Hold Your Own @arisebitcoin

Gold Coast, Queensland
Joined November 2022
A Bitcoin passphrase can be easy for an attacker to guess and a nightmare for its owner to recover. That is a terrible trade. I filmed my approach: physical dice, the @EFF wordlist, fixed formatting, @SeedSigner, @SparrowWallet, @MicroSeed_io and a proper recovery drill.
19
10
7
75
19,573
Your Bitcoin passphrase needs to be recoverable even when you're no longer around to explain it. Here's how six randomly generated words can be backed up on something as small as a @MicroSeed_io washer. And there's room for many more if you want a longer one🐍 Durable, discreet, easily duplicated and stored in geographically separate locations. The secret can be complicated to guess without being complicated to recover. Watch. 👇
1
1
39
A durable backup is only part of the solution. Clear instructions, appropriate separation from the recovery seed, and a properly tested recovery procedure are essential. I demonstrate the complete methodology, including @SeedSigner @SparrowWallet and @MicroSeed_io here: youtu.be/n1s8MK1lyEw
13
Multi-vendor multi-sig users today having combined each of these gems into a 3-of-5
"the password you are attempting to use was part of a data breach are you sure you want to continue using it?" drone strike my house man i don't care anymore
75
You mean the best crash since since. Falling house prices is a prodigious social net positive, because we humans enjoy living inside shelter and having it be affordable.
Current Aussie housing crash is the worst ever recorded since 1980 - national capital city prices are currently falling at a 16% annualised pace based on the last three months of Cotality data...
19
the multi-vendor multi-sig people have been real quiet of late
44
commodity general purpose hardware is looking more attractive by the day
INVESTIGATION UPDATE 2 In our last update, we said we would share how many people had personal information exposed once we could confirm it. We can now share those numbers. Across our old WooCommerce store and our current Shopify store, records containing approximately 5,600 mailing addresses and 5,200 phone numbers, along with names and email addresses, were held in systems the attackers were able to reach. We cannot say for certain whether the attackers accessed all of these records, so we are treating all of them as potentially exposed. These records are a subset of our total customers. Why the data was still there: In our last update, we explained that copies of orders remained in old database tables after past migrations. We have since found that the 60-day redaction also did not cover every type of order, and that some customer details were stored in other parts of the store, such as abandoned carts and contact forms, that redaction never reached. Addresses not in our records: More than 5,000 of the email addresses that received phishing emails do not appear in our WooCommerce or Shopify customer records. Some match our support and hiring inboxes. Together with reports of details that were never shared with us, this makes us confident the attackers also used data from outside Foundation. We are still tracing where these addresses came from. What we are doing: Out of an abundance of caution, we are rotating all keys and secrets across our systems, including those we have no evidence were accessed.We are keeping a single copy of the legacy WooCommerce data offline as evidence for the investigation. Once the investigation is complete, that data will be permanently deleted. We have found no evidence that this incident compromised Passport devices or the private keys they hold. Never enter your recovery phrase into a website or share it with anyone, including someone claiming to be Foundation. We will continue sharing confirmed findings and publish our full report when the investigation is complete.
31
4. from what I have seen first hand, they retained customer data prior to May this year despite what they publicly stated.
3 big sins: 1. For years, their marketing falsely claimed that all PII was being deleted when it actually wasn't 2. Starting May this year, they silently changed the ToS and began to knowingly store PII, but didn't announce these changes to the customer 3. And it all got hacked
2
182
Are we done with proprietary hardware wallets yet?
We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe. Exposed: names, contact details, shipping addresses, and order details (items and prices). Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords. We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers. Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us. NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself. A detailed report is coming soon. Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance. Again, we're truly sorry to everyone affected.
1
9
479
There's going to be some explaining to do here.
Replying to @FoundationHQ
In addition to self-hosting, we automatically purge customer data from our servers 60 days after your order ships. Data tied to any #bitcoin company is sensitive. We love our customers but always make sure you and your data are forgotten!
1
5
286
Not a good place to be in at all. Foundation cannot rule out that their entire customer database has been leaked.
Replying to @TurnerAnalytics
No I cannot. What we are trying to figure out is if our entire customer list was compromised or just the emails from our support inbox. Or some kind of partial compromise in between. We have evidence that folks on our mailing lists did not receive these emails.
2
106
This is looking very bad. I have already received confirmation of clients receiving completely authentic appearing emails purportedly from Foundation's CEO requesting they click a link. The email contains the customer name, home address, contact number and method of delivery of the device.
ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS. We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys. The malicious domain in the spam email has been taken down. Funds stored on Passport are safe and Passport hardware is not compromised. We are working nonstop to discover exactly what happened and will put out a report ASAP.
2
1
22
2,341
how many times must people receive direct evidence that demoncracy is a hoax to only go on believing their vote really counts
BRAZIL SUPREME COURT JUSTICE EXTENDS VOTING BY TWO HOURS Brazil’s version of mail in ballots
2
35
the good news keeps coming
Paralysed. That's how Ray White's chief economist describes Australia's housing market. Values down 7.6% since April across the big five capitals. Sydney down 9.8% (Cotality). SQM Research says a 20% fall in Sydney can't be ruled out. Fewer than half of homes are selling at auction. The worst is yet to come.
43
Another day…
ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS. We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys. The malicious domain in the spam email has been taken down. Funds stored on Passport are safe and Passport hardware is not compromised. We are working nonstop to discover exactly what happened and will put out a report ASAP.
47
Security comes from the randomness. Reliability comes from the rules. I've developed six simple rules for constructing Bitcoin passphrases using physical dice and the EFF wordlist. No clever substitutions. No special-character gymnastics. No guessing what you did 20 years ago. A secret that's extraordinarily difficult to guess, but straightforward to back up and reproduce accurately. Here's how I do it. 👇
1
1
1
5
588
The complete 12-minute instructional covers everything from generating the passphrase to verifying the wallet with SeedSigner and Sparrow, creating durable backups, and performing a proper recovery drill. Watch it here: youtu.be/n1s8MK1lyEw
51
Doing a Pi Zero and Pi Zero W comparison. Can you spot the difference? Don't trust, verify!
1
1
4
218
This is brilliant work and predates what I did, I had no idea it was out there until now. Please give it a read, and never stop learning.
Te dejo estos enlaces por si te sirven complementar. SeedSigner: activar su Passphrase xitter.cf/MatheyBTC/status/21049… 🎲Cómo crear tu passphrase BIP-39 con dados, explicado para que cualquiera lo entienda. xitter.cf/MatheyBTC/status/20853…
22
also a huge thanks to @hansmade3d for the pre-assembled SeedSigner Plus model shown, which is absolutely exemplary.
1
190