Coldcard Mk4 Bitcoin Hardware Wallet (Unboxing, Setup, Demo and Review) - Paranoid Security
HTML-код
- Опубликовано: 4 авг 2024
- Buy a Coldcard MK4: bit.ly/2Qbsf08
Hardware Wallet Comparisons: cryptoguide.tips/hardware-wal...
An unboxing, setup, review and demonstration of the Coldcard MK4 by Coinkite.
00:00 - Introduction
00:32 - Unboxing
01:34 - Hardware Overview
02:22 - Setting Device Pin
03:34 - Demonstrating Anti-Phishing Words
03:58 - Generating a Seed Phrase
03:59 - BIP85 Password Auto Typing (Password Manager)
05:03 - Enable NFC Tap and Virtual USB Disk
05:19 - Firmware Update
06:09 - Pairing the Coldcard with Wallet Software
06:31 - Adding to a mobile wallet (Nunchuck) via NFC
08:21 - Recieving Bitcoin with Nunchuck
09:05 - Sending Bitcoin with Nunchuck (via NFC)
09:49 - Debugging NFC Compatability (Galaxy S10e vs Galaxy S20)
11:09 - Importing the Coldcard into BlueWallet via MicroSD
13:22 - Recieving Bitcoin with BlueWallet (Airgapped via MicroSD)
14:29 - Sending Bitcoin with BlueWallet (Airgapped via MicroSD)
16:17 - Adding to a desktop wallet (Sparrow) via USB
17:41 - Recieving Bitcoin with Sparrow (With Hardware Address Verification) via USB
18:07 - Sending funds with Sparrow (via USB)
18:47 - Advanced Features
18:50 - Advanced Feature: Encrypted Digital Wallet Backups
19:16 - Advanced Features: Exporting Wallet Skeletons
19:23 - Advanced Features: Encrypted Digital Wallet Backup
19:27 - Advanced Feature: BIP85 Deterministic Child Seeds
19:34 - Advanced Features: Wallet Master Fingerprint
19:38 - Advanced Features: Ephemeral Seed (Stateless Operation)
19:44 - Advanced Features: Paper Wallet (Single Unrelated Private Keys)
19:59 - Advanced Features: HSM Mode (For use with CKBunker)
20:05 - Advanced Features: NFC Tools
20:10 - Danger Zone: Seed Operations
20:42 - Settings Overview
20:46 - Settings: Login Settings, PINs
21:10 - Settings: Registered Multisig Wallets
21:23 - Encrypted Digital Backups
22:41 - BIP39 Passphrase Support
22:58 - Summary & Conclusion
#btc #bitcoin #hodl 
Наука
Great video. Thanks for showing it.
No worries, glad it helped :)
Bro you made my day, i will be always thank full to you...
I sent some ETH to you from bottom of my heart.
Got it, thanks :)
Merci beaucoup 🤩
No worries :)
Hello, excellent video! I have an issue with sparrow wallet in multisig. Can I safely use the replace button in sparrow to change one of my key store? And will my funds still be there?
Back up your sparrow wallet file before doing anything... This is especially important with multisig...
Great channel! Been using trezor since 2017 and want to migrate to a cold card or jade for Btc only. Do you recommend keeping the same seed phrase or initiating a new seed phrase with the new wallet for enhanced security? It seems sending the funds from old to new wallet with the creation of a new seed phrase could be somewhat stressful for me. Thanks for your thoughts!
Honestly I would just stick with the same seed, there would be nothing wrong with the seed from the Trezor if you have kept if stored offline
Thank you. Yes off line since 2017. So you feel the Trezor seed entropy is solid vs say cold card?
No different, possibly even better as it mixes entropy from the PC that you initialised it on@@neilsimon6871
Do you think plugging cold card into a wall outlet is an issue and do you think it’s still airgapped if you do whilst still not plugging it into a pc?
No, wall outlet is fine.
What’s your thoughts on the ledger nano X and S back door issues?
Basically the whole thing is unbelievable honestly... It's a shame that they are basically abandoning their current user base and their PR approach made the whole thing worse.
That said, I can understand why they are going this way, as lots of folk do struggle with keeping their seed backup. (Never mind that it will likely be very profitable)
It's worth saying that it's still possible to use their devices trustlessly if you like and that there still isn't anyone in the market who is offering what they do in terms of accessibility.
I've 2 of these but I'm a little unsure to move from Trezor. One of them was broken out of the box.. Are these truly open source?
Cold card isn't licenced open source, but the source code is available and the firmware builds are deterministic.
This means that you can verify that the firmware they distribute matches their GitHub, but other companies can't build on their code. (And fix any bugs they find along the way)
Great video thanks. Question,: I developed a habit to the LIVE mobile interface where I could view my bitcoin. Is there any mobile interface I can use with Sparrow to see my BTC on mobile? Thanks!
So do you just mean a watch only wallet? Either way, there is nothing stopping you from just importing the wallet into either Blue Wallet or Nunchuck and also using it in Sparrow at the same time. (I demo both in the video)
Do you have a video for google 2FA Authentication app that the accounts on previous phone didn’t transfer over?
Nope, you should be able to manually export the missing ones through the transfer via QR feature.
Does ti have the "hidden wallet" feature? how is it? can I show at the airport that it works as a normal calculator?
Hidden wallet is BIP39 passphrase, so yes.
The Q has calculator mode, but not the mk4, but it's really just a dumb meme... The have a very distinctive look and border folk are looking for crypto stuff, will spot it instantly...
Thanks for video, but I was under the impression that coldcard was the best due to its airgapped nature (never being connected to another computer/phone etc, never touching the internet) but the NFC function or USB plug to computer seems to not follow this airgapping principle. Would appreciate your thoughts on this, and thanks for your informative vids
The airgap benefit is not a silver bullet and is very much about marketing and differentiating their product from Ledger/Trezor.
It would be interesting to see the differences and the upgrades from mk4 to coldcard q.
I'll be doing a Q video after I do the Trezor DIY one. (So not the next video, but the one after)
How can I trust coldcard will really generate a new seed phrase oppose to choosing pre created one from their internal ROM?
Basically the deterministic firmware builds let you check that the software is running on your device matches the source on their GitHub
What’s your opinion on the safest cold wallet?
Depends on the users level of experience, what they intend to store and how they intend to use it.
Hello sir i have a question i have watched all your videos and they helped me so much ty for the videos and my question is i want to get a wallet in which i can hodl btc and i want the safest wallet currently i use a ledger waller so please let me know which wallet to get i want to choose from a coldcard or a jade or foundation passport wallet i just want my crypto to be in the safest wallet out there after watching so many videos i feel that i should get the coldcard so please let me know what your views are and what wallet do u think will be the best for me
In terms of the Ledger, if you just have an older Nano S, they will never get recover so you can just leave it there.
The passport and Coldcard are basically the same, with the Jade being more accessible in terms of being able to use it with your phone over Bluetooth. (And a much simpler device overall)
Is something like QR signing a hard requirement? If not something like the Bitbox02 is also a good option and is very easy to use.
Did a video about the passport here: ruclips.net/video/n9EPXCJWTB0/видео.html
what happens if you enter wrong passcode? does it reset? that would kinda suck
If you get it wrong too many times the device is bricked
Hi Crypto Guide, I have a question. When you order the Coldcard, are you ever concerned they store your personal info or shipping? Do they delete this information, or would you recommend ordering anonymously? Are is that just not a concern at all? Thank you so much for taking the time to answer my questions.
Yea I don't ship this type of stuff to my home address ;) They say that they delete the data after 90 days in a tweet somewhere (I'm blocked now so can't see the tweet) It's not just about whether coinkite leaks the data, but their shipping partners get all the info as well...
@@CryptoGuide Now I understand that your information gets collected. However, if you use a PO Box, the postal office still has your name, and information. Is there truly a way around it, and am I truly at risk if I simply just order it to my house? (say I plan to move soon anyway). Thank you, seriously, I really appreciate you being a guiding light.
Yea at the end of the day it comes down to who you are looking to remain private from and how information about you can be broken up so that one single entity doesn't have all of it, as well as also having the information that you purchased a crypto hardware device. (Which is exactly what happened with the Ledger shopify leak, so names, addresses, etc, were all leaked, you can read about it here: support.ledger.com/hc/en-us/articles/360015559320--ENG-FR-SPA-GER-E-commerce-and-Marketing-data-breach-FAQ?support=true)
While the postal office may have your information, the assumption is basically that you are "hiding in the crowd" with all of the other stuff that passes through there, so they wouldn't automatically know that you have ordered a hardware wallet. (And even if they did, it's one thing for an individual staff member to do this and entirely another for all of your personal information to be leaked wholesale and accessed anonymously anyone)
@@CryptoGuide Wow thank you so much, that's terrible what happened with ledger, just read the entire article. Do you think the same will happen again to others like Trezor? Even if you use a PO Box, you still give your name away, but I agree it's still much better than an address! Do you personally request these companies to delete your information as well? And I'm assuming you buy these using prepaid Visa cards is that right? Again thank you!
Similar things have happened with other vendors and will continue to do so given how much of a honeypot they are in terms of valuable customer data.
If you are worried about giving your name away, then you could always use a fake name, different email address, etc, and just have it sent to your home address ;) (Again, it's about splitting things up to make it harder for it all to be in one place)
Why didnt you wait for the Q1 ?
I actually had this Mk4 for over a year and want to use it in some multisig videos, so figured I could do a video at the same time.
Also, who knows when the Q1 will actually ship :)
Is it possible to use with a powerbank
Yes
did u connect it to internet for firmware...??? why not use sd card..???
To demo the virtual USB drive functionality, you can use the microSD for the firmware updates too in the same way.
@@CryptoGuide ok...virtual drive...nice,,, do the mk3 and older have that too?
No they actually don't, the virtual drive mode is a new feature with the Mk4 :)
Hi,
It would be great to see a backup wallet being made from trezor to coldcard
So is there anywhere in particular that you are getting stuck?
@@CryptoGuide thanks for replying, probably post private keys have been transferred from old wallet to new then how can one see the wallet info In coldcard?
Basically it will depend on the script type for the accounts that you were using, so you just need to look in Trezor Suite to see what you were using. (Legacy, Segwit or Native Segwit) You will then need to export the wallet skeleton from the ColdCard and the import the relevant account into something like Sparrow.
Please can you make a video of transfer and receive from kraken to coldcard mk4 ?🙏🏻 Thank You
You just use the same workflow that I demonstrated in the video to receive funds.
20:00 why not use paper wallets?
Their issues are covered well here: en.bitcoin.it/wiki/Paper_wallet
how would you sign and verify a message on Sparrow wallet while using a ColdCard?
You can do the signing (and verification) directly on the coldcard, you can also do the verifcation without the device just using Sparrow.
@@CryptoGuide how do i go about signing a message (.txt) using the ColdCard with a Native Segwit address (bc1q...)?
the problem i run into is that ColdCard defaults the signing of messages to a Legacy address (1B...).
so my specific question is how do i change the default path inside the ColdCard from Legacy to Segwit in terms of signing messages onto the SD card?
coldcard.com/docs/sign-text-file/
@@CryptoGuide thank you so much. i was lacking the 2nd and 3rd row of instructions for the ColdCard. that's why it keeps opting to the default address.
Glad it helped :)
A lot of out puts trezor warnings" im getting this error on the trazor when trying to send some funds to the cold card via sparrow want to send little bit then do a wet run recovery to be sure
So if you look in Sparrow, how many outputs does the transaction that you are trying to sign with the Trezor have?
@CryptoGuide "A lot of Change-outputs 3 outputs ⚠️ " it's what it says on the trazor and its its three I believe the amount Received consolidation amount & the change
That's right, it will require you to confirm when there are more than two outputs that are self-transfer (change). Most normal transactions (even consolidations) would have two outputs, but if you have more than this, it throws a warnings. (Which might be normal if you are consolidating to multiple output addresses or UTXOs)
Can you do a review on AirGap Vault?
I'll certainly add it to the list, as I intend to do a video that looks at BIP85 and it supports that as well :)
You would think CoinKite would have their own informational videos on their website
Their docs here are pretty comprehensive coldcard.com/docs/
@@CryptoGuide lol I missed this, thanx
.
What is the most secure way to generate seed phrase?
It depends. Using something like 100 dice polls is great, as long as you don't mess it up. Using the TRNG on any decent hardware wallet is very good and basically impossible to screw up...
@@CryptoGuide could you make a video tutorial about it? Which decent hardware wallets you recommend for TRNG to use on?
Basically any decent hardware wallet will have a TRNG, or mix entropy from a few sources to get the same result. (So anything like Ledger, Trezor, Coldcard, etc)
@@CryptoGuide do you still trust ledger while it's open source and the news about the backdoor?
Ledger isn't fully open source, so the best that you can say about it is that "It's probably fine". I personally don't like Ledger Recover, but I don't have any reason to think their entropy generation is a problem. (And if you ware worried about entropy generation, you can just add a passphrase)
I've used a ledger for years. Came here by accident. And this Coldcard is confusing. LMAO
Yea it's certainly not nearly as user friendly as something like a Ledger and has plenty of things that it does differently that can easily trip people up. It doesn't hold your hand at all... (So isn't really going to be a good for for everyone)
I just bought a Ledger, Trezor, and a ColdCard Mk4. The cold card is so confusing. And I want to test my 24 word seed phrase, but I don't want to type it into my laptop.(I thought I would type the words into the coldcard, but that's not how it works.) I'm worried about key loggers (so I just bought a brand new MacBook for this purpose) and I bought 3 different types of metal seed plates. A safe. Fire proof bags. And 2 Yubi Keys. But this has been very confusing, and CoinKite has almost no info on their web page.
I also assumed the micro SD card came with the ColdCard, it doesn't. So then I had to go get an industrial grade SD card. But MacBooks don't have an SD card slot. So THEN I had to go out and get a converter to plug it into a USB-C slot. ...sigh it's just on thing after another
When I first got it, I plugged it I to my brand new (day 1) MacBook. But I wanted to air gap it. And I'm like damn it's technically "contaminated" now. It's my fault for plugging it in. But I didn't have the SD card at the time. Now I have to somehow change the settings over to airgap
They certainly only supply the basics.
You don't need an industrial grade one, any MicroSD will do.
isn't it bad to connect the coldcard via USB to a PC?
Not really... It's designed to be safe to connect over USB as well... (hence why they continue to add USB based features)
The whole "don't ever connect over USB" is mostly marketing and a way to differentiate between other competitors.
Ok fair enough. Guess it's more a, what you prefer type of thing. Always heard everyone say 'don't connect to USB!' so thought it was a no go.
Thanks for the great video btw! Love that you talked about so much additional topics (and timestamped them lol)
Thumbs up!
Thanks, glad it helped :)
To be fair shouldn’t you try the demonstration without a case on the phone?
The s10e where the NFC failed every time didn't have a case at all, the S20 where it worked fine every time, worked even with a case. :)
I have seen a tonne of people on Reddit, Twitter, etc, who have had major issues with NFC, but from what I have seen here this is likely related to compatibility issues with specific phones.
Great video, thank you. It was clear, step-by-step and easy to understand. I have subscribed to your channel after watching a few of your videos.
Regarding the Coldcard Mk4 I have 2 questions please regarding longterm, offline storage only. I have a convenient Tangem for any daily transactions which I do not do at the moment.
1. I see Coinkite are releasing the new Q wallet which will ship in Q1 2024, according to their customer support. Is this new wallet necessary over the Mk4 considering it will only be storage and accessed maybe once a month to transfer DCA BTC in? The cost difference is not an issue.
2. I have an unused, recently purchased Keystone Pro 3 which has the option to be a BTC only wallet with dedicated BTC only software. Again, as a longterm storage wallet, is a Keystone Pro 3 with BTC software only as safe as a Coldcard Mk4. Is a purpose built BTC wallet recommended even though the Keystone will be BTC only?
Thanks for your time.
Thanks, great questions.
Basically the Q1 really won't make a huge difference if you are just HODLing and transacting rarely.
In terms of of how the Coldcard compares to Keystone BTC only, they are basically equivalent in every way at this point. (Or at least once the Keystone releases their firmware for the 3 and the BTC only firmware) On a hardware level, there is no such thing as BTC only, it all comes down to the firmware running on the device.
Simply put, the Q1 is adding strengths from the Keystone to the Coinkite hardware lineup...
@@CryptoGuide Perfect, so basically my Keystone 3 Pro with the now available BTC only software will suffice for the purpose of me HODLing only. I plan on using the Sparrow wallet. Moving everything off Ledger.
Thanks for the speedy reply. I had a Q lined up in the shopping cart but dumped it now. In fact, Keystone have a Black Friday special going with a 3 Pro for $90 and free shipping. A bloody good deal. I bought another and this will be my BTC wallet now. Thanks. Off to watch your video on the 3 Pro and also on paraphrases. Keep up the great work.
Yea I just checked and the BTC-Only firmware isn't out yet, when I asked Keystone they said it would be early next year. (Though the current stock firmware actually supports things like Sparrow just fine)
Howz it my bruuu!!! Fully…lol
Spent some time in SA . Jay bay ..
Good times.. great vid and info keep doin it … it will pay off
please help….. no one has made a video on using the led screen on the cold card to receive… I sent from hot wallet to QR code on device…. But my skeleton wallet doesn’t show funds… I do see it when I make watch only wall with pub address
So are you able to at least find the address that you sent the funds to using the address explorer on the Coldcard?
@@CryptoGuide yes
Also would the skeleton wall make its own receive addresses separate from device list but still under seed?
Man I’m confused
Every address is gives you is derived from the seed. Basically you just need to have the right skeleton file to match the same account type that you have in the explorer. (Once you export the right one, your funds will be there)
But yea, Coldcard is really not suitable for newbies.
Basically this is a very straightforward recovery, so don't panic.
@@CryptoGuide 🙏 i wasn’t super worried 1 I watched ur video 20 times lol…. Maybe a lil vid showing how… because as a newb .
It was super ez … use camera with hotwall…
No switching sd or nfc problem.. perhaps I selected electrum instead of .json… maybe I need to use electrum and not blue ?
Why would you connect it directly to laptop defeating the purpose of complete air gap.
What makes you think the complete air gap is required?
I have a ledger, still haven’t updated new firmware, looking for an alternative. However I don’t want to be the reason I lose all my bitcoin…
The first thing I would say is that there is no rush. If you decide to move away from Ledger you have plenty of time to get familiar with how everything works on a new wallet.
It's also not an all-or-nothing type of switch as you can simply load up the seed on any other hardware wallet and you should be able to see all your Bitcoin there on both the Ledger and whatever other device you use at the same time.
A good low cost "middle ground" device is the Jade, as it functions in basically the same ways as a Nano X in terms of what happens if you forget your pin, mobile support, simple vendor supplied wallet, etc. (It provides the vast majority of the functionality of a Coldcard for a far lower price and is a bit more forgiving)
When I was comparing Ledger vs Trezor I learned that ledger isn't open sourced, so you can't audit the code. Does this bother anyone else ?
The tradoff is that with devices like Ledger, Coldcard, etc, it's difficult to actually check the genuineness of your specific device. The other thing is that open source and closed source aren't binary categories, but are a continuum. (Where Ledger has a large amount of open source in the hardware+software stack, but less than a Trezor)
@@CryptoGuidei also have a coldcard and a trezor, the CC for my BTC and trezor for my ETH. but i want to test my seed phrase on my trezor, its saying enter your seed phrase on your new device, so i need to buy a new Trezor in order to test the recovery seed phrase ?
You have two options.
Firstly you can just do the "dry run recovery" on the Trezor which will tell you both whether the seed is valid and whether it's the same seed that is active on the device.
Secondly you could use the "ephemeral seed" feature on the Coldcard to restore the seed temporarily on the Coldcard and then verify that you have the same Bitcoin address on both devices.
4:08 would have appreciated why 12 or 24 since Antonopoulos says 12 is enough…
I mentioned it in the video :) It's not about entropy, but rather that 12 has a much stronger checksum, so is far better at detecting and correcting errors in your seed.
Did you realize that you opened the bag without breaking the seal? I did the same thing with mine and I believe this shouldn't be possible. an attacker can open the bag this way and reseal it with heat while keeping the seal intact. I'm very suspicious about this
The bag is most certainly damaged and can't be re-sealed. (I still have it here)
Firmware verification and update is the first step before everything else
Yes and no, unless there have been major security updates there is nothing wrong with running older firmware.
Thought I was following along ok, then everything went poof. Skeleton wallets, matching account types, address explorer...uhg. Anyone want to buy a coldcard, this is way over my head.
Yea Coldcard really isn't the device you want if you are new as the learning curve is very steep... Something like a Bitbox02 is much more forgiving.
Likewise...
.
That NFC is pretty much useless.
It's not great but seems to work happily with some phones. (Eg: Samsung Galaxy S20)
Ledger is so simple compared to this thing.
Yes it is, this is a big part of why Coldcard is only really suitable for advanced users