Thread by @mflaxman

1/ Storing bitcoin private keys is really hard, and unfortunately every hardware wallet I've seen sucks. I'm looking forward to the wave of improvement that BIP174 (PSBT) is going to unleash. In order to be decent, a hardware wallet must do ALL of the following:

2/ Simple support for m-of-n multisig (where m is > 1 and includes competitors' hardware wallets). If you go from 1-of-1 keys using a "great" hardware wallet and add a lousy hardware wallet but make it 2-of-2, you immediately improve your security (multisig security is additive).

3/ Have a true airgap, meaning that it is eternally quarantined (and gapped with air) from an internet connected device. To accomplish this, it must use QR codes. An SD card, audio cable or bluetooth can work, but given how cheap/easy QR codes are there's no reason.

4/ Make it easy for users to input their mnemonic and passphrase (a few hard to click buttons are not sufficient). Otherwise, users won't remember/test long mnemonic/passphrases and will instead rely on less secure PINs.

5/ Maintain user privacy by not requiring you query a third party service to fetch balance and UTXO data. The obvious solution here is to by default use Bitcoin Core's new PBST feature with a watch only wallet.

6/ Don't trust, verify. A wallet shouldn't sign anything that the end-user hasn't verified. A blind-signing wallet is security theater.

7/ There are lots of extra features that would be nice to have, but aren't needed to be decent: a secure element, a defense against a chosen-nonce attack (

https://twitter.com/mflaxman/status/1082045755991486464

), support for coinjoins, a GUI (vs command-line only useage), support for altcoins, etc.

8/ I often get the question "which hardware wallet should I buy?" and my answer has always been that I haven't found one worthy of a recommendation. Hardware wallet manufacturers, please make a decent product so we can give you money!

This is counter-intuitive. The "best" hardware wallet can still suffer from many vulnerabilities (being loaded with malware by a third party, have a software bug in one of its dependencies, a side-channel attack, etc), while an inferior wallet may not suffer that exact exploit.

If multiple signatures are required, then a hacker needs to simultaneously break multiple wallets, by multiple manufacturers, using multiple different software implementations... Very challenging!

Obviously, complexity is still the enemy of security and if you lose one of your (required) keys then you could lose funds. However, the additive security of an extra signature outweighs this (for large amounts) as it eliminates any single point of failure.

Another benefit here is that this reduces the need for a secure element; a device with a long passphrase (and that wipes on shutdown) doesn't need to manage storing private key material securely.

An example of this includes anything that is closed source. A wallet should also have a screen and use that to confirm the end-user's intentions. A wallet should confirm change addresses are your own (vs an attacker), and that the fee amount displayed is accurate.

Implicit in this is the ability to load in your own mnemonic (and not trust the CSPRNG on the HW wallet). Because BIP39 uses a checksum this is slightly messier than it sounds; you have to trust *something* to convert your entropy (dice rolls, dart tosses, etc) to an XPUB.

One divisive topic that surprisingly hasn't come up in this thread is altcoin support. If you have altcoins, you may want to use the same HW wallet for all your coins. If you don't touch altcoins, supporting them can be a negative ("complexity is the enemy of security").

This is why it's an added benefit if your hardware wallets were even written in different programming languages. That way, they're unlikely to share the same bugs (and potential exploits).

And if you think that your single wallet is so secure you don't need multisig (because you do everything right) check out this terrifying talk on hardware wallet attacks by @StepanSnigirev:

Summary here:

https://twitter.com/mflaxman/status/1148996761555525632