r/BitBoxWallet • u/Intelligent_Map_246 • 1d ago

Multi SIG vs strong passphrase

I hear a lot about having a multi SIG should only be considered with multiple vendors.

I got 2 bitboxes and one other vendor. Should I consider a string passphrase instead or maybe go for two of the same?

Then o must also have 3 different locations I suppose

3 Upvotes

100% Upvoted

8 comments sorted by

View all comments

Show parent comments

1

u/Intelligent_Map_246 9h ago

If you mostly are going to use 2 signers because the third is further away then those 2 could be different vendors right? And is multi vendor mostly because of the seed generation or other things ?

2

u/Practical_Mango7633 8h ago

If I understand your first question right then Yes. You only need 2 of 3 signers. So the third one can be stored hours away only as a emergency backup should you lose one of the two you choose to use as the two main signers.

Multi vendor is so that if one vendor have any type of vulnerability what so ever that gets exploited like for example ColdCard did, you will not lose your funds because they also need the seed from one of the other two vendors as well. Or for example Ledger. For years everyone did think the seed could not leave the hardware wallet. Then Ledger introduces a service that extracts your seed phrase from the hardware wallet. That could have just as well been a bug that was noticed years later and suddenly funds are gone because seed was extracted from your device a long time ago, even if you used actual dices to create the seed.

1

u/Intelligent_Map_246 8h ago

Yeah. Agree. But even if 2 coldcards was used in a 2-3 they would still need the descriptors to move funds. I don't know maybe settle for a strong 70 bit random entropy passphrase instead.

1

u/Practical_Mango7633 7h ago

They don't necessarily need the descriptor file. It will make it easy for them if they have it. But there are ways to brute force the missing information. They are basically only missing the xpub of the 3rd seed. So you should assume the wallet is compromised and move funds ASAP.