-signers, where we have notaries, lawyers, financial intermediaries who can co-sign, who can be participants in your multisig. So it's not, obviously, mandatory. It's best if you're fully self-sovereign and the only one to sign in your multisig. But if you want it to survive you and to be possible for some other people, you may have some external co-signers. And this is what is getting much, much better also with miniscript, because it can be, like, really different spending paths with clear conditions, and the others are not yet available. They only will be enabled if you stop moving your coins.
55:09DarkoWith Miniscript as well, you might have time locks. So you can imagine that you have your wallet with a main spending path, and you have a time-locked one for your kids. And this spending path says that you're allowed to spend the coins locked there after five years. So not five, because it's limited. For now, it's one and a half years, yeah. And every one and a half years...
55:44PoltoA bit less, I think.
55:46Darko14 months, something like that, with Liana today. But you might renew the time lock every year or so, and this way you might have some insurance as well.
55:59PoltoBut for now, I understand it sounds quite complicated for, like, the average person, average Joe. I think that wallets like Liana, they made it... they tried to make it, like, on one side, you can use it in a super self-sovereign way, with your own node running on your own computer. On the other side, they have a web wallet that you can set up with external co-signers. They call it Safety Net, and you can count on people like Hodling, on professionals who can help you to recover, and it can be multi-institutional.
56:37And as I understood, their vision is to bring it also to, like, community signers who co-sign within, like, a community around them. So you can do it for your friends, for the family, and not be the only one. So it makes it, like... first of all, they don't rely only on you. It's not custody. You don't have access to funds unless the expiration arrives. And even when it arrives, you can be not the only one, but a co-signer.
57:11And it can be not even the only recovery path; there can be other recovery paths. So it makes it much more doable in a more self-sovereign way by default. And then you can have multiple backups. And for now, it's quite complicated, but if you give up on a little bit of privacy, then you can have it hosted by, like, the hosted Liana wallet. And yeah, over time, I think all these complications will get, like, abstracted and made available through nice interfaces.
57:55Vlad CosteaWhat do you think about the future of Bitcoin? Is there anything that gets you excited about it? Or do you want it to ossify and remain the way it is?
58:04DarkoOh, full ossification. This is a difficult question.
58:08PoltoNo, it's not a difficult question. Full ossification, I think.
58:12Vlad CosteaDo you like covenants? Do you like drivechains? Do you like Ark or whatever? Is there anything that sparks your interest?
58:19PoltoEverything sparks the interest, but I don't know, like, many of the stuff that you mentioned, I either don't have, like, an educated opinion, or I'm not really bullish on it.
58:36Vlad CosteaWhat's the one you're not bullish on? Let's make it spicy.
58:42PoltoDrivechains. I found the idea really interesting at the beginning, but I don't like a lot of, like, security assumptions around it. Basically, making it a miner-controllable thing over full-node-controllable, enforced, I mean.
59:04Vlad CosteaBut how are you going to enforce that with full nodes? Because you can have... I don't know, you can have a million nodes getting deployed and over-voting with this Sybil attack.
59:17PoltoI don't know the solution to this. It's just that drivechains, because of this, I'm not that bullish anymore. For me, it was still an interesting idea in what it enables, like doing all the testnets and sandboxes on Bitcoin, with Bitcoin, instead of creating other currencies for that. I'm not even, like, fully, fully sure it will completely solve the problem, because, like, you need to inject some money into research and development, and for now, it's done through ICOs or whatever you call them.
1:00:05So I'm not sure that just using Bitcoin instead of Namecoin or whatever coin solves any issue, actually. Well, it solves some issues, but not all of them. But that was the part I liked about drivechains initially. The part I didn't was that, yeah, it's enforced by miners.
1:00:29Vlad CosteaWell, it's funny, because it finds itself in two extremes. On one hand, people say, oh, if it gets too successful, it's going to pervert mining incentives. But on the other hand, people say, I don't think this is going to get any traction, because we already have Liquid and Rootstock, and they provide some Ethereum functions, and very few people use them for that. So it exists in these two extremes, and people find it hard to imagine a middle ground where it gets some usage and the miners are honest.
1:01:02PoltoYeah, I guess with, like, Stratum V2, it should be less an issue to be controlled by... I mean, it would be less controlled by mining pools, but more by miners again. But yeah, still not enforced by full nodes. For now, Bitcoin, for me, that's enforced by full nodes.
1:01:30Vlad CosteaYeah, but once again, you can deploy a million full nodes, and you can use them as voting machines, and there's no way to control that. How are you going to evaluate which node is more important than the other?
1:01:44PoltoThey are not. So in Bitcoin, full nodes are enforcing the vote for you, for yourself. And if you enforce the same rules as the majority, you're on the same network as them. And if you enforce different rules, you're on a different network.
1:02:02Vlad CosteaYeah, and you can just deploy more nodes, and that's what I'm saying. Oh, okay, okay.
1:02:09PoltoSo these nodes, they don't propose new blocks. Blocks are proposed by miners. Yeah, exactly. But miners don't enforce the consensus rules; they only propose blocks.
1:02:22Vlad CosteaSo that's the... which is why Taproot was activated by miners.
1:02:31PoltoYeah, but I don't see the...
1:02:34DarkoNo, my... user-activated soft fork?
1:02:37Vlad CosteaThat was just SegWit. That's SegWit, yeah. And it was just the perfect storm at the time, but I don't think it's something feasible on the long term.
1:02:47PoltoIt's kind of... You can combine nodes...
1:02:49Vlad CosteaAnd miners for decision-making, but...
1:02:52PoltoIt kind of almost started against the... I don't remember what was proposed to be activated, some opcode for... I forgot how it's called, like, imposing recursive covenants. Some covenants opcode was proposed to be activated over the fast... I don't remember how it's called. Speedy Trial, thanks.
1:03:27Vlad CosteaIt was CheckTemplateVerify, by Jeremy Rubin. That was two years ago.
1:03:31PoltoAnd so it almost triggered the opposite of a user-activated soft fork. I don't remember the name. User...
1:03:41DarkoResisted something. Yeah, soft fork.
1:03:43PoltoSo basically, not activated, but refused or prevented. So it almost happened again, and I believe it can happen again. And yeah, it's what I said: the node enforces for you what you accept as rules for the network, but it doesn't vote. It only enforces it for you.
1:04:11Vlad CosteaYeah, and that's what I was saying, because you can spin up a lot of nodes and create a new majority. So you shouldn't put too much political power onto nodes, because you can turn any computer in the world into a node.
1:04:26PoltoYeah. For me, that was the most kind of funny discovery into Bitcoin consensus over time. Like, the first miners were developers, probably. So it was the same person who wrote the code and mined the network. And, like, over time, it got more specialized, and more and more specialized. So it's more and more different types of people. And then merchants arrived. They also had a say in the SegWit2x debate. So it was already, like, many more different actors who have power over the network.
1:05:14And even, like, saying to someone, oh, stop using this wallet, it's shit, switch to this other wallet. It was also voting power, because wallets support this or this network. So yeah, exactly. So it's not only miners or nodes. It's many different people, components and things at play.
1:05:42Vlad CosteaIs there anything that you wish could get added into Bitcoin to make self-custody easier, or add some more tools that would make your work a lot better in some way?
1:05:56DarkoYes, actually, there is something that came up today during the workshop. Someone was asking, is it possible to rotate the keys of the multisig? Unfortunately, it is not, without moving funds, yeah. Simply, that's the way Bitcoin script works. But that would be one feature that would be really useful for people. So if they have, for example, a two out of three multisig, and they somehow either lost a key or a key got compromised, it would be useful for them to be able to swap out and change this compromised key while keeping the same setup.
1:06:37PoltoWe should probably mention at this point that for now, it's possible to do that with some proprietary stuff, like some MPC-based multisig, multi-party computation. So you could use some MPC-based solution, but usually it means that you're not using any hardware wallets, because they're not compatible with this stuff. You're using general-purpose PCs or, best case scenario, some HSMs, very expensive, very proprietary. And that makes your Bitcoin or crypto storage solution not interoperable and not easy to migrate to some other hardware.
1:07:24So this exists today. The other emerging stuff in the Bitcoin multisig, like more native, let's say, is FROST. There you can rotate signers, but it comes with some really weird trade-offs. So for now, we are not using it. We are not using FROST, and as I understand, it's also not compatible with any hardware wallets, as I understood.
1:08:01Vlad CosteaI heard you guys mentioning multisig and passphrases and BIP39, but you haven't said anything about SLIP39, which is Shamir's Secret Sharing. Right now, I think it works with Trezor Model T, the new one, which is the Trezor... what's the name of it?
1:08:21PoltoThe new one?
1:08:21Vlad CosteaYeah.
1:08:22PoltoFour, I believe. Just four.
1:08:26Vlad CosteaTrezor Four? No? Is it Trezor Four? I don't remember. It's Safe 3, I think, if I'm not mistaken, the one that got launched in November. I'm not sure. Also, it works with Keystone.
1:08:39PoltoOkay, those guys integrated it. It's already good that it's supported by Keystone, for now. Unfortunately, the SLIP is, like, similar to a BIP, it's a proposal, but from SatoshiLabs, and unfortunately, it was not supported by so many different hardware wallets. So you still have open-source software to recover this, but for this, you need, like, a secure computer, Tails or something like that, but not everyone can afford this.
1:09:15So we were not big fans, because it's difficult to recover on some other devices. But technically, it's a good solution. It was in the past subject to some implementation bugs, so it's very difficult to get Shamir's Secret Sharing scheme properly implemented. Now I believe it is properly implemented.
1:09:49Vlad CosteaI think you're referring to Armory, right? That was the wallet that had this.
1:09:53PoltoYeah, probably, yeah. There are many who implemented Shamir and who got it wrong, and really badly. So yeah, but I believe now, like, the Trezor implementation should be good. It was tested by many people, so I believe it should be good. But it's difficult to recover if you have to change hardware wallet. Like, for example, Trezor is not available anymore in your country. You still have your shares of the seed, but you need to recover the seed from it.
1:10:34And also, this is not really comparable to, let's say, multi-vendor multisig. So you have shares of keys, so it looks like a multisig, and you need to recover one key. But here, the key will be recovered on one single device that signs the transaction. So if this device is compromised, you don't have the advantage of using multi-vendor multisig, as in, like, traditional Bitcoin multisig, where you would be still protected. In case of two out of three, for example, if one device is compromised, you still need to compromise one other device. So yeah.
1:11:16DarkoYeah, that's what's known as the single point of failure.
1:11:22PoltoYeah, basically, with Shamir, you still have a single point of failure on the device that you will be using to reconstruct the key to sign. So yeah, if you are fine with this trade-off, again, it's perfectly fine to use this. But for most use cases when you want multisig, it's either for governance in an organization, so you don't want to be able to reconstruct the entire key on one device controlled by one person, that defeats the purpose. You wanted in the first place to distribute, like, shares, voting power, and to have them co-sign together.
1:12:09And yeah, the other... so one is multi-party, and the other is multi-factor. Multi-factor is when you do it yourself, but you want to have keys distributed over different devices, maybe even different jurisdictions. Yeah, so here, again, you avoid the single point of failure, while with Shamir you don't.
1:12:37DarkoAnd I just wanted to add that when we say multisig, we think of PSBT, which stands for Partially Signed Bitcoin Transactions, and that's actually what enables you to have this level of security.
1:12:57PoltoWell, it's one of the BIPs that standardize it, and that makes it possible to basically pass the transaction to be signed between the places where the keys are stored.
1:13:16Vlad CosteaSo I got this very nice sheet of paper, I think. No, I'm not going to get it out of my pocket, where you can write your words, and on the back, you don't just have the Hodling.ch branding, you also have a 3-2-1 rule.
1:13:30DarkoOh, yeah. Oh, nice. So 3-2-1, it does not only apply to Bitcoin, it applies to informatics in general. Any backup. Yeah, it simply stands for three copies, in this case seed, your seed phrase, on at least two media, for example, high-quality paper and some piece of metal.
1:13:56Vlad CosteaCryptosteel. Use promo code BTCTKVR, 10% off. Thank you.
1:14:01DarkoYou're welcome. And one means that at least one of those copies should be stored away from the others, off-site, 80 kilometers or more.
1:14:16Polto80 kilometers is because, like, most natural disasters are limited to...
1:14:20DarkoYeah, or it can be a natural disaster, or political problems in the country, or whatever, you somehow get locked out of your possession. And copy means it's not a single piece of paper. Each copy should have... if you chose your media to be piece of paper and metal, each copy should have metal and paper. And on top of that, those should be stored in tamper-evident bags, which give you the additional, let's say, insurance that no one has accessed your backup. A way to verify that they were not accessed, yeah.
1:15:01PoltoSo again, 3-2-1: three copies, two media, one off-site. That's, like, not rocket science, bare minimum for seed backup. You can do better, but this is the minimum.
1:15:16Vlad CosteaI wish we started with this, because most people will not get into the episode.
1:15:20DarkoIt is the bare minimum, but if you take into account that you might have a multisig that has, let's say, five keys, you need to understand the number of backups that it creates. And you need to verify all those backups at least once a year. You should visit your safe deposit, or wherever you're keeping the seed, and check if it was not tampered with. And in the case it was compromised, you need to move your funds.
1:15:57Or, depending on the number of the keys that were compromised, you might need to consider the migration: you should create a new setup and move your funds.
1:16:10PoltoJust also, Darko mentioned these bags, the tamper-evident bags. So it might seem weird, like, why would it help to notice that my backup was opened? So if you're in a single-signature wallet situation, it doesn't help you. Your money is probably already gone, because they accessed the seed. So you have two ways to make these useful. Well, more ways. One way is BIP39 passphrase. Another way is multisig.
1:16:49There is also, like, Seed XOR or other ways to use these also. So you can de-risk one seed storage and make sure that if you notice that it was tampered with, you still can move money out of the wallet.
1:17:08DarkoI just want to add something, because you mentioned XOR. So many people think that by creating their own multisig or whichever setup, they increase the level of security, which is misleading. And this is why you should always stick to tested configurations, and not try to think that, okay, if I have this passphrase here and I have this additional key, I will make somehow my setup more secure.
1:17:41Because in the end, you will end up with a complex configuration, and you don't even know anymore which key is part of which wallet, which passphrase. And yeah, so you should stick to the simple, tested setups, standardized setup configurations.
1:18:01PoltoSo, small anecdote on this also, if we have time. Yeah, we had one client who overdid it. And he did not only multisig, but he added some BIP39 passphrases on top of each of the seeds. And actually, he forgot that he did that. And not only he did that, but with his Cryptosteel backups, somehow he inverted, on all three copies, the 12 and 24 words. So the 12 last words were mixed up with the first 12 words. So that he figured out kind of immediately, because the checksum is not working.
1:18:49And he tried to invert, and it worked. So that was easily solvable. But then he was still... like, he wrote down the fingerprint of each seed and stuff, so he was able to see that he had this fingerprint somewhere, but it's not the one used in the multisig configuration. So it took, like, a few hours to convince him that, yeah, maybe you used the passphrase or some weird derivation path.
1:19:23So we were basically going through what could have happened. He set up the thing on his own; we only assisted him on, like, hardware wallet selection and stuff. And yeah, so don't overdo it.
1:19:39DarkoYeah, and you mentioned Cryptosteel, so it made me think about something also very important which concerns backups. If you have a backup that is on some kind of metal, you should avoid traveling with this backup, because there are scanners at airport security that are powerful and advanced enough that they can actually scan and see your seed.
1:20:16PoltoYeah, that's another anecdote. We tried once with radiology hardware, and we were able to align the plates so that it's, like, perfectly readable.
1:20:28Vlad CosteaI understand that, but they have the capsule, which is like this tiny butt plug-like device, and you put metal tiles on top of each other, and that one is going to be hard to scan like that.
1:20:42PoltoSo with the hardware that I tried, it's definitely possible to scan these and to align on each letter separately.
1:20:49DarkoIt all depends on the effort. If you put enough resources, time and money and computing power, you can probably recover.
1:21:00PoltoWe just suggest to never travel with seeds, unless you use some, like, BIP39 passphrase on top, or Seed XOR or whatever, and that you travel with them in tamper-evident bags, so that you can make sure that they were not tampered with during your transportation. So in some cases, it may be necessary and okay, but you should avoid it completely.
1:21:31Vlad CosteaI did run an experiment with this last year. They paid for my ticket to go to Argentina, at La Bitconf, and I had a Cryptosteel capsule around my neck on a chain, and I went through airports to see how they react. And honestly, only in Romania they made me open it and show what's inside. And I was like, this is my password. For what? For my Bitcoin.
1:21:51And they're like, really? People do this? Like, yeah. Okay. But in a lot of cultures, if you wear something around your neck, it's part of your body, you know? And they can't really take it away from you...
1:22:05PoltoSo, another anecdote then: you told them yourself that it was your password for Bitcoin. In most countries, if you cross the border with, like, over some amount of money and you haven't declared it, it's criminal. So, for example, in the US, the customs agents have a small computer that they can ask you to connect the Ledger or Trezor to. They force you to unlock the PIN code, and it will then extract the extended public key and list how much money you have on them. If you have more than you declared, you have trouble. So this is where, like, BIP39 probably should help, or multisig.
1:22:56DarkoKnown as decoy wallets.
1:22:59Vlad CosteaYeah. Just have one wallet with $10.
1:23:02PoltoYeah, that's all I have. I just tried.
1:23:05DarkoAnd yeah, there is no way to prove that, because the amount of possibilities is so huge that...
1:23:12PoltoYeah, well, we should be careful with these, because you cannot prove it cryptographically, but you can prove it with your social media posts, that, yeah, I made Bitcoin OG and blah, blah, blah. So yeah, people are not stupid.
1:23:27Vlad CosteaYou can also do it like 50 Cent, right? Yeah, but I mean, like, he filed for bankruptcy, and people asked him... not people, in court, he was asked, what's up with these pictures with fancy cars, and you're showering with dollar bills? And he said, oh, they're fake. I just do this for engagement.
1:23:46PoltoI mean, that's what we all do, right?
1:23:50Vlad CosteaOr very poor and we're having fun. We are all rekt.
1:23:54DarkoAs the t-shirt says.
1:23:57Vlad CosteaWhat about zapoi? You guys are experts in this.
1:24:00PoltoExperts in zapoi, yes.
1:24:05DarkoIs it a topic for experts? I'm not sure.
1:24:08PoltoNo, in fact, we are just small practitioners. Small practitioners. To practice the zapoi culture. We are all beginners.
1:24:21Vlad CosteaSo how can someone come to you and ask for help? What's the best way to contact you? Go to Hodling.ch, or...
1:24:28DarkoOr at a conference like today, here.
1:24:34PoltoMaybe we should mention we started something with Nodl, our friends from Nodl. We want to do, like, workshops on the road when we go to conferences, like here, or like BTC Prague or Baltic Honeybadger, etc. We want to do some workshops on the side on multisig. So it will be kind of exclusive workshops with up to probably five to 10 people.
1:25:11DarkoAnd the idea of the workshop is that people arrive to the workshop, they figure out the right configuration for them, and they leave the workshop with a functioning setup and multisig hardware wallets, meaning multisig and infrastructure as well. That's why Nodl is important, because they allow people to have their own nodes, full nodes, which is very important, which is one of the main things that people often forget about in Bitcoin.
1:25:51The first one is having your own node, because you need to be connected to the network yourself and not trusting some third party or intermediary, and the other one, obviously, is controlling your keys.
1:26:07PoltoYeah, the Bitcoin white paper, in the abstract, already says that basically to benefit from the advantages described above, you need two things: be peer-to-peer participants of the network and own your own keys. Those are the two parts that are mentioned since the abstract.
1:26:28Vlad CosteaWell, you're going to own your own keys until it becomes too expensive and you join some Fedimints. But I don't want to start to rant right now. Two short questions. They're hard, but just give the first answer that comes to your mind. You can only buy one hardware wallet. Which one is it going to be?
1:26:47DarkoBitBox02.
1:26:48PoltoSpecter DIY.
1:26:51Vlad CosteaYou can only use one software wallet, and let's say one for laptop or PC or desktop or whatever. So one desktop and one mobile. Which ones?
1:27:01DarkoSpecter Desktop.
1:27:04Vlad CosteaFor mobile?
1:27:05PoltoSparrow wallet on desktop.
1:27:08DarkoFor mobile as well?
1:27:13PoltoProbably BlueWallet, for me.
1:27:17DarkoI'm not sure.
1:27:19Vlad CosteaIs it maintained anymore?
1:27:21PoltoFor the features that I need, yeah.
1:27:27DarkoYeah, I would say for the desktop, probably Sparrow or Specter Desktop. And for the mobile...
1:27:37PoltoBlueWallet is fine. It's really easy to use. It depends really what you want. For single-sig, probably still Samourai. For single-sig. Yeah, it all depends. Even as a... like, this is what Ketominer said here in a talk at Pizza Day: with the shit around Samourai Wallet, we discovered some features that were present for a while, but nobody used. Well, I know some people who use it as, like, an offline signing device, but now it became more obvious, because it's advertised how to use it as a signing device now.
1:28:19Vlad CosteaYeah, but that's only for Android. So what about iOS people? What should they use?
1:28:24PoltoI'm not too much into iOS, but for multisig, BlueWallet is also available on iOS. BlueWallet, yeah.
1:28:31Vlad CosteaNo love for Blockstream Green?
1:28:34PoltoIt's nice, it's nice. It has, like, some multisig support, so yeah. Nice.
1:28:46Vlad CosteaI can ask another question off of this one, but I don't want to. Because, you know, Blockstream Green by default sets up this two out of two multisig. Basically, you have your own key, and when you want to spend, you get a code from Blockstream through email or SMS.
1:29:04PoltoYeah, I don't like that. Yeah, that's their kind of 2FA, degrading into one of two. So it was nice trade-offs. Again, it's all about trade-offs. It was nice for non-technical users trying to get additional security with a 2FA, and was kind of trying to do the best they can to have some fallbacks. Now with Miniscript, you can do better, in my opinion, so I wouldn't use it now.
1:29:45DarkoSo if you like those kinds of services where you have someone participating in your multisig, there is Casa and Unchained.
1:29:54PoltoAnd now Liana with Safety Net. Liana, yeah.
1:29:57Vlad CosteaYeah, but you're Hodling.ch. Don't recommend Casa.
1:30:02DarkoI just said that there are other services, and for some people, that might be what they are looking for.
1:30:11Vlad CosteaBut you don't hold any keys for your customers.
1:30:14PoltoNo. So we don't hold any keys signing into customers' wallets. We do provide some technical services time to time to others, like either financial intermediaries or technical solutions that are recovery solutions. So it's going to get, like, technical, with lawyer jargon, but we can, for example, co-sign in a Casa transaction, where we help the user himself to recover his own funds, but we won't participate in any, like, financial transaction, let's say.
1:30:56DarkoAnd that's why we have the network of trusted co-signers, how we call those. So there you might have lawyers, financial intermediaries who have the right to participate in multisigs of clients. So in case a client loses one of his keys, he can go and get back his key from the lawyer, for example. And the lawyer might be a lawyer of his choice. He doesn't have to be one of the lawyers that are providing the service today.
1:31:35PoltoYeah, so it depends on which country you are in and what, like, jurisdiction you want to stick to. We are in Switzerland. We have to stick with Swiss law, and FINMA actually has a very, like, restrictive view of who may participate in one's wallet as a signer, and they have a tendency to call them immediately financial intermediaries.
1:32:03DarkoSo yeah, that's funny. Something that a couple of years ago, when we started the company, we tried to do everything the correct way. So we contacted FINMA, and we learned, actually, that even if you have one key in a setup where you have five keys, even if you have a partial signatory power, it makes of you someone who facilitates a financial transaction, a money transmitter, and you need a license for that. Even though technically you cannot do anything.
1:32:44PoltoYou only have one. Yeah, so I have to admit, like, in some way, they are right to be quite restrictive on this. At the same time, it's super frustrating, because some people cheat on them by presenting some stuff like, I don't know, bridges or federations as not being multisigs, but they are multisigs, and this is fine. But when you present honestly that this is a multisig, there is a quorum, yes, we can sign within the quorum, no, we cannot prevent the client to sign without us, they still consider us as a financial intermediary.
1:33:34So it's quite frustrating that they don't apply the same rules everywhere, and that they are kind of super restrictive on the multisig for now.
1:33:47Vlad CosteaHodling.ch. And remember, if you watched or listened up to this point, write in the comments: three copies of your backup, two mediums, and one extra location outside of your house. This is a healthy principle. Or write 3-2-1, and I will know that you understood this and you learned something new today. Thank you very much, Darko.
1:34:10DarkoThank you for hosting us.
1:34:11Vlad CosteaNice having you. Thank you. Thank you, Polto.
1:34:13PoltoThanks, Vlad.
1:34:14Vlad CosteaAnd I guess I'll keep on promoting Hodling.ch. Thank you.
1:34:19DarkoThank you. Cheers, Vlad. See you soon. Bye.
1:34:22Vlad Costea[Sponsor read] What is the best way to store your Bitcoin? Do you need a multisig setup? Should you buy hardware wallets? And if yes, what kind? How many backups do you need, and how should you spread them around? These are all difficult questions which deserve an individual answer for every user. Thankfully, Hodling.ch is here to help you. So if you're part of a company that wants to add BTC to its balance sheet but needs to figure out a multisig scheme, or you are a whale who needs to discover the safest long-term holding strategy, you can talk with Polto and Darko, the Swiss co-founders of Hodling. Their service makes you 100% sovereign and puts you in control. Not your keys, not your Bitcoin. Check out Hodling.ch today.
