So with the cold wallet hack I am thinking about using core 29 to store.

[philipma1957]

Honestly, I no longer care about hardware wallets and such things. This is the best approach to my mind: buy a cheap new laptop without any OS installed, do not connect it to the internet, remove wifi and bluetooth parts from it. Stick a usb flash drive with Tails installed on it (verify the Tails image before creating the USB), open an electrum wallet, generate a wallet and that's it, you have an air-gapped computer with cold wallet that's more secure than any hardware wallet.

I agree with everything, except one small detail that I can no longer sleep easy at nights: Computer RNG. I genuinely want to have the randomness confirmed with my own eyes from now on; and I know the recent incident with Coldcard has nothing to do with flawed CSRNG, but I'm afraid that everything happening on the computer is going to be heavily scrutinized by AI, and there MAY be weaknesses on deeper levels as well, like urandom or the hardware component itself.

Rolling a dice will become the new paranoid's standard, but you can't import dice entropy in Electrum.

yes but how big can you make the 25th word on electrum .

I did an electrum years ago and it was a 12 word seed. they said I could add a 13th word but I do not remember the rules about adding the extra word as a passphrase if you can do a big word it is easy use my punch method

https://www.amazon.com/gp/product/B0GWCLMR3V/ref=ox_sc_act_title_1?smid=ATVPDKIKX0DER&th=1


use 32 of the 36 punches over and over again

32x32x32x32x32x32x32x32=1.0995×10¹²   

 1.099 trillion cube it

or 24 characters long   and you get 120 extra bits randomly

[LoyceV]

This is the best approach to my mind: buy a cheap new laptop without any OS installed, do not connect it to the internet, remove wifi and bluetooth parts from it. Stick a usb flash drive with Tails installed on it (verify the Tails image before creating the USB), open an electrum wallet, generate a wallet and that's it

Why buy a new laptop just to run Tails OS? The whole idea of Tails OS is that it's can be used on any computer.

[Synchronice]

I agree with everything, except one small detail that I can no longer sleep easy at nights: Computer RNG. I genuinely want to have the randomness confirmed with my own eyes from now on; and I know the recent incident with Coldcard has nothing to do with flawed CSRNG, but I'm afraid that everything happening on the computer is going to be heavily scrutinized by AI, and there MAY be weaknesses on deeper levels as well, like urandom or the hardware component itself.

Rolling a dice will become the new paranoid's standard, but you can't import dice entropy in Electrum.

Electrum doesn't let you to import dice entropy but it can be fixed if you convert your physical dice rolls into a standard mnemonic seed phrase. Roll physical dice to create 128 bit entropy, then convert it into 12-words BIP39 seed and then import BIP39 seed into Electrum.

This is the best approach to my mind: buy a cheap new laptop without any OS installed, do not connect it to the internet, remove wifi and bluetooth parts from it. Stick a usb flash drive with Tails installed on it (verify the Tails image before creating the USB), open an electrum wallet, generate a wallet and that's it

Why buy a new laptop just to run Tails OS? The whole idea of Tails OS is that it's can be used on any computer.

The whole idea of buying a new laptop is that you are buying a fresh, untouched hardware. Tails can protect you from infected OS but it can't protect you from compromised BIOS, physical keyloggers and altered hardware. If you have an old laptop at home, then no problem, use it. But if you don't have a laptop and you have to buy, I would still choose a new, cheap laptop over second-hand.

[Cricktor]

The whole idea of buying a new laptop is that you are buying a fresh, untouched hardware. Tails can protect you from infected OS but it can't protect you from compromised BIOS, physical keyloggers and altered hardware. If you have an old laptop at home, then no problem, use it. But if you don't have a laptop and you have to buy, I would still choose a new, cheap laptop over second-hand.

What makes you think a "newly bought" cheap (=consumer grade) laptop is cleaner than a second-hand business laptop (=usually easier to open and inspect fully) which I can properly reset, reflash with published firmware from the vendor?

From my personal experience with few consumer laptops, those were sometimes a pain in the ass to open to get access to various components and inspect them. While the experience was quite different and much more pleasant with decent business laptops from Dell, HP and ThinkPads (IBM or later Lenovo).

I'm not paranoid enough to consider a laptop with newly flashed firmware and a properly reset BIOS to be still compromised. Storage media properly wiped, of course.

[LoyceV]

The whole idea of buying a new laptop is that you are buying a fresh, untouched hardware.

Some people trust old hardware more than new hardware when it comes to Bitcoin. How sure are you the manufacturer didn't install a backdoor already?

Tails can protect you from infected OS but it can't protect you from compromised BIOS, physical keyloggers and altered hardware.

How likely is this if you buy a laptop from Craigslist? I'm not worried about a compromised BIOS, nor am I worried about physical keyloggers in an air-gapped laptop. If that's going to happen, it's going to be a targeted attack, and the attacker can just as well install it inside the laptop you have at home already.

If you have an old laptop at home, then no problem, use it. But if you don't have a laptop and you have to buy, I would still choose a new, cheap laptop over second-hand.

I prefer hardware that lasts many years, and I expect a new budget laptop to last less long than a (cheaper) second hand business laptop. And I don't want to pay $2000 for a laptop I'll only use for accessing cold storage once a year.
Let's agree to disagree on the details, I'm pretty sure both options are quite secure anyway.

From my personal experience with few consumer laptops, those were sometimes a pain in the ass to open to get access to various components and inspect them. While the experience was quite different and much more pleasant with decent business laptops from Dell, HP and ThinkPads (IBM or later Lenovo).

I've been thinking about physically removing anything I don't need from an old laptop for a while now, but never actually did it. But like you said: business laptops with full Youtube explanation of how to open them are generally much easier than consumer laptops.
For the truly paranoid:

• remove network card + socket
• remove bluetooth module + antenna
• remove Wifi + antenna
• poor epoxy on the memory modules to prevent liquid nitrogen removal (even if they're soldered, you can't be careful enough)
• remove all USB connectors you're not going to use, fill the holes with epoxy
• remove webcam
• remove microphone + jack
• remove SSD if you don't use it
• remove microSD slots
• add epoxy all around the casing before you screw it back together
• fully encrypt the SSD if you install anything on it
• rig it with C4 let's not do that

But again, I haven't done this yet

[philipma1957]

The whole idea of buying a new laptop is that you are buying a fresh, untouched hardware.

Some people trust old hardware more than new hardware when it comes to Bitcoin. How sure are you the manufacturer didn't install a backdoor already?

Tails can protect you from infected OS but it can't protect you from compromised BIOS, physical keyloggers and altered hardware.

How likely is this if you buy a laptop from Craigslist? I'm not worried about a compromised BIOS, nor am I worried about physical keyloggers in an air-gapped laptop. If that's going to happen, it's going to be a targeted attack, and the attacker can just as well install it inside the laptop you have at home already.

If you have an old laptop at home, then no problem, use it. But if you don't have a laptop and you have to buy, I would still choose a new, cheap laptop over second-hand.

I prefer hardware that lasts many years, and I expect a new budget laptop to last less long than a (cheaper) second hand business laptop. And I don't want to pay $2000 for a laptop I'll only use for accessing cold storage once a year.
Let's agree to disagree on the details, I'm pretty sure both options are quite secure anyway.

From my personal experience with few consumer laptops, those were sometimes a pain in the ass to open to get access to various components and inspect them. While the experience was quite different and much more pleasant with decent business laptops from Dell, HP and ThinkPads (IBM or later Lenovo).

I've been thinking about physically removing anything I don't need from an old laptop for a while now, but never actually did it. But like you said: business laptops with full Youtube explanation of how to open them are generally much easier than consumer laptops.
For the truly paranoid:

• remove network card + socket
• remove bluetooth module + antenna
• remove Wifi + antenna
• poor epoxy on the memory modules to prevent liquid nitrogen removal (even if they're soldered, you can't be careful enough)
• remove all USB connectors you're not going to use, fill the holes with epoxy
• remove webcam
• remove microphone + jack
• remove SSD if you don't use it
• remove microSD slots
• add epoxy all around the casing before you screw it back together
• fully encrypt the SSD if you install anything on it
• rig it with C4 let's not do that

But again, I haven't done this yet

I have a lenovo laptop running core 25.

Pulled the wifi card

Encrypted the ssd a 2tb nvme.2 Samsung

It runs mint os.

It has a 24 character passphrase .

So i think It has 32gb ram

I should check it it has been sitting with 0.001 btc In it.

[nc50lc]

yes but how big can you make the 25th word on electrum .

You'd be surprised, here's an extreme case test done by o_e_l_e_o,

Reference quote:

There is theoretically no limit to how long a passphrase can be. The passphrase is simply used as a salt for the PBKDF2 function, which turns mnemonic phrase in to seed. (You can read more here: https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki) As a quick test, I just created and then recovered an Electrum wallet with a passphrase of 20,000 characters.

I'm pretty sure that Electrum's "seed extension" lines of code haven't been updated to set a hard limit since that reply,
But the GUI seems to have a cap of how many characters it can take (a little more than 32000), I haven't tested using CLI.

[LoyceV]

I'm pretty sure that Electrum's "seed extension" lines of code haven't been updated to set a hard limit since that reply,
But the GUI seems to have a cap of how many characters it can take (a little more than 32000)

At that point, just use the sha256sum of the long text as seed extension. It's just as safe, much easier to do and you can literally make it as long as you want.

[DireWolfM14]

AFAIK, only older models don't have that option to enter the passphrase on the hardware wallet's screen.

The Trezor 1 requires you to enter passphrases on the computer, but on the Model T and newer versions with a touchscreen you can enter the passphrase on the device.  I will say that the small screen and having to swipe from side to side makes it difficult for complex passphrases.

As for the security talk, when something like the recent ColdCard breach happens I think it's a common tendency for people to start questioning their methods.  It's natural and not necessarily a bad thing.  But, one must be careful not to overcomplicate things for himself.  Complications create opportunities to make mistakes.  Multi-sig setups are great but also can be overly complex and cumbersome to recover if one of your devices goes down.

The simplest way to add additional security is to create a long, strong passphrase.  Regardless of what off-line method you use, this is the one thing that isn't complicated to understand and should be taught to newbies as standard operating procedure.  I created this graphic to illustrate how long a passphrase needs to be to add 128 and 256 bits of entropy to your seed.



The ColdCard breach also got me thinking about how for a while now many "experts" have been saying a 12-word seed phrase is plenty long enough for security reasons.  I wonder how many of those cracked ColdCard seeds were 12 words, vs. how many (if any) were 24.