A Chain is only as Strong as its Weakest Link 👁️‍🗨️ The Trezor Hacks...

Something huge came out of left field in the last couple days related to bad code written into the software for cold storage and AI aided after the fact to guess people's security words ♨️ I'll get to that in a minute.

In order to keep my bitcoins safe over the years, I'm always thinking about the the following aspects related related to cold storage

• Generate randomized key pair. This is a process where you load an HTML file of the key generator (think paper wallet.)

• Keys are generated on a computer that is offline with no connection possible to the internet.

• The operating system is fresh, booted up specifically for this one process.

• Keys never get photographed.

• Keys are copied to an encrypted pen drive.

• Every private key is handwritten on a piece of paper and is locked in a safe.

Only then will I start storing money in those wallets. Hot wallets, the ones you have on your phone or on an exchange have lesser security because losses are limited to the small amounts you carry. All of that said, I have seen devices said to be more secure (than the above) when I attend many, many Bitcoin meet-ups and events. More recently, I have found stores that sell various brands and models of cold storage devices.

They do look bright and shiny. Plus I always love new tech, but every time I reach out to buy one, something inside me says, "wait!"

I think to myself, "I take the time to cut all connections from a computer, boot a fresh operating system, load a downloaded webpage, supervise my own randomization by moving the mouse and typing random keys on the keyboard in order to have keys that have never seen the light of day." The last thing I want to do is import that private key into a device that I did not build.

Side note, if I had imported one of my cold storage private keys and loaded it on a device, my funds would not be in the process of being drained right now.

What I'm trying to say is that a device, such as a Trezor, only adds a weak link into the process of creating a very secure key pair.

Lets talk about the hack.

Normally people who buy a device we'll have the device generate the security phrase., otherwise known as a seed.

It is very secure and I believe a device can generate the seed without being plugged in to a computer or connected to the internet.

My problem has always been (having to trust) the developers who were involved in building the device and the software that is installed on it.

For bitcoin to be secure, you need to use it in a trustless way, which is how it was designed.

That, my friends, is why I could never bring myself to purchase one of these devices.

The hack occurred at GitHub. Nobody broke into GitHub or hacked the site but developers generally collaborate and work on projects together and when they have an addition to a piece of software they do what is called a "commit."

Developers usually read code all the time looking for anyone who has written something into the project that would breach security, in this case the security of a Bitcoin wallet device.

I am sure people reviewed the code after this person committed his code, but nobody caught it because it was just one word that was different, which seemed harmless. The word "runs."

I'm not exactly sure how, but that word called another library and changed the number of words that would be used to generate a seed. That was the case on all affected devises.

Note: The bitcoin network is completely unaffected by the hack. Immune if you will.

As I said at the very top, the seed generation or key pair generation, and they are not the same, needs to be done in a very particular way which I also described above. Someone hacked the process. It would be like someone hacking my process by putting a camera above the desk I was sitting at and they saw me writing my keys down. They would get many of the numbers and letters when zooming in, and that would make it easier for them to guess my private key.

Yes, I routinely look around for cameras in the room when generating keys.

The reduction in seed security.

Normally, if someone wanted to guess another person's seed, it would be like trying to guess where one atom is somewhere within 2 billion galaxies. This picture is from an explanation of the hack by @bitcoin_sessions on youtube.

But this faulty commit that was added to the software on GitHub reduced the size of this galaxy that we're talking about to the size of a large virus.

There are still many millions of atoms inside in one full grown virus. But modern day computers and AI are able to combine many different words in different orders (guessing your Trezor generated seed) because there is a much smaller pool of words that composed this faulty seed.

I just wanted to make you aware of the hack which affected what I consider to be a very good product. Actually a couple of products.

Cold storage devices have been affected as well as some cold storage cards.

Please do your own research to find out more about this and make corrections to your crypto storage habits. While it's happening all over the world, coins are still being drained from affected devices, in real time, as I'm writing this.