The very reason for using a hardware wallet is that your computer IS compromised, trusting it makes using the hardware wallet an expensive security theatre (or 2FA at best).
Always verify on the HWW device screen!
ЁЯз╡Thread: 10 Rules for Verification on a #Bitcoin Hardware Wallet ЁЯСЗ
The very reason for using a hardware wallet is that your computer IS compromised, trusting it makes using the hardware wallet an expensive security theatre (or 2FA at best).
Always verify on the HWW device screen!
A compromised computer can be tricked into displaying addresses that belong to an attacker. The only way to make sure you own the addresses is to display them on the HWW device and verify they match.
It is pointless at best, and misleading at worst, to verify them beforehand like receive addresses...
Verifying before that is pointless and error-prone.
Now let's talk some multisig...
This is not 100% mandatory - but if you're no expert - you really should do it.*
This is especially true for at least one address (see next rule) but recommended for all. If using a device that you haven't verified the xpub of on-screen, you should verify all receive addresses on it!
This is needed only once with wallets like ColdCard, Cobo Vault, Bitbox02, and Specter DIY - since they allow saving the multisig xpubs on the device.
So while you might use a Trezor in a multisig, I would not recommend it to non-experts.
Ledger currently does not allow verifying multisig addresses on the device - nor displaying the XPUB on its screen.
It is still possible for a (very) sophisticated attacker to make you think it worked, while it was him signing for you...
This is very useful for multisig! - where devices might be distributed in various places.
Popular devices (besides Ledger as said), can verify that the address you send from and the change address used belong to the same multisig wallet (from same xpubs).
This is valid for both single sig and multisig! (although even more relevant for the latter).
Verifying balances requires getting information from the Bitcoin network - i.e. you need to be online - which would make hww more vulnerable...
This is where a full node comes in!
For redundancy, you could double-check against block explorers or another node (use a different device for either!).
If you want to separate your keys without having a security theatre, you should verify on your signing device!
Also check out some more info on multisig setups over at:
https://t.co/dwsl52QeD8 (@mflaxman guide)
More from Crypto
You are running out of time to get ahead in cryptocurrency.
You know what's coming:
ЁЯФ║я╕П Regulation
ЁЯФ║я╕П More shutdowns
ЁЯФ║я╕П Banks deciding who gets to do business
It's time you got your own crypto wallet.
Don't know how? I'll show you.
/////THREAD\\\\\
METAMASK
What's metamask? It's a wallet. That you -- I mean YOU -- own.
You see, when you buy crypto through an exchange like CoinBase, you own it but only kind of.
If they get
ЁЯФ║ Hacked
ЁЯФ║ Shutdown
ЁЯФ║ Servers crash
-- your money is STUCK.
We are gonna avoid that ЁЯСЗ
First thing,
Go to
https://t.co/JXAp9o5RzJ
You can download it on your computer. It's a browser extension.
Alternatively, go to the app store on your Android or iPhone. It's there too.
As part of the setup process, you will choose a password.
More importantly though...
SEED PHRASE
As you follow the setup process, you will be given a 12-word seed phrase.
WRITE. THIS. DOWN.
Take it down and guard it like the map to Davey Jones' Locker.
THESE ARE THE ONLY WAY TO RECOVER YOUR ACCOUNT.
DO NOT LOSE.
We good? Great.
Let's continue.
Once you're all setup, your MetaMask wallet is going to look something like the picture below.
See where it says Crypto Address? That's where your actual address will be.
It'll be a random arrangement of letters, numbers, etc.
Click on it to copy to your clipboard
NEXT STEP
You know what's coming:
ЁЯФ║я╕П Regulation
ЁЯФ║я╕П More shutdowns
ЁЯФ║я╕П Banks deciding who gets to do business
It's time you got your own crypto wallet.
Don't know how? I'll show you.
/////THREAD\\\\\
METAMASK
What's metamask? It's a wallet. That you -- I mean YOU -- own.
You see, when you buy crypto through an exchange like CoinBase, you own it but only kind of.
If they get
ЁЯФ║ Hacked
ЁЯФ║ Shutdown
ЁЯФ║ Servers crash
-- your money is STUCK.
We are gonna avoid that ЁЯСЗ
First thing,
Go to
https://t.co/JXAp9o5RzJ
You can download it on your computer. It's a browser extension.
Alternatively, go to the app store on your Android or iPhone. It's there too.
As part of the setup process, you will choose a password.
More importantly though...
SEED PHRASE
As you follow the setup process, you will be given a 12-word seed phrase.
WRITE. THIS. DOWN.
Take it down and guard it like the map to Davey Jones' Locker.
THESE ARE THE ONLY WAY TO RECOVER YOUR ACCOUNT.
DO NOT LOSE.
We good? Great.
Let's continue.
Once you're all setup, your MetaMask wallet is going to look something like the picture below.
See where it says Crypto Address? That's where your actual address will be.
It'll be a random arrangement of letters, numbers, etc.
Click on it to copy to your clipboard
NEXT STEP
Where should I start?
1) Is Blockfi profitable?
2) How much money does BlockFi have on its balance sheet?
3) Is the yield that BlockFi pays to its depositors earned or subsidized by billionaire investors?
4) Has BlockFi ever been profitable?
5) Are you planning to go public?
1) Is Blockfi profitable?
2) How much money does BlockFi have on its balance sheet?
3) Is the yield that BlockFi pays to its depositors earned or subsidized by billionaire investors?
4) Has BlockFi ever been profitable?
5) Are you planning to go public?
When is the interview published? @otisa502
— Jakob.Cel (@HedegaardJakob) February 14, 2021
