聊天_156 - 与普拉文简化主权

我现在就去找一下。

I'm gonna I'm gonna find that right now.

我会给评论区的朋友们做个简单的三步指南。

I'll I'll I'll do, like, a little, like, one, two, three steps for people in the comments.

所以如果你正在听这个，ADP是什么？

So if you're if you're listening to this what was the ADP?

ADP。

ADP.

对。

Yeah.

高级数据保护。

Advanced data protections.

所以如果你在设置里搜索‘高级’，应该就能找到。

So if you just search in in the settings, if you search advanced, it should it should come up.

它在Apple账户的iCloud设置里。

It's in app Apple account iCloud.

高级数据保护。

Advanced data protections.

好了。

There you go.

嗯。

Yeah.

那你开启了这个功能吗？

So is that turned on for you or no?

没有开启。

It is not.

嗯。

Yeah.

所以它不是默认开启的，但任何正在听的人 definitely 应该开启它。

So it's it's not it's not default, but you should any anybody listening should definitely turn it on.

基本上，它会将你的所有备份转为端到端加密备份，这样苹果就无法解密了。

Basically, it turns all your backups into end to end encrypted backup so Apple can't don't have the keys to decrypt

它。

it.

好的。

Okay.

但不知什么原因，它并不是默认开启的。

But for whatever reason, it's not default.

所以对于凤凰I或凤凰备份解决方案，我认为如果你之前已经开启了ADP，那么备份就是端到端加密的，但你知道，这并没有保证。

So for the Phoenix I or Phoenix backup solution, I think for that, if you had turned that on, if if you already had ADP turned on before, that would be end to end, but, you know, there's it's it's no guarantee.

但对于大多数人的威胁模型来说，凤凰钱包解决方案实际上相当不错，尤其是如果你使用的是热钱包的话。

But, you know, for most people's threat models, like, the Phoenix Wallet solution is actually pretty good, like especially if you're a hot wallet.

对吧？

Right?

像你并不是

Like, you're not

是的。

Yeah.

是的。

Yeah.

你不应该把20个比特币存在那个东西上。

You shouldn't be keeping 20 Bitcoin on that thing.

没错。

Exactly.

如果你担心NSA来找你麻烦，或者苹果公司偷走你的钱，最好的办法就是买个Coldcard之类的设备。

And if you're worried about the NSA coming after you or Apple stealing from you, like, the best solution, just just get a cold card or whatever.

对吧？

Right?

但我还是想看看能不能做得更好。

But still, I wanted to see if I could do better.

我看到的下一个方案是Phoenix，不对。

What's the the next one I saw was the Phoenix no.

不是Phoenix。

Not Phoenix.

抱歉。

Sorry.

Kraken 钱包。

The Kraken Wallet.

他们的做法很有趣，因为他们让你创建了一个 PASI，我当时就想，这个 PASI 到底是什么东西？

Theirs was interesting because they made you create a PASI, which I'm like, I was wondering, like, what's up with this PASI stuff?

但仅限于 iOS。

However, was only iOS.

就在我研究这个的时候，Bull Bitcoin 提出了解决方案。

And then as I was working on this, Bull Bitcoin came up with a pretty good solution.

我唯一的问题是，它在技术上太复杂了。

My only problem with that, it was just, like, technically complex.

有很多需要协调的部件。

There's, like, a lot of moving parts.

你得自己运行一个服务器。

You'd have to run your own server.

我不感兴趣去运行自己的服务器。

I was not interested in running my own server.

嗯。

Yeah.

嗯。

Yeah.

而且如果你运行自己的服务器，服务器本身不会偷走数据，但万一服务器宕机或者数据丢失，就可能危及你的数据。

And then also if you're running your own server, that could be like, the server can't steal it, but, you know, if if if the server goes away or, you know, the server loses data, then that could compromise your data.

对吧？

Right?

嗯。

Mhmm.

所以，我想到的办法是，你可以创建一个 PAS 密钥，然后利用 PAS 密钥，有一种方式可以使用这些密钥来进行加密。

So, basically, what I came up with is you can create a PAS key, and then using PAS keys, there's there's a way that you basically use PAS keys to encrypt and to encrypt it.

使用通行密钥的好处是，第一，它是端到端加密的。

The nice thing about the passkeys is, a, it's end to end encrypted.

对吧？

Right?

所以没有任何设置。

So there's no settings.

它是默认的。

It's default.

它是端到端加密的。

It's end to end encrypted.

而且如果你通过iCloud和Apple创建通行密钥，它也会同步到多个设备上。

And iCloud and Apple, if you create passkeys through them, it's also synced to multiple devices.

对吧？

Right?

好的。

Okay.

另外，如果你使用Bitwarden或1Password之类的工具，它们都支持通行密钥。

Also, if you're using something like Bitwarden or 1Password, any of the they all have pass key support.

同样地，使用 Kraken 钱包时，你无法使用这些功能。

That's, again, with the Kraken Wallet, you're not able to use any of that.

它基本上只适用于 iOS，而且只有当你使用 iCloud 密码作为密码管理器时才行。

It's just basically only on iOS, only if you're using iCloud passwords for the like, as the password manager.

我用的是 1Password，所以当我刚开始使用 Kraken 时，想试试看，但我无法设置，除非我先把它禁用。

I use one password, so when I started using Kraken, like, to check it out, I I couldn't I couldn't set it up unless I disabled it.

明白了。

Gotcha.

我有个小问题。

I I have a quick question.

我现在要打断一下。

I'm gonna interrupt right here.

你先别往下说了，我先问问。

Hold hold that thought for where you're taking this.

你能给我简单介绍一下吗？

Can you give me a rundown?

因为我确实简单查看过通行密钥，但我不太清楚它们具体是如何工作的。

Because I actually looked in the pass keys brief briefly, but I don't know I don't have a stronghold on exactly how they work.

据我理解，它们更像是远程签名工具，而不是加密工具。

As I understood, they were, like, just kinda like a remote signing rather than an encryption tool.

我和Perplexity简短讨论过我可以如何使用它，但显然，AI的错误和正确一样多，有时候你明明错了，它却告诉你完全正确。

And I had a short conversation with Perplexity on, like, the different ways that I could use it, but obviously, AI is wrong as much as it is right, and then it will tell you you're absolutely right when you're wrong.

所以你得和它斗一斗。

So you have to fight with it a little bit.

但能给我讲讲通行密钥的整体原理吗？它是怎么工作的？

But give me kind of the the big picture overview of the passkey and how it works Yeah.

还有它在这个情境中是如何应用的？

And and how it applies to the situation.

当然可以。

For sure.

所以，是的，我认为这也是人们没有这么做的另一个原因，我觉得Bitwarden可能在这方面做了一些工作，而我还看到Signal的创始人Moxie谈过这个，但很少有人用通行密钥来做加密。

So, yeah, I I think that's another reason people have not done this because I think Bitward might be doing a lot a little bit of this, and then I saw the signal founder Moxie talking about this, but not a lot of people are using passkeys for encryption.

你说得对。

So you're right.

但密码钥其实对比特币用户来说很容易理解，因为PASCII就是公钥私钥加密，而这正是。

But passkeys, like it's kinda actually very easy for Bitcoiners to understand because PASCII is just public private cryptography, which is what Sure.

比特币所用的。

Bitcoin is.

对吧？

Right?

嗯。

Mhmm.

在比特币中，显然你有私钥，也就是你的助记词。

So in Bitcoin, obviously, you have the private key, which is your seed words.

对吧？

Right?

然后是由你的公钥派生出来的地址。

And then the addresses that are derived from your public key.

对吧？

Right?

所以，通常情况下，通行密钥的工作方式是：当你在网站上注册时，你会注册你的通行密钥，这实际上意味着你把该通行密钥的公钥提供给该网站。

So, usually, how passkeys work is when you sign up to your website, you register your passkey, which basically means you give that website your public the public key from that passkey.

当你再次访问时，网站会说：请用你的私钥签署这条消息，以证明你是这个公钥的所有者，这本质上和比特币的工作方式完全一样。

So when you come back, the the website says, here, sign this message, right, with your private key to prove that that you are the owner of this public key, which is basically exactly how Bitcoin works.

对吧？

Right?

这就是它的运作方式。

That's how it works.

所以这只是本地密钥。

So it's just local keys.

这其实和我们长期以来一直需要让互联网适应的东西没什么不同。

So it's it's no different than this is the desperate thing that we have needed to adjust the Internet to for a really, really long time.

就是不再使用用户名和密码。

It's just no username and passwords.

我的意思是，你当然会有个用户名，但你并不会把密码随便发给任何地方。

I mean, obviously, you're gonna have a username, but, like, you're not just giving your password over to anything.

你是在签名来证明某件事。

You're signing to prove something.

那么苹果在本地端是如何处理这个密钥的呢？

How does Apple handle that then for a passkey on the local side?

因为，正如我们所说，这正是比特币的工作原理。

Because, know, that's as we say, that's exactly how Bitcoin works.

对吧？

Right?

但人们会丢掉他们的助记词。

But then people lose their seed phrase.

你知道的。

You know?

所以，这种机制在实际中是如何管理的呢

So, like, how how is this managed in kind of

苹果环境是如何做到‘保护’这个通行密钥的呢？

the Apple environment to to, quote, unquote, protect that passkey?

是的。

Yeah.

所以，在苹果这边，除非你设置了iCloud账户，否则你无法创建或使用通行密钥。

So, basically, in the Apple side, you're not able to create a passkey or use passkeys unless you have the iCloud account, like, set

启用。

up.

好的。

Okay.

原因在于，是的，通行密钥是本地存储的。

The re the reason being, yes, passkeys are local.

所以，如果你没有启用iCloud同步，就无法在其他设备上访问它。

So if you don't have iCloud sync enabled, then you wouldn't be able to access from your other devices.

对吧？

Right?

因此，当启用时，密钥会使用你的苹果账户信息在本地进行加密。

So when it is enabled, the passkey is encrypted locally or encrypted using your, basically, your Apple credentials.

所以它仍然是在客户端本地加密的。

So it's still encrypted locally client side.

苹果可以访问它，但你可以在其他设备上使用。

Apple can access it, but it will be available on your other devices.

是的。

Yeah.

是的。

Yeah.

对吧？

Right?

所以你不会丢失它。

So you won't lose it.

但确实如此。

But yeah.

所以这通常是它的工作方式。

So that's how it usually works.

这就像一个消息签名的东西。

It's it's just like a message signing thing.

它就像是，我不知道你是否了解，有些人会觉得，这就像如何证明你是某个地址的所有者。

It's a it's I don't know if you'd like, like, some people, like it's like how you can prove that you are the owner of, like, let's say, address.

是的。

Yeah.

是的。

Yeah.

是的。

Yeah.

他们可以在钱包里做到这一点，没错。

They can do that in a wallet and Exactly.

通常在高级设置里，但它确实存在。

Usually in the advanced settings, but it's there.

没错。

Exactly.

所以它还有一些其他的保护机制，比如，你知道的，证明另一个好处是，Paskee 是防钓鱼的，你不能用它登录到其他网站。

So there there's some other stuff to it to other protections that, like, you know, to prove the another basically, another nice thing about Paskees is you can't it's anti phishing, so you you can't log in to a different website with with that.

中间人攻击，没错。

No man in the middle attack, man.

是的。

Yeah.

太好了，谢天谢地。

Good Thank god.

真的太需要这个了。

Like, need that so bad.

是的。

Yeah.

所以我觉得 Paskee 应该更受欢迎，但我觉得它不流行的原因是很难解释，但最基本层面，它其实非常简单。

So I I think the like, I think Pascke should be more popular, but I think the reason it's not is is it can be hard to explain, but at the very basic level, it's, like, very simple.

对吧？

Right?

你只需通过签署一条消息来证明你就是那个人。

You just prove that you are that person by signing a message.

嗯。

Mhmm.

但总的来说，从根本上说，通行密钥包含一个私钥。

But, yeah, to get to it, at at the very basic level, passkeys have a private key.

对吧？

Right?

你可以用私钥来加密内容。

And you can encrypt stuff using private keys.

通行密钥的设计目的不是加密，而是签名。

Passkeys were designed not for encryption but for signing.

不过，有一个名为PRF的扩展，即伪随机函数，它利用私钥，只要输入相同，就会始终产生相同的输出。

However, there's an extension called PRF, so pseudo random function, that basically uses the private key that if give an input, will always give the same output.

对吧？

Right?

好的。

Okay.

所以这就是为什么passkey的私钥永远不会离开passkey，因为那样不安全，但你可以通过说‘这里’来创建自己的密钥。

So that's how you can derive so the passkey private key never leaves the passkey because that would be insecure, but you can create your own key by saying, here.

你知道，对于这一串随机的字母和数字，从passkey中的私钥生成另一组不同的随机字母和数字。

You know, for this random string of letters and numbers, give me a different random set of letters and numbers that that's derived from the private key in the passkey.

好的。

Okay.

明白了吗？

Does that make sense?

明白。

Yeah.

是的。

Yes.

所以让我试着复述一遍。

So let me try to explain it back.

嗯。

Yeah.

所以这个派生出来的东西就是实际的密钥。

So is and and this this derived thing is the actual key.

对吗？

Right?

是的。

Yes.

所以这个就是我在代码中使用的密钥。

So this will be the key that I use in code.

是的。

Yes.

好的。

Okay.

所以本质上，你是将你的通行密钥与另一个秘密结合，以创建实际的加密货币密钥，而这个其他秘密可以是助记词，也可以只是一个随机密码、笔或类似的东西。

So essentially, you have you're you're you're mixing your passkey with another secret in order to create the actual keys to the coins, which that other that other secret could be a seed phrase, or it could just be a random password or a pen or anything like that.

因此，你实际上是利用通行密钥的派生值来重新生成该密钥，但它本身并不是真正的密钥。

And and so you're you're essentially using the derivations of the passkey itself is the access to recreating that key, but it's not actually the key itself.

我理解得对吗？

Am I understanding that?

对。

Yeah.

是的。

Yeah.

没错。

That that that's correct.

如果我们从最开始说起，嗯。

If if we're gonna start from the very beginning Mhmm.

私钥只是一串随机的字母和数字。

A private key is just a random string of letters and numbers.

对吧？

Right?

所以是256位。

So it's 256 bits.

所以，是的。

So Yeah.

从这里开始。

Starting from there.

对。

Yeah.

唯一的问题是，我发送到通行密钥的东西不必是秘密。

The only thing is that the the thing I send into the passkey doesn't have to be a secret.

它可以是一个静态字符串。

It can be a static string.

对吧？

Right?

它可以是任何内容。

It could be Sure.

它是什么并不重要，因为这只是通过通行密钥来生成一个新的私钥，而无需获取通行密钥的真正密钥。

It doesn't matter what it is because it's just a way of setting a new private key from the passkey without actually getting the passkey secret.

因为我们不会——如果能从通行密钥中直接提取出它的实际密钥，那通行密钥就会非常不安全。

Because we don't, like, we don't passkeys would be very insecure if you could get their actual key out of it.

对吧？

Right?

你只是用它来生成一个新密钥，基本上就是这样。

You're just using it to make a new key, basically.

嗯。

Yeah.

一个全新的随机字符串。

A new random string.

嗯。

Yeah.

老天，老实说，我所想到的每一个机制或设计，都让我觉得使用密钥派生来拥有层次化的重要密钥要合理得多。

Man, honestly, like, just every every mechanism or, like, kind of design that I've come up with this, it just makes so much more sense to have key derivations so that you have, like, hierarchically important keys.

你懂的？

You know?

因为这似乎是唯一能大规模解决这个问题的方法：它允许你在特定情境下吊销密钥，允许恢复，并能将密钥生成的地方视为极其重要且离线的，而密钥使用的地方则设为在线和活跃的。

Because, like, it just seems like, that's the only way this is actually solved for people at a at large scale because it allows you the option to revoke things in certain contexts, and it allows recovery and being able to treat the actual place where the keys are created as, like, super important and offline, and then the place where the keys are used as online and hot.

而且每样东西都各得其所。

And they can they you know, everything in its own place.

但不管怎样，关于这个的想法或框架一直就是：必须得有一个解决方案。

But, anyway, just the the idea or whatever around this or the the kind of framework has always been, like, there has to be a solution there.

你懂的？

You know?

长期以来，我一直都是这样思考这个问题的。

That that's always been the way I've been thinking about it for a long time now.

好的。

Okay.

那么，能给我讲讲Cove是如何使用这个的吗？

So so then walk me through how Cove uses this.

嗯。

Yeah.

我还在完善它，但基本上，这个设计分为两个部分。

So I'm still working on it, but, basically, the design is it's it there's two two parts of it.

对吧？

Right?

我刚才描述的就是通行密钥，也就是你的加密密钥存储的地方。

So what I just just described is the passkey is basically where your encryption key is, let let's say, stored.

对吧？

Right?

我们讨论过它是如何派生出来的。

We discussed how it's derived from it.

但你可以用这个加密密钥来加密你设备上所有的钱包。

But but then what you can do is you take that encryption key, and then you can encrypt all your wallets that you have on device.

对吧？

Right?

嗯。

Mhmm.

现在这些钱包都用这个加密密钥加密了，你可以把它们存储在任何地方，别人无法访问，因为只有你拥有这个密钥。

Now that these wallets are all encrypted with this encryption key, you can store those encrypted wallets anywhere you want, and nobody can access them because they're encrypted by this key that, like, you'll only you have access to.

对吧？

Right?

嗯。

Mhmm.

所以在iOS上，一开始这些加密的钱包就会存储在iCloud Drive中，或者iOS上还有其他很多可以存储的地方。

So which gives us a really nice design of at at at the beginning, it on I on iOS, it's these encrypted wallets are just gonna be stored in iCloud Drive or like, there's there's all these different places you can store it on iOS.

而在Android端，比如Google Drive或其他地方，这些也都经过了加密。

And then in in the Android side, like Google Drive or wherever, and these are all encrypted.

所以当用户重新使用新手机，或者丢失了手机时，他们只需要那个通行密钥即可。

So then when the user comes back, let's say, with a new phone or they lost their phone, whatever, they just need the passkey.

对吧？

Right?

然后他们需要找到存放这些加密备份的地方。

And then they and they need wherever they stored these encrypted backups.

有了这些加密备份，你可以增加一些冗余。

And then with these encrypted backups, you can, you know, you can add some redundancy.

你可以把v2版本存储在不只是iCloud，还有Dropbox或Google Drive等任何你想要的地方，因为你有多份副本。

You can late like, the v two might be store it in not just iCloud, but also Dropbox or Google Drive, where wherever you want because you can have multiple copies.

它们都是加密的。

They're all encrypted.

对吧？

Right?

嗯。

Mhmm.

丢失的可能性更小了。

There's less chance of losing it.

只要你拥有你的密钥和这些加密数据块，基本上就能访问你的比特币。

And as long as you have your passkey and these encrypted blobs, basically, you can access your Bitcoin.

嗯。

Mhmm.

当然，这并不能替代冷钱包。

Caveats to this, obviously, it's still it's not a substitution for, like, a cold harbor wallet.

对吧？

Right?

这只是让热钱包更容易使用的一种方式，你就可以直接使用了。

Like, this is just a way of making hot hot wallets easier to use and you'd, like like, just eat.

我只是想让用户快速上手，不必过于担心，同时还能拥有备份。

I just wanna get the users up and running without worrying it about it too much and actually having some backups.

但理想情况下，我真的想引导用户完成这段旅程。

But ideal but I really wanna guide the user through, like, this this journey.

对吧？

Right?

比如，你从热钱包开始，它会自动备份，然后你可能会把热钱包的密钥写下来，就像说，嘿。

Like, you start off with a hot wallet, it's automatically backed up, and then maybe you, you know, actually write your hot wallet keywords down just as like it was like, hey.

这对我来说是另一层安全保护。

This is like another layer of security for me.

我可以把它放在离线备份中。

I I can have it on offline backup.

然后，用户会获得更多的比特币。

And then, you know, the user create gets some more Bitcoin.

他们积累到一定数量，就像说，嘿。

They get up to a whatever standard is, like, hey.

对我来说，这已经是一笔很多的比特币了。

This is a lot of Bitcoin for me.

我为什么不投资一个硬件钱包呢？

Why don't I invest in a hardware wallet?

对吧？

Right?

是的。

Yeah.

是的。

Yeah.

就像，这正是我希望的，我不希望这成为终点。

Like, that is where I want I I don't want this to be the endpoint.

它只是一个更好的起点。

It's just like a much better starting point.

这是一个更好的入口。

It's a better entry.

是的。

Yeah.

是的。

Yeah.

更好的入口。

Better entry.

这是另一件事。

That's another thing.

天啊，

Man,

还有另一件事，你知道的，也许是推特上那些煽动愤怒的评论之类的。

that is another thing that and, you know, it's maybe just the rage baiting comments on Twitter or whatever.

人们经常称之为极端主义者，但我并不这么看。

I think it's often referred to as maximalists, but I don't I don't think of it that way.

我觉得这更像是纯粹主义者——在解决方案的范围内，完全缺乏或丧失了细微差别。

I think of it as like purists is that there's there's a total lack or loss of nuance in the range of of solutions to be had.

你知道吗？

You know?

很可能有人正准备发推文，说你提到你用闪电网络，但你通常用的是托管服务。

It it's it's very much like like like there's probably somebody ready to tweet about the fact that you said you use Lightning, but you usually use custodial.

是的。

Yeah.

但对我来说，这正是它该待的地方。

But it's like, to me, it's like, no, that's a perfect place for it.

而且我甚至不觉得这是个巨大的权衡，因为我们谈论的是小额资金。

And I don't even see that as a huge trade off because we're talking about small amounts.

担忧的程度应该明确与风险程度挂钩。

The degree of concern should explicitly be tied to the degree of risk.

你知道吗？

You know?

比如，如果我有5美元存在托管钱包里，或者20美元的比特币在托管钱包里，我只是用它来打赏别人，那它就值20美元的重视和关注。

Like, if I have $5 on a custodial wallet or $20 worth of Bitcoin in a custodial wallet, and I'm just using it to zap people, it should get $20 worth of treatment of my time and concern.

如果是托管钱包，这也不是什么大问题。

And if that's custodial, that's not that big of a deal.

你知道吗？

You know?

比如，我的成本在于，如果出了问题，或者他们跑路了，那就不行了。

Like, my my cost in and if that goes wrong or if they rug me or whatever isn't okay.

我会想，我简直不敢相信我居然信任了这些人。

Like, I'll just be like, I cannot believe I trusted these guys.

真是一群混蛋，我会在推特或者Noster上发帖，然后继续过我的日子。

What a bunch of douches, and I'll post it on Twitter or something and Noster, and I'll get on with my life.

你知道吗？

You know?

但我是说，我难道应该……你知道吗？

But it's like I'm supposed to you know?

我确实会。

And I do.

我确实会。

I do.

我有自己的Start Nine，有自己的闪电网络节点，还有Luna节点和我自己的BTCPay服务器。

I have a, you know, Start Nine, and I have my own Lightning node, and I have Luna node and my own BTCPay server.

但即便如此，很多时候我还是用托管服务，因为我觉得：管他呢？

But still, a lot of times I just use custodial because it's like, oh, who cares?

你知道吧？

You know?

比如，我得去连接 Nostril 钱包的 Connect 功能，这要三步，有时候我觉得不值得。

Like, I'd have to go connect it to Nostril Wallet Connect, which is like three steps, which is not sometimes not worth it to me.

但我非常喜欢这种入门方式，能让人们从零开始，极其迅速、毫无摩擦地进入。

But I love the idea of a entry point, of getting people from zero to one incredibly quickly and incredibly low friction.

然后随着他们投入更深，引导他们、给予他们空间，去做出决定或产生觉悟，逐步走向使用硬件钱包、更认真地管理备份，诸如此类的事情。

And then as they get more invested, leading them to or giving them the allowance to make the decision or realization and directing them through the process of having a hardware wallet or being much more serious about their backups and, you know, that sort of thing.

所以我不确定这是否曾经是你的一个关键点，或者你的理念是否与此一致。

So I I don't know if that's, like, ever been a sticking point with you or how how your philosophy lines up with that.

但是

But

不。

No.

我完全同意。

I I fully agree.

我觉得有些人会抓取那些简短的口号，比如‘不是你的密钥，就不是你的币’，然后彻底关闭大脑，不去思考这到底意味着什么？

Like, I think some people take, like, the the pithy, like, one liners, like, your keys and not your coins, and then just, like, turn their brain off completely and don't think, like, what does this actually mean?

对吧？

Right?

是的。

Yeah.

没错。

Yeah.

这种细微差别的丧失。

The loss of nuance.

老实说，我没怎么看到这种情况。

Honestly, I I don't see it too much.

我觉得我的推特内容筛选得挺好的。

I feel like my my Twitter is pretty curated.

如果你真的这么蠢，我大概就会直接屏蔽你了，因为，拜托，这太离谱了。

Like, if you're gonna be that stupid, like, I'll probably just mute you because because, like, come on.

来吧，让我们动动脑子。

Like, let's let's use our brains.

你知道的。

You know?

我们到底在讨论什么？

Like, what are we talking about here?

关于闪电网络，我的想法是，如果我不放心把这么多钱放在实体钱包里，那我就会把同样多的钱存在我的闪电网络托管钱包里。

With with Lightning because totally with Lightning, my my thinking is if I'm not comfortable with having this much money in my wallet, like my physical wallet, that's how much I'm gonna keep in my Lightning custodial wallet.

对吧？

Right?

嗯。

Mhmm.

因为你总是有可能弄丢实体钱包，所以你不会把几千美元放在里面。

Because, like, you always have the chance of some like, losing your, like, physical wallet, so you're not gonna keep thousands of dollars in there.

对吧？

Right?

对我来说，情况也一样。

So for me, same thing.

这些解决方案都有其合适的场景和时机。

There's a right place and time for all these solutions.

对吧？

Right?

所以，比如Cove的热钱包功能，我们并不是想取代冷钱包或Ledger之类的设备。

So, like like, Cove, the hot wallet feature, we're not trying to we're not trying to replace cold card or whatever ledger.

对吧？

Right?

我们是想解决这个备份问题，比如我认识一些人，他们的比特币存在交易所里，但又不敢把钱转移到别的地方。

We're trying to we're trying to meet like, with this whole backup thing is maybe, like, some people I know that are that have their Bitcoin on exchanges but are too scared to bring it somewhere else.

也许他们会想，嘿。

Maybe like, they might they might be like, hey.

这个备份功能看起来挺不错的。

Like, this backup, this seems pretty cool.

就像，它已经备份了。

Like, it backed up.

我觉得我没什么好担心的，现在也不用担心被锁在交易所账户外而失去所有比特币。

Like, I don't have anything to worry about, and, like, now I don't have to worry about being locked out of my exchange account and losing all my Bitcoin.

对吧？

Right?

嗯。

Mhmm.

所以，是的，我在这些方面完全同意你的观点。

So, yeah, there's levels that I completely agree with you.

我们就动动脑子吧。

Just, like, let's use our brains.

你知道的？

You know?

对这些事情，我们得有点细致的考量。

Let's have some nuance with all these things.

比如，极端主义是好的，但咱们还是再深入想想吧。

Like, maximalism is good, but, yeah, let's just let's just think about it a little deeper.

只是先别急，让信息在你脑子里过一过，激活一些神经元，然后再想想该怎么回应或者怎么应用。

Just just get give it a moment to pass it through your brain and fire some fire some neurons off, and then then think about what your response might be or how how to apply it.

所以给我讲讲这个过程吧。

So walk me through the the process.

我的意思是，我觉得我大概理解了整体思路。

I mean, I think I got the the overarching idea.

但你能详细说说这个过程吗？比如，我设好了这个钱包，现在想恢复它。

But walk me through the process of, like, let's say I I set up this wallet and I'm trying to recover it.

那么，这种情况下有哪些相对的攻击途径呢？

And what are the what are the relative, like, kind of attack vectors of this?

因为我们是用密钥加密那个密钥或随机数——我具体记不清那叫什么了——然后用这个密钥和密钥本身来推导出助记词。

Because we're encrypting the secret or the the random thing, I already forgot exactly what it's called, with the passkey and then using that and the the passkey itself to derive a seed.

对吗？

Is that right?

不。

No.

所以这会变得有点复杂。

So it it gets a little complicated.

这是完整的设计，因为我希望让更换密钥变得容易。

It's the full design just because one thing I wanted to do was make, like, make it easy to rotate out a passkey.

比如，如果用户不小心删除了密钥，或者想要一个新的密钥怎么办？

Like, what if a user accidentally deletes a PAS key or wants a new PAS key?

我想让它变得简单。

I wanted to make it easy.

让我试着解释一下。

So let me try and explain this.

如果讲得太深入了，你就告诉我。

If it gets, like, too off into the weeds, like, you let me know.

但基本上，我希望整个机制即使在不启用云备份的情况下也能正常工作。

But, basically, the way and I wanted this whole thing to work with even if don't enable cloud backup.

我是希望，即使他们以后才启用云备份，这个流程也能很简单。

Like, I want I wanted the story to be easy if they enable cloud backup later.

当你打开应用时，我们会生成一个仅存在于你本地设备上的本地私钥。

What will happen is when you open the app, we will create a local local private key that's just on your local device.

对吧？

Right?

嗯。

Mhmm.

然后每次你创建一个——是的。

And then anytime you create a and yeah.

所以这个本地私钥会一直存在，每当你创建一个新钱包时，我们将钱包种子存储在设备上时，虽然这部分其实有点多余，因为我们已经把它保存在手机的安全元件里了，但我们还是会用刚才生成的这个本地私钥对其进行加密。

So that that local private key is there, and anytime you create a new wallet, when we store that wallet seed in in the in the on the device, we will encrypt this part is a little, like, unnecessary because we're already saving it in, like, the, like, the secure element on the phone, but we will encrypt that with that local private key we just did.

但这样做的原因，后面就会清楚了。

But the the reason for that will become clear later.

但如果你启用了云备份，那么这就是我所说的主密钥。

But then if you enable cloud so that's, like, the master key that I'm talking about.

对吧？

Right?

这就是主密钥。

That is the master key.

它已经创建了。

It's created.

但现在它仅存在于本地。

It's just right now, it's just local only.

如果你创建了密钥并启用云备份，我们会加密这个主密钥。

If you create a passkey and enable cloud backup, what we do is we will encrypt that master key.

对吧？

Right?

好的。

Okay.

嗯。

Mhmm.

主密钥与通行密钥结合，然后我们将它存储在iCloud中，比如说。

Master key with the passkey, and then we will store it in iCloud, let's say.

对吧？

Right?

好的。

Okay.

现在我们有了存储在iCloud中的加密主密钥，就可以处理那些早已本地加密存储的钱包了，对吧。

And now that's now that we have the encrypted master key in iCloud, we can take those encrypted wallets, right, that we that were already stored low locally encrypted.

我们可以把它们也存储在iCloud中。

We can store them in iCloud.

嗯。

Mhmm.

所以，恢复过程就变成了一张白纸。

So then so then the recovery process is that it become a clean slate.

你在另一部手机上启动应用，就会看到iCloud上这些加密的数据块。

You you you you start up the app on a different phone, let's say, yet you see all these encrypted local not local, encrypted blobs of data on iCloud.

嗯。

Mhmm.

你看到这些数据块中的一个，我们说这是主密钥。

And you see this one of these blocks blobs, we say this is the master key.

对吧？

Right?

所以我们现在会下载所有这些数据。

So we now we have we will download all of that.

所以在新设备上，我拥有了所有加密的种子和加密的主密钥。

So now on new device, I have all the encrypted seeds and the encrypted master key.

现在我只需要去访问通行密钥，获取解密该主密钥的密钥。

Now I just need to go to the pass key and get the decryption key for that master key.

好的。

Okay.

好的。

Okay.

明白了。

Gotcha.

好的。

Okay.

所以加密使用的是原始密钥，而钱包密钥是从中派生出来的。

So the the encryption is the original key that's being used, and then wallet keys are derived from that.

而通行密钥并不是从它派生出来的。

And and the passkey It's not derived from it.

我们所有的

We it's the all the

钱包已加密。

wallet encrypted.

它只是一个加密密钥。

It's just an encryption key.

好的。

Okay.

这样做的原因是，我们可以备份导入的钱包。

The reason for that is because that way, we can back up imported wallets too.

对吧？

Right?

所以如果我们派生，哦，这说得通。

So if we derive Oh, that makes sense.

嗯。

Yeah.

如果我们派生钱包密钥

If we derive wallet keys

是的。

yeah.

哦，明白了。

Oh, okay.

所以这完全说得通。

So That makes perfect sense.

嗯。

Yeah.

如果你把它们全部派生出来，你就没法备份了，比如让我导入我的种子。

If you if you derived them all, you couldn't pull you you couldn't have a backup of, you know, let me import my seeds.

让我连接到这个钱包。

Let me connect to this wallet.

诸如此类的事情。

You you know, that sort of a thing.

现在这完全说得通了。

Now that makes that makes perfect sense.

你想要一个解决方案，而不必为两种不同的创建钱包或导入密钥的方式构建两个不同的系统。

You want one solution, and you don't wanna have to build two different systems for two different types of creating or or putting a wallet in there or putting keys in there.

好的。

Okay.

好的。

Okay.

真有趣。

So interesting.

所以你把这个当作一种通用的备份解决方案，用于简单的钱包之类的东西。

So this is you you talk about this as a universal kind of, like, backup solution for, like, a simple wallet thing.

这是你一直在尝试构建的东西吗？还是文章中是这么提到的？

Is this something that you're you've been trying to build, or at least it was it was mentioned that way in the the article?

这会像一个开发工具包吗？

Is this gonna be, like, kinda like a a dev kit?

你只是在想，哦，不。

Are you just thinking about, like, oh, no.

这仅仅是一种人们可以复制并使用的方法吗？

This is just a method that people can copy over and use?

你是怎么在这一背景下看待它的呢？

Like, how how are you thinking about it in in that context?

因为说实话，对于大多数钱包来说，依我之见，这比大多数人的默认方案更好。

Because, honestly, for, you know, most wallets, this would be better than the default for the majority of people, in my opinion.

是的。

Yeah.

所以，让我们稍微回溯一下故事，比特币的这种做法源自一个名为……我想是叫Proton Packers的规范？

So just going back in the story a little bit, the bull Bitcoin method of doing things is is derived from a way a spec called I think it was called pro proton packers?

我记不清了。

I I forget.

光子规范。

Photon spec.

我正要说，你的文章里写的是光子。

It's I was about to say, it says photon in your article.

是的。

Yeah.

光子。

Photon.

是的。

Yeah.

嗯。

Yeah.

我本来以为是不是拼错了，但后来我想，也许这样写是对的。

I thought I wondered if it was misspelled, but then I was like, maybe maybe that's right.

我没去查过。

I didn't look it up.

所以

So

所以当我开发这个想法时，我直接联系了我认识的一些人，说：嘿。

So when I was developing, like, this idea, I just reached out to some people I know, like, hey.

你觉得这个怎么样？

Like, what do you think about this?

然后贾斯汀·蒙恩把我介绍给了坦克·雷德·海耶斯，他是Photon规范的创建者。

And Justin Moon put me in contact with Tank Red Hayes, who's the guy that made the photon spec.

好的。

Okay.

嗯。

Yep.

我跟他讲了我的想法，他非常喜欢，因为他自己也在做这个Photon规范，但他对它并不特别满意，甚至是因为需要第三方服务器这个要求。

I was telling him about my idea, and he really liked it because he's he he was doing this photon spec, but he wasn't in love with it even, like, either because of the requirement for the third party server.

而且当时他还不知道PRF，这基本上是一种将PASI转化为加密能力的方法。

And he didn't know about PRF at at the time, which is basically a way of turning a PASI into an ability in in to do encryption.

嗯。

Mhmm.

所以他非常喜欢这个想法。

So he really liked it.

他帮我补充了一些我遗漏的内容，基本上他说：‘我们为什么不把这个做成一个规范呢？’

He helped me with some of the stuff I was missing, and basically, he said, let's why don't we turn this into a spec?

因为如果你要为Cove做，那我也会用同样的方式来做我的。

Because if you're gonna do it for Cove, I'll do it the same way on mine.

你之前提到的StashPay是这个吗，还是

Is that the StashPay that you mentioned, or is

就这样了，好吧。

that was it okay.

嗯。

Yeah.

嗯。

Yeah.

StashPay。

StashPay.

然后我觉得，这个想法就是，这是每个钱包开发者都需要解决的问题，那我们为什么不把它变成一个规范，让任何人都能实现，并且都采用相同的方式呢？

And then I think the idea is just being that this is the problem, like, any wallet developer needs to solve, so why don't we just turn it into specs so that anybody can implement it and will do it the same way?

也许将来，我不确定这是否可能，这也不是一个最终目标，但也许吧。

And then maybe in the future, like, I don't know if this will be possible, and it's not an like, an end goal, but maybe Mhmm.

如果用户想更换钱包，也许他们可以，因为两者都使用相同的规范，他们也可以迁移备份。

If users wanna migrate wallet, maybe they could, like, if they're both using the same spec, maybe they can migrate the backup too.

我不确定。

I'm not sure.

即使这不可行，我认为制定一个规范仍然很有价值，因为这样一来，我们就可以希望让一些安全专家来审查它，看看这是否是一个好的解决方案。

And even if that's not possible, I think still having a spec is valuable just because then like, one thing we wanna do is, like, hopefully, have some security people, like, review this, right, and see is this a good solution.

如果确实如此，那么所有人都采用同一个经过审查的规范，对大家都有好处。

And then if it is, like, it it's just better for everybody to implement the same, like, spec that's been reviewed and all that.

是的。

Yeah.

你认为苹果方面可能存在的风险和攻击向量是什么？

What do you think the the risk is and the attack vector is from from Apple's side?

是的。

Yeah.

从苹果的角度来看，本质上是他们必须对通行密钥撒谎。

So from the Apple side, it would basically be they would have to be lying about passkeys.

他们必须谎称通行密钥是端到端加密的。

They would have to be lying that passkeys are end to end encrypted.

嗯。

Mhmm.

我认为这可能会让一些人感到困扰，因为这并不是开源的。

And I think this might be a sticking point for some people just because, you know, it's it's not open source.

没有办法真正去验证，比如，嘿。

There's no way to actually verify, like, hey.

你或许能获得一些信心，但你无法100%确定苹果创建、共享或同步到设备上的这些密钥确实是完全端到端加密的。

Is this and maybe maybe you can get some confidence, but there's no way to be a 100% sure that these passkeys that Apple creates and shares or syncs with the devices are actually 100% end to end encrypted.

但这样一来，你实际上就是在说，苹果关于所有端到端加密的内容都是在撒谎，没有任何一个是真正端到端加密的。

But then you're basically saying that, like, Apple is lying about all their end to end encrypted stuff, none of it is end to end encrypted.

另一个攻击面可能是拒绝服务。

The other attack vector would be, like, a denial of service.

如果我们只把数据存储在苹果的iCloud上，嗯。

So if if we're only storing on Apple, like iCloud Mhmm.

如果你失去了对这个苹果账户的访问权限，或者被锁定，而密钥又存放在那里，那么一旦苹果把你拒之门外，你就可能丢失你的比特币。

And you lose access to that Apple account or, like, you get locked out, and if the passkey's on there, then then you could lose your Bitcoin if Apple locks you out.

嗯。

Mhmm.

但有一些方法可以绕过这个问题。

But there are some ways around it.

首先，我们当然会允许用户使用Seats进行离线备份。

Well, first thing is obviously we're always gonna, like, allow people to do offline backup with Seats.

对吧？

Right?

所以，Seats会成为黄金标准。

So, like, the Seat will, like, you'll be like, that's, like, the gold standard.

但这个解决方案的另一个优势是，它不仅适用于Apple，如果你使用一个密码，你也可以一次性管理所有密钥。

But the other thing about this solution is that it works not with just with Apple, but, like, if you're using one password, you can sort the the passkey in one pass.

对吧？

Right?

嗯。

Mhmm.

然后，通过VE1，我们可能只会让你将加密块以blob形式存储在iCloud中，因为这样更简单。

And then you could with with a VE1, we'll probably only let you store the encrypted blocks in blobs in iCloud just because it's easier.

但 v2 版本，我会提供将加密块存储在多个位置的选项。

But v two, I will give the option of storing in those encrypted blobs in multiple places.

对吧？

Right?

这样可以增加一些冗余，防止失去访问权限。

So just add some redundancy for losing access to it.

但从实际窃取的角度来看，基本上，苹果如果要窃取，就等于在端到端加密上撒谎。

But in terms of actually, like, stealing it, basically, yeah, the Apple would be lying about your the end to end encryption.

或者你的手机以某种方式被入侵了，但那样的话，这就像热钱包，你早就已经损失了。

Or your phone is compromised in some way, but then, like, it's a hot wallet, so, you know, you would have already lost it.

是的。

Yeah.

是的。

Yeah.

是的。

Yeah.

那叫什么来着？名字像是凤凰与奇美拉的结合。

The what's the it's like a the name is it's like a phoenix chimera.

那到底是什么东西？

What what is the what's the what's the thing?

那个叫Pony的软件，CIA把它外包给了一群专制者。

The the pony software that they the CIA, like, contracts out to a bunch of authoritarians.

嗯。

Yeah.

我记得你刚才说的……

I I remember what you're

我知道你在说什么，但我忘了。

talking about, but I I forget.

我一时想不起那名字了，天啊，这真让我纠结，我本该记得的。

I cannot remember the name off the top of my head for some Oh god, this is gonna bother me because I absolutely should know it.

就像你总在谈论一个演员，却一时想不起他的名字一样。

It's like it's like an it's like knowing an actor that you talk about all the time.

他就说，嗯。

And he's like, yeah.

我超爱他们的电影。

I love their movie.

他就说，操。

And he's like, fuck.

他叫什么名字？

What's his name?

我可能会在节目结束前想出来。

I'll I'll think about it before the end of the show, probably.

但，没错，如果你的攻击面是这个，如果你的风险评估就是这个，而且你担心这个，那你就别在手机里存十万美金。

But, yeah, if you're if you're if that's your attack vector, if that's like your your risk assessment and you're worried about that, then you shouldn't be keeping a $100,000 on your phone.

你知道，这才是真正的问题所在。

You know, like, that's really the that's the concern there.

所以这就是为什么我觉得这提供了一个非常有趣、非常安全的中间方案，当然，肯定会有边缘情况，而且还有更强大的对手。

So that's that's that's why I think this makes a really, really interesting kind of middle ground that's very safe from obviously, there's gonna be like edge cases, and there are big much bigger adversaries.

国家、国安局、苹果公司之类的，这些都仍然是潜在的威胁。

The state, the NSA, Apple, like, that sort of thing, which this remains vulnerable to.

但我觉得人们只是不重视，或者干脆忘了，尤其是比特币信徒。

But I think people just don't respect or kind of forget because especially Bitcoiners.

我以前一直觉得，直到我自己弄丢了密钥，才真正意识到：哦，原来如此。

And, you know, I used to have this it wasn't until I lost keys myself that I I was always thinking about, oh, okay.

如果警察突然闯进来抓我，因为我是个非法的比特币用户，我该怎么办？

What do I do if the police come and bust me down because I'm an illegal Bitcoiner?

你知道，我的攻击面一直想着那些庞大而可怕的、遥远的敌人。

You know, like like, it was my attack vector was always the big, scary, like, distant enemies.

但很容易忘记，你99.9%的最大敌人其实是你自己。

And it was easy to forget that 99.9 of your biggest your biggest enemy is yourself.

你最大的敌人是你的备份。

Your biggest enemy is your backup.

你最大的敌人是你每次创建钱包时都没有严格执行流程或仪式，然后忘记这一点，开始频繁使用它，因为这钱包太好用了，你心想：我只是在测试一下，结果现在上面已经有1万美元了。

Your biggest enemy is your failure to go through your process or your ritual every single time you make a wallet, and then forgetting and starting using it a lot more than you thought because it's just a fun it's a good wallet, you're like, oh, I was just testing this out, and now there's $10,000 on it.

这到底是怎么发生的？

How the hell did that happen?

对于所谓的普通人、新手来说，如果你能解决99%的问题，而大家都在抱怨剩下的1%，那已经是巨大的进步了。

And that for quote unquote normies, for new people, that is not You know, if you can solve 99% of the problem, and everybody's complaining about the other 1%, that's a huge leap forward.

你知道的？

You know?

就像，好吧。

Like, it's like, okay.

嗯。

Yeah.

当然。

Sure.

我们还没解决NSA和苹果勾结的问题，但天啊。

We haven't solved the whole NSA and Apple colluding problem yet, but damn it.

但我们已经解决了某个问题。

We've solved something.

嗯。

Yeah.

嗯。

Yeah.

当然。

For sure.

不。

No.

我同意。

I agree.

对，没错。

And, like yeah.

我觉得关键是，如果你担心NSA和苹果串通，唯一的真正解决方案是硬件钱包。

I think the thing is, like, if you're worried about the NSA and Apple colluding, the only real solution for that is a hardware wallet.

对吧？

Right?