Topic: Mixin Safe (Decentralized Multisig+MPC+Timelock solution) review preperation (Read 1118 times)

https://bitcointalksearch.org/topic/m.62651709
https://bitcointalksearch.org/topic/m.62652614


@pakhitheboss and @Sakanwa, can you both please post the transaction ID of depositing in mixin safe and withdrawal ID too.
PS: If you don't want the information in public then feel free to PM me.

Sorry for any inconvenience. I need some proof that you tested the system not just wrote a review.

Cheers,

Yes we still need to improve the flow a lot, that's why we are testing and doing reviews. Thank you so much 

I'm looking for "Batch 4" users to test chat functionality. Who can I add? I don't want to PM spam, so please PM me to confirm who you are. My Mixin ID: 41189703.
I have enough people to talk to now, thanks

Thanks for the suggestion. Although when i login to Mixin Safe today, i discovered i can make recovery attempt again (the status no longer locked) so i decide to use recovery instead. Currently i'm waiting for "Waiting for Safe Network to approve this recovery..." which i've no idea how long it'll take (edit: it took less than 5 minutes).

You should definitely state on the website that version 25.0+ is required for creating the Safe (ideally in the combo-box where you can select the type of Safe you want to create). It was the only way I was able to sign the PSBT.

note: this allows you to sign PSBTs from Safe wallets created in older versions of Core

@ETFBitcoin:

Try creating another script wallet using Bitcoin 25.0 rpcs, make sure it's the only descriptor inside the wallet, and then copy the PSBT from the website and try to sign it again - first with the script wallet so it makes the required fields in the PSBT, then paste the output and sign it to the private key wallet.

Thank you for the clarification.


I definitely use Bitcoin Core 25.0 for purpose of testing Mixin Safe. In addition, i don't have other version of Bitcoin Core installed on my device.

For the Bitcoin Core signature issue, I thought maybe the Bitcoin Core is not version 25.0+?

Yeah, the name can be quite confusing. It actually confused a number of members.

If you have a smartphone, just use it instead to install the mixin messenger and mornin key and then use the computer, to visit the mixin safe website for set up and easier QR code scanning using the mobile phone.

I don't think the desktop version of mixin messenger has more futures like the mobile version

@Royse777 will be posting my review soon. by Aug 3.

i thought this is a mixer. i just installed it on my computer. I got a lot of issues due to the system requirements its giving me headaches. i end up using that flathub version for linux.

Coins in Mixin Safe will be secure, no worry if you keep at least one private key. Mixin Messenger or Bitcoin Core.

Now it looks like some instructions issues, the team is trying to make it more clear to use.

I sent a PM to cedricfung to write you a response. Hopefully you will hear soon from him.

The real experience will be appreciated whether it is a recovery attempt or transaction.

Yeah. I didn't read other user review before testing Mixin Safe. Anyway, i'm still waiting for response from Mixin Safe customer service so there's nothing i could do for now.

Oh damn... you got locked too?

Hopefully it was only a small amount. The Bitcoin Core approval instructions clearly seem to be incorrect.

@Royse777 I was about to finish to review, but unable to complete last process (sign PBST transaction with Bitcoin Core) use Bitcoin Core and i got locked from recovery process. The details of the problem can be seen on my review post[1]. Anyway, is it acceptable if my review is about "attempt to make transaction and use recovery instead" rather than "make transaction" ?

[1] https://bitcointalksearch.org/topic/cfnp-mixin-safe-decentralized-bitcoin-custody-solutions-review-campaign-5460259

Boss Royse777 have submitted my review before now and also filled the report form and I had to do it again to be sure , my name is reflecting two times on the report list.. This is the link to my review https://bitcointalksearch.org/topic/m.62596593

It looks like @Rockstarguy made a review but probably forgot to submit it through the report form. Maybe he missed out that bit of the instructions.
With the deadline coming in fast, try sending him a PM about this if he is not paying attention to the mention bot notifications.

Considering the circumstance, I will allow you to submit your review with batch#2 which means you can have the same deadline as they have. No worries.

Screenshot is not mandatory but use it when it is necessary. Your contents will reflect if a user indeed used the service. You can save screenshot in your device just in case you need to defend yourself if anyone ask question.  

I am in the process of writing. Here we had strong storms that caused serious damage to the internet and electrical network infrastructure, so I have been in very difficult conditions for the last few days. If there are additional outages today, I will post this so far written, around 70%.

I definitely wanted to ask, is adding screenshots mandatory or necessary? repeating the screenshot from the application probably only serves as proof that we really went through the process.
tx

Remainder to remaining 4 members from Batch#1.
Please submit your review before 23:59 UTC today.

Agree, for now you can revoke all authorizations from Mixin Messenger -> Settings -> Account -> Security -> Authorizations.

And whenever you sign in to Mixin Safe from a different browser, the old one will also be logged out.

Now adding the feature to logout of the service when inactive for some time.

@TryNinja

Maybe it is better if Mixin Safe had a UI (within both the desktop/web and the mobile apps) for you to revoke unsafe computers? It's very easy for a public computer (particularly Windows) to get loaded with malware that steals auth tokens and approves an unauthorized transfer.

@cedricfung what do you think? It would be a welcome addition to already asking the other devices for authorization of another device that's about to log in.

Any success with this?

If you can change numbers, can offer my help with an alternative number no strings attached. Let me know via PM. GL.

Thanks Royse777 for your understanding
I'll make a few more tries, if it works I'll let you know
Greetings to you

Sorry to hear that.
I am removing you from the list (temp). Currently the campaign is CFNP, before making a new opening if you are able to sort it out then let me know, I will add you back without making an opening.

Cheers,

Hi Royse777
Sorry to tell you that I would like to withdraw my application
During the past days I downloaded the necessary applications for my review and activated Mixin Safe with a virtual phone number successfully, but when I try to create a PIN to create a wallet I get the error in the picture:

                                     

I tried many times changing the number as well as changing the VPN but I get the same error every time, I contacted support via Mixin Safe chat and they tried to help me but unfortunately they could not find out the cause of the problem and my problem was not solved.

So I hope you will accept my apology and withdraw my application and give the opportunity to another participant.

Only noticed this when I reloaded the mixin dashboard, after several hours of doing my review , anyway a simple edit will fix it ,cheers  

If you believe it's a useful security feature, then I suggest you should add it in your review post if you are part of the selected reviewers. This is the main reason they decided to spend some money on the review campaign… Right?

Not sure if the question belongs here or not, but is it just me or others are experiencing this...if you log into Mixin Safe via the web platform , I have noticed that mixin doesn't log you out automatically even after hours of you not being near you PC! Is this suppose to work this way, thought after X minutes it should be asking you to sign In  with Mornin key 🔑 or something  

Hi,

Sorry for this inconvenience, which owner wallet are you using? May you send me the safe id through private message? Just the URL of this safe represents the id.

@cedricfung, I created a safe 2 hours ago and until now it's still on draft status. The note shows that the summary process only takes a minute. Am I missing something here to make my safe active? The support now is inactive while they have the online status. I decided to post it here to get an immediate solution to complete my test on the safe.

The image below is the current status of my pending safe.

Thank you  

Will keep improving the product and customer support.



Thanks for pointing out this, we are working on the website and brand improvement, now I also feel they look fragmented.

We will put everything under domain mixin.one, and the mixin.zone domain is only for beta test service, once the product is ready, it will be available at the one domain.

Thank you




Yes, ledger had that bug that generates a wrong address. For Mixin Safe, we don't use Ledger to generate the address, and we can make sure the address script is correct. Ledger is only doing the private key management.

Thanks for quick answer.
I will have to explore miniscript topic more, especially for hardware wallets, and I will try to find all wallets that support them.
If Coldcard supports miniscript than there is a good chance Passport wallet is also supporting it (they forked from old Coldcard code), unless they decided to opt out.
This is interesting topic for discussion, but if I remember correctly ledger once had a bug that was related with miniscript feature in their wallet.

I just started my review, but I decided to share this here first. As it is not exactly a review of the service, but a security alert.


There is a similar website, which the team should consider buying:
safe.mixing.zone/

This domain is owned by another company, and I mistakenly put it in my web browser.

Suggestion: put all your products in the same domain and redirect them. Multiple domains is confused for the user.
Currently domains that i noticed mixin team has:
https://safe.mixin.zone/
https://mixin.one/
https://messenger.mixin.one/
https://mornin.one/

I think adding all to the same domain and creating subdomains is much easier to users and customers. I am always worried when I move to another domain, specially within the same company/service

I use this SMS receiver online https://temporary-phone-number.com/ to get my SMS code, which arrives a few seconds after I request a code. Probably the problem is the fact that your country is not supported by the app then use other country's SMS to receive the code for the sake of the app test.

---

I just want to give a thumbs up to Mixin support for being quick to solve issues encountered on Mixin Safe. I recently encounter error code 500 when I'm trying to create a safe. They fixed immediately the bug and notified me via email to continue my test. Customer support is very active in helping customers. I hope this will continue in the long term.

Thank you  

The wallets listed are the only supported so far as I know, and only Bitcoin Core, Ledger, Mornin Key have been tested. And I'm sure Trezor doesn't support the miniscript feature yet, so not Mixin Safe compatible.



I just checked we have problem delivering SMS to Indonesian numbers, and we are working on the anonymous number feature which allows you to sign in with mnemonic words, will try to roll it asap.

OK, I somehow managed to register with Mixin and download everything that is needed for testing, so I decided to send my application for review.
I do like the idea of Multisig but let's see how this Mixing setup works in my real life testing.

Question for cedricfung:
Some people in my local board are not sure what wallets are supported except ones mentioned so far (Ledger, Bitcoin Core, Bitbox, Coldcard, Mornin key, etc), so can we get a full list of all supported devices/wallets?
Is Trezor hardware wallet supported?

Yeaaaah, I was a little quicker to apply, but I thought it was no limit for my area, but I realized it was a little careless. 

Okey, thanks @Royse if anything changes I'll PM immediately.

It means the same that Indonesia can't use Mixin, I only tried one provider, but with you saying other providers are the same it means I don't need to try again because the results will be the same.

No, I won't use the "free SMS receiver" it's worse, but I never knew about the paid OTP even though it's said to be premium but I'm still not sure.

I am able to download it with the method above. But, same as your situation, I can't receive any SMS, I changed several providers and still didn't receive it.

I never used it before because I don't know if safe it or not, but when appears OTP in public, I think it's not safe, Maybe someone out there waits this moment to create a parallel device.

connect with Owner's wallet like Bitcoin core is the next method after we successfully installed Mixin safe on the phone, there is a next step on Safe Dashboard which I think it's not affect anything even if we use other applications like mornin' key because we need installed mixin messenger on 1st step, if didn't, we can't use any method like bitcoin core, mornin key, and hardware wallet.

Removed you from Batch 2. If circumstance changes then let me know via PM, I will try to fit you a space.

Most "free SMS receivers" are crap and won't relay numbers to you, there are a number of SMS services backed by real numbers which you can see on kycnot.me and use for this purpose. It works just fine with a real number too.

Also, I just download the APK from 3rd party sources instead of using Google Play. It's not strictly necessary.


You should've installed the app and played with it a bit before signing up for the review, so that you could see if you could get it working.


I think you still need the PIN to sign in with the phone number, because the PIN is stored on their servers in some encrypted form.

If Mixin does not show up or rather not supported for Indonesia then chances are high that if you using an Indonesian number code via sms won't be received unless someone in your locality managed to get one through!

But like Royse said in the review thread, an online number can be used..have you tried this to bypass any potential restrictions?

Go for the bitcoincore method, goodluck

I tried with free VPN but still on Play Store that Mixin is not available in Indonesia, then I tried to download the APK file from Mixin but I can't receive the 4 digit code already 6x I re-send the code it still doesn't appear via SMS.

---

I am in the second batch of this review service but currently I can't do anything everything is not running normally. (Maybe for certain areas)
@Royse777 like I have to resign from the review, but luckily I always check first before the funds are sent.

Yes, I'm almost happy and excited to try when look the application has Windows and Linux download, but after installing, I still need login scan from the Android or IOS application, and I can't find also a button which I can log in use phone number on windows application, this mean installed application in a phone is necessary.

1 more important thing is I can find mixin applications on play store when my phone didn't connect VPN. this mean the aplication is not available in my country Indonesia.

therefore I can't join your service.

Okay, I'll give it a try. I'm kinda curious and new to the timelocked multisig script thing.
I've applied again so I don't mess up your "batch 4".

I am glad you removed some contents from the campaign thread or I was planning to remove it. All good now :-D

That second thought, it would be great if you try it from that old tablet. As far as I understand you need to download the app either from iOS or android unfortunately.
I would love to see what you have to tell in the review.

Cheers,

Correct, it's just for your test of the service, so that nobody knows it's your number or your account.

I edited my application earlier, but it's better to post my question here:
It looks like I'll have to install an app on a smartphone. I prefer a website for several reasons:
1. Smartphones are inconvenient to use for finances.
2. I can't easily use a VM or wipe my smartphone.
3. I don't want to install VPN software on my smartphone.
4. I never install unknown software on my devices.

If I can review without a smartphone, I'll gladly apply. If not, my review ends with "I'll never use such a service". I don't even install software from my bank.
On second thought: I can experiment with Mullvad VPN on an old tablet, and wipe it afterwards. It won't run very smooth, but it should work. Still, I prefer a desktop computer for anything other than "coffee money".

Does that mean someone else can access my account just by accessing the same phone number?

by using P2TR you will reduce the costs but in general, people are lazy to read the codes, so I think we may reach a stage of modernization in which there are hacking, just as happened with some bridges.

Let's continue the discussion on project development page.
 
Although I agree with you but I am surprised by the number of people who have applied for review Campaign, approximately 120 members, have access to hardware wallets or run bitcoincore and are willing to activate the service with them phone number.
I hope they read the terms of service and was not random.

Looking at this topic and the one that was opened in the project development board, a lot of observations and reactions have already been made. 

dkbit98, all curses upon you and may all good angels are with you :-P
To be honest it's my fault. I was not much conscious. Thanks both of you to make me confuse and then to pay better attention :-D

The review campaign is live!
https://bitcointalksearch.org/topic/cfnp-mixin-safe-decentralized-bitcoin-custody-solutions-review-campaign-5460259

I would love to see you all taking a part in it.
Cheers,

Terms and conditions for a review campaign for Mixing Safe will be announced in the next few days as mentioned by the OP.

Also I expect the application to be like signature campaigns usually, where members apply and those who are accepted can do the review.

I'd like to point out that "Mixing Safe" is not a mixing service but rather an "easy to use Bitcoin multisig wallet with timelocked recovery key for a long time" as mentioned in the product thread.

What do you require for this review campaign? I want to try my hands on doing a review. Is the application the same as if you're applying for a signature campaign? And can the signature campaign participants apply? When's the application starting and will it be in Services board?

Edit: Removed the mixing part

The whole product of  Mixin Safe is still in test phase, including the pricing packages. We included ledger a few months ago when it's the only hardware wallet that supported miniscript wallet policy.

Now I'm totally confused here. Royse777 seems to have added "g" and changed to "mixing" (judging by topic subject), but in their topic https://bitcointalksearch.org/topic/mixin-safe-a-convenient-and-decentralized-multisig-mpc-timelock-solution-5459401 the name of the project seems to be "Mixin Safe", without the "g".
What is the final name?


Why do you choose Ledger hardware wallet as part of some packages when they have completely lost confidence by offering some very risky and unsafe possibilities?

Hi, from the Mixin Safe team. The price shows on the website are meant to be the pricing proposal when product fully launched.

For test, the price is very cheap, starts at $2 per year, and it includes a free transaction to send, so $2 is the minimum cost for a tester.



Think we already talked about the product in the ANN topic.  For the test, I believe you have no need to worry about this. Before the anonymous number feature is fully rollout, you may use some phone number services on the Internet to get a random phone number just for a single SMS. Then you can begin the test, just you know that you may lose the account access because you don't own the random phone number, and if you like the product you can change the number to our Mixin Anonymous Number once it's launched in upcoming months.



Miniscript is expensive, that's the reason I don't like it. But it's the only standard that all hardware wallets are going to support, at least for now I can find announcements from BitBox02, Blockstream Jade, SeedSigner, and Coldcard have released miniscript demo.

Miniscript is a intermediate language that will translate to Bitcoin native script, so as long as the native script translated to is secure, the wallet should be secure.

Mixin Safe doesn't only support hardware wallets, also software wallets. Because from my opinion, Mixin Safe can already provides great security with Bitcoin Core or Mornin Key as the owner wallet, and I believe more and more software wallets will support Miniscript in the futuer.

Usually, review campaigns run by Royse777 are strictly regulated, so they are not available to everyone.  Therefore, most users will not be able to participate, and this will increase your chances of being accepted into this campaign.  
Then do not forget that the amount that will be paid for each review is not small, and therefore I expect that the conditions for creating the evaluation will not be easy and not within the reach of everyone.
Good to everybody willing to join and congratulations for the wallet project for choosing their advertisment strategy to be managed by Royse777. This would ensure honesty and credibility.

Nah it's not because whirlwind review compaign was Paying 100$ too, well i am so excited for this review compaign. As, lets see when it will go live looking forward. I think the name is little bit confusing because i thought its some kind of mixer.

I searched quickly about this service.

Personally, I do not like miniscript, and with the limited number of wallets that support this technology, recent ledger miniscript vulnerability^[1], Ledger Recovery^[2], and their price policies^[3], I expect that the number of users for this service will be very few and limited, and thus achieving a return from it will be difficult.
It is true that they avoid a single point of failure, and in theory their service is decentralized and better than Ledger Recovery, but such services will achieve greater success if they are from one of the producers of hardware wallets. In general, we will see future development, especially if P2TR is added.

I honestly don't know but I think it is hard to find 100 BTT account can join to the review campaign, or if I understood it incorrectly.  


[1] https://donjon.ledger.com/lsb/019/
[2] https://bitcointalksearch.org/topic/ledger-recovery-send-your-encrypted-recovery-phrase-to-3rd-parties-entities-5452900
[3] https://safe.mixin.zone/pricing

The biggest review campaign as far as I seen. I hope I can be a part of this review too. I will looking forward to testing.

I just made a glanced on the website, and I think the features are good and just that they have not linked the features to their appropriate menus. Let wait the launch of the review site to see the rules and  the content of it. I was also thinking that is a mixer company but it was when I checked the website that I noticed it was not a mixer. And really 100 participants are many but it is good to know different point of views on a review.

They said they are not a mixing service on their ann thread. Basically, a wallet app that claims to offer a better way for multi-sig so that their users can recover their funds as long as they have one of their keys. They hold one of them, just like other services in this field. CMIIW.

The name Mixin is not unfamiliar to me. I probably use one of their services in the past (Mixin Messenger) but I can't really vouch for their security, reliability, etc. I only used them for a short time. I'll probably participate if the process does not need personal info or something similar.

Sounds like a mixer yet it is not, more like a paid wallet service with a high transaction fee or i say service fee. But let's see since the site/service needs reviews.

Thank you. It has been taken cared.

Maybe download the app and start checking their features to prepare yourself for the review you will plan.

Is it Mixin Safe or Mxing Safe?  
I am checking their website right now to see what is all about in next few days.
One thing I really don't like from start  is that I have to use my phone number to use Mixin app 

All 100 members will receive 0.003 BTC, or only selected few of them, since you say they will have a chance, sounds more like some lucky draw?

100 participants for a review campaign? I think this will be the biggest review campaign on the forum as far as I know.

I hope that the reviewers will have the opportunity to test the service without paying a subscription, because I see that the price of the service starts at $100 per year. But, I will wait to see the exact conditions of the campaign.

Great and I will looking forward to helping  test them out and I also want to say that I have a good few reviews I've help done in the past and I will also love to help review the security of your service as it stated to be decentralized and in your product  discussion, also stated that there will be a third party  involved, which contradicts what decentralization means, frrom a lame man's understanding,  as he wouldn't want to hear of the word third-party in what promises to offer privacy.

Good luck mixing safe and looking forward to help with your review.

There will be a review campaign for Mixin Safe in the next few days. I am working on the review terms and conditions. For each review, 0.003 BTC (at current price it's $90+) will be rewarded.

The service is not like our usual services we see in gambling or mixing projects. It's a very different service. That's why I thought to have this topic so that everyone who will be interested in the review campaign can check the service and prepare mentally. We will have a tight deadline but I think it will be enough for reviewers to submit their review.

Please ask any questions if you have about using the product. I will request the management to guide you if needed.

We will have a total 100 members in the review which means almost everyone who will apply will have a chance to get the reward. The funds for the entire campaign has been already secured to my escrow wallet.

Product discussion on Bitcointalk: https://bitcointalksearch.org/topic/mixin-safe-a-convenient-and-decentralized-multisig-mpc-timelock-solution-5459401