ColdCard Q1 - Worth the switch from Mk4?

[tr0gi]

Hey guys, I've been using the ColdCard Mk4 (fully air gapped setup with full Bitcoin Core node, I know, I'm sort of a chad) for around 2 years and I recently saw CoinKite finally released their Q1 model, which comes with a QR scanner, full qwerty keyboard, and battery slots, which are some pretty awesome features to say the least, especially in the context of an air gapped setup.

I wanted to know if any of you guys use the Q1 and could provide some feedback.

[Pmalek]

I don't own a Coldcard, so I have no personal experience to report. But a general piece of advice would be to look at the new features that the Q1 model has and consider how useful those would be to you. If you plan to take advantage of most new options of the Q1, it makes sense to upgrade. Or better yet, go for something like the Foundation Passport. It's fully open-source.

The Q1 has a bigger screen. I personally don't find that too important. The keyboard makes entering passwords and passphrases easier. The Q1 has a QR code scanner, making it possible to import SeedQRs. Unfortunately, Coinkite created its own standard here, a scheme that isn't supported by all software wallets that you could use as companion apps. Compared to Mk4, you have two microSD slots on the Q1. I wouldn't pay too much attention to this. It also comes with two secure elements.

Keep in mind that it's quite a big device. I can't remember a bigger hardware wallet from the top of my head.

[ABCbits]

I don't own any Coldcard either, but for starter you could visit thread New HW wallet announced: COLDCARD Q1 which discuss Q1 features and odd behavior of CoinKite (company behind ColdCard).

Anyway, i expect you could live without Q1 convenient feature since you bothered to create airgapped setup.

[satscraper]

Hey guys, I've been using the ColdCard Mk4 (fully air gapped setup with full Bitcoin Core node, I know, I'm sort of a chad) for around 2 years and I recently saw CoinKite finally released their Q1 model, which comes with a QR scanner, full qwerty keyboard, and battery slots, which are some pretty awesome features to say the least, especially in the context of an air gapped setup.

I wanted to know if any of you guys use the Q1 and could provide some feedback.

My view on this. It would be better to switch to Passport 2 design of which is elegant and at the same time  more robust than that one relevant to  ColdCard Q1^{( which looks like a cheep calculator for me)} , and, besides, it is made from premium materials. There plenty of complains on the faulty instances^{( just DYOR)}of ColdCard Q1 but I never encountered this for Passport 2.  The reviews on Passport 2 including shared users experiences ^{(including mine)} you can find in this and this treads.

[Pmalek]

I don't own any Coldcard either, but for starter you could visit thread New HW wallet announced: COLDCARD Q1 which discuss Q1 features and odd behavior of CoinKite (company behind ColdCard).

I will try to summarize what ABCbits meant and mention some highlights from the discussion he shared:

- Their QR code scanner module comes with its own proprietary and most probably closed-source code. Also, they put the camera on the top, making for a weird experience when scanning QRs.
- The choice of batteries isn't the best one.
- They designed their own BBQR format for QR codes that doesn't have wide support.
- It's a huge device but with not that big of a display. The text size isn't great either.

[DireWolfM14]

Hey guys, I've been using the ColdCard Mk4 (fully air gapped setup with full Bitcoin Core node, I know, I'm sort of a chad) for around 2 years and I recently saw CoinKite finally released their Q1 model, which comes with a QR scanner, full qwerty keyboard, and battery slots, which are some pretty awesome features to say the least, especially in the context of an air gapped setup.

I wanted to know if any of you guys use the Q1 and could provide some feedback.

I love my Mk4, but I haven't pulled the trigger on a Q1 just yet.  New models of electronics can be buggy, and the Q1 has seen it's share of complaints in that regard.  I'll wait until it's been around the block for a couple more years and they iron out the manufacturing quirks.  In the mean time, I'm also a huge fan of the Foundation Passport as a fully air-gapped hardware wallet, which already has many of the features of the Q1.  The Foundation is by far my favorite hardware wallet, and I've used quite a few.

There is one specific ColdCard feature that I use regularly that the Passport does not include, and that's the Bip85 derivative wallets.  The feature allows one to create seeds and private keys (extended or WIF) that are derived from (and therefore backed up by) the original seed phrase.  I used it to create a seed for my hot wallet that's backed up by my hardware wallet.  How cool is that?  Although it's a pretty sweet feature, I'm anal so I write down the seeds anyway.

[satscraper]

There is one specific ColdCard feature that I use regularly that the Passport does not include, and that's the Bip85 derivative wallets.  

In fact Passport has this feature. It was implemented far ago ^{(I don't remember exactly by what release but  v.2.1.0 already had it)}

I think good to use Passport generated BIP 85 child seeds for feeding my other hardware wallets ^{(Tangem is one of them)}  as there is only one SEED ^{(namely master SEED)}  to be anxious over.

[Pmalek]

There is one specific ColdCard feature that I use regularly that the Passport does not include, and that's the Bip85 derivative wallets.  The feature allows one to create seeds and private keys (extended or WIF) that are derived from (and therefore backed up by) the original seed phrase.  I used it to create a seed for my hot wallet that's backed up by my hardware wallet.  How cool is that?  Although it's a pretty sweet feature, I'm anal so I write down the seeds anyway.

And then you imported that seed into the hot wallet. Do you not trust the hot wallet to generate the seed securely, but you are ok with having that same seed imported into the software? It doesn't sound like too big of a security boost. It might be convenient for other reasons. You don't have to make multiple backups of new seeds, since everything is derived from that one master seed.

[DireWolfM14]

There is one specific ColdCard feature that I use regularly that the Passport does not include, and that's the Bip85 derivative wallets.  The feature allows one to create seeds and private keys (extended or WIF) that are derived from (and therefore backed up by) the original seed phrase.  I used it to create a seed for my hot wallet that's backed up by my hardware wallet.  How cool is that?  Although it's a pretty sweet feature, I'm anal so I write down the seeds anyway.

And then you imported that seed into the hot wallet. Do you not trust the hot wallet to generate the seed securely, but you are ok with having that same seed imported into the software? It doesn't sound like too big of a security boost. It might be convenient for other reasons. You don't have to make multiple backups of new seeds, since everything is derived from that one master seed.

Correct, there is no security advantage.  It's not about security, but rather the convenience of having one back up.  The other reason I like doing it is that I prefer to use Bip39 seeds for my hot wallets, and since I use Electrum as my main software wallet, it's a convenient way to securely generate Bip39 seeds for that purpose.

There is no disadvantage or security risk to your primary hardware wallet seed by using a derived seed in a hot wallet.  A Bip85 derived seed cannot be used in reverse to determine the primary seed.

[tr0gi]

~

I don't own any Coldcard either, but for starter you could visit thread New HW wallet announced: COLDCARD Q1 which discuss Q1 features and odd behavior of CoinKite (company behind ColdCard).

I will try to summarize what ABCbits meant and mention some highlights from the discussion he shared:

- Their QR code scanner module comes with its own proprietary and most probably closed-source code. Also, they put the camera on the top, making for a weird experience when scanning QRs.
- The choice of batteries isn't the best one.
- They designed their own BBQR format for QR codes that doesn't have wide support.
- It's a huge device but with not that big of a display. The text size isn't great either.

Welp, I did not make further research but I'm actually very surprised Coinkite made their scanner source code proprietary, that's very odd.
As for the batteries, I agree, I think it would've been far more convenient to simply have a USB type-c rechargeable battery, but anyways, it's not that big of a deal.
The bulky size is also sort of annoying, the compact model of the mk4 makes it super convenient and easily concealable.

I also read everyone's reply and made the choice to simply stick with the mk4, my current setup is completely fine.
Thanks a bunch for summarizing that post for me Pmalek, much appreciated.

[dkbit98]

I wanted to know if any of you guys use the Q1 and could provide some feedback.

I don't own c0ldcard q1 but based on feedback and reviews from other people I would never waste my money on this device.
First of all this new device is not open source and it is huge, probably one of the biggest hardware wallet in the world ever, than there is a problem with screen dull contrast.
It is also worth mentioning that c0ldard is constantly deceiving customers by claiming this is the only true air-gapped hardware wallet, that is a lie.
I suggest checking out one of my older topics about Q1 for more information:
https://bitcointalk.org/index.php?topic=5439219.0

[tr0gi]

I wanted to know if any of you guys use the Q1 and could provide some feedback.

I don't own c0ldcard q1 but based on feedback and reviews from other people I would never waste my money on this device.
First of all this new device is not open source and it is huge, probably one of the biggest hardware wallet in the world ever, than there is a problem with screen dull contrast.
It is also worth mentioning that c0ldard is constantly deceiving customers by claiming this is the only true air-gapped hardware wallet, that is a lie.
I suggest checking out one of my older topics about Q1 for more information:
https://bitcointalk.org/index.php?topic=5439219.0

I'm not sure where you got the information about the firmware being proprietary. It is not.
https://github.com/Coldcard/firmware
"To have confidence this source code tree is the same as the binary on your device, you can rebuild it from source and get exactly the same bytes."

And I don't see how them claiming their product to be fully air-gapped is deceitful, my mk4 has never touched a computer's USB ports / been connected to the internet, I use an SD card to transfer PSBTs back and forth.

[dkbit98]

I'm not sure where you got the information about the firmware being proprietary. It is not.

When did I said that c0ldcard crap has proprietary firmware?!
They lied being open source for a while, but for years they are NOT open source after they switched license to Common Clause.
Common Clause is NOT open source, you can read the code only.

Is this “Open Source”?
No.

https://commonsclause.com/

On top of that, owner NVK is mentally unstable to run any company.
He spends most of his time on twitter blocking everyone from official company account.

[tr0gi]

Hmm, I must've misunderstood you here.

First of all this new device is not open source

Your arguments seem valid for the most part, but I won't lie, in the 2 years in which I've used my coldcard, I've never had any issues, and take the following statement with a grain of salt, but I'm ready to say, confidently, that it would be nearly impossible to clip a different address in a PSBT in which I am double, triple, quadruple checking the recipient address to make sure I'm sending my coins to the intended recipient, before signing the PSBT and broadcasting it.

[Pmalek]

And I don't see how them claiming their product to be fully air-gapped is deceitful.

You forgot about one important word in dkbit98's reply. He wasn't claiming that Coldcard isn't airgapped or that the owners wrongly state that Coldcard is airgapped. The wrong claim is that Coldcard is the only airgapped wallet. It's not. There are others. For example, Passport, Jade, Keystone, Krux, Seedsigner, etc. All of these are open-source and airgapped hardware wallets.

Maybe the term open-source is what is confusing you here. Coldcard is not open-source, but it has publicly available code. It's source verifiable. You can build it from scratch yourself. But because they don't use an open-source license, you aren't allowed to use Coldcard's code, make changes to it or use it as it is to develop your own products. With open-source code, you can do exactly that. You can take Passports' code and create your own hardware wallets and sell them.

[Meuserna]

Maybe the term open-source is what is confusing you here. Coldcard is not open-source, but it has publicly available code. It's source verifiable.

Good point.  We all need to use that term more often.  Source verifiable.

I respect ColdCard's decision to not keep their source "open" (Foundation Passport basically copied it & made their own hardware for it, though since then, Foundation has taken the Passport firmware their own way, development wise).  But even though ColdCard's firmware isn't still open source, it is published and, thus, verifiable.

Personally, I would pass on upgrading from the Mk4 to the Q unless one needs a new device.  Note that I said "needs."  If you don't need a new device, I'd wait.

I wouldn't be surprised at all if the next generation of ColdCard hardware is worth waiting for.  I'd love to see ColdCard release a touchscreen device, similar to Krux.  I won't be surprised at all if the next gen SeedSigner goes in that direction too.

[Pmalek]

I'd love to see ColdCard release a touchscreen device, similar to Krux.  I won't be surprised at all if the next gen SeedSigner goes in that direction too.

I don't know. Krux has the advantage over those manufacturers you mentioned in that the company doesn't build its own hardware. They develop software only that can be installed on existing hardware and turn those multi-purpose devices into offline signing devices for Bitcoin. Seedsigner, Coinkite, etc., would have to invest much more capital to create something like that. Time will tell...