The very reason for using a hardware wallet is that your computer IS compromised, trusting it makes using the hardware wallet an expensive security theatre (or 2FA at best).
Always verify on the HWW device screen!
🧵Thread: 10 Rules for Verification on a #Bitcoin Hardware Wallet 👇
The very reason for using a hardware wallet is that your computer IS compromised, trusting it makes using the hardware wallet an expensive security theatre (or 2FA at best).
Always verify on the HWW device screen!
A compromised computer can be tricked into displaying addresses that belong to an attacker. The only way to make sure you own the addresses is to display them on the HWW device and verify they match.
It is pointless at best, and misleading at worst, to verify them beforehand like receive addresses...
Verifying before that is pointless and error-prone.
Now let's talk some multisig...
This is not 100% mandatory - but if you're no expert - you really should do it.*
This is especially true for at least one address (see next rule) but recommended for all. If using a device that you haven't verified the xpub of on-screen, you should verify all receive addresses on it!
This is needed only once with wallets like ColdCard, Cobo Vault, Bitbox02, and Specter DIY - since they allow saving the multisig xpubs on the device.
So while you might use a Trezor in a multisig, I would not recommend it to non-experts.
Ledger currently does not allow verifying multisig addresses on the device - nor displaying the XPUB on its screen.
It is still possible for a (very) sophisticated attacker to make you think it worked, while it was him signing for you...
This is very useful for multisig! - where devices might be distributed in various places.
Popular devices (besides Ledger as said), can verify that the address you send from and the change address used belong to the same multisig wallet (from same xpubs).
This is valid for both single sig and multisig! (although even more relevant for the latter).
Verifying balances requires getting information from the Bitcoin network - i.e. you need to be online - which would make hww more vulnerable...
This is where a full node comes in!
For redundancy, you could double-check against block explorers or another node (use a different device for either!).
If you want to separate your keys without having a security theatre, you should verify on your signing device!
Also check out some more info on multisig setups over at:
https://t.co/dwsl52QeD8 (@mflaxman guide)
More from Crypto
1/ Bitcoin: a bold new world.
Satoshi published the white paper on 10/31/2008. Right at the moment of peak despair during the 2008 financial crisis. Trust had been lost in a world that ran on trust.
2/ But why October 31st? It certainly wasn’t because Satoshi was a fan of halloween, it must have had a deeper meaning. With all of his actions, he demonstrated a careful precision.
He had been working on Bitcoin for at least a year and a half before publishing the white paper.
3/ “I believe I've worked through all those little details over the last year and a half while coding it, and there were a lot of them. The functional details are not covered in the paper, but the sourcecode is coming soon” - Satoshi Nakamoto
4/ On August 18, 2008 Satoshi registers registers https://t.co/rMWwiEwtxT through https://t.co/Uj8lMr10kB.
Satoshi was ready and waiting to hit the send button throughout 2008. What was so special about October 31st?
5/ I believe that Satoshi published the Bitcoin white paper on 10/31 as a hat tip to the ancient Gaelic festival of “Samhain” which was also the date in which Martin Luther nailed his 95 Theses to a church door. Both represent an end of the old and the beginning of the new.
Satoshi published the white paper on 10/31/2008. Right at the moment of peak despair during the 2008 financial crisis. Trust had been lost in a world that ran on trust.
2/ But why October 31st? It certainly wasn’t because Satoshi was a fan of halloween, it must have had a deeper meaning. With all of his actions, he demonstrated a careful precision.
He had been working on Bitcoin for at least a year and a half before publishing the white paper.
3/ “I believe I've worked through all those little details over the last year and a half while coding it, and there were a lot of them. The functional details are not covered in the paper, but the sourcecode is coming soon” - Satoshi Nakamoto
4/ On August 18, 2008 Satoshi registers registers https://t.co/rMWwiEwtxT through https://t.co/Uj8lMr10kB.
Satoshi was ready and waiting to hit the send button throughout 2008. What was so special about October 31st?
5/ I believe that Satoshi published the Bitcoin white paper on 10/31 as a hat tip to the ancient Gaelic festival of “Samhain” which was also the date in which Martin Luther nailed his 95 Theses to a church door. Both represent an end of the old and the beginning of the new.
We are actively working to launch on @binance Smart Chain #BSC .
To make this transition easy & understandable for everyone, we are answering most frequently asked questions here.
Ready? Go! 🔥
1/24
#DeFi #YieldFarming
Q1 - What are the benefits of holding the $VALUE token on the Ethereum Mainnet network? Give me reasons not to sell. Some are assuming that the VALUE token will be abandoned now that vBSWAP is being created. Can you clarify the use case for VALUE?
👉 $VALUE will always be a governance & profit receiving token of the whole ecosystem if staked in #vGov. With the new farming token on #BSC , gvVALUE holders will get extra rewards at BSC if they choose to bridge their gvVALUE to BSC & stake in gvVALUE-B/BUSD 98/2 pool.
Q2 - What do I need to do with my VALUE tokens that are staked in vGov? Is it OK to leave them in the vGov?
👉If you have VALUE but aren't staking in the vGov & you would like to participate in the BSC expansion, you will need to stake your VALUE in the vGov to receive gvVALUE.
If you are staking in vGov but don't see the correct gvVALUE amount in your wallet, go to vGov (https://t.co/udXn5IJtVx) to unlock your gvVALUE from the old contract. There will be a bridge from ETH to BSC to move gvVALUE and vUSD over.
To make this transition easy & understandable for everyone, we are answering most frequently asked questions here.
Ready? Go! 🔥
1/24
#DeFi #YieldFarming
Q1 - What are the benefits of holding the $VALUE token on the Ethereum Mainnet network? Give me reasons not to sell. Some are assuming that the VALUE token will be abandoned now that vBSWAP is being created. Can you clarify the use case for VALUE?
👉 $VALUE will always be a governance & profit receiving token of the whole ecosystem if staked in #vGov. With the new farming token on #BSC , gvVALUE holders will get extra rewards at BSC if they choose to bridge their gvVALUE to BSC & stake in gvVALUE-B/BUSD 98/2 pool.
Q2 - What do I need to do with my VALUE tokens that are staked in vGov? Is it OK to leave them in the vGov?
👉If you have VALUE but aren't staking in the vGov & you would like to participate in the BSC expansion, you will need to stake your VALUE in the vGov to receive gvVALUE.
If you are staking in vGov but don't see the correct gvVALUE amount in your wallet, go to vGov (https://t.co/udXn5IJtVx) to unlock your gvVALUE from the old contract. There will be a bridge from ETH to BSC to move gvVALUE and vUSD over.
1/ ERC-20 token standard approve() has caused an unnecessary cost of $53.8M for #Ethereum and #DeFi users
This is bad. Continue reading why and how to avoid this in the future.
👇👇👇
2/ Before you go all rage on the flaws of my analysis, please read the whole Twitter thread for disclaimers and caveats.
3/ approve() is an unnecessary step of ERC-20 tokens when they interact with smart contracts.
You know this because when you do a Uniswap trade you need press two transaction buttons instead of one.
4/ Why there is approve() - you can read the history in this Twitter
5/ I queried all approve() transactions on Google BigQuery public dataset and calculated their ETH cost and then converted this to the USD with the current ETH price.
This is bad. Continue reading why and how to avoid this in the future.
👇👇👇
2/ Before you go all rage on the flaws of my analysis, please read the whole Twitter thread for disclaimers and caveats.
3/ approve() is an unnecessary step of ERC-20 tokens when they interact with smart contracts.
You know this because when you do a Uniswap trade you need press two transaction buttons instead of one.
4/ Why there is approve() - you can read the history in this Twitter
1/ I just spend my Saturday morning on a call with a crypto fund explaining to them how #Ethereum ERC-20 token approve() function works
— \U0001f42e Mikko Ohtamaa (@moo9000) August 29, 2020
I am too old for this shit. pic.twitter.com/7EYfOaRP5L
5/ I queried all approve() transactions on Google BigQuery public dataset and calculated their ETH cost and then converted this to the USD with the current ETH price.
You may be wondering why @bristoliver rather cryptically RT’d a chart that I posted last night. The answer is not just that he loves quadratic fits on log axes, but that this chart may –and I stress may– hint at a vaccine effect amongst the over 80s THREAD
WARNING: this is a long thread, and it’s a bit of a roller-coaster. We find some apparently strong patterns in the data, and then start to unpick them a bit. So if you start getting excited half way through you might find you’re less excited at the end. But we’ll see…
First we first have to go back a bit. @bristoliver posted a thread a few days ago explaining why, with a constant vaccination rate, a log plot of cases should show a quadratic form. In other words, it should fit an equation like: a + b.x + c.x^2
I meant to link in the model thread there - here it is
the quadratic coefficient – the ‘c’ in that equation – gives an estimate of the % of the population who are being newly protected by the vaccine each day. Please note ‘protected by the vaccine’, not ‘vaccinated’ – as we don't expect 100% protection after the first dose
ok, I lied. but strictly it's not a new graph, just a new trendline (now a quadratic on the log plot). looks um... quite a good fit. so I'd say that was interesting. pic.twitter.com/qkgyMf1ya8
— James Ward (@JamesWard73) January 27, 2021
WARNING: this is a long thread, and it’s a bit of a roller-coaster. We find some apparently strong patterns in the data, and then start to unpick them a bit. So if you start getting excited half way through you might find you’re less excited at the end. But we’ll see…
First we first have to go back a bit. @bristoliver posted a thread a few days ago explaining why, with a constant vaccination rate, a log plot of cases should show a quadratic form. In other words, it should fit an equation like: a + b.x + c.x^2
I meant to link in the model thread there - here it is
Been thinking about where we are, where we might be going, what effect vaccines might have and how to tell. This thread may not happen all at once, and will get a bit mathematical in a couple of places (sorry!), but I will put in pictures. It's yet another argument for log scales
— Oliver Johnson (@BristOliver) January 24, 2021
the quadratic coefficient – the ‘c’ in that equation – gives an estimate of the % of the population who are being newly protected by the vaccine each day. Please note ‘protected by the vaccine’, not ‘vaccinated’ – as we don't expect 100% protection after the first dose
You May Also Like
Trump is gonna let the Mueller investigation end all on it's own. It's obvious. All the hysteria of the past 2 weeks about his supposed impending firing of Mueller was a distraction. He was never going to fire Mueller and he's not going to
Mueller's officially end his investigation all on his own and he's gonna say he found no evidence of Trump campaign/Russian collusion during the 2016 election.
Democrats & DNC Media are going to LITERALLY have nothing coherent to say in response to that.
Mueller's team was 100% partisan.
That's why it's brilliant. NOBODY will be able to claim this team of partisan Democrats didn't go the EXTRA 20 MILES looking for ANY evidence they could find of Trump campaign/Russian collusion during the 2016 election
They looked high.
They looked low.
They looked underneath every rock, behind every tree, into every bush.
And they found...NOTHING.
Those saying Mueller will file obstruction charges against Trump: laughable.
What documents did Trump tell the Mueller team it couldn't have? What witnesses were withheld and never interviewed?
THERE WEREN'T ANY.
Mueller got full 100% cooperation as the record will show.
BREAKING: President Donald Trump has submitted his answers to questions from special counsel Robert Mueller
— Ryan Saavedra (@RealSaavedra) November 20, 2018
Mueller's officially end his investigation all on his own and he's gonna say he found no evidence of Trump campaign/Russian collusion during the 2016 election.
Democrats & DNC Media are going to LITERALLY have nothing coherent to say in response to that.
Mueller's team was 100% partisan.
That's why it's brilliant. NOBODY will be able to claim this team of partisan Democrats didn't go the EXTRA 20 MILES looking for ANY evidence they could find of Trump campaign/Russian collusion during the 2016 election
They looked high.
They looked low.
They looked underneath every rock, behind every tree, into every bush.
And they found...NOTHING.
Those saying Mueller will file obstruction charges against Trump: laughable.
What documents did Trump tell the Mueller team it couldn't have? What witnesses were withheld and never interviewed?
THERE WEREN'T ANY.
Mueller got full 100% cooperation as the record will show.
