I have carefully read your comments on BC Vault and while I see your concerns, I would like to offer further explanation and paint the whole picture.
DISCLAIMER: I am the CTO of BC Vault. Everything written below is not a “promotion” as some assume immediately when one talks about anything else but Ledger or Trezor. This is my personal view on reservations some users voiced in the forum,
and also an invitation to further discussion.As always, everything is a two-edged sword and I would like to start off by addressing your doubts.
You can be absolutely sure we can release a decoding app for private keys if needed, as it is obviously encoded in the product and it works.
We haven’t released it yet as it would be a shortcut for hackers to understand how our encryption and everything else works. This is a drawback to open-source that many vendors acknowledge (Ledger is NOT open-source) and others suffer from (Trezor counterfeits). Shortcuts are bad in security.
Let me give you a real-world example of what we have been dealing with for nearly two decades. REAL security
www.real-sec.com is a 17-year old company that only works in the field of IT security. In this period, we have amassed experience and knowledge needed for the creation of BC Vault. We deal with the biggest IT security projects in the region of Central/South/East Europe. Our clients are banks, telcos, governments, state agencies, etc. and thus we have also been dealing with something called HSM (Hardware Security Module) for a long time. HSM is a predecessor of crypto wallets. It is usually used to securely store private key of certificates (PKI) and it “spits out” signed data. We are talking about equipment used by practically all banks, all PKI issuing agencies.
One can hardly find any HSM vendor releasing decoding apps, source code. A crypto currency hardware wallet is essentially an HSM (explained in simple terms). Does one have access to the source of banking software? No. Can the banks be trusted they will not take your money? No, as many that lost money in 2008 can confirm. But does our company have ANY reason not to release decoding utility for BC Vault private keys if needed? No, it does not. As I mentioned, we are a company that has been doing other things in the field of IT security for 17 years (as compared to almost all crypto wallet startups that have ZERO company history in the said field). We cannot simply “shut down” the BC Vault operation and disappear into thin air. Our reputation in the primary field of business would be irreversibly damaged and we have much to lose. What I am trying to say is that we are not a startup that simply played a card and can give up at a certain point and say “we tried”. Even if we had to shut down the project, we would have to do it properly.
On the other hand, by using BIP39 you have a huge security issue: all wallets are linked. Once somebody acquires your 24 words, ALL your wallets (even the future ones) are compromised and you might not even know. The attacker will strike only after there is a substantial amount on the wallets. You will never know what hit you. Also, BIP39 only caters for private key and nothing else. You lose everything else, such as wallet names, etc. Those words are all the attacker needs, and wallets using BIP39 come with the additional cost of seed recovery phrase protection.
With BC Vault, the attacker needs global pin + global password, and each wallet’s pin + wallet password AND BACKUP! The last AND is VERY important. If the attacker remotely compromises all your systems and steals all pins and passwords, they still can do nothing without the backup of your BC Vault. The backup must be physically confirmed on the device, so there is no way for them to make it without you confirming it.
In regards to being “anonymous” in crypto world, with BC Vault you can generate practically unlimited number of wallets and delete them whenever you wish to do so. This is something BIP39 prevents you to do. Furthermore, not many people expressed concerns of Ledger using unique certificate on their devices. Each Ledger device uses its own signed certificate in secure element to authenticate towards central server. You do know what that means or at least has the potential to do.
Besides security, we have not neglected and have strongly emphasized anonymity. The word “crypto” means hidden and it was the one aspect where we were not willing to make compromises.
To come back to the HSM story and again draw the parallels, most of the HSM installations DO NOT allow the export of private keys. This also means one cannot replace the device without a lot of hassle. But since the primary mission of HSM is secure storage of private keys without means of extracting them from the device, this is what customers actually look and pay a lot of money for. All they want is assurance that they have a secure means of backup/redundancy in case a device fault occurs.
Basically, it all comes down to what is your priority and belief. If you have decided that we are the "bad guys", well it's your right, but rethink your position and try to come up with a reason why you think so.
BC Vault has been made to be DIFFERENT and BETTER. We did not just take Trezor’s open-source code, designed a new housing, changed a few minor bits and called it the greatest thing since bread came sliced. We did everything different from ground up with a reason because we believe it can be done better for the benefit of the user, based on our experience in the field of IT security. We dared to take another path (contrary to BIP39) and we still strongly believe in it.
We might even release "export private key" per wallet functionality at some point in the future (and then mark any such wallet insecure), but that needs a lot of rethinking and considering every security implication. There is absolutely nothing that would prevent us from doing something like that, but the care for the security of the user and their funds.
There are three ways of making money in this cynical business: one can be first, one can be better, or one can cheat. We respect those that were first, we strive to be better, and we certainly don’t like cheating and shortcuts.
I encourage everyone to read our latest review:
https://pheeva.com/bitcoin/wallets/bc-vault-comparison/…and join the conversation.
