The simple analogies for hardware wallets.

[alani123]

Look HODLers, we have to find a way to teach people how to understand hardware wallet safety principles. I propose some simple to understand analogies. People like to learn through idioms you know. I'll give it a go.

Getting a used hardware wallet is like re-using a condom. Completely defeats the purpose.

Buying a hardware wallet from any third party other than the manufacturing company directly is like buying medicine from the vet store. Might be cheaper but could risk costing you literally everything.

Buying a hardware wallet with a sealed non-transparent casing is like buying a car and asking to paint the windshield with a thick cost of vantablack. You need to see what's in there so you can compare it to the original circuit designs and verify it has not been tampered with.

Buying a hardware wallet from a company that doesn't have a bug bounty program and/or doesn't encourage serious research to hack-proof their products is like making your money a guinea pig.

Putting your money in any wallet with closed source software is like putting it in someone else's lock box. You're probably not the only one with the key.

Getting an already etched private key store metal card is like finding a key in the middle of the street and asking the locksmith to design you a lock for it to put on your main house door.
Feel free to reiterate and have fun.


A funny AI image I promoted for your inspiration.

[Karl_3000]

What if you followed this and bought Coldcard and funded it with huge amount of bitcoin but later see the wallet has been taken over by hackers and before you know, the money sent there have all be sent to the hackers bitcoin address? Coldcard has almost all the characteristics that you mentioned but some people said it is not completely open source. I am afraid to buy an hardware wallet. I was planning to get Trezor when all these hack started which increase my fear to get any hardware wallet. I will wait for sometime to know what will later happen to another hardware wallet.

[Hatchy]

With the many attacks on hardware wallets we have seen this year, it's understandable that some investors are having second thoughts about purchasing these devices. Having a hardware wallet no longer automatically means your funds are safe, especially with the different ways vulnerabilities can be introduced. You also mentioned open source software, which allows independent researchers to inspect the code, but we all know that this doesn't guarantee complete security either.

There are many reasons to think twice before purchasing a hardware wallet, and honestly, based on my experience with them, I don't consider them reliable in the long run. A properly stored seed phrase written on paper or engraved on metal can last for ages, as long as you protect it properly. That aside, I completely agree that some of the risks associated with hardware wallets can be reduced by avoiding simple human errors. One example is buying from an untrusted third-party seller. It's better to purchase your hardware wallet directly from the manufacturer, but never assume that doing so guarantees 100% security.

[Pmalek]

...Coldcard has almost all the characteristics that you mentioned but some people said it is not completely open source.

It's not open-source at all. Coldcard's code is source-verifiable, meaning it's publicly available for scrutiny. If you know how to inspect and audit code, you can do that with Coldcard just like you can do with Trezor and any other open-source code.

Open-source means you can use the code however you like. Copy all of it, modify it, add to it, create your own product with it and sell it. You could create the Karl_3000 hardware wallet, keep it open-source and sell it.
Coldcard's source-verifiable code doesn't allow you to do that. A Karl_3000 hardware wallet couldn't be legally built and sold using Coldcard's code.

[Meuserna]

...Coldcard has almost all the characteristics that you mentioned but some people said it is not completely open source.

It's not open-source at all. Coldcard's code is source-verifiable, meaning it's publicly available for scrutiny. If you know how to inspect and audit code, you can do that with Coldcard just like you can do with Trezor and any other open-source code.

Open-source means you can use the code however you like. Copy all of it, modify it, add to it, create your own product with it and sell it. You could create the Karl_3000 hardware wallet, keep it open-source and sell it.
Coldcard's source-verifiable code doesn't allow you to do that. A Karl_3000 hardware wallet couldn't be legally built and sold using Coldcard's code.

THIS. Here's why it matters.

ColdCard's code was published and verifiable, but other devs couldn't use it in their own work, so they had no incentive to read it. Why bother?

But even if other devs did read ColdCard's code, there's a huuuge difference between reading code and using code in your own work. When you use somebody else's code in your own work, things can behave in unexpected ways and you have to dig into the code, line by line, to figure out why. That's where it becomes easier to find bugs.

The fact that Coinkite intentionally mislead users into thinking ColdCard's code was open source when it was not is a perfect example of why ColdCard, Rodolfo Novak (NVK) and Peter Gray (Doc-Hex) should never be trusted again. Never.

But too many people in this space are gadget-guys who think the calculators are cool, and Tangem cards are cool, and Ledger gadgets are cool.

Bitcoin is open source. Any code you use to secure your Bitcoin should be open source too. No exceptions. If your keys depend on code that isn't open source, you can't be sure your keys are safe.

Obviously, if you're only securing a few hundred bucks worth of Bitcoin, none of this really matters. But if you want Bitcoin to be part of your financial future, it makes no sense to even consider cool-factor, and it makes no sense to prioritize convenience over security.

[mindrust]

If you don't have a very very specific reason to own a hardware wallet, It means you don't need it. Most people don't need a hardware wallet. They need a well secured linux box (preferably offline but only if you are sending/receiving transactions online is OK too) and a piece of paper as a backup. That's a much better solution than a hardware wallet.

[alani123]

If you don't have a very very specific reason to own a hardware wallet, It means you don't need it. Most people don't need a hardware wallet. They need a well secured linux box (preferably offline but only if you are sending/receiving transactions online is OK too) and a piece of paper as a backup. That's a much better solution than a hardware wallet.

Well, the hardware wallet comes with the supposed benefit of having a secure environment out of the box. Most people can't update their software alone, let alone set up a secure linux environment by themselves in a trustless way.

[Pmalek]

ColdCard's code was published and verifiable, but other devs couldn't use it in their own work, so they had no incentive to read it. Why bother?

Right. Other people couldn't use it commercially and build their own products with it, but no one stopped anyone from scrutinizing the work, finding and making people aware of bugs and/or vulnerabilities. Where were all the "security experts" for five years while the entropy bug was publicly available but no one discovered it? Even if that code was open-source, I don't believe it would have made a difference. No one would notice a lack of security of a seed phrase until it's too late.

At the same time, I do agree with this:

But even if other devs did read ColdCard's code, there's a huuuge difference between reading code and using code in your own work. When you use somebody else's code in your own work, things can behave in unexpected ways and you have to dig into the code, line by line, to figure out why. That's where it becomes easier to find bugs.

[bitmover]

If you don't have a very very specific reason to own a hardware wallet, It means you don't need it. Most people don't need a hardware wallet. They need a well secured linux box (preferably offline but only if you are sending/receiving transactions online is OK too) and a piece of paper as a backup. That's a much better solution than a hardware wallet.

Well, the hardware wallet comes with the supposed benefit of having a secure environment out of the box. Most people can't update their software alone, let alone set up a secure linux environment by themselves in a trustless way.

Most people doesn't even know what is a Linux.

I can guarantee that 99% of the people have no what  idea of what a ' secured linux box' is, and shouldn't be trying to use one, because they lack the knowledge to do that correctly.

Hardware wallets are for these 99% people

[mindrust]

If you don't have a very very specific reason to own a hardware wallet, It means you don't need it. Most people don't need a hardware wallet. They need a well secured linux box (preferably offline but only if you are sending/receiving transactions online is OK too) and a piece of paper as a backup. That's a much better solution than a hardware wallet.

Well, the hardware wallet comes with the supposed benefit of having a secure environment out of the box. Most people can't update their software alone, let alone set up a secure linux environment by themselves in a trustless way.

Most people doesn't even know what is a Linux.

I can guarantee that 99% of the people have no what  idea of what a ' secured linux box' is, and shouldn't be trying to use one, because they lack the knowledge to do that correctly.

Hardware wallets are for these 99% people

Most people who don't have a basic sense of cyber security shouldn't be dealing with crypto in the first place. Hardware wallet isn't making it easier for them, in fact if they insist on staying dumb, they'll lose their coins eventually in the worst possible time.

They better trust banks with their money at this point if they can't bear the responsibility of securing a private key/seed words which is just a combination of a few words/letters.

They should be buying a Bitcoin ETF. Not a hw wallet.

[bitmover]

Most people who don't have a basic sense of cyber security shouldn't be dealing with crypto in the first place.

I disagree.

Bitcoin is a gift to humanity, not for tech geeks only.

Wallets were already made easy to use , so that anyone who understands how to use visa can use crypto.

If they want to add their life savings , they could learn just a little bit and use a hardware wallet. Even a dumb person can use one safely.

There are countless examples around, of people who knows zero about crypto using hw safely

[mindrust]

Most people who don't have a basic sense of cyber security shouldn't be dealing with crypto in the first place.

I disagree.

I have a friend who doesn't understand a shit about cryptography and computers and he holds nearly 1 btc... in a bank owned crypto exchange and there is no btc withdrawal option available. (sounds dumb right?)

He is doing this because he doesn't even understand hw wallets and he doesn't want to. He is pretty sure he would mess it up too and some people who happen to use hw wallets indeed messed it up and lost coins. He read the news. He would rather trust a bank and he calls himself a bitcoin investor, which is true but that's not the reason most people here invest in btc for. (we are not only interested in the price, we want independence too)

Hw wallets create a false sense of security for the wrong people and that's pretty dangerous.

[bitmover]

Most people who don't have a basic sense of cyber security shouldn't be dealing with crypto in the first place.

I disagree.

I have a friend who doesn't understand a shit about cryptography and computers and he holds nearly 1 btc... in a bank owned crypto exchange and there is no btc withdrawal option available. (sounds dumb right?)

He is doing this because he doesn't even understand hw wallets and he doesn't want to. He is pretty sure he would mess it up too and some people who happen to use hw wallets indeed messed it up and lost coins. He read the news. He would rather trust a bank and he calls himself a bitcoin investor, which is true but that's not the reason most people here invest in btc for. (we are not only interested in the price, we want independence too)

Hw wallets create a false sense of security for the wrong people and that's pretty dangerous.

I also have a friend who owns about 2 BTC in a ledger wallet since 2020. I suggest him to buy bitcoin and buy a ledger. He was able to do so and is holding until today.

He even sold about 1 btc last year in a CEX.

He knows zero about computers. He can barely use microsoft excel.

[alani123]

Most people who don't have a basic sense of cyber security shouldn't be dealing with crypto in the first place.

I disagree.

I have a friend who doesn't understand a shit about cryptography and computers and he holds nearly 1 btc... in a bank owned crypto exchange and there is no btc withdrawal option available. (sounds dumb right?)

He is doing this because he doesn't even understand hw wallets and he doesn't want to. He is pretty sure he would mess it up too and some people who happen to use hw wallets indeed messed it up and lost coins. He read the news. He would rather trust a bank and he calls himself a bitcoin investor, which is true but that's not the reason most people here invest in btc for. (we are not only interested in the price, we want independence too)

Hw wallets create a false sense of security for the wrong people and that's pretty dangerous.

Self custody isn't mandatory.
I'd say to the contrary, if any platform wants to act as a custodian, they should put themselves under heavy scrutiny and provide proof of reserves to customers. Independent accountants once a year don't cover the technical capabilities bitcoin offers.

Even through I understand crypto pretty well I'd say I find myself holding decent amounts on centralised platforms. The convenience of being able to convert your crypto in real time to make payments in locations where the only payment option is a MasterCard/Visa terminal is pretty convenient.

It would be nice if the crypto industry enforced this standards through self regulation. But banking standards are completely inadequate to showcase a crypto service isn't bankrupt in the traditional sense because so many new factors are introduced. Holding crypto in a custodian platform could also offer certain protections if these standards were applied though. Bitmex and Kraken already have something similar. Most other platforms don't.

The concern to not hold deposits of crypto to custodian platforms is valid, but it doesn't mean people who don't hold technical knowledge shouldn't touch crypto. Some of the responsibility also falls on regulators for failing to do their supposed job securing clients of financial platforms. And also the platforms themselves

[Pmalek]

Hw wallets create a false sense of security for the wrong people and that's pretty dangerous.

No system is secure enough if you are dumb, ignorant, uninterested to learn, and don't think about the consequences of your actions. You can set up the best possible system for such a person and they will still find a way to mess it up. One day they will see an X post by "Elon Musk" where he is giving away double the bitcoin you send him and lose half their wealth. The other half will get wasted after the king of Sweden sends them an email offering to recover their losses. That's no argument against hardware wallets, though. Such people are the exception to the rule, not the rule.

[mindrust]

Hw wallets create a false sense of security for the wrong people and that's pretty dangerous.

No system is secure enough if you are dumb, ignorant, uninterested to learn, and don't think about the consequences of your actions. You can set up the best possible system for such a person and they will still find a way to mess it up. One day they will see an X post by "Elon Musk" where he is giving away double the bitcoin you send him and lose half their wealth. The other half will get wasted after the king of Sweden sends them an email offering to recover their losses. That's no argument against hardware wallets, though. Such people are the exception to the rule, not the rule.

That's my point.

If a person is not interested in the fundamentals and think a hw wallet will save them, they are dead wrong. Lots of stuff can go wrong with the hw wallets too. Not knowing linux or computers in general is not an excuse. If you are dealing with crypto and want independency, you MUST know these. Otherwise go back to legacy banking, you are their target audience.