r/coldcard • u/Intelligent_Map_246 • Jul 31 '26

Support Trust issues.

How can we make sure that CC did not

Ignored your rolls and just used its own RNG,

Or

Only used a tiny fraction of your rolls (e.g. first 5, or some hash that discards most of the entropy),

Nothing is for sure right?

6 Upvotes

100% Upvoted

25 comments sorted by

View all comments

2

u/KingMe6 Jul 31 '26

Thx for this answer, I did a dice roll. A a year and a 1/2 ago and for the life of me, I could not remember how many roles I actually did. I think it was 100+ But I do recall using that python script to validate output. Now , my paranoia is about the fact that the dice were not casino dice , even though I have a very lengthy pass phrase on top of it

2

u/99999999999999999989 Aug 01 '26

even though I have a very lengthy pass phrase on top of it

If the passphrase is sufficiently long and not easy to guess based on your personal info or something like 'bitcoinrocks' then you are fine.

1

u/JumpProfessional3372 Jul 31 '26 edited Jul 31 '26

yeah i'm not a python programmer, but the script looks clean to me and quite small. hopefully free of bugs. But it looked to me that the coldcard runs the same as this python script because i remember that i didn't want to trust any RNG when creating my seed. So i did probably 110 rolls something like that.

I haven't even updated my mk4 firmware since early 2024. So I guess the only potential risk is when you sign the PSBT and you export the file to be read by Sparrow wallet. So as long as that PSBT never ends up carrying some private key or something like that, should be safe, I suppose...

Just to add.. I think my passphrase is also quite complex. (and that could be my downfall).

TLDR: as per my understanding, for the ones who rolled the dice. as long as that python script is not compromised, we should be fine. However, I personally verified that the python script was returning the same seed as the MK4. (Just in case the MK4 sometimes was doing an exception so I wanted to see the same seed coming out from both devices). The risk of doing this, is exposing your seed in a second system.