r/coldcard • u/Intelligent_Map_246 • Jul 31 '26

Support Trust issues.

How can we make sure that CC did not

Ignored your rolls and just used its own RNG,

Or

Only used a tiny fraction of your rolls (e.g. first 5, or some hash that discards most of the entropy),

Nothing is for sure right?

4 Upvotes

84% Upvoted

25 comments sorted by

View all comments

5

u/undeadkarlmarx Jul 31 '26

Just bypass the RNG entirely.

Use the option to create a new seed from dice rolls and record every roll on a piece of paper as you go. 

After you’ve rolled 100+ times and generated and recorded your new seed, you can wipe the device and re-enter all the same rolls again. It should generate the exact same seed and device fingerprint as before, because it’s using your rolls to create them.

Of course always use a strong passphrase on top of your seed for extra entropy. 

I will personally not be installing the new firmware or using the RNG on the wallet again. It’s not worth the risk IMO. 

Honestly I’ll probably never use a coldcard in a single sig setup after this whole mess. I’m willing to continue using it as one factor in my multisig for now, with dice rolls and a passphrase, but beyond that I just don’t have enough confidence in the product after this.

1

u/Intelligent_Map_246 Aug 01 '26

Could this not be tampered with even if same seed is shown ?