<p>Ben Kaufman did a <a href="https://twitter.com/_benkaufman/status/1341700878072504321" rel="nofollow noreferrer">tweetstorm</a> on Twitter on the 10 rules for verification on a Bitcoin hardware wallet.</p>
<blockquote>
<p><strong>Rule #1: DO NOT TRUST THE COMPUTER SCREEN.</strong></p>
<p>The very reason for using a hardware wallet is that your computer IS
compromised, trusting it makes using the hardware wallet an expensive
security theatre (or 2FA at best). Always verify on the HWW device
screen!</p>
<p><strong>Rule #2: Verify your &quot;receive&quot; addresses BEFORE accepting funds.</strong></p>
<p>A compromised computer can be tricked into displaying addresses that
belong to an attacker. The only way to make sure you own the addresses
is to display them on the HWW device and verify they match.</p>
<p><strong>Rule #3: Verifying change address should be done by the device when sending funds, not before like receive addresses!</strong></p>
<p>It is pointless at best, and misleading at worst, to verify them
beforehand like receive addresses. All hardware wallets support
verifying the change address belongs to you AT TIME OF SIGNING A
TRANSACTION. Verifying before that is pointless and error-prone.</p>
<p>Now let's talk some multisig...</p>
<p><strong>Rule #4: Verify the xpub of each hardware wallet used in a multisig quorum on the device it belongs to.</strong></p>
<p>This is not 100% mandatory - but if you're no expert - you really
should do it. If a hardware wallet doesn't support displaying the
xpub, (like Trezor), it could be fine to just verify each address on
it - so long as you verify consistency on all other devices as well,
but I wouldn't recommend such a device for non-experts.</p>
<p><strong>Rule #5: Verify &quot;receive&quot; addresses on EVERY device of the multisig quorum.</strong></p>
<p>This is especially true for at least one address (see next rule) but
recommended for all. If using a device that you haven't verified the
xpub of on-screen, you should verify all receive addresses on it!</p>
<p><strong>Rule #6: While it is best to verify each receive addresses on ALL devices in the multisig setup - you might choose to trust a specific
one, verifying the xpub/ first address on all - then the rely only on
the &quot;trusted&quot; device - ONLY IF YOU ALSO VERIFY XPUBS...</strong></p>
<p>By that, I mean verify on the &quot;trusted&quot; hww used for general
verification, that the xpubs are consistent for all cosigners. This is
needed only once with wallets like ColdCard, Cobo Vault, Bitbox02, and
Specter DIY - since they allow saving the multisig xpubs on the
device.</p>
<p>With Trezor T - you have to verify the xpubs of cosigners every time -
which is why it's not recommended for that purpose - with Trezor One
it's simply not possible...</p>
<p>So while you might use a Trezor in a multisig, I would not recommend
it to non-experts.</p>
<p><strong>Rule #7: Do NOT use Ledger in a multisig setup! (unless you are an expert or have a very good reason...)</strong></p>
<p>Ledger currently does not allow verifying multisig addresses on the
device - nor displaying the XPUB on its screen.</p>
<p>This means you have no way to verify it was not swapped by an attacker
in your multisig setup - EVEN IF YOU DO A SUCCESSFUL TEST TRANSACTION!</p>
<p>It is still possible for a (very) sophisticated attacker to make you
think it worked, while it was him signing for you...</p>
<p><strong>Rule #8: For convenience, you may print out/ write down a large batch of your receiving addresses - verify all at the same time, and
rely on that paper list for your day to day verification. This is very
useful for multisig! - where devices might be distributed in various
places.</strong></p>
<p><strong>Rule #9: Multisig change verification should be the same as with Rule #3 - on the device at the time of signing.</strong></p>
<p>Popular devices (besides Ledger as said), can verify that the address
you send from and the change address used belong to the same multisig
wallet (from same xpubs).</p>
<p>If they fail to verify the change address - they will show it as a
standard, independent, recipient - in that case YOU SHOULD NOT MAKE
THE TRANSACTION. This is valid for both single sig and multisig!
(although even more relevant for the latter).</p>
<p><strong>Rule #10: Hardware wallets cannot verify your balances - and that's great!</strong></p>
<p>Verifying balances requires getting information from the Bitcoin
network - i.e. you need to be online - which would make hww more
vulnerable... This is where a full node comes in!</p>
<p>It is strongly recommended that you run your own Bitcoin full node -
and use it as your main source for verifying your balances and
transaction history! For redundancy, you could double-check against
block explorers or another node (use a different device for either!).</p>
<p>One last thing: These rules apply to any device you use as a
segregated signing device - be it a &quot;traditional&quot; hardware wallet, an
airgapped laptop, a mobile phone etc.</p>
<p>If you want to separate your keys without having a security theatre,
you should verify on your signing device!</p>
<p>Please note: Some things here might not be fully accurate for the
expert user (especially around multisig address verification), but for
the less advanced users' sake, I have tried to be on the safe side
when things get tricky...</p>
<p>Also check out some more info on multisig setups over at
<a href="https://btcguide.github.io" rel="nofollow noreferrer">https://btcguide.github.io</a> (Michael Flaxman guide)</p>
</blockquote>

CC BY-SA 4.0
2020-12-24T18:32:17.810Z
To minimize even more trust is to build the tx and sign it yourself in a raw transaction, but that opens up too many other pitfalls for most users.
m1xolyd1an
CC BY-SA 4.0
2021-04-06T22:19:39.847Z
The following info helped me understand the Trezor T: The Model T is stateless and doesn't store the XPUBs of the other cosigners. So, the computer must provide the XPUBs to the T.  A malware infected computer could lie about / swap those XPUBs, so fw 2.1.8+ shows the cosigners' XPUBs on the T's screen for the user to manually verify (every transaction). Coldcard, Cobo, etc don't need XPUB verification for every transaction because they store the cosigners' XPUBs on the device when the quorum is setup (and you have verified the XPUBs at quorum setup time).
Donn Lee
CC BY-SA 4.0
2021-04-06T22:33:51.823Z
I have a question about what is meant by using the trusted HWW for "general verification". Is this in the context of setting up the quorum and verifying the receive addresses, or sending to an address owned by the multisig quorum, or when signing/spending from a multisig UTXO?
Donn Lee
CC BY-SA 4.0
2020-12-24T12:21:56.053Z
2020-12-24T12:21:56.053Z
Michael Folkson
<p>I am experimenting with multisig transactions using hardware wallets. Is there some general guidance on what I should and shouldn't do to make the process truly trust minimized?</p>

<multi-signature><hardware-wallet>
How do I make multisig transactions using hardware wallets truly trust minimized?
Michael Folkson
# How do I make multisig transactions using hardware wallets truly trust minimized?

(Asked by: username_0 on 2020-12-24)

I am experimenting with multisig transactions using hardware wallets. Is there some general guidance on what I should and shouldn't do to make the process truly trust minimized?

**Tags:** multi-signature, hardware-wallet


---

## 1 answers

### Answer by username_0 on 2020-12-24. Score: 3

Ben Kaufman did a [tweetstorm](https://twitter.com/_benkaufman/status/1341700878072504321) on Twitter on the 10 rules for verification on a Bitcoin hardware wallet.

> **Rule #1: DO NOT TRUST THE COMPUTER SCREEN.**
>
> The very reason for using a hardware wallet is that your computer IS
> compromised, trusting it makes using the hardware wallet an expensive
> security theatre (or 2FA at best). Always verify on the HWW device
> screen!
>
> **Rule #2: Verify your "receive" addresses BEFORE accepting funds.**
>
> A compromised computer can be tricked into displaying addresses that
> belong to an attacker. The only way to make sure you own the addresses
> is to display them on the HWW device and verify they match.
>
> **Rule #3: Verifying change address should be done by the device when sending funds, not before like receive addresses!**
>
> It is pointless at best, and misleading at worst, to verify them
> beforehand like receive addresses. All hardware wallets support
> verifying the change address belongs to you AT TIME OF SIGNING A
> TRANSACTION. Verifying before that is pointless and error-prone.
>
> Now let's talk some multisig...
>
> **Rule #4: Verify the xpub of each hardware wallet used in a multisig quorum on the device it belongs to.**
>
> This is not 100% mandatory - but if you're no expert - you really
> should do it. If a hardware wallet doesn't support displaying the
> xpub, (like Trezor), it could be fine to just verify each address on
> it - so long as you verify consistency on all other devices as well,
> but I wouldn't recommend such a device for non-experts.
>
> **Rule #5: Verify "receive" addresses on EVERY device of the multisig quorum.**
>
> This is especially true for at least one address (see next rule) but
> recommended for all. If using a device that you haven't verified the
> xpub of on-screen, you should verify all receive addresses on it!
>
> **Rule #6: While it is best to verify each receive addresses on ALL devices in the multisig setup - you might choose to trust a specific
> one, verifying the xpub/ first address on all - then the rely only on
> the "trusted" device - ONLY IF YOU ALSO VERIFY XPUBS...**
>
> By that, I mean verify on the "trusted" hww used for general
> verification, that the xpubs are consistent for all cosigners. This is
> needed only once with wallets like ColdCard, Cobo Vault, Bitbox02, and
> Specter DIY - since they allow saving the multisig xpubs on the
> device.
>
> With Trezor T - you have to verify the xpubs of cosigners every time -
> which is why it's not recommended for that purpose - with Trezor One
> it's simply not possible...
>
> So while you might use a Trezor in a multisig, I would not recommend
> it to non-experts.
>
> **Rule #7: Do NOT use Ledger in a multisig setup! (unless you are an expert or have a very good reason...)**
>
> Ledger currently does not allow verifying multisig addresses on the
> device - nor displaying the XPUB on its screen.
>
> This means you have no way to verify it was not swapped by an attacker
> in your multisig setup - EVEN IF YOU DO A SUCCESSFUL TEST TRANSACTION!
>
> It is still possible for a (very) sophisticated attacker to make you
> think it worked, while it was him signing for you...
>
> **Rule #8: For convenience, you may print out/ write down a large batch of your receiving addresses - verify all at the same time, and
> rely on that paper list for your day to day verification. This is very
> useful for multisig! - where devices might be distributed in various
> places.**
>
> **Rule #9: Multisig change verification should be the same as with Rule #3 - on the device at the time of signing.**
>
> Popular devices (besides Ledger as said), can verify that the address
> you send from and the change address used belong to the same multisig
> wallet (from same xpubs).
>
> If they fail to verify the change address - they will show it as a
> standard, independent, recipient - in that case YOU SHOULD NOT MAKE
> THE TRANSACTION. This is valid for both single sig and multisig!
> (although even more relevant for the latter).
>
> **Rule #10: Hardware wallets cannot verify your balances - and that's great!**
>
> Verifying balances requires getting information from the Bitcoin
> network - i.e. you need to be online - which would make hww more
> vulnerable... This is where a full node comes in!
>
> It is strongly recommended that you run your own Bitcoin full node -
> and use it as your main source for verifying your balances and
> transaction history! For redundancy, you could double-check against
> block explorers or another node (use a different device for either!).
>
> One last thing: These rules apply to any device you use as a
> segregated signing device - be it a "traditional" hardware wallet, an
> airgapped laptop, a mobile phone etc.
>
> If you want to separate your keys without having a security theatre,
> you should verify on your signing device!
>
> Please note: Some things here might not be fully accurate for the
> expert user (especially around multisig address verification), but for
> the less advanced users' sake, I have tried to be on the safe side
> when things get tricky...
>
> Also check out some more info on multisig setups over at
> <https://btcguide.github.io> (username_0 Flaxman guide)

> **Comments:**
> **username_1**: To minimize even more trust is to build the tx and sign it yourself in a raw transaction, but that opens up too many other pitfalls for most users.  
> **username_2**: The following info helped me understand the Trezor T: The Model T is stateless and doesn't store the XPUBs of the other cosigners. So, the computer must provide the XPUBs to the T.  A malware infected computer could lie about / swap those XPUBs, so fw 2.1.8+ shows the cosigners' XPUBs on the T's screen for the user to manually verify (every transaction). Coldcard, Cobo, etc don't need XPUB verification for every transaction because they store the cosigners' XPUBs on the device when the quorum is setup (and you have verified the XPUBs at quorum setup time).  
> **username_2**: I have a question about what is meant by using the trusted HWW for "general verification". Is this in the context of setting up the quorum and verifying the receive addresses, or sending to an address owned by the multisig quorum, or when signing/spending from a multisig UTXO?  

---

