Incredible hyperbole from the Amicus guy:

"This is hugely damaging to the people who believe that 8 billion people will hold their Bitcoin in cold storage in the future," Lawrence said. "That dream is over. Done."

Sky is falling stuff. Actual cryptography experts have shown the importance (and difficulty) of random number generation for ages. Yes, if your "hardware wallet" aka computer and software is implemented poorly you will have issues.

▲

pants2 7 hours ago | parent | next [-]

Crypto people make fun of me for making up passwords in my head, but my brain RNG has never been exploited, nor has anyone successfully Sherlock'd my password.

▲

angry_octet 6 hours ago | parent [-]

If it's long enough it's fine. They key property for passphrases is being able to remember them. But diceware phrases where you actually roll dice are stronger, and has evident verifiability.

RNG on computers is still hard, and a proper HSM has a carefully designed source of randomness and mixing. I'd trust Yubikey RNG mixing into Linux urandom much more than a random hardware wallet developer.

	▲	pants2 6 hours ago \| parent [-]
		Yeah, something very cool is XOR can only improve randomness as long as there's no correlation between the sources. So Linux RNG XOR'd with this comment is even better than it's source!

▲

sunshine-o 5 hours ago | parent | prev [-]

Yes this has been a known problem of crypto/self custody since its inception. The 1 private key -> public key -> address is elegant but an horrible single point of failure.

When people create a wallet, the quality of the entropy and seed is always: I guess good, for now...

So far the only mitigation for that have been multi-signature but it has its own potential vulnerabilities.

My understanding is the next big Ethereum upgrade might include "Frame Transaction" [0] which will bring a "native multisig" capability to accounts so you can easily always have 2 addresses with different seeds origin to mitigate the risk.

- [0] https://forkcast.org/eips/8141/