Coldcard

[hZti]

You don't need a second ColdCard to play with multi-sig, you can have one signer from on the ColdCard and the other on a desktop wallet or a different brand of hardware wallet. 

That is true, but it is very cool to be able to give one ColdCard to somebody else and have two people that control the funds. Of course it is also possible with any other device but it makes it more easy if both devices work the same.

Have you had a chance to play with the Bip85 seed generator?  That's a pretty darn cool feature, and perfect for secondary seed phrases.  I didn't even know about that bip until I got my ColdCard and started researching the implementation of that feature. 

It is indeed very cool and makes it so much more easy to secure the seed, since you can now just secure your main seed on a steel plate and then have unlimited seeds for hot wallets or whatever. I also did not know about that feature before and it is again very nice that it can be done completely offline.

[1714126325]

1714126325

[1714126325]

1714126325

[1714126325]

1714126325

[DaveF]

This just popped up on their twitter feed:

Our team found a bug in the new Mk4 VirtDisk feature

We are investigating if it could have security  implications, as abundance of caution we strongly recommend disabling VirtDisk feature on Mk4

It has no affect on other Mk4 operations

Settings > Hardware On/Off > Virtual Disk

And this is why you don't add features you don't need.

-->This is not just about Coldcard, but all hardware wallets. Keep adding bloat and stuff will go wrong.<--

Why can't developers keep it simple anymore?

-Dave

[DireWolfM14]

And this is why you don't add features you don't need.

Agreed.  I purchased a ColdCard because it's a practical air-gapped wallet.  The USB connection feature (which is needed for the virtual disk) essentially turn the ColdCard into the same thing as any other cheap hardware wallet out there.  The main selling point for me is that it doesn't need to be connected.

The NFC feature is another one that I would suggest should be shelved.  It's not only not needed, it's effectively useless without a compatible app.

[dkbit98]

Why can't developers keep it simple anymore?

Maybe someone remembers that I said how I am just waiting for the moment to see new major bug showing up in Coldcard mk4.
If you check their history you will see they had major bugs with all of their previous models and those issues couldn't be fixed.
Now, they say this virtual disk feature is turned off by default so it's not that serious, but still it's not good for something that was just released.
Good thing is they publicly came out and said about this issue, and I am sure Ledger would hide this much longer if their devices got affected in same scenario.

The NFC feature is another one that I would suggest should be shelved.  It's not only not needed, it's effectively useless without a compatible app.

They are probably working on some app behind the scenes, but could you imagine smartphone that comes out with camera but without supporting software, so it's effectively not working.
Coldcard is saiyng Mk3 is not affected by this bug, but they forgot to say mk3 has it's own unsolved bugs and flaws
This is what you get when you have one-man-team releasing a code for some device.
 

[hugeblack]

Let's move this discussion here: Source ---> https://www.reddit.com/r/Bitcoin/comments/wbgyz2/coldcard_no_longer_states_open_source_on_their/


Coldcard no longer states open source on their webpage but instead says verifiable source code

If you look at the archives from October 2021^[1] you will find that they announced that they are open source, but looking at the site^[2] now you will find that the word “open source” has been replaced by verifiable source code.

I don't want to go into the details of why and whether it's because they're a business and the foundation devices story, but you have to take that into account.


[1] https://web.archive.org/web/20211004193421/https://coldcard.com/
[2] https://coldcard.com/

[dkbit98]

Coldcard no longer states open source on their webpage but instead says verifiable source code

Yeah I know, this is kind a old news and we discussed about that in forum before.
Many people criticized them when they changed their license (including me) but I was more pissed how they pretended they are still open source and kept it on their website for long time.
All this happened after superior forked hardware wallet showed up in market called Passport wallet by Foundation, and they just couldn't cope with that.

NVK is creator of ColdCard and you can check his post history about this topic:
https://bitcointalk.org/index.php?action=profile;u=152074

Here is me in Ausgust 2021 removing them from list of Open Source hardware wallets:

Coldcard hardware wallet removed because code is not Open Source anymore, but MIT+CC license and it can't be reproduced anymore.

[hZti]

Why can't developers keep it simple anymore?

I always wondered about this (useless) feature. Especially when they claim themselves that they are not adding altocinb support since it will make the software more complicated and therefore more bugs can happen. At the same time they create a weak spot like that, that they then solve with overpriced hardware that you can buy from them like the cold power USB Power adaptor or the no data USB cable.

[n0nce]

All this happened after superior forked hardware wallet showed up in market called Passport wallet by Foundation, and they just couldn't cope with that.

It's shame since they also could use Foundation source code to create better/different hardware wallet.

Correct; that's the idea of open source. This timeline is not accurate, but it is a possible timeline in a world where companies understand and embrace open source.

[1] Trezor is the first hardware wallet manufacturer and creates a great open-source crypto library for microcontrollers.
[2] ColdCard wants to create an airgapped hardware wallet, but the microcontroller is similar so they can leverage the tried and tested library from Trezor, and build their own firmware around it.
[3] Foundation thinks there's a market for an airgapped hardware wallet that runs off its own power and has a camera + large screen, so they also use Trezor's library and some bits from ColdCard.
[4] ColdCard adds a camera to their mk5 wallet and takes inspiration for the camera driver from Foundation's code.
[5] A random Bitcointalk user starts a DIY hardware wallet project that utilizes all of the above projects' open-source hardware and software which allows people to build their own wallets from off-the-shelf components and still has like a 90% 'trusted' codebase, due to having been battle-tested in 3 reputable wallets.

[hZti]

[5] A random Bitcointalk user starts a DIY hardware wallet project that utilizes all of the above projects' open-source hardware and software which allows people to build their own wallets from off-the-shelf components and still has like a 90% 'trusted' codebase, due to having been battle-tested in 3 reputable wallets.

[6] A random Bitcointalk user starts a small company that buys those off-the-shelf components in large quantities and assembles them, to make this easily available for everyone. The components can be easily replaced/can easily be bought, even if you use the wallet as cold storage and only find out after 10 years in a safe that your display is broken.

Sadly NVK does not provide the right informations for Coldcard even if also components like the display are clearly off-the-shelf aliexpress components.

[DaveF]

[5] A random Bitcointalk user starts a DIY hardware wallet project that utilizes all of the above projects' open-source hardware and software which allows people to build their own wallets from off-the-shelf components and still has like a 90% 'trusted' codebase, due to having been battle-tested in 3 reputable wallets.

[6] A random Bitcointalk user starts a small company that buys those off-the-shelf components in large quantities and assembles them, to make this easily available for everyone. The components can be easily replaced/can easily be bought, even if you use the wallet as cold storage and only find out after 10 years in a safe that your display is broken.

Sadly NVK does not provide the right informations for Coldcard even if also components like the display are clearly off-the-shelf aliexpress components.

What discrepancies did you see?

I have not checked the MK4 (since I don't have to to check against) but the MK3 diagrams / BoM were accurate as to what was posted on line vs the coldcard that was shipped to me.

Will also admit I just checked what was there in the general sense, not that what they had labeled as a 4.7uF capacitor was really 4.7Uf and not 1uF or 8uF just made sure it was a capacitor.

Also did not check the trace layout but don't see why it would be inaccurate.

-Dave

[n0nce]

I have not checked the MK4 (since I don't have to to check against) but the MK3 diagrams / BoM were accurate as to what was posted on line vs the coldcard that was shipped to me.

Where did you find hardware information? Nothing on their GitHub, for sure. I was under the impression that ColdCard was open software and hardware - even after a license change; but now that I'm actually looking for it, I can't find datasheets.
https://github.com/orgs/Coldcard/repositories

Also did not check the trace layout but don't see why it would be inaccurate.

Sure, in theory, even with whatever non-open-source license they moved to, 'Verifiable Source Code' of both software and hardware, should be accurate and allow users to source parts for repairs if needed.

[DaveF]

I have not checked the MK4 (since I don't have to to check against) but the MK3 diagrams / BoM were accurate as to what was posted on line vs the coldcard that was shipped to me.

Where did you find hardware information? Nothing on their GitHub, for sure. I was under the impression that ColdCard was open software and hardware - even after a license change; but now that I'm actually looking for it, I can't find datasheets.
https://github.com/orgs/Coldcard/repositories

Also did not check the trace layout but don't see why it would be inaccurate.

Sure, in theory, even with whatever non-open-source license they moved to, 'Verifiable Source Code' of both software and hardware, should be accurate and allow users to source parts for repairs if needed.

Here you go:
https://github.com/Coldcard/firmware/tree/master/hardware

No idea why they stuck it there but since the link is on their blog: https://blog.coinkite.com/coldcard-hardware-shared/ and mentioned in a few other spots, I actually think it was posted somewhere on bitcointalk too.
But, it is there and public and somewhat up to date.

-Dave

[hZti]

Here you go:
https://github.com/Coldcard/firmware/tree/master/hardware

No idea why they stuck it there but since the link is on their blog: https://blog.coinkite.com/coldcard-hardware-shared/ and mentioned in a few other spots, I actually think it was posted somewhere on bitcointalk too.
But, it is there and public and somewhat up to date.

-Dave

Very cool, I did not know that existed! Looks like the list for the MK4 is so far not very detailed but I am sure they will update that in the future like they did it with the MK3.
This for example seems to be the right replacement display unit for the MK3: https://www.codico.com/de/ug-2864hsweg01 , it seems to be also available with different color options here: https://deu.grandado.com/products/0-96-zoll-30pin-weiss-blau-gelb-und-blau-farbe-oled-bildschirm-ssd1306-fahrer-parallel-3-4-draht-spi-serielle-i2c-iic-ug-2864hsweg01?gclid=EAIaIQobChMImLSGnqfL-QIVztvVCh2YiwZCEAYYASABEgIUA_D_BwE&variant=UHJvZHVjdFZhcmlhbnQ6MTM1NjYzMzA

If my OLDED breaks I will for sure hook up the blue version 

[dkbit98]

Important announcement for Coldcard users.
Coldcard developers yesterday released newest 5.0.7 version of their firmware for Coldcard Mk4 device.
There are a lot of NFC improvements with signing and multisig, new feature of Ephemeral Seeds is introduced, menu improvements, and lot of bug fixes.
In the same time new 4.1.6 firmware version was released for older Coldcard devices Mk3 and Mk2, so you can update them as well.

⁃ NFC tools menu, msg signing and enhancements
⁃ Temporary/Ephemeral Seed Signing
⁃ Many HSM enhancements
⁃ Menu wrap around UX
⁃ Descriptor type improvement
⁃ Bug fixes and more...

https://coldcard.com/docs/upgrade

[hZti]

Thanks for the update! Is there also news about an application that can actually support ColdCard in an easy way with NFC signing?

[dkbit98]

Thanks for the update! Is there also news about an application that can actually support ColdCard in an easy way with NFC signing?

I don't really know much infiormation about that, but you can ask NVK and coldcard team.
There are few videos Coinkite-Coldcard released on their youtube channel explaining how NFC feature works, showing address via NFC, and signing a text message using NFC.
BTC Sessions also released full 30 minute tutorial how to use Coldcard with NFC feature, so you can check out both of this channels.
https://www.youtube.com/watch?v=eLG8Atcd-l4
https://www.youtube.com/channel/UCqMPBcyg_wemgvC1jDI3EIw

[witcher_sense]

Thanks for the update! Is there also news about an application that can actually support ColdCard in an easy way with NFC signing?

Nunchuk wallet recently added NFC support for Coldcard Mk4. You can check the demo on their Twitter: https://mobile.twitter.com/nunchuk_io/status/1574977342698496000

I don't know much about this wallet, but for example, on their website, they claim it is "the safest and most advanced self-custody solution for your bitcoin." It is a multisig multi-user wallet that allows for collaborative custody with people who you trust. They also claim that all the data about your transactions is kept locally on your device, and you also can connect to your own node if you don't like public Electrum servers. The biggest drawback, however, is that this wallet is likely not open-source; it is only "partially" open-source. Here is a bit outdated report from walletscrutiny:  https://walletscrutiny.com/android/io.nunchuk.android/ You can find more information on their website: https://nunchuk.io/

[nvK]

Thanks for the update! Is there also news about an application that can actually support ColdCard in an easy way with NFC signing?

I don't really know much infiormation about that, but you can ask NVK and coldcard team.
There are few videos Coinkite-Coldcard released on their youtube channel explaining how NFC feature works, showing address via NFC, and signing a text message using NFC.
BTC Sessions also released full 30 minute tutorial how to use Coldcard with NFC feature, so you can check out both of this channels.
https://www.youtube.com/watch?v=eLG8Atcd-l4
https://www.youtube.com/channel/UCqMPBcyg_wemgvC1jDI3EIw

There are a few of "App Wallets" working on NFC support for both COLDCARD Mk4 and TAPSIGNER/SATSCARD. Like the years we had to push PSBT to be adopted, we expect NFC will take its time too. Not in a hurry. Nunchuk has integrated it well for both COLDCARD and TAPSIGNER/SATSCARD. It's working fairly well with the latest version and they keep on improving it.

Our approach to NFC is simple, almost anything you can do with the MicroSD/USB you can do with the NFC (signing, exporting data, etc...)

Cheers.

[hZti]

There are a few of "App Wallets" working on NFC support for both COLDCARD Mk4 and TAPSIGNER/SATSCARD. Like the years we had to push PSBT to be adopted, we expect NFC will take its time too. Not in a hurry. Nunchuk has integrated it well for both COLDCARD and TAPSIGNER/SATSCARD. It's working fairly well with the latest version and they keep on improving it.

Our approach to NFC is simple, almost anything you can do with the MicroSD/USB you can do with the NFC (signing, exporting data, etc...)

Cheers.

Thanks for the information about Nunchuk, I never heard of that one before. I will definitely give it a try, since NFC was the reason to get the MK4 and not the MK3. Honestly I think NFC is not a necessary feature and will probably even scare people away from buying the MK4, but since it is there I want to give it a try.
What I dont really understand is, why you can scrape away the NFC link on the PCB, since it seems like an attacker could easily replace this link if he has physical access to the coldcard.

In any case I like the coldcard so far and use it regularly.

[nvK]

Thanks for the information about Nunchuk, I never heard of that one before. I will definitely give it a try, since NFC was the reason to get the MK4 and not the MK3.

It's a cool project, it's advancing well.

Honestly I think NFC is not a necessary feature and will probably even scare people away from buying the MK4, but since it is there I want to give it a try.

Maybe, but probably due to FUD combained with ignorance. I think we can overcome this with eduction. As a hint, Mk4 is selling incredibly well so still unaffected.

What I dont really understand is, why you can scrape away the NFC link on the PCB, since it seems like an attacker could easily replace this link if he has physical access to the coldcard.

This is not a very realistic or practical attack. 1 there is nothing to really do with that trace, it's part of the antenna network. 2 if you have physical access and the device is off, you are back into PIN dynamics. No thus far proposed a actual attack via that trace probably because indeed there is not much advantage to have access to the antenna network.

In any case I like the coldcard so far and use it regularly.

Glad to hear it, and thanks for the feedback.