βš‘οΈπŸ‘€ NEW - ColdCard: « New COLDCARD firmware is available: 5.6.1 for Mk4/Mk5 and 1.5.1Q for Q. This release follows three weeks of sustained review since our July 31 hotfix. We continue to acknowledge the customers who suffered severe financial losses from the seed-generation attack. Every newly generated seed now requires one source of user entropy: at least 65 key presses with unpredictable timing, 50 physical dice rolls, or 128 physical coin flips. This input is combined with fresh entropy from the STM32 TRNG, SE1, and SE2. The release also adds staged-PSBT verification immediately before signing, stronger USB and firmware-update boundaries, improved Delta Mode isolation, active-wallet backup fixes, stronger RNG initialization and fault checks, safer SIGHASH defaults, and many additional security and correctness improvements. Important: Updating does not repair an existing seed generated on affected firmware. If the advisory applies to your seed, update your device, generate and verify a new seed, then move your funds. We strongly recommend that all Mk4, Mk5, and Q users update and verify the signed firmware download. Thank you to every researcher who reported issues, reproduced edge cases, reviewed fixes, and helped make this release stronger. Β» image

Replies (45)

Unfortunately as in LIFE these critical items have been corrected and made way better after a huge loss and damaging knifewound thru the heart.. how many words left unsaid to a person that died, how many regrets, and corrections in our lives we only made after massive loss. We can only focus on getting better. This seems the right path, but it won’t be easy.
Natestr's avatar
Natestr yesterday
Sweet! My paperweight got an update!
Hofer99's avatar
Hofer99 yesterday
Damn.. wish they'd shut the company down and disappear.
MissingNo's avatar
MissingNo yesterday
He is gathering the most worthy news from many sources and giving them to us. It's a net positive for Nostr. Stop complaining.
"so hey remember how we f'd yall?" "here's a lil somethin on the house to make up for it lolz"
Default avatar
Roboto 23 hours ago
O you are not stronger. There ate a lot of questions to be answered
Default avatar
Y⚑ 18 hours ago
these ppl have no shame 🀑
I wonder if "stronger USB and firmware-update boundaries" is their way of trying to stop people from flashing alternative, open source firmware onto these devices in the future...
acronym's avatar
acronym 4 hours ago
Definitely best in class now, no one can (should) touch them!
↑