Topic: Bitfi wallet - most user-friendly functionality, does not store private keys - page 2. (Read 651 times)

   Wouldn't the government's courts be able to compel you to give up your passpharse as a condition of your plea deal? I suppose that this only protects you if you are exonerated or are willing to go to trial and risk a more harsh sentence.



Does the device not function properly without a valid device ID? I thought that you assured me earlier that I could still access my coins if your company went defunct and my device is on the fritz. Also, if my device is no longer functioning, am I going to not be able to access my coins until I get a replacement? Furthermore, what is to prevent the counterfeiter from simply making their own user ids and providing instructions to go to their similar looking web page? Also, why would this counterfeiter care about angry customers? If they sold 10000 units, I'm sure they would get a few suckers to steal from and then make a proper exit scam. Furthermore, when I am going to buy a hardware wallet or similar device, I'd prefer to buy this straight from the manufacturer. Buying from anyone else is just asking for trouble.

Hi bones261,

That PARTICULAR attack can't happen. They demonstrated one method of extraction. So this method won't work if there is a passphrase. But let's just be realistic here, all stored data in all systems is extractable. The top name in cyber security is Cellebrite but there are many similar firms that are not as well known. They are able to extract data from very sophisticated and highly secure systems that cost thousands if not millions of dollars. Ask yourself, do you really believe that a $100 consumer device that stores data will prevent this data from being extracted?

These are the lengths that people go to in order to keep their private keys secure: https://qz.com/1103310/photos-the-secret-swiss-mountain-bunker-where-millionaires-stash-their-bitcoins/ - an underground military bunker with millions of dollars worth of equipment (they obviously built this monstrosity before Bitfi existed, because Bitfi eliminates the need for this  ). So if a $100 consumer device makes extraction impossible why would someone go to such trouble and investment to build this bunker to store private keys? And let's say someone creates a $10,000 cold storage wallet with encryption so high that it indeed takes months for a cyber security firm to break into? Well, thats only valid today. Their technology and tools are rapidly evolving and so if its difficult for them now, they will crack it very quickly in a year or two. So if you bought this $10,000 marvel of technology and you some situation (these situations can and do happen) like a coma, or prison, or any other long absence while your device is out there, it will be just a matter of time before it is cracked just like a $100 device today.

So we just took an elegant approach to this whole problem, rather than building more and more encrypted systems to store things that become obsolete over time, steel metal plates, fancy vaults, etc. we just created a device that doesn't store anything at all (except the operating system of course). Its a logical fallacy to think that an attacker (even an attacker with unlimited resources) can extract data that doesn't exist in the first place.

We are not trying to smear other wallets. These cold storage tools were initially created to prevent online hacking. For many people this is adequate. But its important to understand what your wallet can and cannot do. And after you understand it all, you may very well conclude that you don't need a tool like Bitfi. Also, the reason Bitfi technology is this way has to do with our beliefs about society, freedom, and privacy. We believe that no government should be able to seize your money any more than your water or oxygen. We think the government exercises abuse of power and that most governments are corrupt. In addition, surely Satoshi himself intended for Bitcoin to be unseizable and so we created an unseizable wallet which is congruent with the philosophy of Bitcoin and blockchain in general.

Now regarding counterfeiting. The reason that it is easy to counterfeit cold storage wallets like the one you have is because their software is completely open source and so anyone can just make an identical looking device and install this software and then you have a Trezor. The counterfeits are so good that sometimes the manufacturer themselves can't tell them apart from their genuine inventory. So lets say you want to counterfeit 10,000 units. You make 10,000 devices and then install the open source software on all of them and you are done.

With Bitfi however, each device is running a different package. To understand this, we have attached an image of two Bitfi devices side by side:

https://imgur.com/Phiy8tp

As you can see, each Bitfi has a unique Device ID. This means no two Bitfi's are the same. The Device ID is generated from devices internal private key which is stored in TEE. If someone managed to somehow obtain this private key (this private key has nothing to do with any of your funds, its strictly a private key assigned to the device itself), and decided to make 10,000 units (which they could because our code is also completely open source) they would then produce 10,000 Bitfi's which would all have the same Device ID. You are not going to be able to sell those and this is the last thing that a counterfeiter would want to do because all units are going to be returned by a swarm of angry customers.

Thank you,

Bitfi Team 

@Bitfi

Did you actually read the reddit thread you cite?

From the reddit thread the title is this.


As I posted earlier, if you use a passphrase, the attack can't happen. Also, it appears that the extraction of private keys while the device is calculating them has been corrected over a year ago. Now the device doesn't start the calculation until after the PIN is entered. Furthermore, this wouldn't happen if you used a passphrase anyway, since the calculation of the private keys for the wallet you are using will not begin until after you entered the passphrase.

Now, please advise us exactly how your device is counterfeit proof.

Hello bones261 & o_e_l_e_o,

You are mistaken. There is a tremendous difference between Bitfi and all other wallets. Again, if we are talking about Trezor it is “cold storage” which means it is literally storing all your access to your money. The Bitfi is storing nothing, extraction is not possible.

Here are things that happened to Trezor in just the last few weeks. And these are proven attacks with method disclosed, not random twitter posts:

https://www.reddit.com/r/TREZOR/comments/aa2dl3/these_guys_just_demonstrated_key_extraction_of/?utm_source=share&utm_medium=ios_app

https://cryptoslate.com/ledger-reveals-five-vulnerabilities-in-competitor-trezors-wallets/

https://blog.adafruit.com/2018/06/07/extracting-the-private-key-from-a-trezor-bitcoin-wallet-with-a-70-oscilloscope/

https://cointelegraph.com/news/trezor-responds-to-ledger-report-on-vulnerabilities-in-its-hardware-wallets

You will notice in the last article Trezor themselves tells you to prevent physical access to your device: As per Trezor, none of them can be exploited remotely, as the attacks described require “physical access to the device, specialized equipment, time, and technical expertise.”

And o_e_l_e_o, when we told you that Bitfi is the only wallet that can protect you in the situation where you are being tortured, you dismissed it as nonsense due to our apparent lack of knowledge about anything security related. Well in the same article Trezor themselves makes a statement: “Furthermore, Trezor noted that a “$5 wrench attack” — a targeted theft when the user is forced by intruders to disclose his password — cannot be prevented by a hardware barrier set by the manufacturer.”

Finally, as you can see in all these articles both Ledger and Trezor have a counterfeiting problem which is particularly severe for Trezor. Bitfi is also the only hardware wallet that is virtually impossible to counterfeit. If you are interested in understanding why, we are happy to explain.

Bitfi Team

Exactly correct, and by using a passphrase you also completely prevent the advanced laboratory physical attacks on the device that this Bitfi account currently seems to be hung up on. Not that these facts will make any difference to their argument, since according to them, this functionality doesn't even exist (despite it currently being in use by thousands of users):

      @Bitfi, I'm not sure about Ledger, but the Trezor doesn't store your private keys. It only stores the seed. If you enable the passphrase function on a Trezor, they may be able to get the seed, but they need the correct password to generate the correct wallet. This passphrase is not stored on the Trezor. In fact, you can have multiple wallets with various amounts of coins. Therefore, your product doesn't have much of an advantage in this situation compared to your competitor. However, enabling a passphrase is only an opt-in only option on Trezor. I suspect many users don't bother with it.

Hi o_e_l_e_o,

This is just getting silly. You continue to claim that you are an expert in security and that we apparently know nothing about security even though we are a manufacturer of a security product.

We never said that breaking into an iPhone is the same as breaking into a Ledger. Right? So why are you speculating that this is what we think?

Actually, it is much easier to break the encryption on a hardware wallet than it is to break into an iPhone, especially one running iOS12.

You are aware that every week law enforcement seizes Bitcoin and other cryptocurrencies in criminal investigations and then later auctions them off (and this is just in the USA). How do you think law enforcement seizes this Bitcoin? You think criminals (or wrongly accused innocent people) just leave their private keys printed out on their desk? No. All this Bitcoin is seized from hardware wallets.

Here is an actual law enforcement guide describing how seizure is made from hardware wallets: http://www.iacpcybercenter.org/wp-content/uploads/2018/03/Bitcoin.pdf - look at pg. 13 - "For an officer seizing the property of a suspect, it is sufficient to secure the hardware wallet and get it into the hands of an IT specialist as soon as possible." And this is just a local law enforcement guide (like sheriff or police) using an internal IT department. Which doesn't even come close to the capabilities of federal agencies like FBI, CIA, and NSA. In addition, an internal IT department of local law enforcement is basically like a garage compared to the labs at Celebrite and other companies in CyberSecurity.

Even teams like wallet.fail are able to extract private keys from both Ledger & Trezor (as they demonstrated just a month ago) and they do not have anything close to the capabilities of the big CyberSecurity firms.

While our engineers indeed don't participate in any social media discussions (if you want to interact with them, go to https://bitfi.dev) we do correspond with them when they have time.

What you are doing is misleading other people in the community and giving them (and yourself) a false sense of security. We never said that cold storage hardware wallets are not secure, they are extremely secure as protection from online attacks, because the private keys are not online. This is exactly what cold storage hardware wallets were designed for and they do it well. All we are saying is that Bitfi is different because it protects users from online and offline attacks. We didn't think the world needed yet another cold storage hardware wallet, there are plenty of good ones. We are pursuing something else.

But if you would instead of trying to mock and ridicule us, tried to actually have a constructive discussion it would be better for the community. That's all we are trying to do.

Bitfi Team

If you are naive enough to think hacking an iPhone is equivalent to breaking the encryption on a secure element in a Ledger, I don't know what else to say. This was actually spelt out in by the Ledger CTO in the screenshot you provided in your last post. I guess you didn't understand the difference.

I would kindly suggest that if you do have a "team of engineers" working on this "all day, every day" as you claim, then you choose one of them to take control of your Twitter, Reddit and Bitcointalk accounts. No one is going to take you seriously or buy your device when you consistently demonstrate such a poor understanding of crypto security.

All we can say is that you are not interested in learning anything new or having a constructive discussion. Perhaps you are just trolling us. You certainly act as though you know everything and as though we know nothing when this is all we do with a team of engineers all day, every day.

We are now going to gracefully bow out of this discussion because you will always come back with some snide remark with absolutely no concern if it’s true or not, or if it has any bearing on reality.

We will just leave you with this. Ever heard of Cellebrite? Yeah, the same company that helped FBI unlock the iPhone of the San Bernadino terrorist. They charge exactly $2,500 to do data extraction from any device and it takes them minutes, all they need is a court order from law enforcement. If you are naive enough to believe that a $100 toy is going to stop them from getting all your money, then you can keep believing that.

You can go ahead and call them yourself to confirm the above, here is their phone number in USA: 201.848.8552

Have a wonderful evening,

Bitfi Team

To be fair... WarpWallet (which put up a 2x 20 BTC(!) bounties for a "simple" 8 char alphanumeric password) suggests using your email address as a "salt"... and as far as I'm aware, neither of those bounties was ever claimed before the expiry date. #devilsAdvocate
is just disingenuous  

Additionally, some of the responses on this thread would appear to show some gaps in their knowledge of how competitor's devices actually work...


Just my 0.00000002BTC

Please just stop. All you doing is making yourself sound more and more ignorant with every post.

The kind of technology required to extract a private key from a secure element is found in few laboratories around the world, there are few people with kind of knowledge required to utilize said equipment, and it would take months and tens of thousands of dollars to perform. Calling that "trivial" once again only shows your deep lack of knowledge regarding crypto security. This vulnerability applies to any and all microchips around the world, not just those in hardware wallets. It is also completely mitigated by using a passphrase on your Ledger (you know, that thing which you are denying even exists despite thousands of users currently using it).

Your "wallet", on the other hand, had its passphrase extracted by a 15 year old in his bedroom using a desktop computer.


Ooft. I had to double check that for myself. I know these guys don't understand security, but still, the advice they give about setting up your passphrase is some of the worst I have ever seen. They suggest an acceptable phrase is "!Why Is Dan So Crazy About Monero and Mustard?", and as you say, your phone number or email. I'd honestly rather store my private keys in plain text on my desktop computer than in a brain wallet with such poor security.

     @Bitfi  I know that you have many objections to respond to. However, Bitcointalk has a thread bumping rule that does not allow the same poster to post more than once in a row in a 24 hour period. If you have additional thoughts to share, and no one else has posted, you will need to edit your last post and add your additional thoughts. I know that can make your messages a bit on the TLDR side; however, I don't want you to end up having posts deleted if a moderator finds out.

     Now To get back on topic. The main problem with your approach is that in order for this to work, a person has to pick a password and salt that they can remember. The problem with such passwords is that they are easier to crack than the webpage you sent to me seems to suggest.
     You gave me this example of a password to use. Bones261LovesBitcoinTalk.orgFor$Advice. Although the web page that you directed me to suggests it will take many octillion years to crack the passphrase, if someone happens to know a little bit about me, it won't be that hard. If a cracker happens to know that I am bones261 and love bitcointalk, they can try those passphrases that contain my user name and bitcointalk.org. I know that you were only using this as an example, however any phrase that someone is going to be able to reasonably retain in their mind is probably going to be easier to crack if the cracker happens to have some information on you.  I also went to your web page and it recommends that the salt be something like a SSN, email address or phone number. This is a rather bad recommendation in my opinion.

    I realize you can have your dice generator generate 7 random words for you. It may seem easy to remember 7 random words; however we get people coming here quite often who can't even remember one word to access their encrypted wallet. The best thing to do is either write the words down or keep them in a password generator. Also, I am not understanding your argument that if a thief comes across a piece of paper with your passphrase written, that they wouldn't be able to tell that it may be a password to access your coins. If you use a phrase with good entropy, it's going to have some special characters. I'm sure a crafty thief can figure it out.

Hi Random8543,

You don't seem to understand Bitfi's security model. Bitfi does not have any private keys. Therefore extraction is not possible. On the other hand all cold storage wallets make it very easy to extract all your money should they be physically seized, lost or stolen. Here the CTO of Ledger himself admits that it is trivial to extract all your private keys: https://twitter.com/xtcc18/status/1109621986123284480

We are extremely aware of all the wallets you mention. However, we believe that you haven't taken the time to understand how Bitfi works.

Thanks for the opportunity to respond.

---

Hi Bob,

This is demonstrably wrong. Bitfi is the most secure wallet because it doesn't even have private keys. Please explain how something could be more secure than such a system where you don't even have anything to steal or extract?

First, we can prove every single one of the claims that we make.

Second, if you want to make an informed opinion rather than just a random angry post like "Bitfi sucks" please see our open source resources at https://bitfi.dev this is a completely open and transparent system that allows all developers in the world to participate, view the code, and see how every feature works.

Try to keep an open mind rather than spreading misleading information.

Thank you,

---

Hi o_e_l_e_o,

You don't seem to understand some crucial differences. The cold storage hardware wallets store all of your private keys and therefore they are device dependent wallets. Bitfi is not device dependent, it has no private keys (its a private key generator) and therefore you can have an unlimited number of wallets with one device (you can have 1000 if you like) and even share one device among multiple users. So long as the users don't know each other's salt & phrase, no one can access anyone's wallet but their own with their salt & phrase.

You were talking about a torture situation. In this case the hidden account with the 25th word is not that much protection. An attacker who is knowledgable about cryptocurrency will surely demand the hidden account as it is a common feature and they will especially demand it if they know anything about you.

With Bitfi, it is literally impossible to know or suspect if any other wallets exist or have been created with the device. It is true plausible deniability. This is a crucial difference in this kind of situation.

Yesterday we spoke about open source and our open source system is now live and we invite you to come and use it, if you are interested in understanding Bitfi technology better: https://bitfi.dev

Again, you may decide that Bitfi is totally not for you. Thats fine. But at this moment, you do not know enough about this technology to make a truly informed decision.

Finally, yes, the Bitfi wallet does allow you to store millions of dollars, thousands of coins and tokens, and terabytes of data in your brain by knowing a single phrase. Walking around with that in your brain sounds almost like science fiction, except its real. But this is optional and you do not have to use Bitfi this way. It is not a brain wallet for many reasons, but it does give you the best of what a brain wallet can offer should you choose to use it that way.

Thanks,

Bitfi Team

---

There is not much more we can say. You are saying our device was hacked, and we are saying yet it was. No disagreement there.

But then you start saying that it was hacked in a way that entitles hackers to $250,000 and that the rules are not clear, please explain what is not clear in these rules: https://bitfi.com/bounty

Just because some hacker is complaining about the bounty rules (perhaps because they wish it was easier) does not mean the rules are not clear or should have been changed. We were clearly simulating a situation where a wallet is stolen from a user and then to test if its possible to steal the user's funds. In this bounty we were not testing to see if a device can be modified without your knowledge and then you use it next time and it gives your information to attacker, that was being tested in this bounty: https://bitfi.com/bounty2

Now you are saying again that passphrases can be extracted from device, even though we already told you nearly half a dozen times that they cannot. This is the equivalent of us taking this article from 2017: https://medium.com/@Zero404Cool/trezor-security-glitches-reveal-your-private-keys-761eeab03ff8 and using it as proof that ST32F05 chip on Trezor is vulnerable to fault injection. But don't you think that maybe Trezor fixed this or did something about this since 2017?

The memory management and the forensic testing method was disclosed here: https://twitter.com/TheBitfi/status/1054884530199449600

Anyone with advanced tech knowledge can use the same or similar method to attempt extraction to see for themselves. The private key, salt, and phrase are all not detectable at all after a transaction. We have a lot more technical resources coming that scientifically prove all claims being made by Bitfi.

We are really not here to bicker with anyone but rather to collaborate. We probably won't be the only hardware wallet in the world and consumers will always have choices just as they do with smartphones. Some think the iPhone is best and others think that Samsung is best. This argument about which is best will likely never end.

All we want is collaboration and stimulating discussion. We are trying to contribute to the space and actively educate people on Bitcoin. The enemy is on the outside. We don't need to fight on the inside, which just causes the industry to self destruct. All we ask is that you keep an open mind. Scam accusations are very serious, especially when you consider the emotional impact on the developers who have been putting in blood, sweat, and tears into this project and other projects. We shared some thoughts on this here: https://twitter.com/TheBitfi/status/1113634972840153088

We are not asking you to buy our wallet. And we also don't claim to know everything. In fact there is not a single engineer who knows absolutely every single thing about Bitcoin (including Bitcoin developers themselves), there is always something new to learn and discover. These are very complex systems.

We apologize that the previously used word "unhackable" caused so much anger and frustration and we apologize to you personally. Please just give us an opportunity to collaborate with people in this community and provide them with information or data they may want. We are not trying to do anything else.

Thank you,

 

This is exactly correct. To claim that Ledger doesn't allow multiple wallets on one device, when I have a Ledger Nano S sitting two feet away from me which has multiple wallets on it, is either a deliberate lie designed to fool potential buyers, or phenomenal ignorance of the basics of hardware wallets. Either way, I wouldn't trust someone who makes such a nonsense statement.

In before a reply saying that their brain wallet isn't a brain wallet because it isn't on a computer or some other nonsense reason.

Wow.

Not sure if this is a troll post or for real   


To anyone reading this and wondering:

The bitfi wallet is probably the least secure wallet in history of BTC. Even android / iOS mobile wallets are more secure than this crap.

Better invest your money into a real hardware wallet or buy more BTC and store them on your mobile. But never use a brainwallet (like bitfi is).

It has been repeatedly proven that this wallet is unsecure and not worth a single penny. Don't listen to empty promises, do your own research.

I usually dont like jumping into discussions like this but I do want to provide my 2 cents on this message. This message does show that Bitfi (or atleast you) have not used ledger, trezor, keepkey, or similar devices that have a seed along with an additional passphrase, or probably have but just being plain ignorant. Using an additional passphrase will allow one to have multiple wallets all while still remaining protected. Such a thing is not stored on a device thus if someone were to extract the seed from any of those devices, as long as no coins are stored along with the seed itself, nothing is lost. If there is, you only lose whats there but nothing stored with an additional passphrase. Heck, I even use it to have different wallets for different things as if its multiple bank accounts for personal and business use and I trust that more than I would trust bitfi. Heck, I dont even like ledger after what they did with ledger blue but I would prefer that over bitfi honestly.

I would seriously suggest that Bitfi should take their heads out of whatever hole it is stuck in and start doing real research if you all expect to have a good reputation. The "unhackable" claim couldve lead to lawsuits for false advertisement (and honestly surprised there was no class action after the stunt that was pulled after being called out about the issues noted with the device). Speak and operate from a realistic point of view especially if you want the business to survive.

I'm getting really bored of going round in circles while you simply deny provable facts. For anyone else interested, just search Google, Reddit or Twitter for "bitfi bounty" or "bitfi hack", and read the screeds and screeds of articles and posts which confirm everything I say.

https://rya.nc/bitfi-wallet.html
This is, yet again, simply not true. I have posted proof above that passphrases can be extracted from the device. I have posted proof that root access can be obtained, allowing a keylogger or similar to be installed and steal the passphrase. Just because it doesn't store private keys doesn't mean the funds can't be extracted when it is this easy to extract the passphrase.


Both Ledger and Trezor allow you to have as many different wallets protected by as many different passphrases as you want on a single device at the same time. There are literally thousands of users using this set up right now. I've been using this set up since before your awful brain wallet even existed. To claim otherwise is just showing just how ignorant of good crypto security you are.

Hi o_e_l_e_o,

It sounds like you are not interested in learning the facts and the truth, rather than thinking objectively you appear to be happy to make assumptions and then assume that these assumptions represent reality. We will, however, respond anyway because it is our duty to educate and correct misleading information in order so that others can get a clear and objective understanding.

1.) "When everyone is calling the bounty a sham because you refuse to pay it, and you are the only ones claiming otherwise, perhaps it might be you who are mistaken? The wallet was hacked (repeatedly). You refused to pay (repeatedly). End of."

How on earth did you determine that the bounty was being called a sham because we were refusing to pay it (even though we were never refusing to pay it & still will gladly pay it to anyone who can demonstrate they achieved the bounty)? It was being called a sham because hackers were not happy with the conditions of the bounty and some thought it was a marketing stunt. Some thought it was a marketing stunt because they questioned how feasible it is to extract information from a device that does not have information. You can see proof of this right here: https://twitter.com/SeanG294/status/1023835288848752642

However, as it turned out, the bounty was not a sham at all because as already described in the above post the private key remained in RAM for some time and so it was extractable. So someone could have achieved this and received the $250,000 payment.

Again, the wallet was hacked and we paid for what we were responsible for according to bounty conditions. You keep repeating that it was hacked multiple times, and we keep agreeing with you. You just don't seem to understand that the $250,000 bounty had certain conditions attached to it (as a bounty from any other tech company) that were not met and never even came close to being met. Would you like further proof?

2.) Yes. You worded the bounty so exactly so you knew you would never have to pay it out, even when someone extracts the passphrase from your device's RAM. How about this one, who gained root access, installed a patched firmware, and your device continued to run, no questions asked. You didn't pay that one either.

Here is the $250,000 bounty again: https://bitfi.com/bounty What in it is not clear? We showed it to many different people, even children and they all can understand the conditions:

- We deposit coins into a Bitfi wallet
- If you successfully extract the coins and empty the wallet, this would be considered a successful hack
- You can then keep the coins and Bitfi will make a payment to you of $250,000
- Please note that we grant anyone who participates in this bounty permission to use all possible attack vectors, including our servers, nodes, and our infrastructure

Can you please explain what part of this is "worded so exactly" that we would never have to pay it? So if someone did extract the coins, we would not have to pay or is it pretty black & white that we would have to pay the $250,000?

3.) Are you sure about that? Are you seriously now trying to claim you used the word unhackable but that it didn't mean that it couldn't be hacked? You are trying to redefine the English language instead of just admitting your lies? This is laughable.

We are not trying to redefine any words and in the above post we did say that the Bitfi device was hacked, multiple times. You are completely ignoring the point where we explain that we were trying to describe Bitfi technology that does not store any private keys and therefore it is impossible to steal funds. In other words, if the device is hacked, there would be nothing to take. Its a completely new way of securing digital assets and its not always easy to explain. In any case, we dropped the word "unhackable" from our branding and it hasn't been used for a long time.

4.) Except you can, and I linked proof of that happening above.

No you cannot. You were able to last year. We stated several times already in our replies that we are shipping the DMA-2 which is a totally different product than what you saw in the hacking demonstrations. It cannot be done now, as already described, since our engineers addressed all discovered vulnerabilities.

5.) If I need you to give me a key to access it, then it's not open source.

Everyone gets a private key so long as they are a developer and every Bitfi user has a private key. No developer is denied a private key. So yes, it is completely open.

6.) Another complete lie. Both Ledger and Trezor support unlimited wallets on one device with the use of a passphrase. See: https://support.ledger.com/hc/en-us/articles/115005214529-Advanced-passphrase-security and https://wiki.trezor.io/Passphrase.

You didn't understand the content in the 2 links you provided. Both pages describe how you can set an additional password (for advanced users) on top of your 24 word seed. In the case of you being tortured you will give up that password and all your crypto will be gone. Again, we repeat, Bitfi is the ONLY wallet that can give you protection from this kind of attack and neither Ledger nor Trezor allow you to have multiple wallets on one device.

7.) Only because the entire crypto world has called you out for your repeated lies. You repeated the unhackable nonsense over and over again until you finally realized everyone was laughing at you.

Why would we want to create tension and bickering in the crypto community if our mission is to drive adoption and innovation? If the word "unhackable" made people in the cyber security community angry it would be foolish to keep using it.

8.) Add all the points I just made to all the previous points I've made, we must be up to about 20-30 lies in this thread alone, never mind the hundreds on your twitter account.

Can you point out one specific lie? You are saying 20 - 30, but we don't see them. We are asking for your help to identify the lies so we can remove them from our website and other materials. Don't you want your fellow crypto users to have access to accurate information? This isn't about Bitfi, but about the thousands of people who use it. Please help these innocent people by just identifying a few specific lies so we can fix them immediately.

9.) You literally threatened security researchers - https://twitter.com/matthew_d_green/status/1026432597856006145. No one in their right mind will ever trust you.

This was taken completely out of context as the hackers wanted to do anything they could to mislead and confuse the public about Bitfi. Even thought all this was conveniently deleted, the archive still exists: http://archive.is/Svbt7#selection-713.1-713.161

It is clear that our threat was due to their use of our logo smeared in diarrhea and posting it all over Twitter and in no way shape or form was anyone being threatened over the attempted hacks.

10.) And the vast majority haven't sold out and are continuing to expose you for the scam that you are.

Please clarify what part of us is a scam so we can fix it. A scam is a fraud in which one is misleading people in order to steal their money. With Bitfi when a customer places an order they receive the wallet and are provided with both email and phone technical support. Not a single Bitfi user ever has lost funds and we have users with $50m or more in a single Bitfi Wallet and they too have never lost a dime. We are open to constructive feedback on how to end the scam that you claim.

When everyone is calling the bounty a sham because you refuse to pay it, and you are the only ones claiming otherwise, perhaps it might be you who are mistaken? The wallet was hacked (repeatedly). You refused to pay (repeatedly). End of.

Yes. You worded the bounty so exactly so you knew you would never have to pay it out, even when someone extracts the passphrase from your device's RAM. How about this one, who gained root access, installed a patched firmware, and your device continued to run, no questions asked. You didn't pay that one either.

Are you sure about that? Are you seriously now trying to claim you used the word unhackable but that it didn't mean that it couldn't be hacked? You are trying to redefine the English language instead of just admitting your lies? This is laughable.

Except you can, and I linked proof of that happening above.

So the key was on the RAM, and therefore extractable? I thought you just said it wasn't? You are really getting caught up in your own lies here.

If I need you to give me a key to access it, then it's not open source.
 
Another complete lie. Both Ledger and Trezor support unlimited wallets on one device with the use of a passphrase. See: https://support.ledger.com/hc/en-us/articles/115005214529-Advanced-passphrase-security and https://wiki.trezor.io/Passphrase.

Only because the entire crypto world has called you out for your repeated lies. You repeated the unhackable nonsense over and over again until you finally realized everyone was laughing at you:
https://twitter.com/TheBitfi/status/1024979075566329856
https://twitter.com/TheBitfi/status/1024552929074839552
https://twitter.com/TheBitfi/status/1025058277552467969
https://twitter.com/TheBitfi/status/1019231065599283200

Add all the points I just made to all the previous points I've made, we must be up to about 20-30 lies in this thread alone, never mind the hundreds on your twitter account.

You made it so specific so you would never have to pay, even when private keys and passphrases were extracted from your device.

So you admit your unhackable wallet has been hacked multiple times?

You literally threatened security researchers - https://twitter.com/matthew_d_green/status/1026432597856006145. No one in their right mind will ever trust you.

And the vast majority haven't sold out and are continuing to expose you for the scam that you are.

Why would an unhackable wallet need to have vulnerabilities addressed? I wonder.

Hi o_e_l_e_o,

We are going to assume that since you support cryptocurrency which was created by cypherpunks, that you also must believe that truth & fact are fundamental principles behind the social change that was driving Bitcoin's development. We are not asking you to agree with any of our opinions, but just to consider the facts that we will gladly and eagerly present.

Please allow us to address your comments with facts:

1) The reason the $250,000 bounty was discontinued is because large groups of hackers were referring to it as a "sham" and it clearly made many of them angry. This is the only reason why the bounty was discontinued. Here are a just a few examples of those attacks on the bounty:

https://twitter.com/barton_paul/status/1024395617525800961

https://twitter.com/MrSm0keTooMuch/status/1035574600564916224

https://twitter.com/gsuberland/status/1025083694070026242

However this bounty was open for several months before it was finally cancelled. In that time, no one has achieved it.

The second bounty was not launched when the first one was closed, it was also launched months before and both bounties were cancelled simultaneously (with the second one being achieved)

You are saying that we "won't pay the second bounty either", but this is demonstrably false as can be seen here where we are offering the payment and acknowledging that the second bounty has been achieved: https://twitter.com/TheBitfi/status/1038339727961800704 this public statement clearly indicates that the second bounty is being paid out.

2) There was simply no bounty for what you are showing here: https://twitter.com/saleemrash1d/status/1035269363903946755 How could we have refused to pay something that wasn't in place to begin with? If some attack was presented to Microsoft or Oracle (with absolutely no reproducible method, by the way) for which they had no bounty, they also would not pay unless something was negotiated in advance. To clarify, in this attack it does not allow him to steal every coin stored on the device, as the device didn't store coins. What this attack allowed was to modify the device in such a way so that if this attack is done without your knowledge and then you use it next, then your coins could be stolen. This is not stealing coins from a previously used Bitfi. (This was of course fixed a long time ago and we are no longer shipping the model on which this attack was demonstrated).

3) We are not saying that we were not using the unhackable claim. John McAfee was so impressed with the wallet that he told us that it was the first unhackable technology he has ever encountered and we started to use it in our marketing. What was meant by this claim is that the device does not store private keys and therefore the funds could not be extracted, not that the device itself could not be hacked. Unhackable is a word that has no definition and you will not find it in any dictionary. We meant no malice in using the word, we were just trying to find ways to communicate and explain Bitfi technology which is very different from anything else.

4) You cannot extract anything from Bitfi's RAM and this was already forensically measured. We are now shipping the DMA-2 that does not retain the private key for even one second. Having said that, the previous version which didn't have perfect memory management had the private key remain in RAM for some time, in some cases even for a few hours. However, a few hours is still infinitely better than having all your private keys (not just one key) remain on a cold storage wallet forever.

5) Please don't judge the developers platform before having seen it. We will give you a private key to grant you access so you can go in and look around. Its just a couple of days away.

6) The $5 wrench attack: Bitfi is actually the only wallet that can give you protection from this kind of attack. If someone comes to your house and you have a regular cold storage hardware wallet and they are torturing you, you have no choice but to give them access and they will take all your funds. However, because Bitfi does not have any private keys (it acts as a private key generator) you can create an unlimited number of wallets with one device. For example, you can have one wallet with passphrase o_e_l_e_oLovesBitcoinTalk.org that contains $500 and a second wallet with passphrase o_e_l_e_oLovesBitcoinTalk.org2 that contains your life savings (lets say $100,000). So if you are being tortured you would give the attacker access to the decoy wallet with the low balance and the attacker thinks he/she cleaned you out - they have absolutely no way of knowing that you have other wallets (it is impossible to know).

7) Of course we admit that the device was and is hackable. This is in our first FAQ on our website. However, it is also important to understand that the device is not the wallet. What we do know for sure: it is impossible to steal money from a previously used Bitfi Wallet and that the Bitfi Wallet is the only wallet that cannot be seized by law enforcement or anyone else. It does not have any private keys. We have also addressed all the vulnerabilities that have been pointed out on Twitter (some were real and many were fake) and launched the DMA-2 with these vulnerabilities fixed.

8.) We still don't see which claim is a lie. If you can point out any specific claim that is a lie, it will be immediately removed.

9) Regarding your summary:

A. We did not offer $250,000 for anyone to hack the wallet. We offered $250,000 specifically for accomplishing the following: https://bitfi.com/bounty
B. Yes, but not days. It was weeks.
C. Yes at times things got really emotional and we acted inappropriately and for that we apologize. However, the researchers also insulted us, for example by using our logo smeared in diarrhea as their avatar, calling our bounty a sham & then calling outrage when we cancel it, claiming that we don't pay bounties when we always pay (we even donated to the Mental Health Hackers, an organization that helps the very people who were attacking us: https://twitter.com/TheBitfi/status/1077054969902219265), etc.
D. During the last 7 months our engineers have been engaged in very intensive development, not just waiting. And just so you know, several hackers from the group who were originally attacking us on social media are working here as employees for the last 7 months because they realized they got some things wrong and they also realized the remarkable potential of Bitfi technology.
E. We did not relaunch the exact same product again, but a very different product shipping as DMA-2 that has all the vulnerabilities addressed (the ones we were able to verify as real) and then additional features to improve it even further over and above those vulnerabilities.

Not sure why you are bringing up Ledger and Trezor when they have been hacked hundreds of times and had dozens of serious hacks in just the last few weeks (while our vulnerabilities occured within weeks of launch, these companies have been in business for years and they have more serious security issues now than we did upon our launch). Just a few recent examples:

https://www.chepicap.com/en/news/6222/trezor-one-ledger-nano-s-and-blue-get-hacked-ledger-denies-trezor-will-update-.html

https://thenextweb.com/hardfork/2018/03/20/ledger-nano-s-hack-cryptocurrency/

https://smartereum.com/46184/ledger-wallet-hacked-ledger-wallet-hacked-with-simple-radio-antenna-according-to-security-researchers-cryptocurrency-wallet-news-today/

https://steemit.com/trezor/@lexiconical/trezor-hack-devices-are-not-secure-private-key-can-be-extracted-at-startup

https://medium.com/@Zero404Cool/trezor-security-glitches-reveal-your-private-keys-761eeab03ff8

https://cryptoslate.com/ledger-reveals-five-vulnerabilities-in-competitor-trezors-wallets/


Thank you again for opportunity to respond,

Bitfi Team