WalletScrutiny's avatar
WalletScrutiny
_@WalletScrutiny.com
npub1j9kt...uswx
Know your wallet like you made it! Our goal is to improve the security of Bitcoin wallets by examining products for transparency and potential attacks.
WalletScrutiny's avatar
WalletScrutiny 4 months ago
BIP110 is heading towards "mandatory signalling" around August 7th with so far 3‰ miner support. How should we deal with this? Bitcoin isn't a democracy. My node, my rules. To say "miners decide" misses how bitcoin works. So ... at what point should we warn users about transactions executing on two blockchains? Bip110 users will see "0 confirmations" on their transactions long after they confirmed on the Core side. But do Core users also need a warning? When and how? Clearly if bip110 would get close to 20% mining support, things would get dicey but now ...
WalletScrutiny's avatar
WalletScrutiny 6 months ago
We went eagerly to work to analyze this fancy new version of the Bitkey. Sadly our verdict is "no source" as the firmware *cannot be built from the source provided* as one *closed source dependency* is not included in their source code. In theory they could remedy this in a firmware update. View quoted note →
WalletScrutiny's avatar
WalletScrutiny 8 months ago
Playing with new features is fun. This one required to review 1300 products for a list of 27 features which LLMs can do in an hour citing sources. How do you like it? Should we put it live? image
WalletScrutiny's avatar
WalletScrutiny 11 months ago
image WalletScrutiny turned 6! We've come a long way over the years. In the beginning, we only looked into Android wallets - 40 of them - and now we've grown to more than 6000 products across many platforms. Your favorite hardware wallet? We got you covered. Desktop? Probably, too. And desktop is a lot of work as here we found many open source and reproducible products!
We’ve been busy but quiet these last months. @npub1qw6s...4882 improved the site a lot by adding new features around #nostr based build verifications. We hope other projects in the nostr ecosystem like @franzap @Zapstore will see the value of these verifications and start integrating them. The more products that build on reproducibility, the more users can truly apply the principle of “Don’t trust - verify.” Binary transparency shouldn’t remain a niche feature - it needs to become the default. If you run software that touches your private keys - be it nostr clients or bitcoin wallets - without binary transparency, only whoever built the binary really knows what code you’re running. image @npub1r709...sf7d and @keraliss checked the reproducibility of almost 300 binaries. The 304 verifications by @npub1z69h...aukf are all the old verifications we had migrated to nostr. And the backlog keeps growing as we cover more and more products with frequent updates. Are we doing something valuable for the space? A @Spiral grant says yes, and community endorsements confirm it - but the project itself also needs scrutiny. We recently introduced "verification endorsements": image This is a simple contribution many could provide. If you read a verification and it looked plausible and complete and you trust the author, mark the verification as verified. If you ran the documented commands yourself on your hardware and got to similar results, please endorse the verification! Even more importantly label verifications as invalid and leave a comment about what's missing when you find issues! Don't be shy! Our goal is to document all steps such that all mildly technical users (you should be comfortable with a Linux shell) can reproduce our findings. If that's not the case, please provide your feedback and we will improve ✋. And if you maintain one of the products we check, share your own verification as a template for others!
↑