Topic: 🔥Seedkeeper🔥 Hardware device to backup your seedphrase - V2 out now! (Read 505 times)

Quote from: Chikito on May 14, 2022, 07:01:13 PM

I just see this on my local board, Husna sharing this tool, I still don't know how it work, when the function still uses electronics as media for storing the seed, is that function can still be hacked from the internet even if it is offline?. (cookie, history and etc)

Is available for storing besides BIP39 seed such as Electrum seed?, because when I read how-to, there is generate a random seed, when different seed (electrum) from the default (BIP39), I doubt it will generally not as usual and make the confused when use for restoring it.

What material? SS304, Titanium, or PVC (ATM Card)?

how to restore when forget PIN CODE?

Quote

Your Seedkeeper card is protected by a PIN code: a 4-16 characters password used to unlock it

Seedkeeper is "offline". If you generate a masterseed "on chip", it's completly air-gapped. Meaning the hosting computer, neither the user is able to see it.
Of course, if you use our Seedkeeper-tool to generate a new seed or import an existing one and your computer has a keylogger, you might be compromised.

You can store any seed on the device.

Cards are made out of PVC like your ATM card.

If you forgot your PIN code, you wont be able to recover it. It's a security measure. But Seedkeeper-Tool comes with a one click backup solution. So you can initialize several Seedkeeper cards with different PIN code and import the same backup on each one.

How many digits codes? is that Seedkeeper have a number 0 for a pin?. because I'm just a little bit uncomfortable, Trezor hasn't Number 0 to create a pin which is my favorite number.

Why you don't make it like another seed keeper using steel?, the function will be more perfect, we don't need to worry about fire and we can keep it on a wood cupboard. And I don't know why we need to PIN for each mnemonic phrase where PIN/Password is we can use for an additional phrase using the same mnemonic seed to create another wallet/address.

Regarding the PIN code, you dont need a dedicated PIN for each seed you want to save in the Seedkeeper memory.
The PIN is unique, from 4 to 16 chars and can include 0-9 but also a-Z or any other char. You will be able to put "ImInLoveWith0" as a PIN code.
This code is needed everytime you want to access the chip memory.

Using a metal plate instead of the PVC will not be more secure or wont last longer in time. And metal plate isnt suitable for NFC communication. Seedkeeper card is NFC ready, the antenna is hidden in the PVC layers.

Chikito

legendary

Activity: 2366

Merit: 2054

Quote from: Chikito on May 14, 2022, 07:01:13 PM

I just see this on my local board, Husna sharing this tool, I still don't know how it work, when the function still uses electronics as media for storing the seed, is that function can still be hacked from the internet even if it is offline?. (cookie, history and etc)

Is available for storing besides BIP39 seed such as Electrum seed?, because when I read how-to, there is generate a random seed, when different seed (electrum) from the default (BIP39), I doubt it will generally not as usual and make the confused when use for restoring it.

What material? SS304, Titanium, or PVC (ATM Card)?

how to restore when forget PIN CODE?

Quote

Your Seedkeeper card is protected by a PIN code: a 4-16 characters password used to unlock it

Seedkeeper is "offline". If you generate a masterseed "on chip", it's completly air-gapped. Meaning the hosting computer, neither the user is able to see it.
Of course, if you use our Seedkeeper-tool to generate a new seed or import an existing one and your computer has a keylogger, you might be compromised.

You can store any seed on the device.

Cards are made out of PVC like your ATM card.

If you forgot your PIN code, you wont be able to recover it. It's a security measure. But Seedkeeper-Tool comes with a one click backup solution. So you can initialize several Seedkeeper cards with different PIN code and import the same backup on each one.

How many digits codes? is that Seedkeeper have a number 0 for a pin?. because I'm just a little bit uncomfortable, Trezor hasn't Number 0 to create a pin which is my favorite number.

Why you don't make it like another seed keeper using steel?, the function will be more perfect, we don't need to worry about fire and we can keep it on a wood cupboard. And I don't know why we need to PIN for each mnemonic phrase where PIN/Password is we can use for an additional phrase using the same mnemonic seed to create another wallet/address.

n0nce

hero member

Activity: 910

Merit: 5935

not your keys, not your coins!

Quote from: Tibu on May 23, 2022, 02:05:10 PM

Our readers are sourced from a trusted third party. It does not require any specific drivers as we are using well known chip that uses verified OS drivers. Eg: Realtek or Alcor.

That's very good to know, that you don't need to install some sketchy drivers and they work out of the box. Especially important with the current mess of 'Amazon card readers' that are apparently affected at huge scale.

Quote from: https://hothardware.com/news/how-cheap-smart-id-card-reader-sold-amazon-became-national-security-risk

The contractor purchased a $15 card reader sold by Saicoo on Amazon. The device has 4.5/5 stars and 11,700 ratings and appears in the sponsored listing section at the top of the Amazon search results for “PIV (Personal Identity Verification) card reader” or “CAC card reader.” The listing and reviews would suggest that this particular CAC reader is a safe and reputable device. However, when the contractor plugged the device into his computer running Windows 10, he was met with a message saying that the device’s drivers weren’t functioning properly. Windows advised that he find newer drivers on the vendor’s website.

The contractor followed this instruction and found drivers for the device on Saicoo’s website, but didn’t install them right away. He instead uploaded the file to Virustotal, which scanned the file for malware with 63 different antivirus tools. 43 of these tools indicated that the file contained malware, specifically the Ramnit worm.

Tibu

full member

Activity: 310

Merit: 151

Hardware and open source software solutions.

Quote from: n0nce on May 23, 2022, 08:18:14 AM

Regarding the card reader, you are completly right. But that's the exact same thing with every hardware that needs to be connected to the computer:
- USB cable can onboard a malware as well as bluethoot communication.

True, however, this is a very recent / current issue that was recently figured out; I also read about that. In theory, you can build MITM USB cables and whatnot [1], but it's not an acute widespread issue right now, unlike the card reader situation.

We are selling our own chip card reader because we can trust this hardware. But as you said, it is and will be a major concern in regards of the global security. Just as any other connection: people has to be careful.

Are you actually making your own card reader or sourcing it somewhere? Because if it's the latter, it could be affected, too. The issue is in the drivers.

Here's the first article I can find about it:
https://krebsonsecurity.com/2022/05/when-your-smart-id-card-reader-comes-with-malware

Would be worth checking your products / drivers you ship if they're affected too or not.

[1] https://mg.lol/blog/badusb-cables/

Our readers are sourced from a trusted third party. It does not require any specific drivers as we are using well known chip that uses verified OS drivers. Eg: Realtek or Alcor.

n0nce

hero member

Activity: 910

Merit: 5935

not your keys, not your coins!

Regarding the card reader, you are completly right. But that's the exact same thing with every hardware that needs to be connected to the computer:
- USB cable can onboard a malware as well as bluethoot communication.

True, however, this is a very recent / current issue that was recently figured out; I also read about that. In theory, you can build MITM USB cables and whatnot [1], but it's not an acute widespread issue right now, unlike the card reader situation.

Quote from: dkbit98 on May 23, 2022, 07:14:17 AM

We are selling our own chip card reader because we can trust this hardware. But as you said, it is and will be a major concern in regards of the global security. Just as any other connection: people has to be careful.

Are you actually making your own card reader or sourcing it somewhere? Because if it's the latter, it could be affected, too. The issue is in the drivers.

Here's the first article I can find about it:
https://krebsonsecurity.com/2022/05/when-your-smart-id-card-reader-comes-with-malware

Would be worth checking your products / drivers you ship if they're affected too or not.

[1] https://mg.lol/blog/badusb-cables/

Tibu

full member

Activity: 310

Merit: 151

Hardware and open source software solutions.

Seedkeeper is purely designed to store sensitive information. Secured by a PIN code.
You can use it to initialize a Satochip card or save an existing seed. It's useful to add an extra security layer and as a backup of your metal plate.

This means that in theory I could just erase wipe out my Seedkeeper card, and load it with open source code provided for Satochip or Satodime?

Quote from: n0nce on May 23, 2022, 05:06:58 AM

We are selling chip card readers because: 1) we have not release mobile app (and thus NFC communication) for Satochip and Seedkeeper products (not yet). 2) NFC reader are very expansive. Much more than a chip card reader.

Chip card readers could be serious problem and single point of failure for your product, for example I recently heard a news about card readers that came with malware infected drivers.
I didn't know that there is list of approved card readers, so anything that was not approved or certified could have some code hidden inside of them.
Even approved card readers can have some government installed backdoor, so I have hard time trusting any of them.
Is the card reader you are selling approved or not, and what kind of code it's using?
https://krebsonsecurity.com/2022/05/when-your-smart-id-card-reader-comes-with-malware/

For security reason, cards we are selling through our shop are "locked" to prevent any malware installation while in transit.
BUT, as everything is open source, we are also selling blank javacard that you can buy and load by yourself.
One applet at a time can run on the chip. And yes, if you want to load the Seedkeeper applet for testing purpose, then erase it and load the Satodime one or the Satochip one, you can.
Check out our compatible Javacard: https://satochip.io/product/satochip-diy-and-developer-card/

Regarding the card reader, you are completly right. But that's the exact same thing with every hardware that needs to be connected to the computer:
- USB cable can onboard a malware as well as bluethoot communication.
We are selling our own chip card reader because we can trust this hardware. But as you said, it is and will be a major concern in regards of the global security. Just as any other connection: people has to be careful.

Tibu

full member

Activity: 310

Merit: 151

Hardware and open source software solutions.

Quote from: n0nce on May 14, 2022, 08:20:51 AM

I see this as a less safe version of a laminated paper backup (since it can be damaged by heat, cold or radiation), but maybe a bit more convenient. Though I wonder how often you make and restore seed words backups (probably not very often). However I do like the other products Tibu makes and will probably try Satochip in the future. Indeed, it's much more stealthy to carry around a regular card instead of a bulky hardware wallet and it might be a replacement for the software wallet I use for on-the-go payments. It's just a pity that while the device itself is as slim and inconspicuous as it gets, you always need a bulky reader to actually use it.

-> Our products are also great in combination with existing one... Such Ledger or Trezor. You can have a Satochip card as a backup or as a "traveller" hardware wallet while you keep your Ledger in the bank safe.

I was mostly referring to the seedkeeper; I don't really get the benefits of doing a seed word backup on a smartcard instead of laminated paper. Since restoring seeds is something you typically do so rarely that the convenience of a smartcard is not really needed. Manually typing them in in those rare occasions is totally enough, in my opinion.

Quote from: n0nce on May 16, 2022, 06:10:07 PM

I totally missed that they have NFC; then it might actually be a pretty cool device to use in conjunction with a phone, since more phones have NFC than PCs or laptops. It would also be relatively inconspicuous quickly holding a card to the back of your phone even in public spaces. I'm generally not a fan of NFC or other wireless technologies on hardware wallets, but in this form factor and for this application (small amounts for usage on the go) it could actually make sense.
But if I understand correctly, unfortunately their software only runs on desktop OSes - missed opportunity in my opinion. If I can carry a laptop, I can also carry a Foundation Passport.

You are right. Our "NFC' mobile application protfolio is weak at the moment. We only have the Satodime Tool on Android.
But we are working on the iOS version and the mobile app for Seedkeeper. We can easily imagine to integrate Seedkeeper with Blue Wallet or Muun Wallet (non custodials soft wallet). And when a user want to create a new wallet, he can just tap his Seedkeeper and the seed is store within the card. It's easy and straight forward. It will be easier for newcomers to start with such software wallet as they would'nt have to deal with the seed. -Store in a dedicated device and forget -

Is this technologically (API-wise) possible on iOS? Since I believe no NFC-capable wallet exists so far that works with iOS, does it? Therefore I assumed it's a kind of software limitation by Apple. But I can definitely be wrong on this; I don't have a lot of knowledge on this topic.
The question arises whether you trust a smartcard's secure element more than your phone's, but I am sure that 'mobile' will be the most useful application for such a device. Since as I said before, as soon as you carry even a tiny purse or a bag, like when carrying a laptop with you, you already have enough space and carrying capability for something like Trezor or Passport. These things are already tiny, but obviously don't fit in a wallet. So I don't see a need for smartcard cryptowallets unless you're in a situation where you only carry your wallet and phone, and nothing else.

Regarding your first statement, Seedkeeper is not only a memory. It encrypts and stores your secrets within a dedicated element, tamper-proof. With a piece of paper, the biggest problem is not really the material itself but the fact that the seed is usually written in plain text. Thus if someone finds it, he got it. But indeed, the seed is something you dont have to deal on a daily basis. But that's also a problem because when you need it, maybe the time has passed and you cant remember where you put your seedphrase Grin

Regarding the iOS part, yes it is. Apple does allow NFC enabled app since iOS 14 released back in 2020. But you are right, before this date, it was barely impossible to use the NFC with an iPhone.

dkbit98

legendary

Activity: 2212

Merit: 7064

Seedkeeper is purely designed to store sensitive information. Secured by a PIN code.
You can use it to initialize a Satochip card or save an existing seed. It's useful to add an extra security layer and as a backup of your metal plate.

This means that in theory I could just erase wipe out my Seedkeeper card, and load it with open source code provided for Satochip or Satodime?