jpph
commented
4 years ago ok, I have found it how to verify myself. For the paranoid like me :-) so the first 32 byte hex id is uuid and is calculated by derivating the mnemonic with path m/44'/1131373167'/0'
here the howto verify by yourself using ian coleman bip39 webpage. https://iancoleman.io/bip39/ (preferably done on a pc without hd, booted with a live cd, no network, with ian colman html on a usb stick)
-
reset vault, generate seed using ian coleman bip39 webpage (roling dice is cool)
-
import the mnemonic in cobo vault
-
start a sync and scan the qrcode yourself, they need to be base64 decoded and ungziped (you can do that on an online pc with a qrcode reader and http://www.txtwizard.net/compression )
-
extract the uuid 2nd line after the @ , this is uuid from the vault.
-
on the ian coleman webpage go to bip32 derivation key and put m/44'/1131373167' as derivation path, check the box 'use hardeness address', remove the 2 first char from the first publick key. this is your other uuid from ian coleman script.
Both uuid should match !! That means you are secure, only uuid and xpub keys for several crypto are sent during initial setup.
aaronisme
transparency is very nice, I have decoded (base64 + gz) the first 3 qrcode on vault setup, I see they contains xpub for all the crypto but there is some code at the beginning like 6d89bc8.... : cobo vault qrcode� @6d89bc8ff1c17025e889ddfc347............... � BTC� M/49'/0'/0'oxpub6CzqM1v4SX67Bbgc....... I would like to know (or be documented) what this first code is and how I can recalculate it? I would like to be sure it is not some encoding of the seed ... It has 32 bytes, enough to store 256 bits of entropy of 24 mnemonic words...