🔓 Lock.com - Software isolation will replace the hardware wallet [PREVIEW]

[Pmalek]

Yes, this is obtainable. Some software providers keep certain parts and patches of their software in private repositories for specific reasons

You may want to read this from Exodus

Although Exodus is built on many open-source components, there are components of Exodus that are not open-source.

Exodus publishes some open-source work used in Exodus on GitHub. You can view the source code, history, and continually published updates by visiting: Exodus Movement.

https://www.exodus.com/support/en/articles/8598678-is-exodus-open-source?

Exodus Wallet isn't open-source regardless of what their people claim or not. Unless something has changed, you can't build the binaries yourself using publicly available code. A partially open-source app, where some components are open-source while others aren't can't be classified as open-source software. Ledger used to do that and called themselves open-source. The firmware that runs on each hardware wallet of Ledger is closed-source. They conveniently avoid to mention this. Their native Ledger app and the coin apps that you need to install on your device are open-source, but that's not enough. When you consider the entire package, it's closed-source software.

[oll]

I went back to take another look at Lock’s activity on X and I’d like to say that the earlier assumption that their account posts automatically is incorrect. They comment on crypto‑related events several times a day, leaving their responses under the news of other crypto communities and projects. Or they simply sometimes comment on the thoughts of Bitcoiners and traders. For example, right now it seems that there was a hack of Multiple Avici, and Lock.com is expressing sympathy for such situations in the comments. Indeed, I have the feeling that wallet and service hacks have become the new reality.

The hacks we are seeing now are the negative sides of AI. Most loopholes in firmwares of hardawre wallets being compromised and software wallets loop-holes are all AI-driven bug detection being exploited. It's good these things are coming now and ColdCard is taking these into account prior to their launch, so they know areas constantly exploited and how to tighten security of their clients assets.

It turns out that not all modern hacks and thefts from hardware wallets are related to AI these days. You may have heard that yesterday news came out about the largest lawsuit, worth 500 million, filed by victims of a long‑ago Ledger hack. And now the representatives of this hardware wallet will need to defend their reputation, even though there are many victims and huge sums were stolen from each of them. And all of this is due to a database hack in 2020. For the Lock team, this is another opportunity to remind the community about their new technological solution in comparison with “hardware” methods.

[Ashawowo(OS)]

Yes, this is obtainable. Some software providers keep certain parts and patches of their software in private repositories for specific reasons

You may want to read this from Exodus

Although Exodus is built on many open-source components, there are components of Exodus that are not open-source.

Exodus publishes some open-source work used in Exodus on GitHub. You can view the source code, history, and continually published updates by visiting: Exodus Movement.

https://www.exodus.com/support/en/articles/8598678-is-exodus-open-source?

Exodus Wallet isn't open-source regardless of what their people claim or not. Unless something has changed, you can't build the binaries yourself using publicly available code. A partially open-source app, where some components are open-source while others aren't can't be classified as open-source software. Ledger used to do that and called themselves open-source. The firmware that runs on each hardware wallet of Ledger is closed-source. They conveniently avoid to mention this. Their native Ledger app and the coin apps that you need to install on your device are open-source, but that's not enough. When you consider the entire package, it's closed-source software.

Yeah, actually we were differentiating between an open code and an open-source earlier and exodus happens to fall into the category of open code. Most essential components are hidden in private repositories, so we cannot call it open-source, but an open code, but I didn't see it as to be totally categorized as close source. However, another wave of thought have flashed through my mind while I read your write-up.

Is there such situation whereby a wallet provider making every component of their code base (including the binaries) public, but restricting the legal rights of it being reproduced? This is to be more precise in my categorization between open code and closed source.

It turns out that not all modern hacks and thefts from hardware wallets are related to AI these days. You may have heard that yesterday news came out about the largest lawsuit, worth 500 million, filed by victims of a long‑ago Ledger hack.

I saw the newsflash in my notification panel during my off-screen time, I'll visit it later and revert. It is really worth discussing.

[Dareo]

While checking my email today, I got an update from Lock.com. They recently had a meeting with security researchers and developers about self custody at the Berlin Blockchain Week. And that might be why they haven't been able to provide regular updates on this thread. When I first got the email I thought I might have gotten early access, but no it was just an update. But even though it's not a huge update, the team is actually interacting with the community at various events, which is nice. Now let's see what kind of updates they come up with for their software.

[Pmalek]

Yeah, actually we were differentiating between an open code and an open-source earlier and exodus happens to fall into the category of open code.

The Exodus Wallet belongs to the category of closed-source software. If you can't build it from source and you can't use the codebase freely, it's closed-source.

Is there such situation whereby a wallet provider making every component of their code base (including the binaries) public, but restricting the legal rights of it being reproduced?

What you are describing is the way Coldcard works. Their code is publicly verifiable but they don't have an open-source license. So even if the code is there for public scrutiny, it doesn't fulfil the criteria to be called open-source. You can't use their codebase, add to it, and create your own product. However, you can do that with Trezor's code if you wanted to. That's because Trezor, unlike Coldcard, is open-source software.

[Cointikka]

I received an email from the team. I used AI to compare why they are promoting that their wallet will be better than a hardware wallet. I am posting a screenshot of what the team is building differently. I am not so much into wallets and their logic. I request those who are good with it to look into the comparison sheet.

I have included a direct link to the screenshot. Clicking it will take you to the detailed image since the width of the screenshot is quite large.

[snowpega]

I received an email from the team.
...

Hmm, email? But for what purpose?
Did you also join their early access at the initial stage? Because if you received an email regarding this matter, than i have not received any email till now. Because I had also requested/joined early access a long time ago. Can you tell me something more about what the email was about?

[Pmalek]

I received an email from the team. I used AI to compare why they are promoting that their wallet will be better than a hardware wallet. I am posting a screenshot of what the team is building differently. I am not so much into wallets and their logic. I request those who are good with it to look into the comparison sheet.

None of that matters until and unless Bitcoin's consensus changes to adopt the post-quantum signatures that Lock.com wants to work with. Lock can make their software safer but they can't get rid of ECDSA on their own and have those changes apply to the entire network. Bitcoin right now doesn't know what to do with their ML-DSA signature scheme and won't recognize it. Even if Lock.com is or becomes quantum-safe tomorrow, the Bitcoin network isn't because it relies on legacy signatures that aren't quantum-safe. Lock's developers, staff, whatever... can say whatever they want, but if they want to send bitcoin on the Bitcoin blockchain today, they can only do so by using legacy signature schemes and not post-quantum ones.

[Cointikka]

~

Yes, I did, and if you are using Gmail, then check the Promotions tab. I saw that mail there.

~~

Your reply gives me a clear understanding what actually is being promoted and the reality. Thanks for the deep dive into the comparison table.

[Yamane_Keto]

None of that matters until and unless Bitcoin's consensus changes to adopt the post-quantum signatures that Lock.com wants to work with. Lock can make their software safer but they can't get rid of ECDSA on their own and have those changes apply to the entire network. Bitcoin right now doesn't know what to do with their ML-DSA signature scheme and won't recognize it.

That’s a good point. the term usually implies that the wallet is quantum-safe unlike standard hardware wallets, meaning the client's funds are secure on their end. I still don't understand how new seed will be stored, given that their current system makes it difficult to write down on paper.

[Pmalek]

That’s a good point. the term usually implies that the wallet is quantum-safe unlike standard hardware wallets, meaning the client's funds are secure on their end.

You still need strong foundations and that's the blockchain. If there will ever be a quantum threat, it's the blockchain that needs to be made robust. A quantum attacker isn't going to try to break the security of your Lock.com wallet. They don't need to if the network protecting your stash, my stash, and all other bitcoins isn't secure.

[ZAINmalik75]

While checking my email today, I got an update from Lock.com. They recently had a meeting with security researchers and developers about self custody at the Berlin Blockchain Week. And that might be why they haven't been able to provide regular updates on this thread. When I first got the email I thought I might have gotten early access, but no it was just an update. But even though it's not a huge update, the team is actually interacting with the community at various events, which is nice. Now let's see what kind of updates they come up with for their software.

So everyone who gave their email for early access received the same email. Thanks for sharing it here, otherwise many might not have noticed it. They gave important details about their timeline, and these updates are important for the community to know where the project currently stands.

Their Berlin presence is really very meaningful, because they need investors, that's what they are telling us, and these events can bring them great exposure because these events in just one week can help them build great relationships within the developer community rather than just marketing to retail investors.

The real talks always happen over coffee, not on stage. In this industry, most of these collaborations are also formed in informal settings.
It's great to know that they have made some partnerships as well, because this transparency will determine the confidence.

[batang_bitcoin]

While checking my email today, I got an update from Lock.com. They recently had a meeting with security researchers and developers about self custody at the Berlin Blockchain Week. And that might be why they haven't been able to provide regular updates on this thread. When I first got the email I thought I might have gotten early access, but no it was just an update. But even though it's not a huge update, the team is actually interacting with the community at various events, which is nice. Now let's see what kind of updates they come up with for their software.

I also checked my email and received the same email so it's for all of those who have been listed for the early access. Will wait for further updates about the product itself and I think that we'll have it in a couple of weeks on how it goes after all of these participations they went.

[kizilhare]

I received an email from the team.
...

Hmm, email? But for what purpose?
Did you also join their early access at the initial stage? Because if you received an email regarding this matter, than i have not received any email till now. Because I had also requested/joined early access a long time ago. Can you tell me something more about what the email was about?

I had signed up for early access quite a while ago, but I received an email on September 4th.
The content of the email was a promotion for Lock.com; I didn't receive any notification confirming my inclusion in the early access program.
I have started following the Twitter account.
Since I received the promotional email, I assume I'll get emails about early access and the like from now on. For the time being, that is the only communication I've received.