Using Coldcard's self-generated seed leads to wallet theft… "Must generate with dice for safety"

While rolling dice in the real world produces unpredictable results, which is 'true randomness,' random numbers created within computer systems inherently struggle to achieve true randomness. It was pointed out that achieving complete randomness in a digital environment remains a challenge to be solved.

This is because the computer's method of generating random numbers is based on certain rules or algorithms, unlike actual physical phenomena. It was explained that no matter how complex the algorithm used, it differs from true random numbers in that, theoretically, the next number can be predicted if only the initial conditions are known.

A position was stated that it is preferable not to trust random values generated by computers.

This distrust stems from the fact that even if a computer generates numbers through complex algorithms, the process occurs purely within a digital environment without human intervention or external factors. This implies a concern that true randomness may be lacking.

While a simple code that picks a random number between 0 and 10 appears to produce different results each time it's run, it was proven that setting a specific initial value always leads to the same repeating result.

This suggests that even if digital random numbers appear random on the surface, their internal mechanism is deterministic. In other words, if the 'seed' value at the start of the program can be controlled, then all subsequent sequences of random numbers can be predicted or reproduced. This characteristic can act as a significant vulnerability in the field of security.

The fundamental principle by which computers generate random numbers was explained. It was stated that random values a computer can produce do not directly extract true random numbers but rather originate from and propagate from a specific 'starting point,' or 'seed' value. Based on this seed value, a series of calculations generate numbers that appear random.

Due to this principle, the position of not trusting computer-generated random numbers was emphasized once again. If the seed value is predictable or exposed, the predictability of the entire random number sequence increases, which can lead to security vulnerabilities.

It was mentioned that the term 'pseudo-random' is often used when explaining random numbers generated by computers. This term encapsulates the essence that random numbers created by computers are not truly random and are generated by a specific algorithm but only appear random on the surface.

The difficulty for individuals to directly verify the reliability of software-generated random numbers was pointed out. It was explained that even with a perfect understanding of concepts related to random numbers, it is virtually impossible for an ordinary user to visually inspect or verify with their knowledge whether random numbers generated by specific software are properly created.

For this reason, a preference was stated for physical and intuitive methods, such as simply flipping a coin, rather than relying on complex software-generated random numbers. This is based on trust in the transparent and verifiable nature of physical random numbers.

Key principles for preventing security incidents and safety accidents were presented. It was emphasized that security incidents presuppose human error, and safeguards should be placed in the 'structure' of the system rather than relying on humans.

It was stated that assuming humans can make mistakes is the most effective way to deal with security incidents or safety accidents. This underscores the importance of minimizing potential human error from the system design stage and building a robust structure that can maintain overall system stability even if errors occur.