Re:‘I forgot my PIN’: An epic tale of losing $30,000 in bitcoin
by rasz on Tuesday October 31, 2017 @01:36AM
(#15591300)
I cant be bothered to check the vendor of Arm M3 this dongle uses, but most cheap non hardened microcontrollers are trivial to bypass read protection
for example budget M0 STM32F0 ttps://www.aisec.fraunhofer.de/en/FirmwareProtection.html
Re:‘I forgot my PIN’: An epic tale of losing $30,000 in bitcoin
by solotronics on Monday October 30, 2017 @06:35PM
(#15589588)
Treat the hardware wallet as securely as the seed words. The advantage is being able to sign and spend from the addresses on the hardware wallet without exposing to an untrusted computer each time you spend.
Re:‘I forgot my PIN’: An epic tale of losing $30,000 in bitcoin
by Scoundreller on Monday October 30, 2017 @07:31PM
(#15589928)
You're assuming the hardware wallet to be a trusted computer...
Re:‘I forgot my PIN’: An epic tale of losing $30,000 in bitcoin
by solotronics on Monday October 30, 2017 @06:36PM
(#15589596)
serious question. is a handful of 16 sided dice a safe generation method?
Re:‘I forgot my PIN’: An epic tale of losing $30,000 in bitcoin
by Scoundreller on Monday October 30, 2017 @07:34PM
(#15589952)
Nothing is perfect, but I'd trust it after doing a small trial, and maybe my own conversion mapping (e.g. 1=16, 2=14, 3=15, etc.) just to satisfy some amount of paranoia.
> If you do what is called a “soft reset” on the device—accomplished by delicately shorting two pins on its printed circuit board—you can then install the exploit firmware without wiping the SRAM’s memory. This allows you to see your PIN and seed numbers.
There's the primary vulnerability.
I fear there are other vulnerabilities that could defeat the anti-PIN cracking delays...
Old-school pay-tv hackers (Chris Tarnovsky anyone?) would probably have a field-day with micro-probers and more invasive recovery techniques on these hardware wallets. At $100 and in small volumes (plus the cost of flashy UIs and marketing), who knows how secure the silicon is.
The more I think about it, the more I think PIN-enabled wallets are the wrong way to go for long-term storage. Print your recovery words, store them appropriately (not all with one person and/or in one place, etc.) and then crush the generation device. Hopefully its random numbers can't be predicted.