News for hackers. Stuff that matters.
Re:People don't want to run their own bank by fireflymetavrse on Friday February 04, 2022 @08:00AM (#30206254)
Many people underestimate how hard is to store securely and reliably a crypto wallet key on long period.
Re:People don't want to run their own bank by lrvick on Friday February 04, 2022 @09:23AM (#30207052)
I think it is a lot easier than reliably storing say, gold, and yet it is considered not unusual for people to keep some gold or other physical assets of value in personal home vaults. Unlike physical assets, you can make redundant copies of digital assets giving anyone not lazy a huge durability advantage.

For readily accessible warm wallets not storing kidnapping-worthy amounts, this airgapped pattern can work well for the modestly technical https://github.com/hashbang/airgap/blob/master/docs/HD-Crypt...

Anyone that wants to learn reliable self custody hit me up.

My job is teaching self custody to major fintech companies but anyone asking questions for personal use in public in places like #!:matrix.org I will help for free as I have time.

Re:People don't want to run their own bank by raesene9 on Friday February 04, 2022 @09:38AM (#30207258)
The difference between storing gold and crypto, is the range of people that can attack it.

With Gold someone has to physically come to the location I've stored it in, that necessarily limits my attacker set.

With crypto, if I use a hot wallet the whole world can attack me. And I know you can use a cold wallets and air-gapping, but now you need to get into managing those well. This is possible but inherently not easy for the average lay-person.

And yep you can duplicate them, and again I look at how many relatively savvy people have DR incidents where they don't test their backups and restores regulaly and get a nasty surprise when they try a restore and realise they got corruption.

All to say, it's possible sure, but I'm not sure for non-specialists I'd say it's a lot easier than gold.

Re:People don't want to run their own bank by lrvick on Friday February 04, 2022 @10:17AM (#30207800)
Any non technical person can learn to use a cold hardware wallet like a Trezor or Ledger these days. Anyone that can put a combination into a home vault can use one.

I am not aware of anyone who has tried a modern hardware wallet that still argues that crypto self custody is above the abilities of anyone technical enough to use traditional online banking.

Once they use a pen to write down the 24 word backup then they can simply write it down a second time, or a third. Store a copy in a safety deposit box or anywhere resistant to theft or fire. Easy.

Anyone that can store paper stock certificates can do this only with these the copies are valid.

Re:People don't want to run their own bank by raesene9 on Friday February 04, 2022 @01:03PM (#30210298)
So once I've got my 24 word backup, how is that any safer than storing gold? Anyone who could come steal my gold can come take my hardware wallet, could they not?

Also the problem with duplicate hard wallet backups is, if I'm understanding it correctly, a thief can take any one of them to access the crypto?

If so it's a tradeoff, redundancy against increased risk of loss...

Re:People don't want to run their own bank by lrvick on Monday February 07, 2022 @01:33PM (#30249002)
They can come take your hardware wallet but they can't use it without your passphase/pin and most have a built in self-destruct if you get the pin wrong too many times.

Now if someone has an electron microscope and can read the raw memory cells, that is another matter, but not your typical adversary trying to steal for a quick buck at a pawn shop.

It is also more durable because gold you can only store in a single location, whereas with a hardware wallet you could put you 24 word backup somewhere hard to access, maybe spread across one or more safety deposit boxes.

Then if your funds ever feel at risk, you can simply erase your hardware wallet and go on vacation with confidence knowing you can trivially restore it when you get back with a trip to the bank.

Re:People don't want to run their own bank by titoCA321 on Friday February 04, 2022 @11:16AM (#30208737)
People don't want to store gold and valuable at home without insurance. There are businesses that will store your gold for you. And yes home robberies do occur along with disasters from flood, quakes, and weather.
Re:People don't want to run their own bank by raesene9 on Friday February 04, 2022 @01:05PM (#30210320)
I wasn't suggesting people did want to store gold, I was suggesting that storing crypto isn't necessarily easier or safer than doing so :)

That said, as the post I was responding to mentioned there are definitely people who absolutely do store gold.

Home robberies and floods do also occur... and those things can take out offline hard-wallets just like they can take out gold.

Re:People don't want to run their own bank by grumple on Friday February 04, 2022 @09:51AM (#30207437)
Just in that list of commands, there are a dozen different pieces of software that a user has to trust not to steal their keys or make some sort of error. I have more faith in the legal system than software I haven't personally audited. So now I have to audit whatever btchip_setup is, ndeftool, and a bunch of other software if I really want technical security. Oh, and if I really want to do it right, I've got to audit the chip designs and inspect the chips to make sure they are to spec and don't have secret cred-stealing hardware.

Then you have to trust the hardware storing the data not to fail. But every physical storage medium will fail eventually, so now you need a system by which you create backups and test your backups. And now you have to secure your backups separate in case of fire or technical theft too. It starts to become a part time job very quickly...

Re:People don't want to run their own bank by lrvick on Friday February 04, 2022 @10:29AM (#30208001)
The end result is storing 24 english words. You can store them on paper, on a CD, an NFC tag, a stone tablet. Storing words long term is a well understood problem.

Do not trust any or this software to generate those words truly randomly? No problem. Use bip39 diceware to literally generate your words with dice.

When it comes to not trusting software to convert those words to a keypair deterministically, use NASA dual path tactics.

Use two unrelated software suites to convert those words to keypairs and sign a transaction and ensure the final signed payload output from both unrelated toolchains is identical. Bip39 has been implemented in many programming languages.

Now you can form strong confidence in your entire supply chain from key generation entropy to a final transaction with perhaps a couple hours of effort. If you are moving millions in value and worried about supply chain attacks the extra effort may be worth it.

For most a Trezor or a Ledger used as the instructions that come with it advise will be in fine shape.

Re:People don't want to run their own bank by grumple on Friday February 04, 2022 @10:43AM (#30208233)
How many people on earth would even understand what you just said? It's limited to a (probably small) subset of software experts. For the vast majority of people it's basically "trust the shady nerds and the VCs backing them".
Re:People don't want to run their own bank by lrvick on Friday February 04, 2022 @10:50AM (#30208338)
I have taught dozens of companies and hundreds of people these tactics.

That said only people that need to understand tactics this strict are those storing VC levels of value.

For an individual just buy a Trezor or a Ledger and follow the point and click instructions. It is no harder than traditional online banking.

Re:People don't want to run their own bank by bell-cot on Friday February 04, 2022 @08:13AM (#30206370)
This +10 (if I could).

And that ("Many people underestimate...") is before you factor in all the extremely talented people who are looking for ways to remotely steal crypto wallet data.

Re:People don't want to run their own bank by im3w1l on Friday February 04, 2022 @08:36AM (#30206582)
Having a small amount of money on-chain can work as a hedge in many scenarios. Risk of losing, sure it is high, but the failure mode is very different from anything else you own, so the overall risk is lowered.
Re:People don't want to run their own bank by lottin on Friday February 04, 2022 @09:55AM (#30207481)
So when society collapses you'll be fine because you'll have a small amount of money... that only exists on the internet.
Re:People don't want to run their own bank by im3w1l on Friday February 04, 2022 @10:49AM (#30208319)
There are other possibilities than full collapse of society. A simple one is that your possesions are siezed.