"Hardware wallet, open source or secure chips?"

Original title: "open source or secure chips again?"
Source: bitpieteam

For more "ideas" articles, click on the classifieds at the end of the article to enter.

The previous oneHardware wallets - open source or secure chips?

The article has generated a lot of discussion, although we have explained with very clear logic "why open source is a prerequisite for a hardware wallet?" And what is the purpose of a security chip? " "But there are still a lot of mixed voices repeating" four legs good, two legs bad ".

I have no choice but to say a few more words on this topic.

First of all, we have been emphasizing that "the purpose of open source is to prove innocence", some people run out to say that "open source is not necessarily more secure", "open source community is not necessarily able to find out your vulnerabilities"... The question is, do we emphasize the word "safe" in this sentence? Can the person who comes out and says this conclude that closed sources are safer, or that closed sources can find all the bugs?

Security is not safe, it is determined by the cold wallet solution, architecture, code and other aspects together, if there is a problem, then whether your solution is open source is not safe, so the security itself with open source has nothing to do, open source is not for more security.


We still have to reiterate that the purpose of open source is to prove itself. We want to be safe, but the purpose of open source is not to be safe. So, when we talk about this topic, please only discuss the word "self-innocence".


On this point of self-proof innocence, closed source is zero, no way, a priori logic decided that can only be zero, more than a point is not. However, some people ask, "how can you prove that firmware is the same as open-source code?" "" I don't understand code. How can I verify that your code isn't evil?

There have been numerous discussions in the bitcoin community about this kind of problem from the beginning when someone tried to make a hardware wallet to the time when Trezor made the first relatively complete hardware wallet solution. From the first generation of Trezor to today's bitshield and blade hardware wallet, it has always been open source and verifiable. That is, you can compile your own version of the firmware and compare it to the official firmware. You will find that the signature of the official firmware is different, but everything else is the same.

Of course, you can also run your own version of firmware by brushing your own packaged firmware onto the hardware wallet, which displays unofficial firmware due to the signature. In addition to firmware, if you're interested, you can even buy your own chips, do your own circuit boards, and make your own hardware wallet, which means you can even do everything yourself, completely independent of the hardware wallet project, which is what open source is all about.

For those who can't read the code, that's okay, because there are people in the world who can read the code, and they'll read it for you, not for you. When I say this, some people might say, "people who can read the code don't necessarily want to read it." There is a relationship in the world called a "rival." doesn't Ledger just stare at Trezor's code every day? If there's a code-level bug, Ledger has to shout at the world over a loudspeaker...

Well, at this point, you should be able to see why I said "open source is to prove clean", and the above mentioned content, closed source is not even qualified to talk about.

Now we're going to talk a little bit more about "self-sanitization." in response to our last post, there were some people who said, "if security chips can be partially open-source, wouldn't that be self-sanitization?"

My answer to this is simply, "what's all that crap for? . Why not open source yourself, and then preach all the time that everything other than security chips will be open source and clean themselves?


So, you are the source!

Gotten here I can give you talk about how to do, it is gotten to give the dual chip, the main chip is wallet function, security chip on cryptography, only then the firmware in the main chip is open source, in this way, a certain extent, achieved "from the innocent" (not 100%, but also better than closed source on miles). That is, if you're interested, you can make your own version of the hardware wallet using the same master chip and the same security chip, and then you can basically make your own version of the hardware wallet using Ledger's open-source master chip code. That is to say, use this type of solution, you can at least do not fully trust the third-party hardware wallet manufacturers, of course, also have to trust in a security chip manufacturers, because of the security chip sales to many industries, currency circle is just part of it, so the third party trust problem were not as severe.

Here, we understand it, if a hardware wallet manufacturers can not do 100% open source, at least should also go to the "self-proof innocence" on the four words, basically can be self-proof innocence. If you can't prove your innocence and solve the problem of trusting a third party, what's the difference between keeping your COINS in your hardware wallet and keeping them in the exchange? Who wouldn't?


So, if you really want to argue with us about "open source or secure chips," at least, please make sure that the Ledger is at least as open as possible.

After that, we'll talk about security. Open source is the premise of hardware wallet, so security is the top priority. At this point, all kinds of cold wallet Bitcoin.org made so much contribution, like Trezor contributed first perfect hardware purse, wallet and colder than too invented the qr code is extremely random a TRNG true random number solution, gotten is the innovative design of double chip architecture, all of these contributions are working to help users more secure protection of assets.

In the process of designing BITHD, we have also fully learned and borrowed these excellent schemes. In order to make users use the hardware cold wallet easily while ensuring security, we have made a lot of meaningful optimization and developed a lot of valuable functions.

Open source will make the ecosystem more prosperous and products and services more open.

Let open source come more violently!

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia