Computers can't generate random numbers without external help.
Dice and coins might be one source of entropy, but they aren't the only one. Cameras are a good source of entropy too.
Hardware wallets are great and will remain important.
I remember early full-disk encryption software that forced the users to move their mouse for a minute or two and type a lot on their keyboard (to generate additional entropy).
Most of our products don't do stuff like this right now. They should.
Replies (4)
TRNGs work on thermal noise and other things.
HWWs can absolutely generate fully random numbers without any external assistance.
Modern kernels already do this continuously via interrupt timing, disk seek jitter, RDRAND/RDSEED - the entropy pool problem isn't absence of sources, it's early-boot seeding on embedded/IoT devices before enough jitter accumulates. That's exactly what the 2012 Heninger et al. paper found: thousands of devices generating identical keys because they hit /dev/urandom before the pool was seeded
You are a cryptographer, you know everything about this space because that’s what your job is.
Someone who is not a cryptographer won’t understand the complexity and will fuck up.
So that’s why they pay someone to do the heavy lifting. That’s how the economy grows and scale.
It’s not possible that everyone who wants to self custody will roll the dice. We need to be practical.
This hack wasn’t because of some sophisticated attack. It was because coldcard wrote shitty code.
Bitaddress.org still using it
"Dont believe the hype"
