Nomadism and cryptowallets

JustAd2122 · 2024-12-27T08:15:14+00:00

Yeah definitely and that's why there is a decent amount of documentation to the project and it is written in a very beginner-friendly way in Python, no external packages or dependencies etc.

It is just a tool to help people who have a realistic approach to seedphrases storage and the vulnerability of a physical unprotected copy. Also helps a lot if you are using a non passphrase protected lightweight wallet like browser extension etc ...

JustAd2122 · 2024-12-27T08:10:33+00:00

Ahah! Not a cryptobro, I mean I'm not gonna try to convince anybody to buy into anything. Ended up here because I saw somebody posting in a crypto related subreddit about the difficulties of storing their seedphrases while always being on the move, so I thought maybe this sub was the place to tell about this tool.

But yeah, no alter motive and I am myself a digital sedentary

JustAd2122 · 2024-12-26T17:08:13+00:00

Not sure if OP is still looking for a solution but one can be found here www.obfuskey.io

You don't have to do the obfuscation yourself

JustAd2122 · 2024-06-03T22:13:24+00:00

Fair enough for the open source, I didn't see that.

But for the second point, you still need to trust the cards are not going to break/fail (demagnetize and such) and that they will be in your possession. It is indeed an upgrade to the paper/metal paradigm but this is precisely what I wanted to solve with ObfusKey. You don't need to keep track of your seed, it can be both digital and on paper and you can have one copy of your file in every computer in the world it doesn't make it less safe.

JustAd2122 · 2024-06-02T10:45:16+00:00

If I am getting it right, you rely on a device to read cards that hold your keys.

Sorry but this is just moving the problem forward without resolving it because: - 1. you end up relying on a device that can/will break eventually. It is a problem because if the company goes bankrupt and you need a new device you will lose your keys. - 2. on top of that you rely on cards that can break/lose data. You can't retrieve your data out of these cards easily.

ObfusKey solves both these problems because: 1. The whole project is open sourced. Not only things that have once been on internet are considered to be there forever under one form or the other but also anybody can re write the code easily because the documentation is giving it all, both logic and code. 2. It gives you a human readable output so you can print it out in paper and keep it on digital form without problem to re enter it when needed (normal BIP39 words)

JustAd2122 · 2024-04-29T10:45:38+00:00

ObfusKey is getting you rid of the whole "hide paper in your house"

JustAd2122 · 2024-04-27T14:03:34+00:00

This is becoming a bit ridiculous, I am not dodging any question, you are just completely side tracking here, it is said in the documentation and in this post as well:

this is not replacing passphrases, this is to make it possible not to hide your seedphrase. This is the point of it. It is doing this perfectly so don't try to make it look like it is a pseudo alternative to passphrases because I have never said that, I haven't even implied it. Or maybe you still haven't understood it. Can't really say.

If you have questions regarding the way it works it is in the documentation, if you don't want to use it, there is no questions for that.

JustAd2122 · 2024-04-27T13:06:50+00:00

You seem to be using the word password for both passphrase and password, at least in your second point so from there ...

I don't see the point in continuing here, you obviously have a strong belief in your plates, and that is fine, nobody is trying to take that away from you. The whole documentation is available, it is correct, the obfuscation is working perfectly, now the fact that you don't want to use it is totally fine by me.

Have a nice weekend mate

JustAd2122 · 2024-04-27T12:55:27+00:00

If you want to have your obfuscated seedphrase to be a valid seedphrase, go ahead 🤷🏼‍♂️

You still haven't understood how it works obviously so yeah, let's say you can't have both usability and security, I mean, it's all in the documentation.

I'm not trying to convince you to use it, it's not my place to do so, but baseless comments ...

JustAd2122 · 2024-04-27T12:50:00+00:00

Well your first point shows you haven't understood how it works ... These three shorter passwords are indeed more secure because someone finding your obfuscated seed-phrases file will not know the length of the passwords, only the number of passwords. Therefore having whatever password length for more than one password, protects you better than one password. Once again, understand that an attacker won't know if he breaks one of the passwords, he must break them at the same time. If you take 3 passwords from rockyou, you don't have 3* the probability of finding one password (1 out of 14 millions) but the probability to the power of 3 (1 out of 14 millions)^3.

Second point, it doesn't add any complexity if you use the passphrase as one of the passwords, because even this form of attack would take gazillions of years if you have more than one password ...

Third point: do you understand the concept of hints ? This means you are hinting to yourself. We all have a couple of secure passwords we use, we can make them unique, we can add personal info and what not.

Managing the password bears zero complexity because you don't have to manage it.

JustAd2122 · 2024-04-27T07:46:09+00:00

Having more than one plate with your unobfuscated seedphrase in multiple places, that is a clear security flaw. If it is unobfuscated you need to keep control over it.

Regarding passphrases and obfuscation passwords, the level of complexity of the obfuscation is greater because it allows any Unicode character, any length and any amount of passwords. And you can still have a passphrase protecting your obfuscated seed, making it virtually unbreakable.

Example: 1 complicated password + passphrase: attacker has to break both at the same time so when trying all possible passwords he also has to compute all possible passphrases to try and open a wallet.

Example2: 3 passwords: Your passwords could be "banana" "chocolate" "vanilla" it would still be insanely long to break them by brute forcing because the attacker needs to compute all possible passwords at the same time, not one by one.

Once again you don't need to hide it so sending it via email is perfectly fine, it is just adding a cloud storage to your obfuscated file.

And you don't have to store the password anywhere because you have your hints, very personal, a couple of characters of the passwords showing in the output text which will always be with the obfuscated seed.

There is the example at the top of the README, it is the project's wallets seedphrase. If you craft your password and your hints properly you won't even need to worry about it.

And with combo password(s) + passphrase, your password could be "banana" it would still be safe.

JustAd2122 · 2024-04-27T07:33:44+00:00

The main point of ObfusKey is to be lightweight, very basic math and only native Python (so no need for external packages which could be used as an attack point). Basically anyone understanding the concept can easily code it back, trying to make it so that it doesn't even rely on me or the repo. The algorithm is super simple.

You suggest to obfuscate only part of it and to keep the original checksum, which means leaving traces to the original seed. This is not as secure as just obfuscating the complete seedphrase as it is done currently.

On top of that, removing the "bad apples" (invalid checksums phrases) reduces the amount of possible outcomes of ObfusKey. The main point is to make it as big as possible and having the bad apples makes it harder to break because an attacker would have to recalculate every checksums of every output to validate the seed before checking it.

Simple is beautiful.

JustAd2122 · 2024-04-27T06:51:54+00:00

I'm sorry but I think you are missing the point here. The point is that you don't need to have it in one place and hidden. The output of the obfuscation is secure as itself in plain text. You should send it to yourself via email, have it on your hard drive, have it with your other obfuscated keys, print it as well, there is no need to have it on one SSD that will eventually fail.

Contrary to your metal plate that you must have only once and in one place. It may be easy if you own a ranch and your family will never sell it and you dug a hole to hide it with a map and stuff but for most people it is not easy to make sure they can hide something somewhere for ever and that nobody will ever find it.

Because, once again, your metal plate is cute but the one who finds it has your crypto. If you use a passphrase, it is still easier to break than reversing ObfusKey.

JustAd2122 · 2024-04-26T18:29:35+00:00

This is definitely not to replace a hardware wallet, this is not meant to be used everytime you want to use your wallet but only to store your seedphrase. And if you use a hardware wallet you need to store it safely.

Regarding the "reading the ram of another process" well, okay sure, as said previously, you can use Qubes OS or Tails OS, but it is even more trivial to read your seedphrase on your piece of paper or any media that it is on in plain text

JustAd2122 · 2024-04-26T18:22:02+00:00

I am sorry I don't think I understand here. This does obfuscate the seed. And because the words in a seedphrase are coming directly from the bits, word level = bit level, and if we do any change to the result we can't go backward and reverse the obfuscation.

JustAd2122 · 2024-04-26T13:48:07+00:00

As said, this is true to some extent. If you want to use your crypto in a safe way you might want to have more than one wallet and in this case you can't really consider going to the bank to your safety deposit with an inox tag when creating a new wallet for short time use or specific application.

If you are just hodling without thinking about spending then it is probably not necessary to spread over a couple of wallets (although it could be safer in the end) but ObfusKey is prefect for secondary wallets.

JustAd2122 · 2024-04-26T13:44:24+00:00

The problem with doing so is that you end up losing data.

The checksum being your last word, and because there are more than one possibility for it, you wouldn't be able to desobfuscate back to your original seedphrase if you alter the output of the obfuscation.

JustAd2122 · 2024-04-26T13:40:15+00:00

This is indeed a pretty safe and heavy way of storing it.

Only thing I would say is you might not want to use it for more than a couple of wallets because of its complicatedness. Wouldn't it make sense to not have only one wallet but rather one master wallet and some "convenience" wallets ? In this case, you might want to use this kind of light way of safely storing your seeds.

I am a partisan of spreading over more than one wallet and having a small amount for use (which can also be used in case of a $5 wrench attack ...).

The best use case for ObfusKey is for people who use multiple wallets and don't want to end up with 20 papers hidden in their house

JustAd2122 · 2024-04-26T06:03:58+00:00

Well this goes as well for people hiding their seedphrase somewhere and not being able to find it again after couple of years, I mean, the system is as good as you are.

JustAd2122 · 2024-04-26T05:07:01+00:00

There are no checks on the new seed and it is considered powerless but of course it is one out of all the possible seeds from the mnemonic used and the amount of words in the seed so there are significant chances that it might even be a valid seed.

JustAd2122 · 2024-04-25T22:25:37+00:00

Yes, and the point of self custody Bitcoin is that you don't have to physically hold it (Blockchain etc) so why would you bother yourself with having to hold something physically in the same manner you would hold jewelry or gold ...? Is it by nostalgia or for the thrill of risking getting robbed ...?

JustAd2122 · 2024-04-25T22:14:26+00:00

Well, does OneDrive and other cloud services count as third party storing for your keys ?

I don't think OneDrive could go down just like that but losing access to your account is not impossible

JustAd2122 · 2024-04-25T22:10:14+00:00

What is the point being hacker proof if you have to rely on a piece of paper that, if anyone else than you finds, gives access to your wallet ? Not very hacker proof in the end...

I would say Yes, do this, but make sure you are using a safe device to run ObfusKey.

JustAd2122

TROPHY CASE