Topic: Foundation Passport Official Thread - page 2. (Read 4583 times)

Nice.

Generate on the device  let's say 1000 (or whatever number you want)  SEEDs and have 1000 x 20 = 20 000 child-seeds. Or reset device and generate child-seeds each time with the same Master SEED but starting with different BIP 85 index.  But I don't think that  personally you need such quantity.

Whether you  like it or not Passport device is limited in number of child-seeds it may generate.


Nice, then look for other device. Passport is not for you.


Probably yes, but the niche is extremely narrow (currently one can count on fingers those  companies that use BTC in their accountance, probably they are  non-existent) . Foundation is relatively young to encompass all market and pay attention to its miserable part .

Yeah, I just made up that scenario as an example, but it's not what I'm using BIP85 for.

I think BIP85 is a very powerful tool that more advanced Bitcoiners who do self custody will find great use for in years to come because it provides an extra layer of backups for everything.  Lost a key?  Regenerate it.  Want to confirm a word in a seed?  "Is that an l?"  Regenerate it.  It's so easy.

For the average Bitcoiner doing self custody, the way the Foundation Passport does BIP85 is probably very useful, and I'd definitely recommend Passport users check it out.  But for my needs, I think it's not what I'm looking for.  I want quick access to plaintext child seed QRs.  I don't want to save the child seeds since I won't actually be using this hardware wallet as my hardware wallet (and also because I use my hardware wallet 100% stateless).  For me, this is about recovery from a parent seed, not general use of the child seed itself.

I'm starting to think about forking SeedSigner (or doing a DIY Raspberry Pi app) to make a Quick BIP85 device that does nothing but scan a parent seed, ask for a BIP85 index number and seed length to generate, & then display the child seed words followed by a plaintext QR.  That'd be a huge project for me, and it's beyond my current abilities, but it might be something to work on for the fun of it.

The company example sounds like a potentially good example if the accounts of the employees were to be for company expenses rather than for the individual as an end payment.  The employee might be able to spend from such company owned accounts within parameters outlined by the company, and perhaps from time to time the account receives payments from the company or even might receive payments from customers, and maybe the account has to be replenished from time to time by the company or maybe even have some payments back to the company from time to time, but also the company has the ability to remove the authorization from the employee or to recover the account if the employee were to have had lost access to the account or if the company chooses to remove the employee's access to the account.  One account could also be accessible by several authorized employees, such as a departmental account that is ultimately owned by the company but largely managed by authorized employees within the department.

You're still not seeing it.

BIP85 turns a parent seed into the ultimate backup of anything you'd want to secure using words, not just Bitcoin.  I use a 12 word child seed as a decryption key.  12 words means it's unhackable, and being a child seed means it can easily be regenerated from the parent seed.  So, there's no danger of losing the decryption key since it can be regenerated by the parent.

That's why I'm trying to find a hardware wallet that makes generating BIP85 child seeds quick and convenient.


I have no interest in saving them on the device.  In fact, I specifically do not want to save them on a device.  I just want to be able to quickly regenerate a child seed if I need it.

Sorry if I was rude before, but being asked "Why would you need that?" is like asking "Who needs deterministic wallets?  Isn't that overkill?" or "Why have a seed use words instead of numbers?  Who needs that?"

I've become a huge advocate of using BIP85.  There's no such thing as a lost multisig key if they were generated by a parent seed since the parent can easily regenerate every child seed.  All you need to know is the index number to get a key back.  It's a brilliant system.  I'm actually surprised BIP85 hasn't caught on among more experienced Bitcoiners.


Can you explain the 20 key limitation?  I assume that's a limitation of your device, since BIP85 can generate millions of child seeds - not that I need millions.  I'm just trying to understand the device since it requires extra steps such as saving and naming the child, for example.  I don't need to create the child seeds.  I did that last year.  I'm looking for the easiest way to regenerate one of them if it's lost, or if I'm traveling and need one for whatever reason.  In a perfect world, a device would just ask for the BIP85 index # and the child seed length, then show me the words so I can confirm it's correct, then give me the QR code to scan with my main hardware wallet (which doesn't do BIP85).

I don't have a high number of child seeds yet, but I do already have more then ten, and I assume I'll have more in the future since a child seed is backed up by the parent seed, which means so long as the parent seed is securely backed up (paper, metal, safe deposit box, etc), child seeds become a foolproof way to avoid loss.  Lose a key?  Regenerate it using the parent seed.

BIP85 makes managing seeds so easy, in terms of keeping track of which is for what.

We absolutely do implement BIP 85 correctly, and allow you to create a child key at any index. We intentionally start at index #0 to ensure that users who don't have complex requirements could easily find their child keys in the future if they didn't note them down somewhere by just starting at index #0 and iterating through them until they find the right one. Hopefully users would note down their index #s or use encrypted MicroSD backups to prevent needing to do that, though!


It does show the exact steps in both text and a GIF, but I'll detail them here for you as well  

Creating a new child key is as easy as New Key > 12/24/Nostr > Choose index (defaults to starting at #0, can be set to anything you'd like) > Set name > Done. If you want to then view the QR you simply select the key from the list in Key Manager > Export > Select Format (Words/Compact SeedQR/SeedQR/MicroSD) > Done. Just to be sure I explicitly setup a key at #105 to test this with no issues 

Click me for GIF!

All of this is 100% to BIP 85 spec, and if you have a specific need for abnormally high index #s you can do that, or if you have a need for an abnormally high number of keys you can do that (you can create 20 keys per master private key, so applying a passphrase allows for 20 more child keys).

If you have any more questions I'm happy to help Meuserna, but let's please keep the tone civil and be kind to all of those in here trying to help answer your questions!

Example with a parent is  the good one.

But could 20 different keys (SEEDs) be not enough to cover this ?

Definitely, If he has 21+ kids then Passport will not suite him, but, rhetoric question follows.  Who has such a gang?

Example with  a small company is bad in my view. Employee would not agree  to receive payment on wallets controlled by their boss.

For me Foundation's approach is the  wise one. There is no need to litter device's memory with the stuff that will be never used.

I'm not asking how to retrieve the named child seeds, or even how to name child seeds.  I'm asking how to generate a child seed in the first place.

It should be as simple as Choose Index Number.  Choose Seed Length.  Here are your words.  Display QR?  Done.

I own a Blockstream Jade, and the process of generating a child seed takes a bajillion clicks.  It works, but a process that should take less than 10 seconds instead takes a few minutes.


You can't be serious.  I can think of tons of examples.  Here's an easy one.  Let's say a parent sets up wallets for their kids, as college funds.  The dad uses his seed as a parent seed and uses the year each child was born as the child seed index number.

Here's another example.  Let's say you have a small company and some employees get an expense account.  Give each employee a child seed wallet using their employee number as the index number.

This is very standard stuff.  Advanced, sure, but standardized.  Just follow the BIP85 spec.  Limiting the millions of BIP85 index numbers to just 0 through 19 seems...  bizarre, arbitrary, and pointless.

Ah well.  I already have a hardware wallet that does BIP85.  I was just hoping to find one that does it well.  My search continues.

There is no need to do many clicks  to get QR for  relevant child seed.

When you engaged into  the child seed generation on Passport you name every  following child SEED (key) . The list of these names is available in  Key Manager Extension. Thus going through this list you need a couple of clicks to get the relevant QR.

Regarding  index number 105,  Passport is limited to generate 20 keys (child-seeds) and I'm not sure if it can start let's say from BIP85 index number 100 (to cover 105) rather than from number zero.

And I repeat my question again. Is there any sense  to be concerned of   #105 but not any other number in 0-19 interval?

That page DOESN'T show the steps.  It just gives an overview, which is why I asked the question here:  Walk me through the steps.

Let's say I want to get a QR code for a 24 word child seed for BIP85 index number 105.  What are the steps?  I'm not going to spend over a hundred bucks on a device only to find out it's a ton of clicks & isn't more convenient than using a Blockstream Jade, which does the job though inconveniently (click click click, step step step, click click click).

Gotcha.  That means they're not really doing BIP85.  They're doing a limited version where you're locked into only using the first 20 index numbers, and I'm guessing they do some nonsense where they automatically choose which index number to give you.

Sheesh.

That's so stupid.

The proper implementation should be: Choose an index number & choose a child seed length.  That way, years from now if you lose a key & need to get it back, you just go back to the parent seed plus the index number without ever having to think about how the hardware wallet you set it up with worked.  My BIP85 child seeds can be regenerated by any wallet that does BIP85 correctly.  Enter the index number and choose the child seed length.

For anybody reading along who isn't familiar with BIP85, check out Ian Coleman's Mnemonic Converter tool (not with your real seed of course.  Just use it for testing & learning).

https://iancoleman.io/bip39/

Click "Show BIP85" to see how a seed with an index number generates another seed.  And since it's just math, your seed with that same BIP85 index number will always produce the same child seed.  BIP85 is a fantastic way to juggle multiple seeds.  The parent seed becomes a backup for them all.

This quote, from the BIP85 github sums it up so well:


It really is that simple.

According to what was declared in this official video-guide Passport is capable to generate 20 child seeds, thus your willingness to have  "child seed #105" would be a zeal, nothing more. Is there any sense  to start with #105 but not #0? 

BTW, when generating child-seeds Passport offers to give it a key-number (proposing "0"). I think that "0" is relevant to BIP85 child-key index.  Probably it can start from not "0" index, but I'm not sure about this and reluctant   to test this as generated child-keys can't be deleted and Passport advises to generate them wisely.

Absolutely! We put a lot of time and thought into our implementation of BIP 85 called "Key Manager." We wrote a blog post detailing how exactly it works when we released the feature a few months back:

All your wallets, one backup | Foundation.xyz

If you have any questions out of that I'm more than happy to help.

Can anybody walk me through Foundation Passport's implementation of BIP85?

I want a hardware wallet that lets me load a QR with my parent seed and enter an index number & child seed length (12 or 24 words) to receive the child seed QR.  Can Passport do that?

For example, let's say I need to generate a new 24 word seed for a hot wallet.

I want to be able to scan my parent seed's QR code and then choose which BIP85 index number I want to use as the child seed.  Let's say I want child seed #105.

I want the device to give me a QR code for that child seed without making me jump through a ton of steps (write these words down, then write these words down, and these and these and these and confirm and confirm and and and...)  Good grief.  The parent seed IS the backup and I've already confirmed I have that by loading it!

...anyway...  I'm trying to find a hardware wallet that makes BIP85 easy.  Blockstream Jade and ColdCard do BIP85, but they make it cumbersome to use (though in fairness, I haven't seen how the ColdCard Q does BIP85 yet, but I'm not a fan of ColdCard's clunky UI.  I prefer a stateless device with quick QR access to everything).

Does Foundation Passport make it easy to get child seeds, or is it still a ton of click click click click click click click click click click click click click click click click click click...?

Is there a good reason to follow their path? Having a single SEED and different BIP39 passphrases one always may have separate sets of addresses. In my view, it is more simple and (at the same time) fool-proof approach than let's say "storing of 3 seed phrases" that may potentially threaten  the  security  model implemented by Passport.  

P.S. I like Passport's ability to follow BIP85 standard and  generate bunch of child-SEEDs which cover all possible cases  in use of HD wallets. For instance, one may use one of the child-SEED to feed ENVOY operating at  standalone mode.

Yes I was thinking about that, even generating multiple seed phrases would be good to have, and I think secure element memory should easily allow that.

As far as I know new Keystone devices allow storing of 3 seed phrases, Cypherock X1 can store 4, and Ellipal even more, not sure about c0ldcard and other hardware wallets.

Great (re)design that you made on the website @foundationdvcs. I particualry like the fact that you kept the color pallet the same between Passport, Envoy, and the website as well. I also enjoy the detail that some sections of the page resemble the exact shape of the menu that Passport holds. The devil is always on the details and you nailed it.

When will the celebrations start? 

1. Dark mode was a huge focus, most of the team are dark mode maxis 
2. Hmm, will have to do that for the next one! Great idea to bring that sort of thing to Bitcoin Talk as well.
3. Not that I know of, but would love to break into that market!


1. .xyz is actually becoming a very common TLD for big tech companies like Alphabet, so it's not as obscure as it can seem! There also are pretty limited domain options for a common word like "foundation" and a key goal was dropping the "devices" from the domain.
2. Do you mean storing multiple and loading them as desired? We do have a WIP feature that will allow you to load BIP 85 child seeds from Key Manager and sign from them on Passport which meets the majority of that type of need.
3. That was... an interesting and unexpected exchange  None of us had ever even talked to him but seeing someone try to wield restrictive licenses out of spite on social media was a new one for me 

Probably because their thought was something about  the drawing  of all Generations  to the color of Foundation :


I think Passport devices suite  both the youngsters and elders due to their clever UI/UX design and functionality.

Why choosing obscure .xyz domain?
I think having separate Passport HW domain or subdomain would be a good idea.
 
One question for you guys:
Are you working on adding support for using multiple seed phrases in the same time on one device?
More hardware wallets are supporting this, and I think it's a good idea to add it.

---

I had to post this here to show how ''serious'' keystone developers really are.  
Few months ago they posted fake open source license for keystone firmware, and they excluded Foundation Devices and Zach Herbet!
This was not open source, but they fixed it and remove that crap later.

https://github.com/KeystoneHQ/keystone3-firmware/blob/d9e7f20985140e38e4cf2c9f841f8e576d90e98f/COPYING-KEYSTONE#L19