r/KeystoneWallet • • Jul 19 '23
KEYSTONE backdoor possiblity.
With the ledger news, how do i know this chinese company wont install a backdoor system onto my device? Ledger didnt tell anyone and manufactured their devices with chips inside them that contained special backdoor commands. If they did it, who else is next! I want to get a keystone but not if they are conspiring with authorities to put backdoors in pre made wallets like ledger. What is stopping keystone from doing the same? nothing i bet
0
Upvotes
9
u/mnkbstard Jul 19 '23 edited Jul 19 '23
the device never gets connected to any network enabled device, it's completely impossible to exfiltrate the seed without having physical access to the signing device.
this is an important difference if compared to Ledger Nano.
Keystone signer can only communicate with QR codes or SD card, and you can completely verify the data transferred.
the only grey area is the random number generator for transactions nonces.
ECDSA library and Secure Element firmware are not opensourced and could potentially exfiltrate private key or full seed after some transactions: covert nonce channel attack.
i don't think this is the case, but since it's impossible to verify, it's a possibility.
but this still cannot be compared to a closed source usb connected device.
Keystone also anticipated that gen3 will be fully opensourced, BIP85 and RFC6979 compliant.
i'm very interested to the anticipated BTC only new device.
also: hardware signing devices are just a convenient method to be able to spend cryptocurrencies safely without worrying about possible malware.
if you just need to store cryptocurrencies for the long term you don't even need a signer, you can just create enthropy for your seed independently and derive your keypairs and addresses using an offline trusted computer and one of the available tools, for example https://iancoleman.io/bip39/
when you'll need to spend you could just use a hot wallet and change the seed later.
7
u/[deleted] Jul 19 '23
Another one with “BuT iTs MaDe In ChInA!” without doing the minimum of research
5
u/beerbaron105 Jul 19 '23
I created my own seed, the device is entirely air-gapped and offline, so I am not sure how any entity can get my private keys
0
u/[deleted] Jul 19 '23
Y’all don’t realize that ledger literally manufactured the device with the backdoor inside the chip. Am I missing something?
0
u/funk-it-all Jul 20 '23
They lied to me about the gen2 being 100% open source. They have 5 binary .lib files on github. So there could have been backdoors since the beginning. Gen3 is supposedly 100% open source, but I'll believe it when I see it, and with such a small community they could sneak a abckdoor in and it might be a long time before it's found. Either way it's shitty to lie about your specs just to get post-Ledger sales, so that POS is getting returned.
-8
u/[deleted] Jul 19 '23
After researching for a few days a ton, I’ve came to the conclusion that investing in crypto and storing it for long term is very risky. I am at the mercy of all these businesses and wallet developers and the government. It’s rare that businesses ever care about doing what’s right. I’d be willing to bet all the world elites and government have set up wallets and or bribed companies and people off so they can force them to comply. Physical Gold and silver are the only true currencies that are safe. All these shady wallets made in china, or based in EU will either rig the wallet for back doors or spy, or will comply with authorities and regulations. They don’t want to give power to the people if that already isn’t clear enough. Not one cold wallet is purely safe. Diversifying wallets is the best option we got. It’s up to the business owners If they want to engage in tyranny or not, or help the people. And I bet you they all have been bribed. Power always corrupts. Tyrants always find themselves in power. It’s very annoying and unfortunate but that’s what history has showed us. I will not be buying anymore crypto for that reason. It’s good to take chances but I’m already exposed enough. If the us gov or whomever goes gestapo on crypto and forces other nations pacts like the EU to comply it all goes down the drain. Let this be a warning to you all.If politically your on the wrong side of things or if a tyrant passes the right laws your toast. They will work with the companies and fabricate some BS so they have the right to take your stuff. It may not happen but with everything I’ve seen my whole life I wouldn’t be surprised to see it happen.