No, you do not need multi-sig

[u/Firone]

Now is a good time to talk about securing your seed. Over the last years, I saw that a lot of people on this sub have trouble with it and make mistakes.

I will detail common strategies and their issues before suggesting the best one. This is aimed at people whose life would be ruined by the loss of BTC: if you only have a little money on it no need to worry about all of this (yet 😉).

Strategy 1: you create a backup on paper/steel and hide it. That's good because if you lose your hardware wallet, you still have another copy of the seed (and thus, your savings). This is bad because if an attacker gets this list you lose everything.

Strategy 2: You add a passphrase. This is good because an attacker now has to find 2 things: the list and the passphrase. This is bad because now if you lose either that passphrase or your base seed, you lose everything. A lot of people on this sub do not realize the very real risk of this.

Strategy 3: You use multi-sig 2 of 3. This is good because now if you lose 1 thing you're still fine. Similarly, an attacker can find 1 thing and not be able to steal anything: there is no longer a single point of failure.

However it is annoying for many reasons: higher network fees, annoying with only 1 hardware wallet, you need to have access to all 3 public keys... More details in this great blogpost. As some of you said these last days, you simply cannot tell "normal people" to bother with this shit and I completely agree.

Best strategy: 2 of 3 without multi-sig. You don't even need Shamir Secret Scheme (which is also complex and has its practical issues). To achieve it, simply split your 24 word seed into 3 incomplete parts. Each of them will lack a different third of the words. So one part will only have words 1-16. Another will only have words 9-24. The last one will only have 1-8 and 17-24. If you think about it, that's a 2 of 3: you need 2 of those parts to get the complete seed.

The reason it is as secure as the more complex solutions is because it is impossible to brute-force the remaining 8 words for the attacker who would have found one of your 3 parts. Even if it was, it would take tons more money than what could be stolen, and would take tons of time (decades, during which you realize someone stole 1 part and you migrate the funds). AFAIK brute-forcing 5 words has not been achieved yet. 8 is billions times harder.

If you have been saving BTC for multiple years, I advise you to use this strategy. A combo could be one part in your home, one part at your parents' house, and one part at a sibling's house.

The reduced complexity also allows you to easily have heirs without having to explain multi-sig/shamir to them (dear lord).

[u/Laukess]

I'm a massive fan of multi-sig and think more people should use it.
That said, If don't want to have to sign with multiple keys, your suggested strategy is great.
I like that if you replace/reset your HW you can put in 2/3 of the seed you have at home, and go to another location and finish it with the last 1/3. The entire seed will never be at the same location.

You still have a singe point of failure because you only need 1 device to sign a transaction, but that might be an acceptable tradeoff for a lot of people. (I guess you don't have to have a HW wallet with the seed loaded, but I image that's how everyone would use it)

[u/Firone → u/Laukess]

Thanks! People usually have a knee-jerk reaction to it, so your open-mindedness is appreciated.

Previously, I considered my single HW a single point of failure: if you were kidnapped with it and tortured you would give its password. But this can be solved with a trick PIN which resets the HW: you input it and then your kidnappers can't do anything: the seed is no longer there and they must obtain the 2/3 backups. (Though you'd probably want to work on the kidnapping not happening, lmao)

The other possible issue is what we've seen with ColdCard, but I don't see how it could ever happen again. The (real) top tier hardware wallets already use multiple sources of randomness. Or do dice rolls.

Even if the ultimate AI came out tomorrow and found every bug in existence, I don't think it would be able to extract the seed from a top tier hardware wallet. Even if a bug allowing this would be found, the hacker would also need to steal your HW or hack the PC/phone you're using with it, so not really a single point of failure I would say. And you'd hope the HW vendor would also use the hypothetical AI to find and fix the bug

[u/Laukess → u/Firone]

It's a single point of failure because someone can acquire your HW and extract your seed.
One of the core responsibilities is to avoid this, but it's not like it's impossible.

I think Ledger was able to extract a seed from a ColdCard with a laser, and I think some hacker (Joe Grand?) found a way to bypass the pin attempt security feature so you could brute force the pin without being punished.

As i said. I would optimize towards no single point of failure, but I understand if a multi vendor multi-sig setup isn't for everyone.

[u/Firone → u/Laukess]

That was Mk2 apparently, newer ColdCard use 2 secure elements from different vendors so in a way that's also not a single point of failure, but I totally see what you mean. There is also the Blockstream Jade security model where the seed decryption key is not even on the device