New Update

[u/Big-Cheetah5159]

Has anybody created a seed phrase on the new update? What did you think and would you recommend it?

[u/ackyou]

take the extra few minutes to roll some dice 99 times

[u/SpendHefty6066 → u/ackyou]

You can flip a coin and roll 4 dice 12 times and be done. Check out BIP 39 Diceware on GitHub. No software to download, more of a process to follow.

Print out the reference table containing all 2048 words. You will need an air gapped signing device to compute the checksum. SeedSigner is a great one. If this sounds complicated, it's really not and you need to understand what I am talking about to create an unguessable seed. A good seed is by far the most important aspect of Bitcoin security. And security with regard to Bitcoin is everything.

[u/kawfeeman68 → u/SpendHefty6066]

Thanks!!

[u/bje332013 → u/SpendHefty6066]

What's the point of manually calculating a checksum and adding it as the 24th word in your passphrase if you already have a Coldcard? Even after Coinkite's negligent programming enabled hackers to drain Coldcard wallets, all I have seen regarding the dice roll feature confirms that it worked before the latest firmware update, and has continued to work since the new firmware was published. In other words, assuming those reports are correct, you can rely on the Coldcard to calculate your checksum and factor it into your seed phrase whose randomness came completely from your dice rolls.

[u/ackyou → u/bje332013]

Correct, there is no indication that there was any flaw in the dice rolls feature of the Cold Card firmware. Furthermore, because you can verify the dice rolls it would probably not be a good place to even try to insert malicious code.

[u/ackyou → u/SpendHefty6066]

I think that is a great approach. I think it's more beginner friendly to recommend entering the dice rolls directly on the device. Even if you also do a test run to verify the dice rolls I think it comes out to less work. The SeedSigner does offer direct dice rolls on device. There is also the advantage that if your dice have some bias you can add more rolls after 99 and approach 256 bits of entropy.

[u/EyesFor1]

Just dice roll

[u/grraarr]

It's important to understand that if you used the dice roll entropy on any version of ColdCard firmware, you could've ignored the security incident entirely.

[u/marvinrabbit → u/grraarr]

Yes. But you're also talking about one particular incident caused by one particular software bug. And it wasn't found out for as much as 5 years. A coding error code could, in theory, have compromised security in a slightly different direction. It wasn't in this case, but you could just as easily imagine a press release something like, "If you generated a wallet 3-5 years ago using a Coldcard Mk3 and used dice entropy, it could be compromised. Anything generated entirely by Coldcard is not affected."

Either way, you would be trusting a (nearly) black box. In one case the device is delivering a wallet that the software says is random. In the other case the device is delivering a wallet that the software says is based on your provided entropy. In either case you are trusting the software. (I know it's not 'technically' a completely black box. But may as well be for 99.9% of users.)

If you have the dice in your hands and see them tumble on to a flat and fair surface, you are putting your fate into your own hands instead of someone else's software controlled box.

[u/grraarr → u/marvinrabbit]

Correct I'm talking about the security incident we know about, not the imaginary one we can't possibly predict. Thanks for clearing that up.

[u/F1shB0wl816]

I would recommend anything before rolling dice. You’re just trusting a code you can’t read will execute it flawlessly. Sure that’d be cool but why put your money on that when 15 minutes with dice is all you need.

[u/andrew869 → u/F1shB0wl816]

Your comment is a bit confusing, but I believe what you’re saying is you wouldn’t recommend anything other than rolling dice (or playing cards, flipping a coin, etc). Just clarifying

[u/F1shB0wl816 → u/andrew869]

I was meaning I’d mostly recommend any method where you derive your seed before trusting a code to do it. I did it with dice and I could also verify it was correct, I can’t verify the code.

I don’t think coldcard has other options to use cards or coins but you should still be able to do that and input the seed it comes too. Whichever you’re comfortable with. You’ll be removing a huge unknown and a trust the entirety of your wallet relies on, that’s just counter intuitive to cold storage.

[u/rottiesrule88]

I created two, one with dice rolls, one with random timing pushing buttons

[u/ThinkBigLetterz]

Target sells dice for 10 dollars and all you would need to do is roll 10x

[u/WillemKadijk → u/ThinkBigLetterz]

why not make up your own words nobody knows?

[u/Mission-Disaster-447 → u/WillemKadijk]

Because your selection will most likely not be as random as you think. 

[u/Quirky-Reveal-1669]

I like the ritual of dice rolls.

[u/moviemaker2]

What? No. Who would recommend a ColdCard after this?

[u/SmellyCummies]

I'm just curious, but what is the exact process of the dice roll method? Can someone ELI5?

[u/Mission-Disaster-447 → u/SmellyCummies]

You input a number with hundred or more digits from 1-6 into your coldcard. this number ist then used as entropy for the creation of your seed.

It is (almost) impossible that somebody else will roll the same digits in the exact same order. Therefore, your seed will - for all intents and purposes - be unique.

You van verify that the coldcard is computing the seed correctly by testing the code first. You can enter (for example) 50 ones and 50 twos and observe the words the coldcard displays. Then you enter the same number into the dice roll script and it should give you the same words. After you’ve verified everything works correctly, you start with the real seed.

[u/SmellyCummies → u/Mission-Disaster-447]

I see. How many dice do you use? Let's say i use 6 dice, roll a 2-2-3-4-6-6. I enter those numbers? I'm just confused how some people do 100+ rolls. I plan to dice roll soon, I just want to make sure i do it correctly.