Coldcard

[nvK]

Yes there was quiete a long preorder period but now I think it is officially on sale and you can get it in aroubd 3 weeks.

We will likely be fully caught up by end of day today and update to no lead time "in stock"

[1715466211]

1715466211

[1715466211]

1715466211

[1715466211]

1715466211

[dkbit98]

Since the beginning of this thread I have receive my coldcard Mk4 (actually two of them) and used it quiete a lot. If you have any questions feel free to ask but other then the NFC feature everything is as I would have expected it to be.

I think that new NFC tap feature is disabled by default, but someone from coldcard said that you can even destroy it if you want to disable it forever.
I would like to see how this NFC work in real life, and maybe some overall review for new mk4 hardware wallet, but I heard several complains from customers who had some glitches.
Few people reported issues with screen characters on mk4 wallets they received, but I think they got replacement devices.
https://www.reddit.com/r/coldcard/comments/v93pqu/mk4_glitches/

One example (I can't find exact source):

[n0nce]

Since the beginning of this thread I have receive my coldcard Mk4 (actually two of them) and used it quiete a lot. If you have any questions feel free to ask but other then the NFC feature everything is as I would have expected it to be.

I think that new NFC tap feature is disabled by default, but someone from coldcard said that you can even destroy it if you want to disable it forever.

Opt-in definitely sounds better than opt-out on such a feature! This automatically means whoever doesn't care about NFC, doesn't know about it or doesn't have a compatible host device (or software) doesn't have to go looking to turn it off. Good choice by CoinKite.

I'd like to see it in action, too though! I'm interested to see if it's faster to use than QR codes, for example. Since that's the only upside of NFC that I can think of.


Already broken screens sounds bad. But honestly with the quantities they sell and probably not very high quality components they use, it's to be expected. You know best about how many issues Ledger had with screens in the past.
But that's the difference between a $1 one-inch LCD from China and a $30 state-of-the-art (in terms of hardware security) memory LCD from sharp.

Unfortunately the ColdCard hardware doesn't seem to be open-source, so I can't check their BOM, but from pictures they seem to be using a simple, cheap off-the-shelf LCD as I mentioned. If we assume 1,000 units, it's $0.50 per display instead of $30 so it's kind of clear that the quality has to be lower.

For contrast, this is the higher-quality LCD I keep mentioning.
https://github.com/Foundation-Devices/passport-assembly/blob/main/Bill%20of%20Materials/BOM.pdf

Here's more information about the screen (the timestamp is important; no need to watch all 43 minutes.. )
https://youtu.be/mrKBKZ0RJAo?t=1491

[hZti]

I think that new NFC tap feature is disabled by default, but someone from coldcard said that you can even destroy it if you want to disable it forever.

Yes that is correct, you can scratch off a trace on the PCB to disable it. Im not an expert but all the attacks on hardware wallets that I have seen anyways solder some stuff on the PCB so I would assume that at least the hardware part could be restored by soldering a new trace. Still the NFC feature is disabled in the software settings and also NFC is only active when you press send/recive via NFC at the right point and it is not active all the time.
MY problem with the feature is that there is no wallet at the moment that can recive the signed transaction via NFC. If you look in blue wallet you can only upload a file from your file explorer or use a QR Code. There is no such option like "recive transaction via NFC". The problem with that is that you could only recive a transaction with a 3rd party NFC app that allows you to store the data that you recive on your device. Then you could go into blue wallet to upload that data and broadcast the transaction. But with my testing I could not get this to work, since the NFC receiver app could not handle the kind of data from coldcard so it was not saved properly. Other than that the coldcard seems to send the data correctly. If somebody from coldcard ready it correctly my solution would be:

At the moment it is possible to send the transaction from the iPhone to the coldcard via NFC. -> The coldcard then signs the transaction and will automatically try to send it back via NFC. This is not possible since the wallet can not recive it (blue wallet etc.)
If you would now allow a setting that would not directly answer an incoming NFC transaction with a NFC response but it would show a QR code of the singned transaction then the feature would be somewhat usable.

[hZti]

e quantities they sell and probably not very high quality components they use, it's to be expected. You know best about how many issues Ledger had with screens in the past.
But that's the difference between a $1 one-inch LCD from China and a $30 state-of-the-art (in terms of hardware security) memory LCD from sharp.

Unfortunately the ColdCard hardware doesn't seem to be open-source, so I can't check their BOM, but from pictures they seem to be using a simple, cheap off-the-shelf LCD as I mentioned. If we assume 1,000 units, it's $0.50 per display instead of $30 so it's kind of clear that the quality has to be lower.

For contrast, this is the higher-quality LCD I keep mentioning.
https://github.com/Foundation-Devices/passport-assembly/blob/main/Bill%20of%20Materials/BOM.pdf

Here's more information about the screen (the timestamp is important; no need to watch all 43 minutes.. )
https://youtu.be/mrKBKZ0RJAo?t=1491

Thanks for the details, maybe someone can at some point validate that it is indeed the right screen. Would aiso be cool to be able to mod the CC to have a blue screen. From what I can see that sceen looks very much the same but I don't want to open the CC to check in more detail.


Here is a picture of the NFC trace that you can destroy:

[hZti]

Yes there was quiete a long preorder period but now I think it is officially on sale and you can get it in aroubd 3 weeks.

We will likely be fully caught up by end of day today and update to no lead time "in stock"

Could you maybe describe on how to use the NFC feature with an iPhone or is it at the moment only a hardware feature that will maybe be later integrated into wallet softwares?

[dkbit98]

Already broken screens sounds bad. But honestly with the quantities they sell and probably not very high quality components they use, it's to be expected. You know best about how many issues Ledger had with screens in the past.

I don't think that screen was broken on image I posted, but it was some other internal problem that showed weird characters on screen, so replacing screen wont fix anything.
Something similar happening a lot on ledger nono x hardware wallet, that is more likely some problem with one of their microchips new Coldcard mk4 have now or firmware problem.
I wont speaculate much until NVK posts more details about this, and this was not the only case I noticed, but I was busy to record this on time with link proof.

At the moment it is possible to send the transaction from the iPhone to the coldcard via NFC. -> The coldcard then signs the transaction and will automatically try to send it back via NFC. This is not possible since the wallet can not recive it (blue wallet etc.)

I really don't understand why they are using NFC for decoration purpose only unless they had some futuristic use case in mind.

[n0nce]

I think that new NFC tap feature is disabled by default, but someone from coldcard said that you can even destroy it if you want to disable it forever.

Yes that is correct, you can scratch off a trace on the PCB to disable it. Im not an expert but all the attacks on hardware wallets that I have seen anyways solder some stuff on the PCB so I would assume that at least the hardware part could be restored by soldering a new trace.

If you have hardware access, wireless attack vectors become much less interesting. That's why scratching off the trace is indeed a good remedy; because the added risk (compared to a wallet without wireless technologies) is now gone.

MY problem with the feature is that there is no wallet at the moment that can recive the signed transaction via NFC. If you look in blue wallet you can only upload a file from your file explorer or use a QR Code. There is no such option like "recive transaction via NFC". The problem with that is that you could only recive a transaction with a 3rd party NFC app that allows you to store the data that you recive on your device. Then you could go into blue wallet to upload that data and broadcast the transaction. But with my testing I could not get this to work, since the NFC receiver app could not handle the kind of data from coldcard so it was not saved properly. Other than that the coldcard seems to send the data correctly. If somebody from coldcard ready it correctly my solution would be:

Thanks for the feedback! It's a bit weird shipping a product for which the software doesn't exist (yet?), let's see what happens on that front in the future. If CoinKite fully rely on wallet developers to implement this, I'm not sure it will actually happen. ColdCard is the only popular wallet with NFC that I know of; app developers would literally be going to need to implement this just for ColdCard for the time being.

Already broken screens sounds bad. But honestly with the quantities they sell and probably not very high quality components they use, it's to be expected. You know best about how many issues Ledger had with screens in the past.

I don't think that screen was broken on image I posted, but it was some other internal problem that showed weird characters on screen, so replacing screen wont fix anything.
Something similar happening a lot on ledger nono x hardware wallet, that is more likely some problem with one of their microchips new Coldcard mk4 have now or firmware problem.
I wont speaculate much until NVK posts more details about this, and this was not the only case I noticed, but I was busy to record this on time with link proof.

I'm not sure either, but it's definitely possible (and in my opinion likely) to be a failure of the LCD's chip (they have an IC - that's what makes them less secure / less open-source / less verifiable) rather than a failure of the main chip. Just because a failure of the main chip that only affects the LED functionality, while leaving everything else intact, seems a bit odd.

[hZti]

Seems like so far there is really no NFC support anywhere and we can only hope that it will be integrated in wallet apps later on: https://www.reddit.com/r/coldcard/comments/vcmxcx/mk4_nfc_compatible_apps_yet/

[DaveF]

Thanks for the feedback! It's a bit weird shipping a product for which the software doesn't exist (yet?), let's see what happens on that front in the future. If CoinKite fully rely on wallet developers to implement this, I'm not sure it will actually happen. ColdCard is the only popular wallet with NFC that I know of; app developers would literally be going to need to implement this just for ColdCard for the time being.

Although not in the crypto sphere as much, that has been a common practice for years in the tech world.
Make the hardware and hope the software and devices catch up.

I disagree with adding things like this to security devices and appreciate the fact that you can cut the trace.
Think it would be better if you had to force enable it instead of force disable.

-Dave

[dkbit98]

ColdCard is the only popular wallet with NFC that I know of; app developers would literally be going to need to implement this just for ColdCard for the time being.

I don't think that Coldcard is the only hardware wallet with NFC support.
Many credit card format hardware wallets have been using NFC for some time, like CoolWallet, Satochip, Tangem, Keycard, Sugi, etc. but it was never so popular.

Seems like so far there is really no NFC support anywhere and we can only hope that it will be integrated in wallet apps later on

I saw yesterday they are testing this NFC feature with Bluewallet, but I didn't see much demand from people asking for this.
It will be interesting to see how Coldcard NFC functionality is different from other hardware wallets with NFC.

[n0nce]

I disagree with adding things like this to security devices and appreciate the fact that you can cut the trace.
Think it would be better if you had to force enable it instead of force disable.

Well, at least in software it's a force enable.
But sure, it could just have been a jumper that is shipped with the device and has to be installed if you want to use the NFC. Especially seeing as the software doesn't exist, there's no need for the trace to be connected now, even for users that may want to use NFC a few months from now, when the software catches up.

One of these guys. The device is chunky anyway; I'm sure they would have made space for such a jumper and two THT pins.

ColdCard is the only popular wallet with NFC that I know of; app developers would literally be going to need to implement this just for ColdCard for the time being.

I don't think that Coldcard is the only hardware wallet with NFC support.
Many credit card format hardware wallets have been using NFC for some time, like CoolWallet, Satochip, Tangem, Keycard, Sugi, etc. but it was never so popular.

What software do those use then, though? If there are no wallet applications that support it yet?

[hZti]

What software do those use then, though? If there are no wallet applications that support it yet?

Many of them use just a chip where there is a password stored on it that is then used to unlock the transaction in the app. But Im not shure about it. Also some other use special apps for the hardware wallet that don't seem compatible even if they somehow use NFC.

One of these guys. The device is chunky anyway; I'm sure they would have made space for such a jumper and two THT pins.

I was thinking the same about the USB Port. You could just put a switch on the Device that cuts the Data Connection from the USB Port, so you could use your PC to power the device and not worry about any data getting leaked.They solved this problem with the much more complicated cold power adaptor which doesn't make any sense in comparison to an easy switch.

[dkbit98]

What software do those use then, though? If there are no wallet applications that support it yet?

I don't own any of this hardware wallets with NFC feature, but from reviews I watched they have smartphone apps with NFC support and they work with tapping.
You need to pair your hardware wallet with your phone and than you can use after that for this purpose.
Here is one example with Keycard hardware wallet:

It supports both NFC and ISO7816 physical interfaces, meaning that it is compatible with any Android phone equipped with NFC and all USB Smartcard readers.

The most obvious case for integration of Keycard is crypto wallets (ETH, BTC, etc), however it can be used in other systems where a BIP-32 key tree is used and/or you perform authentication/identification.

To further simplify integration, we have developed a Java-based API which can be used on both desktop and Android systems. On the desktop it uses the javax.smartcardio to interface with the card, which is compatible with most USB readers. On Android it uses the on-board NFC reader.

https://keycard.tech/docs/

Here is second example short video of using Tangem NFC card with their Tangem app:
https://www.youtube.com/watch?v=m6xey-172PI

NFC is nothing special really 

[n0nce]

What software do those use then, though? If there are no wallet applications that support it yet?

[...]
NFC is nothing special really 

Sure; that's not the issue, I was just wondering if there's no software for ColdCard mk4 how other, already existing NFC wallets work. But from that video it appears the hardware wallet guys made their own apps until now.
CoinKite could for instance have written the NFC code themselves for BlueWallet (as it's open source) and submitted a pull request.

Or made their own little app like Foundation's 'Envoy' app.
Keep in mind they only sold around 2,000 devices so far (and shipped 1,000) and they managed to write a simple wallet application that even allows to update the device firmware without a PC. The beta is supposed to come next week and I'll definitely give it a try! I'm surprised that the much more popular ColdCard doesn't have their own app, after 4 revisions, especially if available apps don't support their 'killer feature' for the mk4 that is NFC.

[hZti]

Here is second example short video of using Tangem NFC card with their Tangem app:
https://www.youtube.com/watch?v=m6xey-172PI

NFC is nothing special really 

It is not very special in regards to hardware wallets, but it is very special if it would be usable in combination with coldcard. Since i tried now to use apps from 3rd party NFC hardware wallet manufacturers and they always want you to create the seed first on your phone and then somehow load some data on the NFC chip to be able to have an additional security layer. Still this is far from an air gapped coldcard. So I would really appreciate it if coldcard would integrate this feature in an open source wallet like blue wallet, but maybe this makes the chances even slimmer, since it would be confusing to people that use other NFC wallets, since those people couldn't use a real air gapped NFC function.

What software do those use then, though? If there are no wallet applications that support it yet?

[...]
NFC is nothing special really 

Sure; that's not the issue, I was just wondering if there's no software for ColdCard mk4 how other, already existing NFC wallets work. But from that video it appears the hardware wallet guys made their own apps until now.
CoinKite could for instance have written the NFC code themselves for BlueWallet (as it's open source) and submitted a pull request.

Or made their own little app like Foundation's 'Envoy' app.
Keep in mind they only sold around 2,000 devices so far (and shipped 1,000) and they managed to write a simple wallet application that even allows to update the device firmware without a PC. The beta is supposed to come next week and I'll definitely give it a try! I'm surprised that the much more popular ColdCard doesn't have their own app, after 4 revisions, especially if available apps don't support their 'killer feature' for the mk4 that is NFC.

I do not think it would be very hard to make an app in the first place for coinkite, but it would be hard to maintain it for many years. So to me it would be much more useful if they could implement it in an existing and widely used app. Also it would be great advertisement for them.

[dkbit98]

Or made their own little app like Foundation's 'Envoy' app.

I think that it's not so hard to make or fork app if your smartphone already has NFC support.
Speaking about that, did you finally receive your Passport batch2 hardware wallet or you are still waiting for delivery?
I have one idea how to make my own DIY device that looks similar like Passport, but it can also be used for making calls (sort off), and I will probably post more information about that next week.

It is not very special in regards to hardware wallets, but it is very special if it would be usable in combination with coldcard.

It's nothing special for me, with or without coldcard wallet, I wouldn't use NFC feature at all and it has zero value for me.
I agree with you that with NFC chip this can't really be considered as air-gapped wallet, but people tend to twist definition of airgap according to their needs.

[hZti]

It is not very special in regards to hardware wallets, but it is very special if it would be usable in combination with coldcard.

It's nothing special for me, with or without coldcard wallet, I wouldn't use NFC feature at all and it has zero value for me.
I agree with you that with NFC chip this can't really be considered as air-gapped wallet, but people tend to twist definition of airgap according to their needs.

It is not special in a way that I think everyone should be using it, but it is special in a way that it is much better than other hardware wallets that are using NFC. The other wallets are created 100 % on the smartphone and then loaded on the NFC chip. Coldcard is created 100 % on the coldcard hardware and only the transaction is send. This is very convenient for small amounts. I would use a special coldcard that has only few coins on it but because of coldcard + NFC it is still much more secure than just a mobile wallet for example that many people would use for small amounts. Still even for bigger amounts I can't really see a possible attack, since the NFC can only happen if you hold your phone directly on the Coldcard. So for an attack you need to be at least in my house or have an extremely good antenna and i think thats just not going to happen to steal a few hundred dollars.

[dkbit98]

It is not special in a way that I think everyone should be using it, but it is special in a way that it is much better than other hardware wallets that are using NFC. The other wallets are created 100 % on the smartphone and then loaded on the NFC chip. Coldcard is created 100 % on the coldcard hardware and only the transaction is send.

If I understand correctly, all hardware wallets need to have NFC chip built inside them, so Coldcard is not different from them in some special way.
You need to have two devices with NFC chips that can communicate with antennas between each other, first device is smartphone with NFC chip, and second device is hardware wallet with NFC chip.
Good thing would be to make some comparison review and see how all NFC wallets work in real life scenarios.

[n0nce]

Or made their own little app like Foundation's 'Envoy' app.

I think that it's not so hard to make or fork app if your smartphone already has NFC support.
Speaking about that, did you finally receive your Passport batch2 hardware wallet or you are still waiting for delivery?

More and more delays I'll elaborate on my thoughts about shipping deadlines / announcements and such when I'll get it and receive the v2 device and review it.

I have one idea how to make my own DIY device that looks similar like Passport, but it can also be used for making calls (sort off), and I will probably post more information about that next week.

I'm excited to read what you're up to; but generally I prefer to have a wallet be as simple and bare-bones as possible, without integration of any unnecessary technologies (or software features). For instance, I don't like how the BitBox02 is meant to be used as a 2-factor authentication device; I'd never do that myself and rather get a second device (like Yubikey) dedicated for that purpose.

Coldcard is created 100 % on the coldcard hardware and only the transaction is send. This is very convenient for small amounts. I would use a special coldcard that has only few coins on it but because of coldcard + NFC it is still much more secure than just a mobile wallet for example that many people would use for small amounts.

Honestly if you have an up-to-date modern smartphone and you use a non-custodial app, you're good for small amounts.

Besides; if a wallet uses a non-wireless technology for its air gap, like - let's say - QR codes and a camera, then you don't even have to worry about where you set the limit of 'small amount' or 'large amount' and can store even larger amounts on it / don't need to buy multiple wallets.