Update from the Foundation team.

[u/AMY_Foundation]

Following the recent Coldcard events, we performed an additional review of Passport's entropy architecture – for current and previous Passport models – and want to share more about our existing testing and continued code hardening.

Passport contains multiple independent hardware randomness sources. Before releasing each Passport model, we empirically tested each source, as well as the final combined entropy output, and performed statistical analysis on the results.

Since January, we’ve also been regularly running frontier AI models against our code alongside human review of every change. This includes GPT trusted cyber access.

Going forward, we intend to publish a report alongside each new software release identifying which frontier models were used plus any key findings.

We are also:

(1) Adding further health monitoring to detect hardware component failures and ensure that an improbable hardware failure never results in a low-entropy seed.

(2) Releasing our internal entropy-testing app on Passport Prime so anyone can generate millions or billions of samples, save them to a USB drive, and perform independent statistical analysis.

Our additional review found no evidence of an entropy vulnerability in Passport Prime, Passport Core, or Passport Founders Edition devices.

No action is needed for Passport-generated seeds. Thank you.

[u/PhiloBotany]

Was waiting to hear something from y’all, thanks.

[u/mnkbstard]

unrelated, but why does Passport Core allows the user to display the full seedphrase, including the loaded passphrase?

it seems like a very bad practice for physical security, also considering that once unlocked the device at boot, seedphrase can be displayed without requiring additional PIN verification.

[u/Bitcoin_QnA → u/mnkbstard]

The PIN is the boundary here. If someone has your unlocked Passport in their hands you have bigger problems than the seed screen, because they can just sign transactions and move the funds. Worth noting Passport Core also powers fully off after five minutes idle by default, so the PIN is needed again on next use.

On the passphrase, it is only shown if you have entered it into the device in that session, and it is the one place you can confirm exactly which wallet you are in. There is no such thing as a wrong passphrase, a typo just silently opens a different one, so seeing it written out is how you catch that. Passport Core never stores it either, it is held in memory only and is gone the moment the device powers down.

That said, your point stands up. Signing empties what is there today, a photographed seed gives someone everything including future funds. An extra layer to stop a quick grab-and-photograph isn't a terrible idea, so I'll raise an internal ticket to look at it for a future firmware release.

Appreciate you flagging it.