Thread by @krippenreiter

[1/🧵] You've heard of @XummWallet but aren't sure if you can #trust its #security?

You'll learn about @cossacklabs' most recent security assessment and why the #XUMM #wallet strives to maintain the highest security standards.

Follow along in this "all-in-one security 🧵" 👇

[2/24] — Outline —
🔸 Basic Introduction
🔸 Hot #Wallet Fundamentals
🔸 #XUMM Wallet Security
🔸 #Security Audit (18.05.2023)
🔸 XUMM @Tangem Cards
🔸 #Tangem Card Facts

[3/24] — Basic Introduction —

After hearing the news of #Ledger willingly integrating a 🔑-extraction mechanism into their FW if opted-in, I decided it was time to review #XUMM + @Tangem

This 🧵 is not sponsored in any way, & all of my praise comes from the bottom of my ❤️

[4/24] — 1⃣ Hot Wallet Fundamentals —

▶️ #XUMM is a hot, self-custodial ("unhosted") mobile-only #cryptocurrency wallet designed exclusively for the XRPL ecosystem, allowing users to securely store their private keys, make payments, and engage with the #XRPL via #xApps.

[5/24] — 2⃣ Hot Wallet Fundamentals —

Regardless of how secure the app is, "hot" desktop & mobile apps have access to the internet & are only as secure as their weakest link.

Keep the following in mind:
🔸 Update your smartphone
🔸 Don't use public WiFis
🔸 Use strong passwords

[6/24] — #XUMM Wallet Security —

❓ How long would it take an attacker to successfully exploit the app?

🔸 ~99 quadrillion years → secret number
🔸 ~228 years → 6 digit passcode
🔸 There is basically no pw-length restriction for the signing password → 200+ years (16 chars)

[7/24] — 1⃣ #Security Audit —

@XRPLLabs had a security assessment performed by #Cossacklabs that required over 240 person-hours of work and was publicly disclosed on 18.05.2023

The main takeaway was:
☑️ "No critical vulnerabilities or immediate exploits were identified"

[8/24] — 2⃣ #Security Audit — BEFORE —

During the 1st evaluation, #Cossacklabs noticed that "only" 28 of the relevant 65 standards had been met.

Sounds worse than it is since #XUMM users were never at risk as long as their 📱 were updated and their passwords were kept safe. 🫡

[9/24] — 3⃣ #Security Audit — AFTER —

Following the implementation of the solutions, #Cossacklabs verified that 58 of the necessary 65 criteria were met, significantly reducing the number of unresolved issues.

Consider how much effort went into resolving all of that. 🔥

[10/24] — 4⃣ #Security Audit —

Many cryptographic flaws and weaknesses, according to #Cossacklabs, were caused by insufficient security controls that were already in place but did not meet the highest criteria.

[11/24] — 5⃣ #Security Audit —

As a result, @XRPLLabs opted to re-implement the whole cryptographic layer, thereby building on existing solid foundations to combat certain sophisticated edge cases.

[12/24] — 6⃣ #Security Audit —

Key takeaways:
🔸 Even #XUMM is not foolproof
🔸 No secrets were ever compromised
🔸 Security has been upgraded based on WASP MASVS v1.5
🔸 @XRPLLabs team is capable of fixing code related security issues
🔸 Hot wallets will inevitably be attacked

[13/24] — 1⃣ XUMM Tangem — Firmware —

There are @Tangem cards and #XUMM branded Tangem cards that both use one firmware that has been reviewed by #Kudelskisecurity with one exception:

The XUMM-branded #Tangem cards are not designed to sync the keys 👇

[14/24] — 2⃣ XUMM Tangem — Firmware —

Not only can the firmware not be upgraded by design, but the #firmware can never give out your #privatekey because it is physically only feasible to communicate through #NFC while keeping the secret truly offline at all times.

[15/24] — 1⃣ XUMM Tangem — Best Practice —

Here are some guidelines to make your cold storage genuinely secure:
🔸 Create a #PIN / Password on your card using #XUMM
🔸 Purchase 2 cards and configure your "Plan B" using the "Tangem Backup" #xApp within XUMM

[16/24] — 2⃣ XUMM Tangem — Best Practice —

Additional suggestions:
🔸 Use 4 cards (2 #XRPL accounts) to separate your hot & cold wallets
🔸 Do not 'root' or jailbreak your phone and use your cards on it
🔸 Less is more, so use your cold storage to save your funds in the long run

[17/24] — 1⃣ XUMM Tangem — Hardware Chip —

The "SE" within the card, which is practically indestructible, is the #S3D350A microchip from #Samsung

Entropy is created from the chip's inherent physical noise source via thermal noise amplification 👇

[18/24] — 2⃣ XUMM Tangem — Hardware Chip —

Now that we know the source of genuine randomness utilized to generate the secrets, what about the #CPU? 🤔

#Tangem employs the "#Arm #SecurCore SC000 Core," one of the most extensively licensed 32-bit smartcard processors in the world

[19/24] — 3⃣ XUMM Tangem — Hardware Chip —

The #Tangem microchip passed the "Common Criteria #EAL6+ Assurance Level," which is required if your chips are to be used in passports.

Fun fact: #Ledger also reached that level.

[20/24] — 1⃣ Tangem Card — Facts —

Here are some mind-blowing #Tangem facts:
🔸 Tangem offers a 25+ year replacement warranty
🔸 Withstands environmental extremes
🔸 Withstands occasional mechanical deformation
🔸 Withstands electromagnetic pulse (#EMP)
. . .

[21/24] — 2⃣ Tangem Card — Facts —
. . .
🔸 Withstands electrostatic discharge (#ESD)
🔸 Withstands X-rays
📝 Within limits defined in #ISO7810.

Further:
🔸 #Tangem App, an open-source in-house development, is capable of verifying the installed firmware on the card
. . .

[22/24] — 3⃣ Tangem Card — Facts —
. . .
🔸 Works from -25°C up to 85°C
🔸 Works even underwater 😅
🔸 #IP68 certified
🔸 An Access Code may be set and even adjusted to prevent it from being removed from the card after it is set.
📝 If you lose this code, you lose everything.

[23/24] — TL;DR —

🔸 XUMM security upgraded (MASVS v1.5)
🔸 XUMM Tangem account backup via xApp
🔸 Tangem cards — simple secure offline cold wallet
🔸 Literally indestructible
🔸 XUMM branded cards w/o key-sync
🔸 Cutting-edge certified hardware security
🔸 @XRPLLabs rocks!

[24/24] Hopefully, this gave you a solid introduction of #XUMM and #Tangem cards in terms of security.
Rest assured, there is more to come. 🔥

Please follow me here:
@krippenreiter 🙏

Feel free to contribute by sharing here: 👇

@threadreaderapp unroll