I would be wary of doing this for a couple of reasons. Clipboard malware could obviously change the address, but so could anything malicious on your email provider's servers. It's also a privacy risk, since your email provider will likely have copies of the draft email you create saved and linked to your account even after you've deleted the address. I would prefer to use QR codes or a USB drive, same as I would use for moving transactions back and forth to an airgapped device.

The same probably applies to passphrases. Given how often users reuse the same password across all their accounts, I bet there are a significant number of people who are using their computer password or various account passwords as the passphrase for their seed extensions.

Shamir's secret sharing is designed in such a way so that if you have any number less than the threshold number of shares, it is the same as having no information at all. In that example, you need three shares to recover the secret. Having two shares provides absolutely no information, and is the same as having no shares at all. Anyone trying to break that will be trying to brute force every possible 12 word seed phrase, which is obviously impossible.

However, Shamir's secret sharing is generally a poor method and is not recommended for a number of reasons: https://en.bitcoin.it/wiki/Shamir_Secret_Snakeoil

Unscrambling 12 words is almost trivial while unscrambling 24 words is computationally impossible, provided no additional information, yes. But that does not mean this is a good way to back up your seed phrase or protect your wallets. If you are uncomfortable with simply backing up your seed phrase normally, then you should either use an additional passphrase or a multi-sig wallet, rather than trying to create your own method. I've lost track of the number of users who have come to the forum looking for help because they cannot recover from their own back ups after doing something non-standard like what you are proposing.

Certainly there is always the possibility that a website (any website) could also be hacked and have files or links replaced with malicious ones, but that has never happened to the Electrum website as far as I am aware, whereas there seems to be a new scam crypto wallet on the Apple or Google app stores every other day. That's also why I said you should verify the .apk you download before transferring it to your phone for installation. Even if the website is hacked and the .apk replaced with a malicious one, then you will discover that when it does not verify correctly. You cannot do any of this if you download directly from the play store.

If you opened the correct Electrum website, and if it hasn't been hacked, and as long as you weren't redirected by some malware or similar, and the Google Play upload also hasn't been tampered with, then yes, you have landed on the right wallet. The only way to be certain you are installing what you think you are installing is to verify the download as I said above.

By that argument, an egg cell does not have a 0 percent chance of survival either. It will also survive if it meets the right conditions in the womb.

If you then claim that an unfertilized egg cell isn't a human but a fertilized egg cell is, the only different between the two is that it has gone from 23 single chromosomes to 23 pairs of chromosomes. If that is your criteria, then that means a skin cell is also a human.

Your cut off is entirely arbitrary. A ball of cells is not a human being.

That's just not true. They can sense their environment, they can react to stimulus such as bright lights, pain, or skin to skin contact, they can communicate that they are hungry or tired, etc. A fetus before the limit of viability cannot do any of that because it does not have a functioning cerebrum.

I've already addressed this. Being temporarily unconscious is not the same as having no capacity for consciousness because your brain has either died or doesn't exist.

Sure, that's a fair argument. My point about discrimination was more about the network itself. If Visa decide they don't like you, or things you say, or things you do, or causes you support, or how your spend your money, or who you trade with, etc., then they can unilaterally decide to suspend your transactions and close your account and there is nothing you can do about it. Whereas bitcoin will not and can not do any of these things. It is censorship resistant, and therefore by definition, usable by anybody (although I appreciate your point that anybody doesn't mean everybody).

Do they? Visa transactions take 3-5 days for funds to arrive in the merchant's account and take 90-180 days to be irreversible. Bitcoin achieves this in seconds and minutes respectively. They cost the merchant several percent in fees, which the consumer obviously ends up paying through increased prices on goods. The entire Visa network has gone down in various countries and even globally in the past, rendering it completely useless and meaning businesses could only accept cash. This has never happened to bitcoin.

Assuming that they are only going to allow you display Lightning invoices. I'd be very surprised if there was no option to display a standard Bitcoin address, especially if the information about allowing users to display Ethereum addresses is accurate.

I never even thought of that. How often will the average Twitter user visit their own profile to double check the address/invoice hasn't been changed. Even worse considering a hacker could have days to generate a look-alike address using a vanity generator so it is not immediately obvious.

I agree. If you are careless enough to believe a fake Elon Musk Twitter profile will send back double whatever you send to the address they post, then you are also careless enough to follow a link saying the same thing.

If you download the correct one from the play store, there is should be no difference between that .apk and the .apk on the Electrum website. However, Google do not perform any due diligence about what gets listed on the play store, and frequently host scam wallets and malicious clones, which look very similar to the real thing and unsuspecting users download, use, and then lose all their coins. You are far safer downloading the .apk from the Electrum website, verifying it against ThomasV's +/- SomberNight's public keys, and then transferring that verified .apk to your phone for installation.

Not quite. Most notably, it does not have coin control, which is a real drawback to using it. If you only use each address in your wallet once you can still freeze addresses which gives you a workaround, but that is far from perfect.

Sure, but they are still derived from the same seed phrase, and so the same seed phrases can still be used to create a multi-sig wallet. Just as Electrum won't let you use an xpub to generate a segwit wallet, it won't let you use a zpub to generate a multi-sig wallet, but the same seed phrase can quite happily generate an xpub, ypub, zpub, Ypub, and Zpub.

There is nothing inherently different between the seed phrases Electrum generates if you choose a standard wallet or a multi-sig wallet. Both options generate segwit versioned seed phrases. You can try this yourself by telling Electrum to generate you a multi-sig wallet, and then import one of the seed phrases as a standard wallet, and create a bunch of addresses as normal. The thing that differs between the two wallets is how it uses that seed phrase, not the seed phrase itself.

Welcome to the Politics & Society board, where the average IQ is less than your shoe size.

Even if OP did not make any additional mistakes beyond storing his seed phrase on the cloud, or was using a perfectly clean computer on his own private WiFi, his seed phrase could still easily have been stolen from the cloud. We have no idea how many servers around the world OP's seed phrase was copied to, how secure those servers were (physically or digitally), which Google employees or third party employees could access them, how robust their encryption algorithms are, and so on. Google don't exactly have the best security practices, previously being caught storing passwords in plaintext for 14 years. This is why cloud storage is always a risk - you have absolutely no idea who else can access it.

There is no real reason not to do this. It takes a few seconds at most, and guarantees your security. Checking only the first ~3 and last ~3 characters still leaves you open to a small risk of theft from clipboard malware, and this risk will only increase over time as hardware becomes more powerful and vanity address generation becomes quicker.

There is absolutely nothing stopping your laptop from having multiple different pieces of malware on it, one which will change your clipboard and another which will steal your seed phrase. Indeed, the fact that you have one piece of malware on your laptop increases the risk of you having others, since you clearly do not have the best security practices or behaviors. I would be formatting that laptop and starting from scratch.

I think maybe he is confused due to the different types of public key between different types of Electrum wallet.

If you create a standard single-sig Electrum wallet, your public key will be a zpub.
If you wish to create a standard multi-sig Electrum wallet, then you need to use public keys of the Zpub variety.
If you try to create a multi-sig electrum wallet using zpubs instead of Zpubs, you will be shown the error "Wrong key type p2wpkh".
You can see the differences on github here: https://github.com/spesmilo/electrum-docs/blob/master/xpub_version_bytes.rst#specification

But there is nothing stopping you from using a pre-existing single-sig seed phrase to derive the Zpub necessary to set up a multi-sig wallet.

Mobile apps are far inferior to hardware wallet, in my opinion. Sure, maybe the apps themselves are open source and well designed, and maybe they are encrypted when not in use, but you also need to consider all the other things going on on a mobile device. They can suffer from clipboard malware, just like computers can. There are other apps which can read your files or monitor your keyboard input which could steal your wallet file or any seed phrase you enter. Encrypted backups can be encrypted with insecure passwords, or encrypted in a flawed manner, or leak unencrypted information, or be stored on cloud servers, and so on, all of which can lead to loss of funds.

That's not to say I don't use a mobile wallets. I do, for small daily spending amounts of bitcoin which I can afford to lose. But I would never store the amounts I store on a hardware wallet on a mobile wallet.

If you have a encrypted airgapped wallet, then you don't need that device. You can sign transactions just fine on your airgapped computer and then move them to an online computer to broadcast them. This device is only really useful when you have paper or other non-digital cold storage and you don't have a safe computer to import them to. It is, after all, just a Raspberry Pi behind the scenes, so it essentially is just a simplified airgapped computer but without any persistent storage.

I would ask for a source for any of that nonsense you just spewed, but I know better.

Sorry, am I missing something here? You need to use Strike, which requires KYC, and connect that to your Twitter profile to display a Lightning invoice for other users to send tips to. And what exactly is stopping me just using a non-custodial non-KYC wallet and generating my own Lightning invoice and putting that on my Twitter profile, bypassing their system and their KYC altogether?

This seems like a privacy nightmare. Potentially millions of people are about to de-anonymize themselves by linking their very public names and social media accounts to their bitcoin wallets. Also, the amount of Twitter scams I can see coming is going to be ridiculous. Now fake Elon Musk accounts can just ask people to send donations directly to the bitcoin address listed on their profile.

In that case, next time you see your butcher could you ask them the best ventilation strategies for managing ARDS? Asking for a friend.

That's a cool project, but I wouldn't call it a hardware wallet or even cold storage, since it doesn't actually store anything. All it is really providing is a way to safely sign transactions from a paper wallet without having a full airgapped computer on which to import your seed phrase or private key.

I'm not aware of any which come without any firmware, but there are some such as Trezor which have open source firmware which you can download and build yourself: https://wiki.trezor.io/Developers_guide:Deterministic_firmware_build

Honestly, I think if you reach the point where you are going through the entire code of the hardware wallet yourself (which is the only way to be sure it is only doing what you want it to do), then you might be better off switching to airgapped and encrypted cold storage, since you clearly have the knowledge to do so in a safe and secure manner. Half the point of hardware wallets are to be newbie friendly and easy to use without having much technical knowledge.

I'd like to see a little bit more elaboration on some of their ratings. For example, with Hodl Hodl they state that "This exchange may request a KYC verification if it finds your movements suspicious." I was completely unaware of that, but can't find any more information about it on a web search. What I did find, however, is that apparently Bitfinex recently purchased a stake in Hodl Hodl, which is pretty concerning if you ask me.

You cannot use LBC at all without completing KYC. You cannot use Binance's DEX at all without completing KYC. Both are very poor exchanges to be using.

So your counter to a massive, peer-reviewed, global study undertaken over many years is, once again "Well, someone told me." Dear lord.

Sure, no one is watching the advert and immediately going out to sign up for a new Visa card, as they might go out to buy some food or drink or jumping on Amazon to order some other product after seeing an advert for it. But if for a moment lets imagine there are only two credit card providers in the world, Visa and Mastercard. Visa plaster their name everywhere - TV adverts like this one, on billboards, on the side of buildings, on sports teams' shirts, sponsor big events, put their little stickers with their logo in every shop windows, etc. - and Mastercard do none of that, then next time you go to open a new credit card, you are going to have a heavy bias for Visa, even if the two companies are otherwise identical.

This kind of service isn't available in every country or jurisdiction, though. Some people might not want to try to request any such ID because they are undocumented and doing so could result in their deportation. Some people might not physically be able to get to a bank to open an account, or have the minimum amount of money required to open an account, or have too poor credit, and so on. There are lots more reasons other than just lack of ID or fixed address to be turned down for a bank account. Whereas bitcoin does not discriminate against anyone.

The possible options are that you specify which type of address you want to recover such as you do with Electrum, that it scans for one or more active addresses as is partially the case here with BlueWallet, or it just imports only a single type of address, as I believe is the case with blockchain.com web wallets only importing legacy addresses.

In terms of when 2 out of 3 have been used (this will be a very niche case), then looking at the code I linked above BlueWallet won't find them all. It first scans for an active P2WPKH address, and if found, imports that one. Only if the P2WPKH address is unused will it then scan for a P2SH-P2WPKH address, and only if that is also unused will it then scan for a P2PKH address.