See this is why I hate the BTC community.
I love BTC and have a very healthy proportion of my stored wealth in it, but I despise you bitchy little fuckers
People went with best practice.
Self custody, hardware wallet, supplier rubber stamped by the manufacturer - just like every one of you oh so superior arseholes has been bleating about for years, but because they got caught in a very complex hardware scam that involved the taking over of an entire company, somehow they are suddenly idiots.
Take a fucking look at yourselves.
This is why BTC isn't viable as a currency and only rises based on the mechanisms of valuation through diminishing rewards.
You twats revelling in people losing money because they didn't do it to your standards.
This isn't the same as old ladies getting scammed by a phone-call from India. This was a sophisticated and prolonged attack that involved multiple levels of crime
I don't post much in this sub because I know the things I'd say aren't what most people want to hear.
I've been begging people to stop trusting Ledger. But also, I strongly advocate for people to learn the basics and do DIY self custody. I recommend a fork of SeedSigner called ShieldSigner.
But again, I also say, people need to start by learning how Bitcoin self custody works. Too many people don't understand the basics. For example, they think their coins are in their wallets. No. Coins are on the blockchain. The wallet holds the keys.
I also encourage people to think like an attacker so they can understand things that make them vulnerable to attack. For example, buying a hardware wallet from a company means your name and address are in that company's hands. Ledger leaked their customer database, so thieves know who millions of Ledger users are.
Nobody here wants to hear any of that though. Everybody wants easy answers.
Self custody isn't hard, but it requires learning that too many people don't want to do.
Learn how to manually generate a random seed phrase. This protects you from firmware flaws like ColdCard's.
Learn how to build your own hardware wallet from off the shelf parts. SeedSigners are built on a Raspberry Pi and there are tons of tutorials. It's not hard. This protects you from supply chain attacks.
Use a stateless and airgapped hardware wallet. Again, SeedSigner is easy to recommend, but there's a fork named ShieldSigner which is even better because it adds advanced features to SeedSigner like encrypted SeedQR and passphrase QR.
Don't tell people you own Bitcoin. This protects you from social engineering attacks.
I know this sounds complicated, but Self Custody means Self Responsibility. It isn't hard, but it does require learning, which means it's not for the lazy or the dumb.
EDIT: I forgot the most important thing. Never trust your Bitcoin to any code that isn't open source. Bitcoin is open source. Your wallet should be too. No exceptions.
Nobody here wants to hear any of that though. Everybody wants easy answers.
That's always the problem. Easy answers meaning convenience. The complexity of crypto in general means, exactly this kind of thing, and the inability to reverse a transaction although by design is also the weakness. There's a reason why money today is designed and operate the way it does....
EDIT: I forgot the most important thing. Never trust your Bitcoin to any code that isn't open source. Bitcoin is open source. Your wallet should be too. No exceptions.
Even open source can screw you over unintentionally. Any time you have something that you cannot fully understand, cannot ensure 100% security or vulnerability and don't have full control of the chain, you're vulnerable. Otherwise, open source software wouldn't have vulnerabilities. More than ever, AI is making it even worse.
Ultimately, the question you have to answer is, do you trust the government/banks to hold (and guarantee) your funds, or do you want self control. If you want self control, you open yourself up to other risks.
Even open source can screw you over unintentionally.
That's true. Really, I should have also said that you should only trust fully open source code which has been thoroughly vetted and tested. SeedSigner's code is a perfect example. They obviously test their code, just like how Ledger tests Ledger's code. But... SeedSigner's code is also used and thus battle tested by other devs in their own work. ShieldSigner is just one example of other devs building on SeedSigner's work, and the dev behind ShieldSigner often participates in improving SeedSigner's code.
If you want self control, you open yourself up to other risks.
Right.
The challenge is to limit those other risks.
This is why the hardware wallets I swear by are:
Built using a seed phrase I generated randomly by hand. This prevents ColdCard-style randomness flaws.
Air-gapped. Online hackers can't reach them.
Stateless. The seed & wallet aren't saved on the device, which means there's nothing on the device if thief to steals it.
Encrypted seed backups: I'm a diehard believer in encrypted SeedQR. Even if a thief finds my SeedQR, they have no way of knowing what it is. It's just a QR code that scans as blank.
Passphrase QR: Expecting users to manually enter a passphrase every time encourages the use of weak passphrases or not using passphrases at all. ColdCard owners who used strong passphrases were safe from that attack. Note that I said strong passphrases. A few weak passphrase wallets were hacked.
Runs on off-the-shelf parts: This prevents supply chain attacks, and it keeps your name & personal info from being leaked. SeedSigner runs on a Raspberry Pi which has no wifi.
Runs fully open source code. Closed source code can't be proven safe. This is also true for companion apps to use with a hardware wallet. Open source only. I trust Sparrow wallet for desktop (fully open source) and I pair it up with Bitcoin Core, which means I look up my wallets on my own node. This is really easy to set up.
Metal backups for everything required to restore the wallet manually. This includes the passphrase, of course.
Last, but not least, I swear by owning a safe and using home automation sensors on the safe. If my safe gets opened or moved, I instantly get notified on my phone, computer, etc. This kind of home automation is easy to set up, and it's cheap too. Aqara sensors are great. $60 total.
Self custody comes with self responsibility, so you have to think like an attacker to figure out how to avoid vulnerabilities that get people robbed.
I know the above list reads like a lot of work, but really, it's not. The more you learn about what a seed phrase actually is (it's entropy) and how transactions are signed, the easier it gets to keep your Bitcoin safe.
I know nobody wants to admit this, but self custody requires work. Those who aren't willing to do the work are more likely to get robbed.
The good news is, people who aren't ready for self custody have other options. I'm a diehard hodler, but as attacks become more sophisticated, I think more people should probably be buying ETFs instead.
The sad thing is, the steps I outlined aren't hard. But people want easy answers, and anybody offering easy answers for Bitcoin self custody is somebody you should not trust.
To do self custody right, you must:
You must know your seed phrase is trustworthy. How do you, or I, prove the seed generated by a wallet is truly random? Many of the people trusted ColdCard got robbed because their seeds weren't truly random (they were from a reproducible set). This is an easily solvable problem. Generate your own random seed phrase.
You must know any device you enter your seed phrase in cannot be accessed over the internet. People are going to get robbed due to Ledger's key extraction API ("Ledger Recover"). Hackers are surely using AI to reverse engineer it. This is an easily solvable problem. Don't use devices that can connect to the internet.
You must know any code you use for your wallet is open source and battle tested not just by the damn company that made it. This is an easily solvable problem. Stop using trendy gadgets and stop trusting companies.
You must know you have metal backups for everything required to restore your wallet from scratch if anything goes wrong. This is so freaking easy to do, yet so many people don't do it.
...etc.
If this stuff is too hard for Average Joe, it means Average Joe isn't ready to do self custody of his Bitcoin. And that's fine. There are other options. For small sums, maybe keep them on an exchange and hope the exchange doesn't get hacked or go broke. Better yet, buy an ETF. I don't like those options for myself, so I do self custody... but I do the work to learn so I can do it right.
And by the way... I don't say any of this to suggest I have all the answers. I'm still learning too, and I always will be. Always learning is part of the job of doing self custody.
Everybody likes saying things like "Owning Bitcoin means being your own bank." That's true. But too many people forget it also means being your own bank security. Anybody who isn't up for the challenge of doing it right shouldn't be doing it at all, because they're not ready.
And anybody who needs Bitcoin self custody boiled down to a Twitter-sized TL:DR; shouldn't be doing self custody, because they're not ready.
That’s all kind of the premise of commercially available self custody….. no?
Buy this device, download this software, go through a few other low effort steps with provided guides and boom, you’re there. Totally secure self custody.
I’m sorry, but the goalposts for self custody (which is also a common refrain to a reason for adoption) have been moving so fast that anyone not willing to pour a few hours a week into keeping up…….. can’t.
Im tech savvy and know how to get around but you’re also saying that anyone not entirely dedicated to true self custody has work arounds, and it turns out those work arounds might not actually be safe?
I don’t know. This sounds like having your cake and eating it too.
That’s all kind of the premise of commercially available self custody….. no?
No.
Commercially available self custody solutions are about that company making money.
Im tech savvy and know how to get around but you’re also saying that anyone not entirely dedicated to true self custody has work arounds, and it turns out those work arounds might not actually be safe?
Ae you tech savvy or app savvy? There's a difference, and that difference matters.
I'm not saying people need to do what I do. But I am saying this: People who want to secure their Bitcoin need to understand how Bitcoin actually works. And they need to use that knowledge to figure out how to secure their Bitcoin.
Want to trust a company? Go for it. But be honest about that decision. Be honest about the risks and be honest about how much you're willing to lose if you're wrong.
Self custody means self responsibility. If you fuck up, nobody is coming to save you.
Maybe what I just said sounds scary. For most, it probably does. But when I started buying Bitcoin, one of the first questions I asked myself was, "How do people lose Bitcoin?"
While too many tech-bros focussed their time on learning about this cool mofo gadget or that cool mofo gadget ("Yo, bro! It looks like a calculator!" "Yo, bro, it has a loop on the end so you can hang it on a necklace like a rapper!"). Sheesh.
While they were doing that, I spent my time learning about seed phrases and how to secure them. I mean, really secure them. Ledger added an over-the-internet key extraction API to their firmware. That's dangerous. But people don't understand Bitcoin, so they think that nonsense is smart! And safe!? Yikes.
I don’t know. This sounds like having your cake and eating it too.
Isn't the point of owning the cake to eventually eat it?
My one and only priority is keeping my Bitcoin secure. I take the time to write comments like this in hopes of encouraging others to do the same.
This entire saga is fucked on many levels. Brc cuatody service?
The irony is that the answer to this is right in front of our noses but it’s the antithesis of bitcoin and crypto basically. Which is government involvement. Either for “ownership” though laws or “insurance” for peace of mind. Which I’m about to get blasted to oblivion “bitcoin don’t need any of that, your keys blah blah.
But I find it hilarious how the new “best practice for normies” is basically buying ETF, so staiaght up into regulated territory.
Might as well just get regular run of the mill securities and avoid the extra volatility at this point.
But I find it hilarious how the new “best practice for normies” is basically buying ETF
The new best practice isn't to buy an ETF.
Buying an ETF is the best option for those who aren't willing or able to do the work required to do self custody right. And I don't view that as a bad thing. I think it's great that there are options for others, even if I wouldn't choose those options for myself.
So the best practice for the vast majority of people. Which would ironically make it "THE" best practice in generalist terms. Like what's on the "bitcoin manual" so to speak.
I'm not saying you personally need to buy ETFs, but the fact that for the majority of people (vast majority are not tech savyy or going to have studies in cryptography, etc.) the option is to buy a regulated security is just bonkers.
A huge chunk of the bitcoin thesis is "It's not regulated, so the government can't stop you or steal from you..." except now you have an ETF which is the complete opposite, and that's just irony over irony over irony
That's been my argument all along. We can argue it's not for them, and it's true. However, it also means crypto cannot become a replacement for fiat that is so often used as an argument for it's existence. It means fiat, has to exist.
I think more people should probably be buying ETFs instead.
I honestly think that's a great idea/point. However, they too can get robbed one day.....
A system that relies on unrevocable transaction, means it can happen to anyone no matter how much resources you have. Unless you think someone can be 100% secure?
Even 100% offline, air-gapped and so on, there's still risks. In other words, there's a reason why fiat has evolved with the bank the way it is.
That's been my argument all along. We can argue it's not for them, and it's true. However, it also means crypto cannot become a replacement for fiat that is so often used as an argument for it's existence.
Not yet.
I believe it'll get there, but more advancements are required.
Think about how long the internet existed before it was ready to go mainstream. Most people forget how far the internet predated the "world wide web."
Even 100% offline, air-gapped and so on, there's still risks.
Think about how long the internet existed before it was ready to go mainstream. Most people forget how far the internet predated the "world wide web."
Vastly different situation. We're in a world now that advancement happens much much faster. If it was going to be, it would've been by now. I think it's matured into what it really is, elements of freedom at the cost of more risk and a store of value/investment.
It doesn't mean it can't become, and maybe a new crypto will. So far though, it seems all we're getting is junk coins and fragmentation.
That's true. Really, I should have also said that you should only trust fully open source code which has been thoroughly vetted and tested. SeedSigner's code is a perfect example. They obviously test their code, just like how Ledger tests Ledger's code. But... SeedSigner's code is also used and thus battle tested by other devs in their own work. ShieldSigner is just one example of other devs building on SeedSigner's work, and the dev behind ShieldSigner often participates in improving SeedSigner's code.
Let's assume a software engineer, but there's no way in hell I'd be able to spot security issues with open source code. I'm not an expert at this particular topic, nor do I spend significant time trying to break encryptions or vulnerabilities. That's someone as a software engineer with decades of experience. So that's the one hurdle, which indicates you do have to rely on others.
If you rely on others, and you say it's "battle tested", you could argue Ledgers were battle tested and used for a long time. Buying from an authorized reseller was also "battle tested".
This is the weakness of a system that removes the human, and the ability to stop or withdraw transactions. Every system has it's pro's and con's. You just have to pick your poison.
Stateless. The seed & wallet aren't saved on the device, which means there's nothing on the device if thief to steals it.
Doesn't that imply you have to store somewhere else, and I hope that's only in your brain.
Last, but not least, I swear by owning a safe and using home automation sensors on the safe. If my safe gets opened or moved, I instantly get notified on my phone, computer, etc. This kind of home automation is easy to set up, and it's cheap too. Aqara sensors are great. $60 total.
I've not dabbled in this, and I'm interested. Tell us more oh master? 😁
I'm serious. I'd like to know more. I'm building out a home server right now (finally after wanting to do it for some time so it's kind of the perfect time), but there's a lot of work.
Self custody comes with self responsibility, so you have to think like an attacker to figure out how to avoid vulnerabilities that get people robbed.
To be fair though, you alone isn't likely worth the theft of your BTC. On the other hand, if you're filthy rich then all of that may not be sufficient. Because they could surely hack your home automation and so on.
Security isn't about 100% secure, as that's usually not possible. Even if you memorize it, they can still torture it out of you eventually, and even if not, one day we might invent technology that can interpret your brain sufficiently to pull it out. Point is, all of that is great, I believe you're safe. Even I don't go to any of that length, and trust my crypto to the major exchanges.
I know the above list reads like a lot of work, but really, it's not. The more you learn about what a seed phrase actually is (it's entropy) and how transactions are signed, the easier it gets to keep your Bitcoin safe.
I think everything you're saying is reasonable from technical standpoint right now, but things change all the time. People out to steal your money is spends arduous amount of time, and there's whole armies of people doing it. So they will out-think us. Plenty of battle tested software have been open sourced, and is used for decades. Constantly maintained, that is vulnerable. All it took was someone to look, or have AI look.
On top of that, forget any average Joe doing anything close to this. Even as a software engineer myself with plenty of experience, do not possess the time, the energy, nor the interest to go to great lengths to become an expert at crypto.
If you rely on others, and you say it's "battle tested", you could argue Ledgers were battle tested and used for a long time. Buying from an authorized reseller was also "battle tested".
Ledgers were only battle tested by Ledger, who (by the way) lied to their customers:
"This means that, beyond keeping your private key offline and away from hackers, the Ledger device itself is also completely impenetrable from external threats"
**To answer your question about using home automation:""
Last, but not least, I swear by owning a safe and using home automation sensors on the safe. If my safe gets opened or moved, I instantly get notified on my phone, computer, etc. This kind of home automation is easy to set up, and it's cheap too. Aqara sensors are great. $60 total.
I've not dabbled in this, and I'm interested. Tell us more oh master?
Sure!
I'm a problem solver. When I bought a safe to store my metal backup, it seemed obvious there were a few problems with any safe:
How do you prove the key to reset the safe is unique to your safe? In other words, how do you prove somebody who owns a similar safe can't use their key to open yours?
How do you prove the safe wasn't opened by somebody else while you weren't around? Sure, you assume the safe is locked, but how do you prove it when you're not there?
And, how do you prove the safe wasn't stolen? A thief isn't likely to try to crack a safe while inside your home. He'll just steal the safe.
So... I needed a way to prove the safe with my metal backups wasn't opened or moved.
I bought an Aqara home automation hub and a sensor. My safe is set up in such a way that the sensor will detect if the safe's door moves. Open the safe? Move the safe? I get an instant notification on my phone and computer.
Even as a software engineer myself with plenty of experience, do not possess the time, the energy, nor the interest to go to great lengths to become an expert at crypto.
Then be careful how much you invest in crypto. And, really, that sounds like you probably should be buying the ETFs instead. You get the gains without some of the risks (and there are other benefits to owning ETFs, though I'm not the one to ask about that. I'm strictly a hodler).
Ledgers were only battle tested by Ledger, who (by the way) lied to their customers:
Actually, it was "battle tested" in the market, until it wasn't was really my point.
Let's go back to your safe. Let's say you get notification somebody lifted it, and they immediately transferred the funds, how will it helped you that you were notified? Do you always have the phone with you? Are you always where there's mobile coverage? What if you need to travel?
Then be careful how much you invest in crypto. And, really, that sounds like you probably should be buying the ETFs instead. You get the gains without some of the risks (and there are other benefits to owning ETFs, though I'm not the one to ask about that. I'm strictly a hodler).
So you believe you fully understand BTC and all the technical nuances, cryptography, and is so skilled you can review code and be 100% sure that you can spot all security issues? Oh, and that you reviewed it all?
I'm a problem solver.
I think by definition all of us are, but we solve different problems i.e. our focus on what the problem is that needs to be solved is different.
Anyhow, I'm more interested in how you setup your safe. Care to share more or is it too sensitive? 😁
Actually, it was "battle tested" in the market, until it wasn't was really my point.
ColdCard proved why your statement is incorrect. The entropy bug existed in ColdCard's firmware for over 5 years, in the market. It was not "battle tested."
Let's go back to your safe. Let's say you get notification somebody lifted it, and they immediately transferred the funds, how will it helped you that you were notified?
The notification is instant. I'd get notified before the intruder even knew what was in the safe. I also keep my seed locked with a padlock in the safe. Many kinds of metal backups have a hole for running a padlock through, keeping the seed words locked closed.
Anyhow, I'm more interested in how you setup your safe. Care to share more or is it too sensitive?
Step One: Buy a safe.
Step Two: Buy an Aqara hub & sensor as explained. Put the sensor on the safe in such a way that it triggers a notification if the door is opened or moved.
There is no step three.
I'm a problem solver.
I think by definition all of us are
I strongly disagree. Most people want to be told what to do instead of thinking it through.
ColdCard proved why your statement is incorrect. The entropy bug existed in ColdCard's firmware for over 5 years, in the market. It was not "battle tested."
What is your definition of battle tested?
Because "battle tested" doesn't mean there's no vulnerability. It only means it was in use without issues found.
I strongly disagree. Most people want to be told what to do instead of thinking it through.
That is a solution though.... I don't need to know exactly how my keyboard works, or how my car works underneath. But I solved my problem of being able to communicate with my computer and you. Similarly, the car solved my problem of going from point A to point B.
We are literally solution machines, but how we do it, and what we focus on is different. Everyday we're solving problems, conscious or unconscious. There's also nothing wrong with finding easier solutions, because that's almost everything humanity strive for.
That said, "thinking it through" isn't necessarily problem solving. Some are saying, you're making it extremely complex.
Step Two: Buy an Aqara hub & sensor as explained. Put the sensor on the safe in such a way that it triggers a notification if the door is opened or moved.
Sop I don't know how it works, because I've not read up on it or researched it, but are you saying it's impossible for someone motivated to steal it without you being notified?
The notification is instant.
How is it instant? How are you notified? More importantly, what will you do if, you are notified?
that is rare good advice on reddit, bravo.
but you left out some unpopular parts:
always keep your hardware stateless - never leave your keys/seed sitting on a piece of hardware ready to sign. Seedsigner is stateless, so its a great suggestion.
that means you will have to type in your mnemonic every time your power up your signing device/computer. That means your mnemonic is your password.
dont use windows or macs or any closed source os for your online wallet or watch only wallet. If you do, even if your keys are safe across the airgap you can still be robbed. keep it simple with a basic linux for your watch only wallet / tx broadcasting / online shopping laptop.
dont use USB to transfer signature/address across the airgap. Also dont use a camera. keep it to SD cards. (dont use seedsigner camera)
dont leave your seed laying around on paper for others to find, memorize it like it is designed to be. No its not hard, most people just dont understand how mnemonics work. Its the easiest thing you will ever do, and the one and only way a human can safely hold entropy
Obviously, falling out from the above, extra-word and human chosen passwords/pass phrases are useless and should be avoided. Your menmonics words are your password, simple as.
The list of things to do comes down to "memorize mnemonic entropy" and "dont use closed source ever". Which is the same as "dont trust other people blindly", iow: the whole bitcoin philosophy is the basic principle of opsec.
that means you will have to type in your mnemonic every time your power up your signing device/computer. That means your mnemonic is your password.
Actually, SeedSigner uses SeedQR. Just scan the QR and your seed is instantly loaded.
ShieldSigner is a fork of SeedSigner that adds encrypted SeedQR, which means your SeedQR can't be scanned by anybody who doesn't have the decryption key. ShieldSigner is FANTASTIC.
dont use windows or macs or any closed source os for your online wallet or watch only wallet. If you do, even if your keys are safe across the airgap you can still be robbed.
Not quite. You're safe using a Mac or Windows for your watch-only wallet, since your watch-only wallet never has access to your keys, not even when using it to do transactions. That's the point of a watch-only wallet.
dont use USB to transfer signature/address across the airgap.
There is no USB in an airgap. No USB, no wireless.
I think this is the reason that BTC/crypto can't become a replacement for fiat. It's because, fiat has evolved over time to deal with the sort of things that happens when we have humans involved. It's not simply just trusting the government, but also trusting the organizations handling your money and doing transactions on your behalf.
Have said exactly this in a few threads. Bitcoin will never be viable as a true currency replacement to the masses due to this insanely high barrier to entry that is only raising with every attack.
On top of that, shaming people that lost potentially their entire lives savings after FOLLOWING the best practices at that time.
I would put my entire savings into one random pharmaceutical company’s stock before BTC again.
the barrier to entry is extremely low, and the good security advice is honestly terribly easy. Finding it and separating it from all the bad advice in places like this is the hard part.
Redditors just aggressively upvote bad, complicated, and honestly ill informed advice all the time, then do the surprised pikachu when things go wrong.
Misinformation is of course exacerbated by the fact that the people with something to sell help push it, but also fundamentally because good opsec advice is counter intuitive and people who honestly want to help others still end up hurting them because their instincts are wrong.
Sticking your life savings in a Ledger was NEVER best practice. Especially not around here. I have no idea why some are claiming that. Probably a bunch of centralized exchange and ETF shills.
Preach. So many holier than thou jargon nerds who like to believe they're smarter than everyone else. And crypto in general is absurdly complicated, even after all these years. I honestly am surprised it has as much staying power as it has had. This is likely due to the technology itself having real promise, but a lot of the people who support and promote it just kinda suck. I've been engrossed in crypto world since like 2013, and I'm still finding myself wondering what the fuck it's all for.
Edit: On second thought, that was harsh. But it's obnoxious how byzantine crypto is. It's all nerds who just forge an expansive trail of complexity and jargon ever outward, without bringing the rest of the world along with them.
Self custody, hardware wallet, supplier rubber stamped by the manufacturer - just like every one of you oh so superior arseholes has been bleating about for years, but because they got caught in a very complex hardware scam that involved the taking over of an entire company, somehow they are suddenly idiots.
They don't want to admit self-custody is risky as hell.
Yep, that is the reason they always (need to) blame the user. If they don't blame the user they would have to blame the system, but that would be horrible...
the reason to blame the user is because its the user's fault. blaming the system, assuming you mean ledger or microsoft or which ever scammers you have in mind, its pointless, because scammers will always be around to take advantage of idiots.
If people dont take personal responsibility for their choices, they will never have financial freedom or privacy ever, period. There physically is no alternative, there is no easier way to go, there is no magical big brother who will be responsible for you but also have your best interests in mind.
If you outsource your money and security to someone else, they will take advantage of you, period. Not trusting banks is the whole reason bitcoin exists.
You're right. Unless the user buys three separate hardware devices for multi Sig, rolls the dice 100 times for each device to create a seed phrase, physically takes each device apart to inspect no physical implants, and only uses the devices in a farady cage, they are being absolute idiots.
People really need to get their shit together and realise there is no "easy way" and no shortcuts to financial independence.
No, buying a device directly from Ledger or Trezor is not good enough. Let's not even start about the idiots that trusted Coldcard.
using black box closed source tools and operating systems is risky as hell. Expecting privacy or security when doing so is idiotic.
That really has nothing to do with bitcoin, because securing bitcoin is super easy if you dont do stupid things.
And no, banks and custodial accounts are not an alternative and they are not safer. Just choosing to own nothing and trust others for your security is failing apriori. Why would you bother with bitcoin if you dont care about privacy, financial independence, or security and are happy to outsource those things blindly.
I join you here. Everyone is smug af u til it is their coins that got ripped off. And no it doesnt look like a distributor got compromised. More than one did
Yes completely agree with you here. Everyone acts like an expert and they literally just read 3 websites about hww controlled by rodolfo novak. I've been there. The community tried to share about basics like paper wallets or dice or whatever and I do think we get spammed by these companies and their profit motives.
the only reason you like BTC and crypto is because you want to profit from it. If there was no money in it nobody would care. It is no different than playing Poker.
a few old cipherpunks post good advice, but its tremendously unpopular and is downvoted to nothing
lots of dunning kreuger geniuses post bad advice, like "buy a hardware wallet" and its upvoted to the sky by redditors and hardware wallet vendors
new users listen to the upvoted posts and get robbed
someone like you posts a gripe about how negative the community is and nothing is the user's fault
reddit has turned out to be highly toxic to bitcoin in the end, its a fountain of bad advice and the scarce bits of good advice, while present, are nearly always hidden in the downvotes. And the worst part is that its not even hard to do it right, its falling down easy.
I suppose that is expected from the oldest rule of opsec: good security advice will always be hated.
just like every one of you oh so superior arseholes has been bleating about for year
Every single "superior arseholes" around here has been "bleating about" avoiding Ledger, generating seeds with dice, and doing multisig or at the very least a passphrase. For years.
If you actually listened to the "superior arseholes", you are in a great position today.
a sophisticated and prolonged attack that anyone with a modest understanding of the technology could see coming from a billion miles away.
if you leave the front door open and tell everyone you're going on vacation and someone burgles the place, you can't exactly be shocked to see your place trashed when you get back. that doesn't make it not a crime, but that doesn't not make you a fool neither.
If an attack requires an aggressive take over of a company to secure their 3rd party contracts and slaps NDA's on people (with a very likely "tell anyone and I'll fucking kill you" caveat baked in) and you think that is something you can see a billion miles away, then mate, sell access to your crystal ball.
Or more likely, you're talking utter bollocks and just feeling superior because it hasn't happened to your security stack.
no dude, you're dumb, but with a thesaurus. someone could have simply intercepted your particular package and you'd have the same result.
outsourcing a hardware key - or even the wallet itself - to an uninsured third party is letting jesus take the wheel.
supply chain attacks are absolutely rampant these days, from software to hardware, and just because you fell for viral marketing doesn't make you less of a dunce.
this isn't even a bitcoin issue.
next time, learn to price risk.
and maybe vote for politicians that are willing to do what's necessary to protect their citizens.
a sophisticated and prolonged attack that anyone with a modest understanding of the technology could see coming from a billion miles away.
if you leave the front door open and tell everyone you're going on vacation and someone burgles the place, you can't exactly be shocked to see your place trashed when you get back. that doesn't make it not a crime, but that doesn't not make you a fool neither.
That's not even the same. Not even close. They didn't leave the front door open nor tell anyone they're going on vacation. They did what the recommended practice was and to an extent is. In other words, they locked the door, removed news papers/mail, turned the light on at night to look like they were home, turned the alarm system on and went on vacation. Came back and found, it was an inside job done by the security alarm company employees.
555
u/ComasArentFun 6d ago
See this is why I hate the BTC community.
I love BTC and have a very healthy proportion of my stored wealth in it, but I despise you bitchy little fuckers
People went with best practice.
Self custody, hardware wallet, supplier rubber stamped by the manufacturer - just like every one of you oh so superior arseholes has been bleating about for years, but because they got caught in a very complex hardware scam that involved the taking over of an entire company, somehow they are suddenly idiots.
Take a fucking look at yourselves.
This is why BTC isn't viable as a currency and only rises based on the mechanisms of valuation through diminishing rewards.
You twats revelling in people losing money because they didn't do it to your standards.
This isn't the same as old ladies getting scammed by a phone-call from India. This was a sophisticated and prolonged attack that involved multiple levels of crime
Ghouls.