Topic: Cold wallet transmissible to my heir in a trust-minimized fashion. (Read 317 times)

I tried out this wallet and it definitely looks good so far.

I did notice there is a "withdraw from wallet" fee of about 0.1%. Is that correct? I assume this is part of the business model as the app is free and it is free to deposit into the wallet, but there is a cost to withdraw.

Using an android device for the cold wallet seems pretty secure to me by using the following workflow:

1. factory reset android device
2. add google account to device (If I remember correctly, if using 2FA with the google account, you will need to enter this code as well when adding your account to the device)
3. add a unique password to the startup of the device or when the device is locked
4. turn on wifi and connect to your own wifi
5. download app from play store
6. turn off wifi and forget wifi connection
7. run app and create a wallet with your own entropy or restore your wallet
8. add unique password to the app
9. use wallet normally
10. if the app is updated, then start at step 1

One thing I am not sure of though:

When I want to send BTC to another wallet and I am using the selftrust.me website, how do I know the app on the cold wallet phone is not sending the seedphrase/private keys to the selftrust.me website to be stored? This could be just an inherent limitation of wallets in general as we will always have to trust the wallet/seed generator to some extent, just as I have to trust in the full node I am running.

It would be nice if I could specify my full node for this wallet.

12 months would be sufficient in the use case you mention since our longest plan lasts 12 months. Therefore, assuming the person originally purchased a 12-month plan and goes to jail the next day for more than 12 months without access to her/his wallet, then, after 12 months, her/his heir will receive the information to take control of her/his wallet.

As I said earlier, if we stop activity tomorrow, we will obviously stop accepting customers. And from then on, we will keep an Amazon instance active for 12 months to send out any pending information to heirs (the cost of doing so for a year is insignificant, i.e
I agree that no solution is perfect. However, most people still have no solution to transmit their wallet to their heir after their death. Our solution is easy, affordable, flexible (you can enjoy your wallet till the end and change your beneficiary at any time), non-custodial, anonymous, and non-exclusive. Indeed, beyond our service, you can also put in place additional backup solutions.

Offline Android Device

Once our app is installed on an Android device of your choice (like a repurposed old Android phone for example), the device must be:
. kept offline for good,
. used exclusively for our app.

To ensure you keep your Android device offline for good, if you don't trust Android's airplane mode, you have two possibilities imo.

1) You can ask your local mobile shop to physically remove remote connectivity from your device (i.e. remove sim card slots, wifi modem, bluetooth...) before using our app. I did that myself on different Android devices (it is straightforward, usually costs $5-20 depending on where you are located, and takes less than 15 minutes).

2) You can simply remove the SIM card, delete all WIFI configurations, and never connect again to any networks once our app is installed.

In both cases, there will be no way for your Android device to ever transmit any wallet-related information beyond the information transmitted via QR codes.

Going out of business

To keep a minimal Amazon instance running (that's all we need to just send out pending information to heirs) costs USD8 a month. Therefore, even if we were to go out of business, we should be able to afford this insignificant amount for a year (enough to complete any pending commitments). And we'll have a strong incentive to do so. Indeed, paying for that last tiny cost will allow us to at least keep our head up after the failure and possibly prepare our next move with happy former customers lining-up... ;-)

What if someone goes to jail for 13 months ... and you go out of business the day the person is incarcerated? 12 months is too short, there has to be a way to do it without relying on the company.

They aren't, though. A phone in airplane mode is not an isolated device, and as I said above, your phone carrier, Google, and who knows who else can still send and receive data to phones which are in airplane mode. Similarly, even if you delete the wallet before turning off airplane mode, there is no guarantee that the files don't still exist and are accessible on your phone's storage, and could be transmitted to a third party at a later date. Cold storage has to be permanently air gapped.

Fair point.

Another fair point. My only concern is your statement that you do not know the value of the wallet - we do not know that to be true until your source code is released.

There is no way you can guarantee that. If you go out of business because you don't have any money left, how will you pay for your servers to stay up for 12 months to complete pending transmissions?

Thank you for taking the time to provide us with valuable feedback.

Cold Wallet

By design, with our wallet, the secret keys are really yours (created from your own entropy) and are always kept offline. This is in line with the definition of a cold wallet as you can see here: https://en.bitcoin.it/wiki/Cold_storage

Source Code

We are still at an alpha stage (that's why we propose to test our wallet with our money). We will obviously release the source code of the app once we are past this stage and publicly release our product.

Ransom threat

Imho, this threat is not a realistic possibility.

Indeed, we do not know who you are and have no way to estimate the value of the wallet you intend to transmit to your heir. Furthermore, the information you entrust us with is useless without the information that your heir already has and that we ignore.

Therefore, even if we were dishonest and planning to operate anonymously (which is not the case), we have:
. no power to steal your heir's inheritance;
. no reason to ruin our business and risk jail time by trying to ransom your heir for your wallet whose value is unknown to us.

Instead, our only incentive is to play by the rules and hopefully turn your heir into our customer.

Going out of business

If we go out of business, we'll use a customary 12-month sunset period to:
. let our customers know they need to find another solution for cold storage and for transmitting their wallet,
. allow our servers to complete pending transmissions to heirs.

Price of the inheritance service

We are still undecided but plan to charge USD 1-2 worth of BTC a month in order to make the service affordable to anyone.

Taking care of the inheritance by yourself or through a law firm.

We provide convenience and affordability. You can also use additional backup solutions beyond ours.

Now, compared to our solution, using a law firm is:
. way more costly (even with only a one-time fee),
. not anonymous,
. possibly troublesome if one alleged heir pretends to have been spoiled and sues your estate executor and/or your intended heir; this happens all the time and may delay for years your intended heir from enjoying your wallet (not to mention the hassle and legal fees your intended heir may have to face).

Android device in airplane mode

Once our app is installed on an Android device, the device is meant to be kept offline and for the exclusive use of our app.

If you don't trust Android's airplane mode to keep it offline, you can also ask your local mobile shop to physically remove remote connectivity from your device (i.e. remove sim card slots, wifi modem, bluetooth...) before using our app. I did that myself on different Android devices (it is straightforward, usually costs $5-20 depending on where you are located, and takes less than 15 minutes).

Alternatively, you can also simply remove the SIM card, delete all WIFI configurations, and never connect again to any networks once our app is installed.

Why an Android phone to shelter our app?

Hundreds of millions of people can't afford a USD 100 hardware wallet but can use a repurposed old Android phone dedicated only to shelter our app and protect their bitcoins (and possibly other crypto-assets). This is especially true in countries where people use bitcoins because they can't trust their local currencies and have no access to banking services.

1) As I said elsewhere in this thread, publishing the source code of the app is obviously a no brainer and will be done as soon as we are past the alpha stage (where we are now) and release the app publicly (right now, a few alpha testers play with our wallet using our money).

2) Using someone else's entropy (including Electrum's) always represents a significant risk.

3) In any case, an entropy generated by a software is not as random as an entropy generated through physical means (i.e. "physical entropy"), as you can see here:
https://en.bitcoin.it/wiki/Passphrase_generation

Our wallet facilitates the use of physical entropy. When you use physical entropy, you have the guarantee that your entropy is truly random. You can't obtain that guarantee if you use Electrum's entropy (or any software-based entropy). Yet, obtaining that guarantee is crucial since all your secret keys rely on the randomness of your entropy.

Yeah, I don't see why I wouldn't just use Electrum. You can generate the seed from either the phone or another desktop / laptop computer and it uses the computer's entropy by default which is good enough for most people. The seed has to conform to a standard or a checksum.

It's good there are other options, but the source eventually needs to be published or no one else is going to use it.

You can use your own entropy on any BIP39 supporting wallet by downloading https://iancoleman.io/bip39/ and running it offline. This also has the added advantage of being open source, so you can be sure the seed which is displayed matches the entropy you have generated. You haven't yet answered my question above about your claim that you are open source, but you provide no link to any code repositories. You can even just calculate it manually if you wanted - the only program you would need is something simple to perform a SHA256 hash for you to calculate the checksum.

At the risk of security. Various studies have shown that Google can track phones even while they are in airplane mode, and as soon as airplane mode is turned off, data which has been recorded while airplane mode was on can be transmitted.

This is too much work and to get a shop to open up the phone and get all those removed it will not only cost a lot and chances of it working again is quite slim as the kernel is built around controlling this connectivity modules. What if they have an expensive iphone and or another expensive device?

It will be much more easier for them to just get a HTC Exodus 1S which has a secured partition specially for crypto wallet. Having one integrated with the phone is far more secured than running a third party app.

All in all, keeping a paper wallet in a bank storage would be so much easier and cost effective in terms or legally making a will in case something happens to the owner , etc or a trezor.

Just my 2 cents.

Once you download our app on an Android device, you must keep this device in airplane mode as long as the app is installed.
You can also (as I  did myself) ask your local mobile shop to physically remove remote connectivity from your device (i.e. remove sim card slots, wifi modem, bluetooth...) before using our app.

In any case, once offline (in airplane mode or after physically removing all connectivity), you can use our app to create your wallet with your own entropy and offline-sign transactions via exchanging QR codes.

This way, by design, your secret keys are really yours (created with your own entropy) and are always kept offline. This is the definition of a cold wallet as you can see here: https://en.bitcoin.it/wiki/Cold_storage

1) To my knowledge, you cannot use your own entropy on Electrum. With our wallet, you can generate and use your own entropy very easily.

2) Using an air-gapped mobile phone (Vs. an air-gapped computer) brings you convenience (i.e. you have access to your cold wallet almost anywhere). It is also easier to scan QR codes with an air-gapped mobile phone.

3) Elipal is expensive and has the typical hardware wallet vulnerabilities: https://en.bitcoin.it/wiki/Hardware_wallet
With our wallet, since you choose your own hardware to install our app, you considerably mitigate such vulnerabilities.

I've had a look at your website, and there are a number of things which concern me enough to not want to use your service. Perhaps you can address them.

A phone is not a cold wallet.

I can't find a link to your open source code anywhere, and the "audit" link simply links to your wallet generator.

This is not trustless. We have to trust you not to go out of business, or hold our coins ransom whilst demanding our heir pay for the other half of the secret. At the moment we also have to trust your secret generation and transmission process, since there is no link to your source code.

There is also no mention of your pricing model. Why would I pay an ongoing subscription and trust an unknown third party, when I could just split my seed myself and pay a one-off fee to place half of it in my will with a reputable law firm?

You can't consider it as a cold wallet if its on a phone. Eventually the phone will go online unless if you're keeping it offline 24/7 without wifi, data then there won't be use of using a phone anyway. Plus not to mention the fact that you have to preload a third party app.

Pretty sure you need to be online first and then switch to airplane mode, or download from another phone and send it to your 'wallet phone'. In both cases, it still needs to connect with the internet or another device, and not as 'cold' as you think it would be.

Ignore me if I sound stupid but how would you download the app when your phone is on the airplane mode? It needs the internet to download the App right? 

Is the feature available only for Android at the moment? I would give it a shot on an iPhone any day. Also, kinda skeptical about going online to your web-app when things are supposed to be "offline."

What makes this any different than using Electrum for Android (in airplane mode), or a separate air gapped computer with Electrum?

There is also another hardware wallet called Elipal Titan that is completely offline and uses QR Codes.

Is it really trustless if it relies on your company not going out of business?


Even with gmail you can do it nowadays with their new 'scheduled send' feature.

And there are many similar services, e.g. https://www.deadmansswitch.net/

Google also offers a deadman's switch service: https://myaccount.google.com/inactive

Which specific services are you referring to?

The cold wallet works as follows.

1) Download our Android app on a device of your choice.

2) Keep the device on airplane mode while the Android app is installed.

3) Use the Android app to create your wallet following your own entropy.

4) Use the Android device to sign offline the transactions you generated online via our webapp (all communications offline/online are via QR codes).

5) Use our trustless mechanism based on Shamir Secret Sharing to transmit your wallet to your heir.

Here's some additional description of the cold wallet: www.selftrust.me

We give you USD 5 worth of btc to test our wallet and give us your impressions.