The "Decoy PIN"

[briggswillis4real]

The "Decoy PIN"

 I setup 3 wallets on ONE hardware wallet. Most people don't know this is possible.


Everyone knows about seed + passphrase. But I rarely see people talk about using MULTIPLE hidden layers on the same device.

What I did on my Coldcard / Trezor / Ledger

Check this out!

In Wallet 1 - PIN 1234 Decoy with $50 in it. If someone puts a wrench to my head, I give this PIN. It looks real.

In Wallet 2 - PIN 5678 My real savings. Different seed entirely? No, same device, different passphrase that no one knows exists.

In Wallet 3 - PIN + SD Card My inheritance wallet. Needs both the PIN + the microSD card to even unlock. SD is hidden elsewhere.

So one physical device holds 3 completely different realities. An attacker would stop after finding Wallet 1 with $50 dollars in it.

- Do you use a decoy wallet?
 How much do you keep in it to make it believable?

- Has anyone tested if this works after firmware updates?

Does the hidden passphrase survive?
 I heard you can create a wallet that bricks itself after 3 wrong PINs and wipes the decoy only. Anyone done this?

I feel like 90% of hardware wallet users only use 1 PIN and lose the whole plausible deniability feature. Am I overcomplicating it?

[Coyster]

I feel like 90% of hardware wallet users only use 1 PIN and lose the whole plausible deniability feature. Am I overcomplicating it?

Using a passphrase to create a few hidden wallets for plausible deniability is not a bad idea, but talking about your exact setup on an internet forum is. I know nobody knows who you are here, but you sound like an excited guy who would discuss things like this where they shouldn't and then attract the attackers you wanted to avoid.

I heard you can create a wallet that bricks itself after 3 wrong PINs and wipes the decoy only. Anyone done this?

In most hardware wallets, 3 wrong attempts at entering the pin would factory reset the device and erase all data on it. At that point, you can only access your funds with your seed phrase.

[joniboini]

- Has anyone tested if this works after firmware updates?

That would depends on what HW you use and what kind of updates it receives. Most developers would probably give you a notice that updating to certain version requires a specific setup and might break some things, so you can always check them first before updating your device. But as always, there's always a risk when updating so at the end of the day keeping your seed phrase safe is the priority. CMIIW.

[nc50lc]

I feel like 90% of hardware wallet users only use 1 PIN and lose the whole plausible deniability feature. Am I overcomplicating it?

You're good.
It's perfectly normal, if the hardware wallet doesn't support duress PIN, most users rely on hidden wallet via Passphrase.

- Do you use a decoy wallet?
 How much do you keep in it to make it believable?

No one's in their right mind would answer this, even if Bitcointalk profiles can be anonymous, you'll never know if you're a target.
Take Coyster's recommendation to keep your setup private.

But I can tell that the sample $50 isn't realistic for someone who've purchased a hardware wallet, that's a hot wallet pocket money.
A mugger with at least average IQ will be able to tell that there's something more in it.
Plus, "hidden wallet" isn't entirely new so someone who knows Bitcoin/Crypto (since he knows about HW) might consider this as a possibility, specially with small amounts.

[BitMaxz]

But I can tell that the sample $50 isn't realistic for someone who've purchased a hardware wallet, that's a hot wallet pocket money.
A mugger with at least average IQ will be able to tell that there's something more in it.
Plus, "hidden wallet" isn't entirely new so someone who knows Bitcoin/Crypto (since he knows about HW) might consider this as a possibility, specially with small amounts.

Well, I will think something more about this wallet. Why did he hold only $50 with a $150+ hardware wallet?
I would think there's something else about this hardware wallet, and do another brute force attack to find the other pin since I know the Duress pin or dual pin.

However, even though he had 3 different pins in a single seed phrase, the pins only protect the device itself from physical and remote access. If the device is already being breached, like the tampered devices, having this many pins won't help.

And the most effective extra layer of protection for hardware wallets is to make a multisig wallet with 2 or 3 different brand hardware wallets, but the only downside is the transaction fee is higher than the standard one.

[stompix]

But I can tell that the sample $50 isn't realistic for someone who've purchased a hardware wallet, that's a hot wallet pocket money.
A mugger with at least average IQ will be able to tell that there's something more in it.
Plus, "hidden wallet" isn't entirely new so someone who knows Bitcoin/Crypto (since he knows about HW) might consider this as a possibility, specially with small amounts.

This is some Xkcd stuff 
Crypto bros always think they have outsmarted the thief, assailant, etc with some trick that would not fool an elementary school kid.
Like seriously, when you start feeling that wrench or hammer on your fingertips, do you think you will keep staying silent for what, two or three seconds? In a few hits you will remember the first day of school, the weather at that time, the people you met, what you had for lunch, and how many steps you took that day.

Also, why in the name of god would you carry your wallet with your life savings with you?

[Riginac111]

But I can tell that the sample $50 isn't realistic for someone who've purchased a hardware wallet, that's a hot wallet pocket money.
A mugger with at least average IQ will be able to tell that there's something more in it.
Plus, "hidden wallet" isn't entirely new so someone who knows Bitcoin/Crypto (since he knows about HW) might consider this as a possibility, specially with small amounts.

Well, I will think something more about this wallet. Why did he hold only $50 with a $150+ hardware wallet?

i want to know the reason everyone why is asking same question, why did he hold only $50 with a $150 hardware wallet? But you can buy a hardware wallet with $50 and above, depending on the brand you want and the screen type or the standard you want, going for higher price depends on what you want, we don't even know if op buy the cheapest one.

[TryNinja]

Well, I will think something more about this wallet. Why did he hold only $50 with a $150+ hardware wallet?

i want to know the reason everyone why is asking same question, why did he hold only $50 with a $150 hardware wallet? But you can buy a hardware wallet with $50 and above, depending on the brand you want and the screen type or the standard you want, going for higher price depends on what you want, we don't even know if op buy the cheapest one.
[/quote]
That's because if you're using $50 as a decoy, it probably won't work.

Xkcd was mentioned above...



But I understand that's not really the point. The number doesn't really matter, because someone that worries enough to have a decoy wallet will probably know best that he needs at least a few grands to make an attacker go home happily.

[dkbit98]

Do you think decoy pin will save your from wrench attacks or something else?
I know many cases of people being attacked, and one family in France recently got into hostage situation for hours until attackers got €40,000 in crypto.
I am not saying having multiple PIN codes is bad, but you need to be aware they won't protect you in situations like this.
https://www.bitbase.com/news/french-family-bound-for-hours-as-attackers-demand-e40000-in-crypto

[Lucius]

This is some Xkcd stuff 
Crypto bros always think they have outsmarted the thief, assailant, etc with some trick that would not fool an elementary school kid.
Like seriously, when you start feeling that wrench or hammer on your fingertips, do you think you will keep staying silent for what, two or three seconds?
~snip~

Maybe he is one of those who have a high tolerance for pain, although you have to be completely crazy or specially trained not to loose your tongue when the game starts "this pig goes to school, this one goes to the butcher..." and so on up to 20 times. All of that falls apart if they catch someone you care about, then they're not torturing you, they're torturing that person.

My philosophy is that I take care of them before they take care of me, and that means they regret ever thinking of visiting me.

[NeuroticFish]

An attacker would stop after finding Wallet 1 with $50 dollars in it.

Just a question to think on: are the transactions known and tied to you on the decoy wallet, on a hidden wallet, or ... both?
Plus: how much do people around you know on how many sats/coins you have?

I mean: just mix a little bot of research and bitcoin knowledge with what that Xkcd magnificently done drawing, do some thinking and decide for yourself if the setup is well done.

[stompix]

~

Maybe he is one of those who have a high tolerance for pain, although you have to be completely crazy or specially trained not to loose your tongue when the game starts "this pig goes to school, this one goes to the butcher..." and so on up to 20 times.

The only tolerance he has is seeing that he is typing BS and he is still able to hit post after all that nonsense written in front of him.
I've seen this a lot of times, people who make plans on how they will deal with robbers and how they will trick them are the first ones to completely crash and go jeelly feet when this actually happens.

Also, one funny thing I just realized, OP said: "What I did on my Coldcard", this is actually a good strategy!!! If the thief sees your wallet is a Coldcard he might leave you alone thinking you're so stupid you don't know you have already been robbed clean.

[philipma1957]

Basically this thread is a set of instructions to thieves advising  to continue torture

just in case there is more hidden.

The USA does have some states with break in hostage thefts being common.

So if they scout this website they now will not believe you even if you give it all

away.

So to the op thank you for making the world a bit less safe for all of us.

[Rikafip]

I've seen this a lot of times, people who make plans on how they will deal with robbers and how they will trick them are the first ones to completely crash and go jeelly feet when this actually happens.

As Tyson famously said, everyone has a plan until they get punched in the face.

Basically this thread is a set of instructions to thieves advising  to continue torture

You can look at it the other way: since this "decoy pin" thing isn't exactly unknown, maybe some people here will read this thread, realise that it's not as effective as they might think and focus on other ways to avoid becoming victims of $5 wrench attacks (like for example keeping their mouths shut when it comes to crypto).

[philipma1957]

I've seen this a lot of times, people who make plans on how they will deal with robbers and how they will trick them are the first ones to completely crash and go jeelly feet when this actually happens.

As Tyson famously said, everyone has a plan until they get punched in the face.

Basically this thread is a set of instructions to thieves advising  to continue torture

You can look at it the other way: since this "decoy pin" thing isn't exactly unknown, maybe some people here will read this thread, realise that it's not as effective as they might think and focus on other ways to avoid becoming victims of $5 wrench attacks (like for example keeping their mouths shut when it comes to crypto).

or they can say my shit is in a bank vault. So you need to hold my wife hostage while I go get the trezors.

Just pick up the trezor and you can be free of your wife when they get pissed off at what

you did.

edit just a joke.

[Rikafip]

or they can say my shit is in a bank vault. So you need to hold my wife hostage while I go get the trezors.

Just pick up the trezor and you can be free of your wife when they get pissed off at what

you did.

edit just a joke.

Haha not a bad plan. 

Reminds me somewhat of that masterpiece Fargo, in which a guy hires two criminals to kidnap his wife so he can collect the ransom money from her rich family.

[philipma1957]

or they can say my shit is in a bank vault. So you need to hold my wife hostage while I go get the trezors.

Just pick up the trezor and you can be free of your wife when they get pissed off at what

you did.

edit just a joke.

Haha not a bad plan. 

Reminds me somewhat of that masterpiece Fargo, in which a guy hires two criminals to kidnap his wife so he can collect the ransom money from her rich family.

Wood chipper and a foot if ircc

Great movie a must watch

[Lucius]

Basically this thread is a set of instructions to thieves advising  to continue torture

just in case there is more hidden.

The USA does have some states with break in hostage thefts being common.

So if they scout this website they now will not believe you even if you give it all

away.

So to the op thank you for making the world a bit less safe for all of us.

The OP didn't write anything that wasn't already known - and those who go into robbery with the aim of stealing someone's crypto-currencies have probably done their homework and learned what hidden accounts are. In fact, they do not have to visit any other website on the internet except for the official manufacturers of hardware wallets, where they can get information about setting a passphrase and PIN.

A passphrase creates a completely new wallet that is linked to your existing wallet backup. Think of the passphrase as an extra word or phrase you add to unlock a different wallet. It adds another layer on top of your wallet backup.