r/Bitcoin: why open source did not catch the low-entropy seed generation
reddit-open-source-missed-flaw
https://www.reddit.com/r/Bitcoin/comments/1ve5jyc/since_coldcard_is_opensource_why_wasnt_low/
Latest reviewed change
source content difference between and
New comment by Quantris linking a personal gist that converts seed generation to dice rolls, noting their earlier advice to mix in external entropy against hardware RNG weaknesses now looks prescient.
edited: false
body:
Okay, so is Trezor fully open source by every standard of what is meant by that?
+
+comment: p256lp8
+parent: t1_p1etzos
+author: Quantris
+created_utc: 1786051775
First lines only. The complete diff is in the timeline below.
- Organisation
- Evidence role
- Community discussion
- Published
- not established
- Source changes
- 2
- Detected differences
- 2
- Unreviewed
- 0
- Copies held
- 3
Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .
This post is held twice: here, with this project's own note on why it matters, and again as part of the conversation captured at , which is polled for changes. Both copies are the same post; neither is a separate event.
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain the addresses of people who published nothing themselves. Capture times and reviewed change summaries remain available below.
Held captures
-
New comment by Quantris linking a personal gist that converts seed generation to dice rolls, noting their earlier advice to mix in external entropy against hardware RNG weaknesses now looks prescient.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 12 lines
edited: false body: Okay, so is Trezor fully open source by every standard of what is meant by that? + +comment: p256lp8 +parent: t1_p1etzos +author: Quantris +created_utc: 1786051775 +edited: false +body: +I did exactly this, and even wrote a script to convert to dice rolls: [https://gist.github.com/Quantris/9143112266dacdd86f1221095e792928](https://gist.github.com/Quantris/9143112266dacdd86f1221095e792928) + +caveat emptor of course (if someone else posted that, I'd be pretty leery of using it before closely examining it...so my advice is don't use it unless you understand it) + +edit: also just now rereading what I wrote back then "I do suggest it's worth using it as an additional source of entropy to guard against any potential weaknesses lurking in a hardware RNG (or the software that drives it)"...maybe I should get tested for psychic powersExtracted text as captured
post: 1ve5jyc author: kevinar990 created_utc: 1785738893 title: Since Coldcard is opensource, why wasnt low radndomness od seed generation not found earlier? body: As a non technical person, honest question. Since Coldcard is open source, how is it possible noone looked at their seed generation algorithm? Was that not available to the public? Trying to understand, so i can make a better choice of cold wallet in the future Ty comment: p1edkin parent: t3_1ve5jyc author: cilicia3k3 created_utc: 1785739082 edited: false body: It was enough entropy to go under the radar comment: p1ee49w parent: t3_1ve5jyc author: PublicBarracuda5311 created_utc: 1785739354 edited: false body: Coldcard was under MIT license if I remember correctly. comment: p1eey3c parent: t3_1ve5jyc author: Bred_Slippy created_utc: 1785739767 edited: false body: It was open for people to view the code, but not open source (others could not use their code for commercial purposes). This move away from true open source led them to change the code in a way that introduced the bug. After they moved away from it being true OS, there wasn't much incentive for people to scrutinise the code as it couldn't be used by others for their own products /services. This could well be a key reason why the bug wasn't found/exploited for over 5 years. comment: p1ef2bt parent: t3_1ve5jyc author: garlicChaserExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
A comment by IllllIIlIllIllllIlll recommending 48 dice rolls and 12 coin flips with BitBox diceware PDFs now shows as [deleted], a second comment by the same author dropped from the listing, and a new comment by aaj094 asks whether Trezor counts as fully open source.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 28 lines
comment: p1ezucw parent: t1_p1ekxtr -author: IllllIIlIllIllllIlll +author: [deleted] created_utc: 1785750319 -edited: false -body: -You don't need so many rolls 48 dice rolls and 12 coin flips are enough - -[https://bitbox.swiss/bitbox02/BitBox\_Diceware\_HowTo.pdf](https://bitbox.swiss/bitbox02/BitBox_Diceware_HowTo.pdf) - -[https://bitbox.swiss/bitbox02/BitBox\_Diceware\_LookupTable.pdf](https://bitbox.swiss/bitbox02/BitBox_Diceware_LookupTable.pdf) +edited: 1786028087 +body: +[deleted] comment: p1f5cdb parent: t1_p1ezucw We need to get at least random seed generation into our own hands ! -comment: p1f6cy2 -parent: t1_p1f5cdb -author: IllllIIlIllIllllIlll -created_utc: 1785753345 -edited: false -body: -It would be completely useless but you do you - comment: p1f6kdb parent: t1_p1eimhe author: oaga_strizzi edited: false body: I’d guess it was a Mythos/Fable or Astra model find, and we should expect a lot more in the coming months. + +comment: p237jdf +parent: t1_p1hyz3w +author: aaj094 +created_utc: 1786033707 +edited: false +body: +Okay, so is Trezor fully open source by every standard of what is meant by that?Extracted text as captured
post: 1ve5jyc author: kevinar990 created_utc: 1785738893 title: Since Coldcard is opensource, why wasnt low radndomness od seed generation not found earlier? body: As a non technical person, honest question. Since Coldcard is open source, how is it possible noone looked at their seed generation algorithm? Was that not available to the public? Trying to understand, so i can make a better choice of cold wallet in the future Ty comment: p1edkin parent: t3_1ve5jyc author: cilicia3k3 created_utc: 1785739082 edited: false body: It was enough entropy to go under the radar comment: p1ee49w parent: t3_1ve5jyc author: PublicBarracuda5311 created_utc: 1785739354 edited: false body: Coldcard was under MIT license if I remember correctly. comment: p1eey3c parent: t3_1ve5jyc author: Bred_Slippy created_utc: 1785739767 edited: false body: It was open for people to view the code, but not open source (others could not use their code for commercial purposes). This move away from true open source led them to change the code in a way that introduced the bug. After they moved away from it being true OS, there wasn't much incentive for people to scrutinise the code as it couldn't be used by others for their own products /services. This could well be a key reason why the bug wasn't found/exploited for over 5 years. comment: p1ef2bt parent: t3_1ve5jyc author: garlicChaserExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
post: 1ve5jyc author: kevinar990 created_utc: 1785738893 title: Since Coldcard is opensource, why wasnt low radndomness od seed generation not found earlier? body: As a non technical person, honest question. Since Coldcard is open source, how is it possible noone looked at their seed generation algorithm? Was that not available to the public? Trying to understand, so i can make a better choice of cold wallet in the future Ty comment: p1edkin parent: t3_1ve5jyc author: cilicia3k3 created_utc: 1785739082 edited: false body: It was enough entropy to go under the radar comment: p1ee49w parent: t3_1ve5jyc author: PublicBarracuda5311 created_utc: 1785739354 edited: false body: Coldcard was under MIT license if I remember correctly. comment: p1eey3c parent: t3_1ve5jyc author: Bred_Slippy created_utc: 1785739767 edited: false body: It was open for people to view the code, but not open source (others could not use their code for commercial purposes). This move away from true open source led them to change the code in a way that introduced the bug. After they moved away from it being true OS, there wasn't much incentive for people to scrutinise the code as it couldn't be used by others for their own products /services. This could well be a key reason why the bug wasn't found/exploited for over 5 years. comment: p1ef2bt parent: t3_1ve5jyc author: garlicChaserExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
0 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
Compare the screenshot or a quotation against the original while it is available.