[Feature request] BIP39 seed phrase without SD card backup

[jonathancross]

As a power user, I would like the ability to setup a new BitBox02 device with an alternative backup procedure.

1. Show me the BIP39 seed phrase on the screen (I will record on paper, etc)
2. Do not force me to write the seed to the SD card unencrypted.

This follows the Trezor setup procedure and is likely to be familiar to users familiar with those products.

[benma]

Thanks!

Is the main issue that the backup is unencrypted (which is the case also for BIP39 phrases), or that there is a backup on an sd card in general? What if there was an encrypted backup option?

[jonathancross]

Is the main issue that the backup is unencrypted (which is the case also for BIP39 phrases), or that there is a backup on an sd card in general?

Personally, I see many benefits to BIP39 seed phrase and very few to an SD card (other than convenience, which is unimportant for me). In my mind, and SD card reduces my options and increases the attack surface.

• I prefer paper (or rather Cryptosteel :-) to an SD card for resistance to bitrot. I also trust my own hand (and BIP39 checksum) to write a phrase correctly more than software to write a file to the SD card, SD card firmware, etc.
• I would be much more likely to lose a fingernail size SD card.
• Having a secure element to protect keys at rest doesn't help much if the attacker gets an unencrypted SD card containing the keys. I'd prefer to know that is not even possible.
• Something like Cryptosteel also provides an easy way to recognize if the seed has been viewed by an attacker -- tamper-evident seals.
• I prefer the simplicity of a BIP39 seed phrase as it can then be used with Shamir's Secret Sharing, memorization, etc. to increase redundancy of the backup without additional security risk.
• Also it is easier to verify independently & restoring a backup doesn't require a BitBox02 (restore on a Trezor T for example to verify or recover without the seed ever touching an insecure device).

What if there was an encrypted backup option?

Although that would make it feel a bit safer in the event that I lost the SD card or someone got a hold of it, I don't think that would really make a big difference for me. I'd still prefer no card exist in my particular case.

[jonathancross]

We might consider just making these options available later in the Electrum plugin if it seems like it will add too much complexity to the desktop app. Depends on the target audience (power users or not?) for the desktop app.

[benma]

After some internal discussions, we came to the conclusion that this is a low-prio feature for the desktop app, due to:

• added complexity in UI/UX of the setup. The SD card based setup is quick and simple, while multiple backup options and bip39 are confusing to newbies.
• power users can work around this by either importing a phrase created elsewhere, or destroying the SD card afterwards.

We might consider just making these options available later in the Electrum plugin if it seems like it will add too much complexity to the desktop app.

This might be an option, we have not gotten to a conclusion on this yet ;) Let's revisit it when we add an Electrum plugin.

[benma]

Fyi, we are picking this issue up again as there seems to be much more demand now. We will continue in this issue, which is a duplicate.