Remix.run Logo
▲ aa-jv 6 hours ago

The crypto lunatic fringe have long frustrated me with their assertions of sovereign this and that.

There is no sovereignty in crypto if YOU ARE NOT BUILDING YOUR OWN HARDWARE.

Any claims of sanctity or reliability in the software stack are rendered null and void until someone with a tunneling electron microscope has completed an audit of your chips.

THIS is why Taiwan matters so much, people: there is NO sovereignty for as long as your chips are being imported. You can trust all you want - but trust is nothing without verification. We are all serf-subjects of the wafer-producing overlords.

Ledger clearly drank the koolaid. Crypto people: invest in hardware. NOT software. Anything less is utter futility.

▲RugnirViking 6 hours ago | parent | next [-]

not your keys, not your crypto

not your hardware, not your keys

not your chips, not your hardware

not manufactured in house, not your chips

not your designs, not manufactured by you

not designed by you personally, not your designs

ad infinitum. To be truly secure, you must first learn to survive alone in the wilderness and smelt tin

▲ourmandave 5 hours ago | parent | next [-]

... and smelt tin

I'll just order my crucible and tongs off Alibaba.

Wait a second...

▲lxgr 2 hours ago | parent | prev | next [-]

And at that point, why do you still need to transact with other humans, securely or otherwise?

▲vitorfblima 5 hours ago | parent | prev | next [-]

Our grandparents stored their crypto under their matresses.

▲trollbridge 2 hours ago | parent | prev | next [-]

Hence why governments have generally ended up issuing and securing currency.

▲orsorna 6 hours ago | parent | prev | next [-]

This is why the assertion that crypto allows you and you alone to control your capital is a fallacy. Depends on your threat model of course...

▲stymaar 6 hours ago | parent | prev | next [-]

Every cryptographic system has a trust assumption somewhere

▲flir 6 hours ago | parent [-]

Hm. Computation with paper and pencil?

(I agree in general, I'm just exploring the statement).

▲cedilla 5 hours ago | parent [-]

Unless you are a world-class cryptographer, you have to trust someone that the algorithms are sound.

▲Ohentis 3 hours ago | parent [-]

Even if you are a world-class cryptographer, you have to trust that the algorithms are sound (but now it isn't even a person you are trusting).

▲aa-jv 6 hours ago | parent | prev | next [-]

Yes, that is true.

▲gpderetta 6 hours ago | parent | prev | next [-]

big bang or bust.

▲riffraff 6 hours ago | parent | prev | next [-]

ah the good old C-x M-c M-smelting

▲karel-3d 6 hours ago | parent | prev [-]

Crypto people keep rediscovering we live in a society.

▲dansquizsoft 5 hours ago | parent | prev | next [-]

I don't get what you are saying here re no sovereignty with no (custom) hardware.

Grab the Bitcoin white paper and an airgapped PC with a fresh Debian install.

Implement the algorithm(s) in the white paper to generate yourself a private key and then a wallet address from that.

Send bitcoin to that wallet. Write down the private key and wallet address, store it somewhere safe, bury it in the garden, whatever.

No special hardware is required for any of this...

Or am I missing something?

▲duvall69 3 hours ago | parent | next [-]

Yes, you're missing that grabbing an airgapped PC with a fresh debian install is less fool-proof than you are proposing. The victims here thought they were buying an airgapped device but due to a supply-chain attack they were not actually airgapped. Of course the odds of their being a secret modem in a random PC you buy to be your own homebrew ledger device are nearly 0 -- but it's certainly not impossible or even difficult for a motivated attacker -- it's just unlikely because there would usually not be enough value in snooping on a device like that. What you are talking about is just security through obscurity, not actual security.

▲expedition32 an hour ago | parent | prev [-]

Ah yes real mass adoption strategy right there.

▲dingaling911 6 hours ago | parent | prev | next [-]

Seems like maybe crypto having a single point of failure (keys) is a problem rather than hardware.

You will never be completely secure against failure, the only way to protect yourself is to be able to robustly recover from failure.

I'd rather be able to say "every single government is in my hardware and they still can't touch it."

Perhaps possible with multisig, but now you're basically back to trusting banks.

▲rhyperior 6 hours ago | parent [-]

Keys don’t have to be a SPoF though. Multi-signature schemes are the baseline for security today.

▲dingaling911 5 hours ago | parent [-]

Right, but who is the multi in the multisig and what happens if they die.

▲rhyperior 5 hours ago | parent [-]

You can be the multi yourself. Choose diverse hardware (ie, not all the same Ledger) and your likelihood of compromise changes significantly in your favor.

Sure, loss of seed material would be catastrophic so have a backup scheme. The point isn’t that you can make it perfect, but there’s laughably risky and imperfect solutions and putting everything on a single key HW device like this is the poster child.

▲dingaling911 4 hours ago | parent [-]

OK but if your wallet gets doxed, you can still be forced to give it up by criminals.

▲rhyperior 2 hours ago | parent [-]

Indeed! The pipe wrench attack, employed since valuable things existed!

▲PaulRobinson 4 hours ago | parent | prev | next [-]

That's an impractical stance, there's always another layer down.

Supply chain risk is real, and it has to be managed in realistic terms.

For me, this is the weak link in the chain for digital assets, and always has been, but the mitigation is simple: no one hardware wallet should have millions of dollars of assets on it. Split it up, and use different techniques, different vendors, with different supply chains.

▲thenthenthen 6 hours ago | parent | prev [-]

Not sure what you mean? Taiwan, imported, isnt taiwan the biggest exporter of high end chips? 100% these have not been hacked in Taiwan. You mean setting up your own fab? I am confused

▲aa-jv 6 hours ago | parent [-]

Yes, Taiwan is the biggest exporter of chips. Have you audited your chips today?

▲dada216 6 hours ago | parent [-]

I wonder if even people like Intel or AMD or Nvidia do.

There might be a strict hardware audit process for cryptographic accelerators on IBM Z machines though, I'm not sure, I'm gonna ask though.

▲aa-jv 6 hours ago | parent [-]

It is standard practice in many industries to do hardware audits, including random controls of chip supplies.

These industries are just not sexy enough for the crypto folks to want to learn from, or about.