No Stupid Questions
No such thing. Ask away!
!nostupidquestions is a community dedicated to being helpful and answering each others' questions on various topics.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules (interactive)
Rule 1- All posts must be legitimate questions. All post titles must include a question.
All posts must be legitimate questions, and all post titles must include a question. Questions that are joke or trolling questions, memes, song lyrics as title, etc. are not allowed here. See Rule 6 for all exceptions.
Rule 2- Your question subject cannot be illegal or NSFW material.
Your question subject cannot be illegal or NSFW material. You will be warned first, banned second.
Rule 3- Do not seek mental, medical and professional help here.
Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.
Rule 4- No self promotion or upvote-farming of any kind.
That's it.
Rule 5- No baiting or sealioning or promoting an agenda.
Questions which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.
Rule 6- Regarding META posts and joke questions.
Provided it is about the community itself, you may post non-question posts using the [META] tag on your post title.
On fridays, you are allowed to post meme and troll questions, on the condition that it's in text format only, and conforms with our other rules. These posts MUST include the [NSQ Friday] tag in their title.
If you post a serious question on friday and are looking only for legitimate answers, then please include the [Serious] tag on your post. Irrelevant replies will then be removed by moderators.
Rule 7- You can't intentionally annoy, mock, or harass other members.
If you intentionally annoy, mock, harass, or discriminate against any individual member, you will be removed.
Likewise, if you are a member, sympathiser or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people, and you were provably vocal about your hate, then you will be banned on sight.
Rule 8- All comments should try to stay relevant to their parent content.
Rule 9- Reposts from other platforms are not allowed.
Let everyone have their own content.
Rule 10- Majority of bots aren't allowed to participate here.
Credits
Our breathtaking icon was bestowed upon us by @Cevilia!
The greatest banner of all time: by @TheOneWithTheHair!
view the rest of the comments
hmac(passphrase, "one") -> seed used to create the private key.
Its so god damn simple man. Passphrase is the key. Standardize the solution so that when Hmac(passphrase, 'one') emits the same private key on two separate devices, we know that their code is legitimate. Run tests on commercial solutions to make sure they emit the standard answer to a set of publicly known private-keys (as well as a few personal tests to ensure it works on your end) and bam, problem solved.
You're telling me that all the best cryptocoin wallet peeps can't come up with a college-textbook answer like that?
As other keys are needed, use hmac(passphrase, "two") and hmac(passphrase, "three"), etc. etc.
No. The answer is that no one is really trying to solve the info-sec issue with regards to cryptocoin. Its just a money game to them. There's elementary / college-level solutions that are in the front of any textbook (or maybe left as an exercise, that you'd find at the back of the book / answer key).
When the level of cryptography knowledge is this primitive, I know that the entire damn community ain't serious about it and I shouldn't waste my time with them.
thats how it works, im not sure what you are getting at?
Oh really, wallet hardware companies are publishing the hmac and algorithm used to go from passphrase to private key?
Care to post one?
there are opensource wallets, the standard is called BIP39
im not sure if any of the hardware providers are doing it though
im still not sure what you are getting at, if you are suggesting I somehow trust hardware cold wallet providers, I dont, does not mean Im not stuck using the tools.
I'm saying there's an obvious solution to anyone who has passed a cryptography 101 course here.
PKI private keys are randomly generated prime numbers and/or ellipitcal curve numbers (depending on algorithm). Either way, that random number generator needs a seed, and that seed can be based off of the passphrase. BIP39 isn't the whole solution, that's just a way to turn long-strings of alpha-numeric characters into binary data.
My overall point is that there's a blatantly obvious, simple solution to the hardware wallet problem. I brought it up because its not a hard crypto-problem to solve. The fact that there's no adequate solution in 15 years is a failure of the cryptocoin community. Not due to a failure of basic cryptography problems.
The cryptocoin community, despite using "cryptography" is a joke. They barely know how to use cryptography even at its most elementary levels. It takes 15 years to come up with crappy, untrusted hardware wallets and they still can't open a basic textbook to come up with a better solution that's already written down.
the issue with the hardware wallet is not a "simple math" problem but a "trust" issue. in reality you simply can't trust any hardware you didn't make yourself, in practical use we usually pick vendors we like and decide to trust them.
for example. many people considered ledger trustworthy until they introduced firmware that indicates a capability to exfiltrate the keys.
I think the problem you are speaking to was some older hardware keys (and maybe some strange off brands) that encode keys at the factory, to my knowledge no major product does anything like that and they take pains to show you are generating the key. the big back and forth there has been with hardware providers using methods that are potentially reversible or other types of vulnerabilities.
Yes pretty much all devices will allow you to import a key you have generated by whatever means you prefer, however once you put it on the device you are signing up for the other issues that come with hardware still.
I don't think you recognize how easy it is to generate trust with the methodology I laid out.
"The Standard-compliant" method is any algorithm that goes from hmac(passphrase) into seed -> generating the random numbers needed to build a wallet. (Prime numbers or whatever). As far as I can tell, this "standard method" doesn't exist, not yet anyway.
Issue has been the workflow for that, everyone wants something that works with thier phone and self-updates. Also have only seen a couple good air-gapped signers. No one likes the offline signer story except finance governance ppl so far.