🔓 Lock.com - Software isolation will replace the hardware wallet [PREVIEW]

[madebylock]

🔓 Lock.com's thesis is that you get more safety by isolating inside the wallet than by isolating from the computer. A hardware wallet isolates the key from the computer. Lock.com tries to isolate the key from the rest of the wallet itself. You open one product and use it like any other wallet.

For active self-custody, software isolation can replace the hardware wallet. Hardware wallets solved a real problem. Keeping your keys off a general-purpose computer full of malware, browser exploits, and clipboard hijackers was the right call, and for deep cold storage it still is. Nobody's disputing that. But "keep the key off the computer" is a narrower guarantee than people treat it as, and for anyone actually *using* their coins it's showing its limits:

• You're still trusting the supply chain, the firmware, the update process, and the companion app. The secure element is small; the trust surface wrapped around it is not.
• The tiny screen that's supposed to be your source of truth can't meaningfully show you a complex swap, bridge, or contract approval. You end up confirming a blob and hoping.
• For real multi-chain use, the surrounding software still owns everything that matters - chain state, providers and routing, transaction context, swaps, bridges, and the entire UX. The device signs; the software decides what it signs.

To you, it's one wallet app. Under the hood, the sensitive roles are pulled apart so a compromise in one piece never reaches the seed. This isn't another skin over the same monolith. The part that can sign is small, walled off, and never shares space with the part talking to the internet or drawing the UI.

• Treasury — the only component that touches seed-derived material and signs.
• Node — chain state, providers, routing, RPCs, swaps, bridges, all the network-facing work.
• Wallet — the interface you actually click around in.
• Vault daemon — protects the device key on its own, on platforms that let us do it.

On post-quantum, Lock uses hybrid classical + post-quantum cryptography inside its own architecture and communication layers. It does not make any existing chain quantum-safe - on-chain signatures still come down to whatever cryptography that chain uses, and that's not ours to change.

Our claim, plainly: for most people doing active self-custody, this replaces the hardware wallet. For deep cold storage, a dedicated device may still be the right tool.  I want to know exactly where you think that line falls. Here's what we're particularly interested in about this thread.

• Wallet builders and auditors: tear into the architecture and the trust boundaries.
• Hardware-wallet users: tell me where a dedicated device still beats this.
• Self-custody users: the frustrations nothing on the market has fixed.
• Anyone who wants to follow along before it's public.

.POR.    |   .FIL.   |   .GER.   |   .SPA.   |   .PID.   |   .IND.   |   .CRO.   |   .RUS.   |   .TUR.   |   .ELL.   |   .HIN.   |   .ROM.

	___________________	__________________	__________________

[satscraper]

~

I like this picture.

Empty beer boxes suggest that your coming project is bound to succeed.  

On the serious note, your mentioned "post-quantum schemes inside the wallet's own architecture and its comms layers". Does it mean that your are intend to protect from quantum treat the app itself ^{like its local data,sync, backup, any client-server communication, what else?.} rather than funds it controls?

[madebylock]

~

I like this picture.

Empty beer boxes suggest that your coming project is bound to succeed.  

On the serious note, your mentioned "post-quantum schemes inside the wallet's own architecture and its comms layers". Does it mean that your are intend to protect from quantum treat the app itself like its local data,sync, backup, any client-server communication, what else?. rather than funds it controls?

Hi satscraper, seeds created from the Lock Treasury are quantum safe, the security is designed for the quantum world. If a blockchain is not quantum safe, this is out of the programs control.

[Zwei]

how is that "True Air-Gapped Security" when the wallet app can communicate with the offline signer via bluetooth or local wifi?

seeds created from the Lock Treasury are quantum safe, the security is designed for the quantum world.

can you explain in more details how the seeds created are quantum safe?

[satscraper]

What I'm after in this thread:

• Wallet builders and auditors: tear into the architecture and the trust boundaries.
• Hardware-wallet users: tell me where a dedicated device still beats this.
• Self-custody users: the frustrations nothing on the market has fixed.
• Anyone who wants to follow along before it's public.

More to come, including the whitepaper and early access details. Site's here if you want it: https://www.lock.com

All of the above can be answered only after your whitepaper sees the light. Until then, your words cannot be taken seriously and our speculations would be meaningless.

But at least now I can say that, in my view, there's no way to achieve absolute isolation of key material in the host machine, as those keys need to communicate with the host which builds the unsigned transactions.

So I'm waiting for your whitepaper for serious discussion.

[nc50lc]

This isn't another skin over the same monolith. The part that can sign is small, walled off, and never shares space with the part talking to the internet or drawing the UI.

When you said "small", you meant a few lines of code that's easy to audit?

Because based from the website,
I can't see any advantage from existing cold-storage feature that's already available in some self-custodial wallets.
e.g.: An air-gap machine with offline wallet and an online watch-only pair.
Open-source so it can be verified even though it's not isolated from the wallet daemon and/or GUI.

Of course, an easy-to-verify source code for the "Treasury" is good if that's what you meant.

[madebylock]

how is that "True Air-Gapped Security" when the wallet app can communicate with the offline signer via bluetooth or local wifi?

seeds created from the Lock Treasury are quantum safe, the security is designed for the quantum world.

can you explain in more details how the seeds created are quantum safe?

Hi Zwei, the air gap is between your Treasury (signer) and the internet, not between the Wallet and the Treasury. Bluetooth/WiFi/USB/Ethernet is the local link the app uses to hand the Treasury something to sign.

The Wallet itself never generates a transaction. The Wallet sends instructions to the Treasury where all the verification and generation of the transaction takes place. Signing happens entirely on the Treasury with no access to the internet.

That link is locked down: end-to-end encrypted with a post-quantum handshake, protected by an 8-digit pairing check against impersonation, and the Treasury is blocked at the OS level from ever making an outbound connection.

As for your question on the seeds being created there are two parts to it. First, the seed: Grover's algorithm halves brute-force strength (256-bit to ~128-bit), so Lock's 36-word Universal Quantum Seed uses 272 bits of entropy  ~136-bit even against a quantum search, with a hardened KDF (PBKDF2 600k + Argon2id) on top.

Second, the seed derives genuine NIST keys (ML-KEM-768 + ML-DSA-65), always paired with classical so both must break, protecting your chat, files, the Wallet to Treasury channel and node auth against "harvest-now-decrypt-later."

The majority of on-chain signatures are still classical (secp256k1/Ed25519). Lock's built to switch the day they do. Until then, your seed already carries the headroom.

What I'm after in this thread:

• Wallet builders and auditors: tear into the architecture and the trust boundaries.
• Hardware-wallet users: tell me where a dedicated device still beats this.
• Self-custody users: the frustrations nothing on the market has fixed.
• Anyone who wants to follow along before it's public.

More to come, including the whitepaper and early access details. Site's here if you want it: https://www.lock.com

All of the above can be answered only after your whitepaper sees the light. Until then, your words cannot be taken seriously and our speculations would be meaningless.

But at least now I can say that, in my view, there's no way to achieve absolute isolation of key material in the host machine, as those keys need to communicate with the host which builds the unsigned transactions.

So I'm waiting for your whitepaper for serious discussion.

Hi satscraper, a laptop without internet access can't leak your private keys. Currently we're planning the Treasury OS, a full operating system that only runs the Treasury. Your laptop or Raspberry Pi becomes your signing device.

One that has verifiable open code.
One that wasn't tampered or swapped in transit.
One that doesn't have your home address or phone number on file.
One that doesn't leave you open to phishing attempts.
One that isn't assembled and compiled by random people you don't know.
One that doesn't require trust.

This isn't another skin over the same monolith. The part that can sign is small, walled off, and never shares space with the part talking to the internet or drawing the UI.

When you said "small", you meant a few lines of code that's easy to audit?

Because based from the website,
I can't see any advantage from existing cold-storage feature that's already available in some self-custodial wallets.
e.g.: An air-gap machine with offline wallet and an online watch-only pair.
Open-source so it can be verified even though it's not isolated from the wallet daemon and/or GUI.

Of course, an easy-to-verify source code for the "Treasury" is good if that's what you meant.

Hi nc50lc, our Wallet, Treasury and Node combined is over +2,000,000 lines of code. You can choose to trust a hardware wallet manufacturer, you can choose to trust they will deliver your device that hasn't been tampered with at the facility where it was made or in transit. You can choose to trust they will keep your personal billing information secure.. or you can choose Lock, who you don't have to trust, where you can verify the code and compile it yourself without even divulging your email address. The security benefits are enormous, we're in a league of our own.

[nc50lc]

This isn't another skin over the same monolith. The part that can sign is small, walled off, and never shares space with the part talking to the internet or drawing the UI.

When you said "small", you meant a few lines of code that's easy to audit?

Hi nc50lc, our Wallet, Treasury and Node combined is over +2,000,000 lines of code. You can choose to trust a hardware wallet manufacturer, you can choose to trust they will deliver your device that hasn't been tampered with at the facility where it was made or in transit.

Not the answer to my question, thanks for the reply anyways.
I guess I have to wait for the official release, whitepaper, documentation for the proper answer.

For clarification, I meant "Cold Storage" setup which doesn't involve a hardware wallet.
E.g.: An offline Electrum wallet that's the signer and an online watching-only wallet for the online-related features.

About the part where I asked about that "small" thing, I'm asking if it's the code of the Treasury (as you said "the part that can sign").
Not asking for the whole codebase's size.

[satscraper]

. Currently we're planning the Treasury OS, a full operating system that only runs the Treasury. Your laptop or Raspberry Pi becomes your signing device.

.

Developing a new OS from scratch for the zoo of available hardware is very risky business. I would never vouch for the security of any chicken OS. Even Linux, which has existed and polished for decades, reveals nowadays that it has hidden flaws that may open the doors. Why not develop a dedicated app to keep key materials in the persistent volume of Tails with the frozen radio channels?

[madebylock]

This isn't another skin over the same monolith. The part that can sign is small, walled off, and never shares space with the part talking to the internet or drawing the UI.

When you said "small", you meant a few lines of code that's easy to audit?

Hi nc50lc, our Wallet, Treasury and Node combined is over +2,000,000 lines of code. You can choose to trust a hardware wallet manufacturer, you can choose to trust they will deliver your device that hasn't been tampered with at the facility where it was made or in transit.

Not the answer to my question, thanks for the reply anyways.
I guess I have to wait for the official release, whitepaper, documentation for the proper answer.

For clarification, I meant "Cold Storage" setup which doesn't involve a hardware wallet.
E.g.: An offline Electrum wallet that's the signer and an online watching-only wallet for the online-related features.

About the part where I asked about that "small" thing, I'm asking if it's the code of the Treasury (as you said "the part that can sign").
Not asking for the whole codebase's size.

Hi nc50lc, It's like you're saying with Electrum, if Electrum was used on an offline computer and you had access to 120 Blockchains instead of 1, along with a highly encrypted chat system where the senders and receivers are hidden, instant swapping with optional fees, online file storage with direct connection to the filecoin network, importing any wallet from all the major wallets including old wallet.dat files from 2009, hidden wallets to create branches from your original seed which are not stored in memory for safe keeping and much more.

Let me try to explain the Treasury, it should only be running on an offline computer of yours, you can use it on your regular computer connected to the internet but that is highly unrecommended, it can be connected to from Bluetooth, Wifi, USB or a direct LAN connection. We offer a seperate Wallet program that can be downloaded on Windows, Mac or Linux. When you send a transaction, its built inside the Treasury and sent back to your Wallet to be broadcast.

Our first version will be released in a few weeks, you will be able to see for yourself

. Currently we're planning the Treasury OS, a full operating system that only runs the Treasury. Your laptop or Raspberry Pi becomes your signing device.

.

Developing a new OS from scratch for the zoo of available hardware is very risky business. I would never vouch for the security of any chicken OS. Even Linux, which has existed and polished for decades, reveals nowadays that it has hidden flaws that may open the doors. Why not develop a dedicated app to keep key materials in the persistent volume of Tails with the frozen radio channels?

Hi satscraper, The Treasury OS is not an actual operating system the way you're thinking. It makes it so you're computer only runs the Treasury and nothing else, the app itself becomes the OS.

[nc50lc]

Hi nc50lc, It's like you're saying with Electrum, if Electrum was used on an offline computer and you had access to 120 Blockchains instead of 1, -snip-

Oh, I didn't take that into account.
I mainly use Bitcoin and Bitcoin wallets, but being a multi-coin wallet is indeed an advantage since I rarely see one with cold-storage feature.

Let me try to explain the Treasury, it should only be running on an offline computer of yours, you can use it on your regular computer connected to the internet but that is highly unrecommended, it can be connected to from Bluetooth, Wifi, USB or a direct LAN connection. We offer a seperate Wallet program that can be downloaded on Windows, Mac or Linux. When you send a transaction, its built inside the Treasury and sent back to your Wallet to be broadcast.

Thanks, but I'm aware of this.
It's just the note about it being "small" that I'm interested with.

But since it'll be released in just a few weeks, I'll just wait for it to check.

[satscraper]

. Currently we're planning the Treasury OS, a full operating system that only runs the Treasury. Your laptop or Raspberry Pi becomes your signing device.

.

Developing a new OS from scratch for the zoo of available hardware is very risky business. I would never vouch for the security of any chicken OS. Even Linux, which has existed and polished for decades, reveals nowadays that it has hidden flaws that may open the doors. Why not develop a dedicated app to keep key materials in the persistent volume of Tails with the frozen radio channels?

Hi satscraper, The Treasury OS is not an actual operating system the way you're thinking. It makes it so you're computer only runs the Treasury and nothing else, the app itself becomes the OS.

But it needs drivers to interact with hardware.

 Will you write them yourself to ensure the integrity of Treasury OS? And what about the connection to Tor?

Still, I think the Tails approach would be more reliable, taking into account that you're going to target virtually all existing hardware. It's one thing when you build your own hardware ^{like Apple and  Foundation do} and make the dedicated OS for it, but it's another when  OS has to run on the whole zoo of devices.

[LoyceV]

I know will get pushback in this crowd, which is exactly why I want it here first: for active self-custody, software isolation can replace the hardware wallet.

As they say: Extraordinary claims require extraordinary evidence. If you claim your software is safer than a hardware wallet, you'll have a tough time convincing us here.

a laptop without internet access can't leak your private keys. Currently we're planning the Treasury OS, a full operating system that only runs the Treasury. Your laptop or Raspberry Pi becomes your signing device.

So you're replacing a hardware wallet by an entire laptop? I can already sign offline using a laptop, with software I trust. Why would I want your software instead? No, I do not need 120 different blockchains.

over +2,000,000 lines of code.
~
or you can choose Lock, who you don't have to trust, where you can verify the code

I don't know a single person who has the skills and time to properly review 2 million lines of code.

I mainly use Bitcoin and Bitcoin wallets, but being a multi-coin wallet is indeed an advantage since I rarely see one with cold-storage feature.

From what I've seen, people who are into many different altcoins usually keep "their" coins on an exchange. They don't care about self-custody.

you can use it on your regular computer connected to the internet but that is highly unrecommended

That's what makes hardware wallets so easy to recommend to beginners: it's much easier to keep secure than a manual cold storage setup.

[nc50lc]

I mainly use Bitcoin and Bitcoin wallets, but being a multi-coin wallet is indeed an advantage since I rarely see one with cold-storage feature.

From what I've seen, people who are into many different altcoins usually keep "their" coins on an exchange. They don't care about self-custody.

Probably for the mainstream,
Although Bitcoin isn't much different for them, most of them also store their bitcoins in Exchange, if not, in popular Multi-coin wallets like MEW.
In my viewpoint, I'm seeing more posts throughout the internet about the latter.
But since there's no actual survey or study regarding this, we can't be assured on the actual numbers.

[snowpega]

@madebylock

Hi there!

Hope you are doing well. I just registered for early access. When I click it, it says, "Registering..."

And there is also a button for sign-up which I think is not working for now, right? Because when I click it, it says, "Saved. Connection is unstable, so we’ll keep trying automatically."

Meaning the service is not fully functional, or am I mistaken?

Aside from this, I would like to translate the ANN into the Urdu Language if it helps the service to grow faster in adoption. Thanks!

[BitMaxz]

@madebylock

Hi there!

Hope you are doing well. I just registered for early access. When I click it, it says, "Registering..."

And there is also a button for sign-up which I think is not working for now, right? Because when I click it, it says, "Saved. Connection is unstable, so we’ll keep trying automatically."

Meaning the service is not fully functional, or am I mistaken?

Aside from this, I would like to translate the ANN into the Urdu Language if it helps the service to grow faster in adoption. Thanks!

You might behaving a connection issue. I have a different response, and I got "Thanks. You’re on the list."

About the sign-up button, I can't find it on the home page. How did you find it?

I think the home page is not done yet; the signup button is gone.

[snowpega]

You might behaving a connection issue. I have a different response, and I got "Thanks. You’re on the list."
 
About the sign-up button, I can't find it on the home page. How did you find it?

I think the home page is not done yet; the signup button is gone.

Yeah, it seems like there is something wrong with my connection.

Aside from this, When you will scroll down a bit, then you will see sign-up button on the top right corner on your screen.

Edit: it works, i am now also on the list...

[nc50lc]

Edit: it works, i am now also on the list...

I can confirm this, I also pre-registered and it went smoothly.

@madebylock
I hope that it supports testnet 4 or 3 chains because I don't prefer testing a preview software in mainnet, if possible.
BTW, great timing on announcing the preview version, capitalizing on Coldcard's debacle is a smart move.

[joker_josue]

A new project can always be interesting for revitalizing the sector. We'll see what really comes next.

However, I'd like to ask a few simple questions, not so technical, but more from a user's perspective:
- What makes this different from Electrum? (I'm not referring to the quantum part.)
- How does this make my day simpler than with an Electrum and safer than with a Ledger/Trezor/etc?

[Pmalek]

I am not so sure about this. I don't want to turn my back on hardware wallets altogether because of what Coldcard, NVK, and the rest of the guys did. Their implementation was flawed but that doesn't make 12/24-word seeds unsafe now, especially with a complex, long, and non-bruteforcable (according to today's standards) passphrase or multisig involving several other parties. Entropy from non-biased dice is still good.

The flawed code of Coldcard was public for five years. Why didn't anyone notice it? People can argue that nobody wanted to waste their time reviewing it or working with NVK because of his past behavior but I don't think that's good enough of an excuse. Any expert that claimed to have "reviewed" Coldcard's code and gave them the thumbs up messed up.

If people weren't able to find the vulnerabilities with that product for five years, what are the chances they will review Lock properly and its 2 million lines of code? At the moment, that's a no from me.

If I make the decision to abandon all hardware wallets, it's going to be for a completely and properly airgapped setup involving Electrum on an offline computer. To me, that's levelling up in terms of security.