Dialogue between Wang Yishi and Super Jun: Hardware wallet is the only way for Crypto users
Moderator: Ziyu
Guests: Wang Yishi of OneKey, Mocha Community Manager Super Jun
Organization: ForesightNews
< /p>
Ziyu: Today's topic officially begins. I am Ziyu, and I am also an old leek. Today we invited Wang Yishi, the core contributor of OneKey, and Super Jun, the leader of the Benmo community. We should be very familiar with these two friends. To be honest, today’s topic is still a bit worrisome, that is, not your keys not your coins. The main reason is to chat with you, and how many times does it take CeFi thunderstorms before the currency holders will agree? Use your own wallet, which is also a very painful lesson from this market turmoil.
Actually, regarding the use of hardware wallets and wallets, wallet platform entrepreneurs have spent some time over the years It is time to educate users, but it is far less profound than the education from the market. Everyone suddenly realized how important security is to us, which led to the recent sell-out of hardware wallets. Today, we would like to invite two guests to briefly share the CeFi mine explosion incidents over the years and the pits you have stepped on.
Super: Hello everyone, I am Super , the biggest thunderstorm incident I encountered since I entered the circle was Mt.Gox. At that time, Mt.Gox educated everyone, and everyone realized that decentralization is the right way, and storing coins in the exchange is a particularly risky things. This incident triggered the coin withdrawal movement back then, and Sihai is now the main advocate of the coin withdrawal movement. But once a year or two has passed, the pain will be gradually forgotten by everyone, and the market will begin to feel that the exchange is safe again. Until this FTX, it instantly awakened people's awareness of asset security.
Unfortunately, I have also been on Twitter for a long time, and I have been active before On Weibo, I think the users on Twitter are still relatively young, have never experienced the CeFi thunderstorm, and they don’t know the danger. So every time I see some KOLs on Twitter, they will advise users to put their coins on top exchanges, and it is hard to avoid the occurrence of FTX. But how far and how difficult are we from cold wallets? In fact, it is very simple. My mother graduated from elementary school and she knows it. She doesn’t know what the word means, but what she knows is to copy the word. It’s that simple. Why do currency holders find it difficult?
It’s strange that some KOLs always say that hardware wallets are difficult, and I suggest Xiaobai not to touch them. Do not have to use. They probably don't understand the meaning of hardware wallets, and they haven't used them themselves, so they feel that everyone doesn't need to use them. Many people even regard the little fox as a great security guarantee. This is a big misunderstanding and a big safety hazard.
In fact, not only big CeFi like Mt.Gox, but also small CeFi have more accidents. In some cases, the boss was arrested, in some cases the website was shut down for various reasons, and some people had their life savings in it. It hurts me to see it, but some people don't take it seriously, after all, it hurts others to lose their wealth to zero. So the only person who really cares about the security of your property is yourself, and don’t believe in the suggestion that you hand over your private key rights to CeFi.
Wang Yishi:Super is indeed very OG. It’s not the first time that FTX’s thunderstorm has happened countless times. Super also said it just now, but it’s useless to ask everyone to put the coins in their wallets and say it 100 times, until one day he was cut off. This lesson is not enlightenment, it is repentance.
The threshold of the cold wallet, everyone seems to have a natural resistance, thinking that I can't get the cold wallet , and then choose to hand over your coins to a platform that you think is fairly reliable for safekeeping. Even though there are so many exchanges, there are still users who feel that this one is violent. Can I change to another depository? When we take care of our own assets, we must have such a psychological construction. If you choose to hand over your assets to others for safekeeping, then you must prepare for the worst result, that is, he may lose money due to various reasons. Reasons, regulation or hacking incidents or self-stealing of savings, or how he will disappear if he becomes insolvent. You have to be prepared, can you accept this result? If you can't, you shouldn't be doing it. No matter how reliable and trustworthy he seemed, when he fell to the ground, all your previous assumptions about him were untenable. In the past week, before the FTX accident, how many people thought that FTX was second only to Binance? A lot of people including me think so, because he really grew up too fast, but who can guess what happened today?
So when it comes to handling your own assets, you really need to work a little harder After a while, this kind of effort belongs to you stepping up your feet a little bit, and you can put yourself in a relatively safe zone. There is no difference between many hardware wallets and these wallets you use. You just copy these 12 words, just copy them down. It is nothing more than saying that you copy the hot wallet on the APP, and you copy the hardware wallet against the hardware. They are both copied, and there is no difference. Therefore, some KOLs really have never used it and don’t understand it. Then they tell everyone that this is very important. It's dangerous, don't use it, just put it on the exchange, this kind of behavior is really misleading people.
There is another saying that the mnemonic is easy to lose, so you should put it in Evernote Inside, what do you do if you are afraid that the Evernote server will scan it, and even make a fuss about the secondary encryption and compression. But this kind of encryption is useless and can be easily cracked, so please don't do it. Science popularization and safety have a long way to go.
We want to clarify an idea, that is, hardware wallet is the only way for you. No matter how much or how little your assets are, you cannot use its value today to measure how you should keep it. For example, I think these coins are only 100,000 yuan now, so just put the little fox on it. But if one day your little fox computer is hacked by others, or the hard disk is stolen, or a Trojan horse virus copies your mnemonic phrase, you will completely lose 100 times the chance.
Hardware wallets, you can compare them, because there are really many in the market, you can click You can choose your own ideas. Hardware wallets can be bought for only a few hundred dollars, and a few hundred dollars is just the price of a hot pot meal.
Super: is actually a DeFi transaction fee.
Wang Yishi:The use of hardware wallet is a one-way The door, as long as you step into this door, there is no way to accept the world without hardware wallets.
DeFi major mining casually millions or even tens of millions of U, let him in They dare not operate on the little fox, what if something goes wrong?
Risk control, the core of risk control is to avoid risks that you cannot bear, so hardware Wallet is a good solution, it is physically isolated, is the most thorough.
Ziyu:Wang Yishi just talked about the market There are many hardware wallets on the Internet, and everyone can choose according to their own preferences. But a problem that users are very concerned about is that many of us are blank in this area, and we don’t know how to screen safe wallets. First of all, we need to overcome certain psychological obstacles for him to trust this wallet, So how to select a safe wallet and how to use it safely is a question that many people want to know.
Super:One stone wrote an article< a href="https://yishi.io/guide-to-safe-access-internet/" rel="noopener noreferrer" target="_blank">Very powerful article, everyone read his article Just read the article.
Wang Yishi: Let me briefly tell you how to choose A wallet, wallets are generally divided into two categories, software and hardware. I think every web3 user is basically a user of Little Fox. Little Fox is indeed the ceiling of the software wallet. Now there are about 30 million monthly active users in the world, 30 million users. There are many hardware wallets, such as Ledger, Trezor, and OneKey. When you choose a wallet, I think the first thing you should put is-you have to see if the wallet is open source. Why? Because the cost of doing evil with an open source wallet is much greater than that of a non-open source wallet. If the oncoming wallets ABC are all similar in length and function, you may not be able to pick out which one you choose. At this time, you just need to see which one is more open source.
Open source is a very, very important indicator. If you do something secretly, you dare not open source. If it is not open source, you can upgrade it casually, and put some private goods in it. I don’t know if you have any impression of the slope wallet that had an accident before. At that time, we had a friend who was a good investor and asked us how the wallet was doing. Then I experienced it at the time and felt that the UI interaction was not bad, but Who knows, it broke out in less than two months, and he directly passed the user's private key to the server. Do you dare to think about it?
So if a wallet is not open source, it actually gives a lot of people in these companies or teams some The opportunity to do evil, and when he does evil, we can't see it, which is terrible.
So which wallets are open source, and the open source is very thorough. Software wallets Trust wallet and Matemask. Hardware wallets OneKey and Trezor. Although Ledger is one of the most mainstream hardware wallets in the world, the hardware part is indeed not open source. I am not lying to you. You can check its code warehouse for yourself. It is indeed not open source. Of course, Ledger has its own reasons for not being open source, so I won't comment on it.
So back to what I just said, how to choose a wallet, the first one is to see if he opens it If it is not open source, the second one is a matter of opinion. Generally speaking, you must have the currency you want to use, so the number of supported public chains is also a very necessary element.
In addition, there are some user experience, including support for multiple platforms, some wallets It's only on the plug-in, some wallets are only on mobile phones, and some wallets are only on hardware. So OneKey has made a family bucket, so if you like convenience, you can choose OneKey. As a deep user myself, it is still very good to use.
Super: Let me insert a little here, some people may I like to use an old Apple mobile phone, and then download a wallet software, and then disconnect the network to generate mnemonic words for storage. Generally speaking, this is also a good way. The only thing to note is that you must download a team to do it. The one sent is relatively good, and then it is indeed a wallet software without any loopholes. This is a premise. It does not mean that the mnemonic words generated by disconnecting the network are completely risk-free. In fact, if the wallet does evil, it can be used in advance. It is a risk point to record your mnemonic and then calculate the order of your mnemonic.
Da Xiong wrote an article, I personally think it is quite well written. That is to say, we hope to go one step further, not only to persuade you to buy a hardware wallet, but also to have a concept, so that everyone can truly and safely protect their assets. Even in the face of CeFi thunderstorms or others, it can be avoided.
I have taught you how to use hardware wallets before. I feel that it is really difficult to convince a person, and most of the time I rely on my own awakening. The evangelist may be more idealistic, because in the past, cold wallets meant bitcoin wallets, bitcoin offline wallets or simply not connected to the Internet. But now that there is Ethereum, this system is getting better and better and more prosperous, so you will often interact on the chain, and many people subconsciously think that the wallet on the chain must be better than a hard wallet or a cold wallet. More convenient, but behind the more convenient represents greater risk. So I am asking all communities to use hardware wallets to go to DeFi. I can only try my best to persuade others, although it is difficult to persuade.
Ziyu: DeFi users have experienced or witnessed the The thing about assets being stolen, can hardware wallets prevent this?
Wang Yishi: No, Let me clarify a concept with you, that is, the only thing the hardware wallet does is to store your private key in the hardware and not let it leak out in any form. Will the interactive authorization on the chain that is usually said be stolen? All wallets cannot be protected whether it is hardware or software. Why? This is a defect in the design mechanism of Ethereum, how to prevent it? For example, you can use some tools to cancel the authorization. OneKey has created a website called Revoke.gg, which detects all your authorizations, all authorizations on the EVM chain, and then revokes them directly, revoking the authorization with one click. Sometimes you can't remember what you authorized, and then you can cancel all of them with one click. In fact, it is to help users avoid risks. This is actually a pretty good feature.
The other one is that some users said that I imported my little fox’s mnemonic Into the hardware wallet, will my wallet become a cold wallet? I am here to answer everyone: no. for what? Because your little fox's mnemonic is generated on the software side. The wallet generated on the software side is actually a hot wallet itself. The process of your generation can only be called a cold wallet if you ensure that it must be offline and completed independently in the hardware.
If you say you finish at the hot end, it's like you fry a rice at home, and When you bring it to the restaurant to sell, it is the environment where the hot wallet is generated, including its random number generation method. In fact, it is somewhat different from the cold wallet, especially in the environment of browser plug-ins, there are many things that cannot be controlled. the elements of.
Many people install a plug-in, create a wallet, then copy the mnemonic and paste it locally Make a document, or in the notebook software, and then fill it in, and you will feel that it is done. At this time, your mnemonic is actually already in your computer operating environment. At this time, you are actually not sure. For example, if you have installed Sogou Baidu, then congratulations, it’s over. Sogou Baidu these input methods, as long as you enable this kind of networking permission, it will upload all the things on your clipboard. Even if he doesn't do it, he doesn't do it subjectively, can you guarantee that the people working in these companies who can read the service logs of the backend will not do it? You can't guarantee that.
So I said these are two points, the first point is whether the hardware wallet can How to prevent this authorization attack on Ethereum? The answer is no, not only hardware wallets, but all wallets, but you can clear your authorization in time by using tools like Revoke.gg or Revoke.cash.
The second problem is that the mnemonic I created on the hot wallet is imported to the hardware Wallet, is it still cold? no.
Super Jun: Let me add, that is, the first To put it bluntly, the coin hoarding wallet should be separated from the DeFi wallet. This is the first principle.
The second principle is that it is best to fill in one address per mine. You dig a mine and then use an address. Here you have the advantage of using a hardware wallet. You can add one more address in one second, because it can be the same set of mnemonic words. Even if the address is risky, it will not be passed to other addresses, and then it will not passed to other chains.
The third principle is that it is best for you to change your address. But if the address you have does have some relatively long-term on-chain relationships, such as loan relationships, this does not mean that it can be removed in a short period of time, so you can regularly clean up the authorization situation. As for clearing authorization, as Da Xiong said just now, OneKey also has a URL that can be automatically detected and cleared, which is more convenient.
There is another very important thing, try not to dig mines that the interest cannot understand For each mine, you need to know how the interest comes from. There's always something that pays off, but you don't know how it came about.
Wang Yishi:I want to say, just now On the basis of what I said, everyone should not think that it seems to be messed up. It seems that this wallet is very complicated to use, and the address must be isolated and the authorization must be cancelled. Something went wrong. Let me tell you that if there are none, where are they? Just put it in FTX, you can see the result of FTX.
There are many things in this world, that is to say, many people say that we want to solve the pain points, and users keep them It's really too difficult, we want to do what we want to do with the NPC wallet, what do we want to do. Let me tell everyone, in order to avoid this pain, all the shortcuts you take will be returned to you one day.
You said I don’t want to go to DeFi, it’s too complicated, I don’t want to hold my own private key, It's too complicated, but I want to earn interest, I deposit the currency in FTX, because FTX looks good, then congratulations, now I lost all. If you really learn one day that the private key or mnemonic in my hand is my own, then congratulations, you have really entered Web3 from Web2.
Wang Yishi: I only believe in hardware wallets for large assets , Offline mobile phones cannot be used instead of hardware wallets. Hardware wallets can be friends with time, and top exchanges change too quickly over time.
Super Jun: This industry is not too big to fail.
Ziyu: The hardware wallet is an electronic product after all, what should I do if it is damaged? It is not damaged, what if the company of the hardware wallet goes out of business?
Wang Yishi: It doesn’t matter if the company is down, the wallet is broken if it is broken, you can restore it by importing it to other wallets.
Closing down is too normal. A 10 percent chance of starting a business is not bad, right? There is a data that says that the average survival time of start-up companies around the world is two and a half years, just two and a half years. If you think about how many companies die in just one or two years, this goes back to what we said at the beginning , why you put your assets in the hardware wallet that you are in charge of the private key is because the form of the mnemonic or the form of the private key is universal.
Ziyu:That is our theme today , Not Your Keys, Not Your Coins.
Super Jun:Because I especially think of one As for the matter, I think it should be emphasized that mnemonics cannot be placed on the Internet, because as far as I know, there are several companies that specialize in this business. He may be like the Raiders of the Lost Ark in the past, looking for a treasure map. They are a professional combat team, and then they specifically look through the mnemonic phrases on the Internet and the mnemonic phrase information stored in the personal computer. His search ability is quite strong. It can automatically recognize similar mnemonic phrases from all places on the Internet every day. Your personal computer is also frequently hacked, and then go to get your mnemonic.
Wang Yishi:I tell everyone, use all kinds of netdisc. On the Github warehouse, there are n machines scanning various private keys on it every day. What I know is that many people pass the private key to Github because of carelessness or how, and it will be gone in the next second. Very fast, people are not artificial, all automated.
So, you must use those network drives with caution, and don’t be smart and say that I put this The mnemonic is stored in a local TXT file or some other file, I will encrypt it with compression software, and then set a password, such as your birthday.
Super Jun: I still recommend the mnemonic, OneKey has recently released a titanium plate with mnemonic phrases.
I think it is a better way, but it will involve many lines of content For example, when you go through the security check, or where you want to put this board, and then how you make it and back it up, there are still many things to talk about.
Ziyu: We can open another discussion on mnemonics.
Wang Yishi: Mnemonic Don't put the words online, and I will talk to you about the storage of mnemonics next time.
Ziyu: It was supposed to be a 30-minute discussion today, we Chatted for 70 minutes. I am very grateful to Teacher Wang Yishi and Teacher Chao Jun for their sharing, and also thank OneKey for providing such a good product to everyone. I hope that all the audience present today will not appear in a CeFi thunderstorm in the future, so that we can all live in the Crypto field for a long time and safely. Remember what we're talking about today, Not Your Keys Not Your Coins.
Original link
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia
Related Articles
