The idea of a hardware wallet sounded wronged to me from the start.
Why would you trust some random hardware, that has the sole purpose of holding your money, making it an obvious target, over a general purpose computer you control entirely?
Strictly speaking, a hardware wallet doesn't hold your "money". Your assets live on the blockchain, and your seed phrase generates the private keys that control them.
The hardware wallet is just a sandboxed interface between you, your seed, and the blockchain. It requires a computer to connect to you and the internet.
In other words: as long as you have your seed phrase (and your passphrase, if you set one) on a piece of paper, you can smash your hardware wallet to bits and be fine.
(This assumes a standard single-signature wallet using the BIP-39 standard)
Your general purpose computer is connected to the internet 24/7. It runs a complex operating system which constantly gets updated and patched. It visits dodgy websites, downloads npm packages, backs up files to the cloud, etc.
Is it though? There is nothing you can solder onto it that will gain any meaningful access and go unnoticed. Tampering with the supply chain is a lot more difficult, easily detectable, and wouldn't scale. I can use 100% open source software, in an OS where it's signed and completely safe from interference - except the NSA of course, but they are not interested in your money.
For example, in MacOS it would be extremely hard to "sniff the display" as in this attack, unless you take obvious steps to authorize screen access.
Using a consumer pc, risk wouldn't come from hardware hack implementations, it would be mostly software.
To continue with your example, "display sniffing" could be done by infecting trusted software or software presented as trustworthy (fake or infected Zoom binaries, Xcode binaries, etc.) or injected through open source dependencies like npm packages.
Yes, you or I might be paranoid enough to check the checksum hash to make sure the open source code matches the build. But every time, for everything?
The less connected it is, the safer. The less software it runs, the safer.
> fake or infected Zoom binaries, Xcode binaries, etc.
There are so many hoops to go through to pull something like that off, it's basically impossible. It would be a "the great train robbery" kind of effort. I also don't think an npm package could alter an existing app or obtain screen access otherwise, unless you're running `sudo npm install` routinely.
Some form of phishing would be way more likely to succeed, luckily you can use your own brain to protect against those attacks.
More software means more complexity means more pathways to losing.
Can you do it? Sure. I'm sure there are millions of dollars in private keys stored on internet connected laptops somewhere out there. But the best practices remain the same: as little internet as possible, as little software as possible.
Yes, you can certainly use an air gapped laptop as a dedicated hardware wallet.
But now you need to generate a public key to send to someone so you can receive coins. How are you sending that key to your friend? Are you going to read character by character and manually type up the string?
Right, so now you need an additional device on hand (your phone) to parse the QR code into a string. Or I guess you could activate your hot laptop's webcam, pick up your cold laptop, crank the brightness up, point it towards your webcam, and capture the QR like that.
You need an additional device on hand to use the hardware wallet too, so that's not an argument against an air-gapped general purpose computer instead of a hardware wallet.
Yeah, I'm not deep into this stuff, but I thought the role of the device is to hold the key for a wallet that you don't intend to transfer out of very often. This makes the trade-off (more hassle, more security) worth it. If you are using the key all the time I don't see the point, the storage device won't be the weak point in your setup anyway.
It's all about reducing the trusted computing base, both in terms of lines of code and of organizations supplying said code.
Most people's computes run a lot of software, including a general-purpose OS with a huge attack surface and third-party applications, often with broad or even unconstrained access to all their files.
General purpose computers often also don't have tamper-proof secure storage; hardware wallets generally do.
Get a general purpose computer that you have removed all writable storage from. Boot from a CD-ROM or write protected USB drive that contains an OS, your wallet software, and your encrypted key.
To use it boot, run your wallet software, enter the decryption key for your wallet, conduct your transaction (communicating with whatever other device you are using for this the same way a hardware wallet would communicate), and turn off the wallet computer when done.
How do you write the CD-ROM? Who vets the software that goes on it? How sure are you that none of the many peripherals running their own firmware are compromised?
The software that goes on the CD-ROM or write-protected USB drive can simply be a minimal Debian Linux, with some popular software wallet that works on read-only systems installed.
You build it the same way people build any other read-only bootable Linux.
Configure your kernel to not include drivers for any peripherals not needed for the task of being a wallet.
If you have some peripheral whose firmware does something like snoop RAM on its own to try to find and steal your crypto keys, and it has some way to exfiltrate that data then maybe you are screwed.
But if you do this right nothing you are using is particularly associated with cryptocurrencies or cryptocurrency users, and ideally you bought all this some anonymous way (like went to Best Buy and bought an RPi with cash, along with any peripherals you need).
Note that once built you should never need to update either the hardware or the software, so unless it is already compromised when built it should stay safe.
If there was ever any appeal to me, it’s that vague notion that machines get wiped, rebuilt, compromised, travel, get stolen, etc. A dedicated device could kinda avoid some of that if it mostly sits in a safe or something.
Why would you trust some random hardware, that has the sole purpose of holding your money, making it an obvious target, over a general purpose computer you control entirely?