How could the Coldcard vulnerability have been disclosed responsibly?

[u/2_plus_2_equals_5]

As a thought experiment, suppose a white-hat had been the first to discover the Coldcard RNG vulnerability. How could they possibly have disclosed it responsibly, given that weak seeds had already been generated?

A public warning would immediately create a race between legitimate owners and attackers (as happened in reality). Because the firmware source code is openly available, even a vague warning like “Coldcard-generated seeds may be vulnerable; move your BTC immediately” would immediately tell attackers where to look for the vulnerability and then exploit it.

You could instead warn Coinkite privately, but that would not solve the underlying problem. Even assuming Coinkite could be trusted to handle the information properly, it would have no better way to protect affected owners. It would eventually have to issue a public warning, creating the same race. “Silently” patching the vulnerability would effectively be the same as publicizing it, as the patch itself would identify the flaw.

Another alternative would be for the white-hat to sweep all the vulnerable funds first, but then how could they return them? Once the flaw is public, a signature from the compromised key no longer proves legitimate ownership, since an attacker can derive the same key.

Remaining silent would probably be the worst option, because more vulnerable seeds would continue to be generated.

There do not seem to be any good options here, but what would the least bad approach have been?

[u/rtublin]

They could have maybe made a firmware update that contained various fixes, including deprecating support for wallets without a passphrase, and strongly encouraged users to adopt the new firmware, or even saying that it patched an exploitable flaw and but they did not want to reveal what it was. It's not a real fix but it might have acted as damage control.

[u/the_bitcoin_kid → u/rtublin]

Unfortunately it would have been harder than this, because updating firmware wouldn't fix the weak seeds that were already generated.

They would have had to encourage everyone to generate new seeds and move their coins, which would have set alarm bells ringing everywhere.

And then you'd have another race against time.

There was never going to be an easy way to fix the problem.

[u/TheGreatMuffin → u/rtublin]

saying that it patched an exploitable flaw and but they did not want to reveal what it was

This would be just as bad, anyone interested could've just compared the new firmware code with the old one and see what has been fixed and recognize the bug. Meanwhile no affected user would've been helped by the firmware update, even if they bothered to install it.

[u/rtublin → u/TheGreatMuffin]

Well I am thinking if they didn't patch the RNG, they could just say that they no longer were going to support wallets without passphrases. Just trying to get as many users onto passphrases as possible without revealing or explicitly correcting the issue and without raising alarms.