端侧模型explorer3 创始人| 主研 数学&哲学 | web4架构 | https://xitter.cf/t.co/rty0HY5vDu

born on the moon
Joined March 2022
法制国家不同的理解 北美:政府得遵守法规,不可以乱来 中国:民众须遵守规则,特殊情况除外 神棍国:**经是天条,宗教法庭就是王法,全世界人民都应该遵守
1
31
零信任硬件钱包 1、当安全芯片(SE)不再安全 2、当主板电路被植入窃听装置 3、当助记词备份被远程劫持 4、当交易数据被中途篡改 5、当明文私钥显示不再安全 6、当供应链不完全可信 大额资产 ·底层安全 · 终极DIY t.me/MacroXCN
1
1
242
5/6 明文私钥显示不再安全 离线签名大幅降低网络攻击风险,而大部分的损失发生在私钥管理的操作窗口,私钥生成、备份变成了高危环节。 近距离偷窥、偷拍屏幕上的助记词时常发生在大额线下交易中,有个朋友在对方车上被隐藏摄像头窃取了助记词,十分钟后直接损失全部资产;国内纪委搜查时,会翻遍整个房间寻找纸条/钢板备份的助记词,他们知道那是隐藏的金库。 密文切片备份就显得格外重要,使用廉价的NFC卡片,完全能够防御明文窃取的可能性!当我们开源整套方案后,即使在手机端的热钱包也可以快速切片备份,快速安全恢复钱包!
1
43
6/6 当供应链不完全可信 a.多源采购,模块厂商直发,减少中间环节渗透,比如三颗安全芯片(SE)从三个厂商直接到用户手中,规避集中植入的风险 b.模块独立验收,用户拿到模块之后,按照完整的流程验证,可以直接发现在硬件层面的问题,如SVM是否有窃听电路、IDAM是否正常 c.手动 DIY 组装,在开源工具交叉验证测试通过之后,用户按标准流程组装并初始化钱包 零信任的基础是:只相信密码概率学
3
6年前,蹲在办公室思考,数字金融/经济模型如何改变世界 如今,蹲在江边/湖边,思考如何不被AI淘汰 咖啡续命,茶水维生,肉身之于旷野,只为解锁一点点贫瘠的想象力 [咖啡]
1
42
真正的宗教,往往用来约束自己 而邪教,一直在要求别人
29
3/6 3、当助记词备份被远程劫持 私钥明文备份是一项非常落后的技术,为了容易记录私钥生成等价的助记词,当最关键的核心数据裸露时,它的风险变得无穷大! 黑客正是利益这个窗口,轻松在Lerdger 的IDAM添加插件远程获得私钥。 屏幕/交互模块永远不显示明文私钥、助记词,直接加密私钥,keystore切片通过NFC备份。即使部分备份丢失,也不会丢失钱包。 无明文、切片备份NFC,彻底摒弃助记词方案,安全性将大幅度提升!
1
1
39
4/6 4、当交易数据被中途篡改 a.数据被篡改 ➡️ 解密失效 ➡️ 无法执行 b.任何一个微小变化会导致哈希承诺(Hash Commitment)发生巨变,交易验证会立刻判定数据失效并锁定。 c.xn--3ds443g端的交易信息和离线钱包的交易信息如果不一致,用户肉眼或系统校验能瞬间识破骗局,彻底击碎中间人 UI 欺诈! 零信任机制 端到端加密和交叉验证对于篡改交易的风控直接且有效。
1
40
对,把散户挂山顶上 永远 [咖啡]
57
零信任硬件钱包DIY的思考 1、不信任任何一个厂商 2、不信任任何一个模块 3、手动设计安全的硬件钱包
1
70
为什么用agent做交易,钱包余额瞬间变少?
37
#Ledger 事故,让高净值群体重新审视 硬件钱包的安全问题。 1、钱包出了bug,风险谁承担? 2、高额利益诱惑下,硬件供应链必然遭受攻击,是否有新的0信任机制? 3、商业模式单一,硬件钱包厂商如何寻找新的合作方式,来扩收益加固安全? @ohyishi
56
零私钥硬件钱包 ✅ 多SE验证 ✅ 不显示助记词 ✅ 切片备份+ 社会恢复 ✅ 硬件0信任机制 ✅ 大额/高频虹膜活体验签
58
硬件钱包从SE芯片到固件的供应链攻击面很大,购买运输上也非常容易出状况,可能需要新的工程思路做冗余验证
再次卧槽! 出事的经销商还代理权 Trezor/OneKey? 所以真的要注意啊同志们: 1️⃣ 在允许的情况下,非要用硬件钱包,那就是2/3多签吧,至少一个出问题不会影响全局。 2️⃣ 不要再在经销商买,不要在经销商买!直接去官网买,都买硬件钱包了就不要省那么几个钱。 3️⃣ 为了避免扳手攻击,收货地址不要写本人地址,这个如何拿到自己有自己的办法,不赘述,不然暴露我自己。 4️⃣ 实在不行你懒的搞多签,也不想搞这么复杂,你就搞个旧手机,然后私钥助记词的生成可以用随机数生成,方法自己用 AI 一步步的来。 还有什么要注意的,大家帮补充下评论区!!!
43
根据OpenAI发布的数学超级智能,研究员Justin Drake 推测说ECDSA可能几个月后被暴力破解,持有50btc 的用户要小心了 英文区博主:要小心了 中文区KOL:小心了 0 btc holder :心了 50btc holder :了 Open AI :……. 量子团队:我们不太懂
Today I call upon the blockchain industry to calmly begin planning for "bunker mode". My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash. Holders, starting with large and sophisticated ones, should consider moving the bulk of their funds to addresses that have never signed a transaction. And when they do sign one, they should also move remaining funds to a new address (possibly generated from the same seed phrase). Don't rush. While I believe there is cause for action a rushed migration would do more harm than good. Don't panic either. Moving assets to protected addresses is a simple, preventative step which does not require new cryptography or new wallets. IMO it is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years. By "break" I mean fast private key recovery (e.g. in one week) on available hardware (e.g. a large GPU cluster). Recent days have been humbling for human mathematical intuition. Long-held, unquestioned hypotheses have fallen. This includes the n log(n) bound for integer multiplication and the 3SUM conjecture. In hindsight, May's unexpected disproof of the Erdős unit distance conjecture was our warning shot. Yesterday's OpenAI drop made it clear that mathematical superintelligence is upon us. They say there are weeks where decades happen. We are about to live through weeks where centuries of mathematical progress happen. Could our magic 64-byte ECDSA signatures be too good to be true? Was it just security through obscurity all this time? Elliptic curves feel especially vulnerable to superintelligence. Curves carry rich structure, with room for fancy tricks like Schoof, Frobenius, pairings. (By contrast, hashes are designed to minimise algebraic structure.) Separately, as Ewin Tang can attest, an efficient quantum algorithm sometimes foreshadows an efficient classical one. We should be open to the possibility of a classical counterpart to Shor that breaks elliptic curves and RSA at once. Also noteworthy is the striking under-representation of cryptographic breakthroughs among the 722 mathematical results OpenAI published. I've witnessed first-hand the US government censoring academic quantum cryptanalysis results. Backroom interventionism is my base case. I urge large, sophisticated actors to lead by example. Project11's "risq list" (bitcoin-risq-list.projecteleven[.]com) is a great tracker of exposed BTC pubkeys. Binance, Bitbank, Robinhood, Bitfinex, and Tether have an opportunity to harden their cold storage. Next month I'll address institutions in London in a live Q&A (forum.ethereuminstitutional[.]org/london-2026). Again, please do not rush. Wallets holding under 50 BTC enjoy partial cover from "Satoshi's shield", i.e. his 20K exposed addresses that hold 50 BTC each. Load-bearing signers like oracles and L2 security councils should consider rotating ECDSA pubkeys with every signed message and/or multi-signing with a hash-based schemes like SPHINCS. Exiting bunker mode safely will require post-AI cryptography. My inclination is to go all-in on hash-based cryptography and avoid structured mathematical assumptions entirely, whether from curves, lattices, or isogenies. A single battle-tested hash (e.g. from the SHA or BLAKE families) yields plausible post-AI security. The Ethereum roadmap on strawmap[.]org fully embraces hash-based cryptography with end-to-end formal verification as a response to the quantum threat. Those timelines must now be revisited and accelerated in light of mathematical superintelligence. I'll be pushing for maximum defensive acceleration.
96
主要是信任成本太高
新加坡2049心得: 1,主要项目集中在以下几个赛道: rwa(尤其是美股上链) perp(无数高度同质化的perp,正如之前无数的layer2一样) AI和agentic trading方向 稳定币支付(U卡) 2,项目方越来越少,创新也越来越少了。可能现在做项目的成本实在太高了,珍惜身边还在创业还在折腾的人吧。 3,项目方越来越少,中介、买办和marketing agency越来越多。中尾部kol接不到广子,头部kol多以advisor身份勾兑项目获得一点额度。 4,在币圈一定要做一个decent and honest的人。因为这个圈子实在太小了,everyone knows everyone。只要进入核心圈,信息没有传播壁垒。学会对自己和对身边的人诚实是一个很重要的事情。很多背刺来自于分赃不均,对身边人好比什么都重要。 5,做一个正直的人,有integrity和好的reputation是最重要的proven record。正儿八经的builder,没事别去碰meme。容易留下reputation issue,恐成一辈子污点。 6,没人邀请你去聚亨或者同乐的话你大概率不是核心圈。去三次以上同乐吃饭,就是很核心的核心圈。 其实还有很多辛辣的点评,只是现在我只能谨言慎行,写的见闻应该是远远不如之前有看点了。 总结就是:做一个正直的,努力的,善良的人,会有好报的。
30
L2消失只证明经济性并非eth网络增长唯一的问题,AI native 或许对web3更大的增长意义
Why I’m becoming even more bullish on Ethereum: A lot of the garbage L2s are dying off, projects like Abstract and Blast shutting down. The lesson is simple: just build on Ethereum mainnet. Stop spinning up unnecessary chains designed to extract value from your own community.
31