Hacker News Reader

> Or, if you are planning to use the note immediately or near term in commerce, you might have sufficient confidence that our re-key service won't shut down (but yes, this obviously implies some trust if you hold notes without re-keying of claiming).

Does this mean that your private servers have the ability to re-key notes? What prevents someone from scanning the chip or storing the user key that they generated, handing the note to someone else, and then walking around the corner and immediately using the scanned information to re-key it?

Without understanding more about the technical details, this feels like unless a user is using an app to re-key immediately at the time of transfer that it's significantly less secure than normal cash. I guess I'm not completely clear on what you're doing with user keys.

---

> Because with a phone alone they need to store their keys locally.

But they have to do that here too, or is the assertion that they don't need to back up the user key necessarily and that it's not secret? Is the user key just plain-text readable?

If the user key is accessible from the chip just via scanning (not cutting), and isn't a user-defined secret that only they know (which seems like would require some form of backup), then does that mean an attacker can just walk past my wallet with a reasonably powerful RFID reader and then rekey every single one of my bills?

> Without understanding more about the technical details, this feels like unless a user is using an app to re-key immediately at the time of transfer that it's significantly less secure than normal cash.

We will have a security overview doc up soon, we ran out of time to have it ready today. Long story short, there are pending key rotation states and the latest holder can always re-key the note again. But it is indeed distinct from cash; we can't just state a note has value like governments do, by fiat.

We have to provide users with sufficient information to assess the veracity of that claim relative to the functions of Bitcoin and the information we provide on the note.

> But they have to do that here too, or is the assertion that they don't need to back up the user key necessarily?

Not necessarily; in the condition where a user is confident they are the only ones that can claim, they can place the notes in a safe the same way they might printed Bitcoin keys or Opendimes (I would recommend a fireproof safe).

> We will have a security overview doc up soon, we ran out of time to have it ready today.

I mean this respectfully - why would you release a cryptographic method of transferring money - without going into detail of how it actually works? That's kinda the entire point of cryptocurrency, that we have a way to be mathematically confident the money is safe - but you didn't tell us the math. Especially on HN were a lot of the audience is technical enough to want to and be able to verify it to some degree.

I see you have patent US10896412B2, which honestly I have to ask how this is any different from any other hardware wallet?

> A physical cryptocurrency may comprise a physical medium and an attached processor.

I read some of the details (admittedly not all) and I'm still unsure how this is different from any other hardware wallet. AFAIK this is just a hardware wallet that exposes it's public key, then exposes it's private key when you cut the wire? Then we still need your signature to transfer the crypto, which is so double spend is prevented?

Also, if your servers go down or you're hacked or rm -rf dir/ * happens, will all the notes become unusable? Are we relying on you to maintain servers indefinitely?

> I mean this respectfully - why would you release a cryptographic method of transferring money - without going into detail of how it actually works? That's kinda the entire point of cryptocurrency, that we have a way to be mathematically confident the money is safe - but you didn't tell us the math. Especially on HN were a lot of the audience is technical enough to want to and be able to verify it to some degree.

As noted, the app will be open source as will the (brief) Bitcoin script for audit. For the sake of simplicity 2-of-2 multisig that downgrades to 1-of-2 multisig over time should capture the essence of how these notes work.

> Also, if your servers go down or you're hacked or rm -rf dir/ * happens, will all the notes become unusable? Are we relying on you to maintain servers indefinitely?

Nope. Users can always claim funds after the expiration date of January 3rd 2029 using the user key stored on the note.

> For the sake of simplicity 2-of-2 multisig that downgrades to 1-of-2 multisig over time should capture the essence of how these notes work. > Users can always claim funds after the expiration date of January 3rd 2029 using the user key stored on the note.

Interesting, thank you. That does seem more reasonable to me. Best of luck with your project.

>Nope. Users can always claim funds after the expiration date of January 3rd 2029 using the user key stored on the note.

Wait what? If your service gets hacked or goes away, the funds will be usable seven years from now? How is this statement different from “You’ll find out whether or tech stack works years from now “?

This kind of "smart-contracts" can be made and tested today on the Bitcoin network. Instead of picking a block-height of 7-9 years in the future, you could pick one on the next 20 minutes....

The code (if not put in a Taproot transaction) is "naked" visible on the blockchain, so no "trust" is needed.

> 2-of-2 multisig that downgrades to 1-of-2 multisig over time

Did you mean "downgrades to 1-of-1"? "1-of-2" implies either key would work.

> The multisig reverts to only your key after a printed expiration date on the note

Yes, that makes more sense, I was mischaracterizing it. 1-of-1 is more appropriate (although the notion of a 1-of-1 multisig is a little odd at face value until one digs in).

What do you mean you ran out of time? Was this a race?

The fact they couldn't wait a few days to make a post here makes me think "move fast break things" at best, and a flat out scam at worst.

Would the security details have ever been worked on if people weren't commenting here?

Are they going to take orders before putting it up?

Are they aware of how prevalent crypto scams are and how vitally important it is to distance yourself if you want to be taken seriously?

This kind of impulsivity is exactly what I don't want from people dealing with money.

> This kind of impulsivity is exactly what I don't want from people dealing with money.

You're going to be really disappointed to hear how most fintech startups, and non-startups, and non-fintech software companies, and non-startup companies, operate then.

Yeah its bad, but lets not act like the bar was ever high to begin with.

I'm not saying that's the bar across all companies, that's ridiculous. I'm saying my bar is someone has to prove they are competent for me to trust them with my money.

And given how many crypto scams there have been, one's bar should be higher than your normal startup, unless you don't care about losing money put into it.

It's the same way I don't let a friend borrow money if he's generally irresponsible or burned me in the past just because he guarantees he can double it by the end of the month.

I don't know if you're implying this, but it seems like you think because every company has to start somewhere it means they inherently deserve trust and little criticism to help them along?

They are trying to build a physical/digital bearer instrument. Not a company, pure cash in your pocket. Of course the standards for security are higher.

That's completely ridiculous, of course it's a company.

You needed resources to design the money art, put NFC chips on them, code + test the system, and make the promo website.

Next they have to build more of the site, setup a system to track sales and deliver the money to customers, and host a server to make the money work.

Not only that but this is definitely not "cash in your pocket". Cash has value backed by the government that you can pay taxes with.

Even if Bitcoin notes take off, they're no better than a visa gift card you can redeem (if the company doesn't go out of business, at least)

I sound like I'm bashing, but it's very disingenuous to say this and bitcoin is the same as fiat currency.

FWIW Cameron is well known around here (YC S09) and very unlikely to be a scammer...

Does "cutting" a note mean taking scissors to cut it physically? Can you cut it in the corner or it has to be "across" a sensor boundary somehow breaking connectivity?

Can you tear the note apart and have it work too, if you don't have scissors on hand for example?

Maybe you can sell a kit that comes with the notes and a special cutter, like a cigar cutter with a box

The synthetic paper we use is laughably difficult to tear -- it more readily deforms and stretches instead. You need to cut across a trace.

I like the idea of a note "humidor" with included cutter -- instead it's fireproof and includes EMF shielding.

Meaning the cutting part is literal and the notes are basically single-use?

Yes, literal cutting -- if not cut, the notes can be re-keyed and recirculated until the expiration date in 2029.

What happens after the expiration date?

At that point in time the note downgrades to a 1-of-2 multisig where only the user key on the note is needed to create a transaction. Cutting the note isn't required/is irrelevant as the second encrypted key has no function at that time.

Thanks.

I assume this is a technical limitation rather than a business decision to sell more notes. But I do wonder (as someone who doesn't quite understand cryptography and multisig beyond the basics of how Bitcoin works), barring a protocol update, is it technically impossible to have reusable notes or was this a trade-off/design decision? If it is possible, is the trade-off it requiring an on-chain transaction to update the multisig every time the note change hands?

This looks like a cool gift, but the necessity of destroying the note to move it, or otherwise trust the giver didn't copy the key, makes it a bad currency (I understand that cold-storage is the aimed use-case, not currency). My first thought on the landing page was that the keys were inaccessible to the holder without destroying the note for moving it to a known address (which would be somewhat alike trading in US dollars for gold, back in the day). I.e., that you could trust the note holds it's denomination as long as it is not cut. That would make it a proper offline and trustless currency. Is there a future where such notes will exist and does it require a major protocol update?

> I assume this is a technical limitation rather than a business decision to sell more notes. But I do wonder (as someone who doesn't quite understand cryptography and multisig beyond the basics of how Bitcoin works), barring a protocol update, is it technically impossible to have reusable notes or was this a trade-off/design decision? If it is possible, is the trade-off it requiring an on-chain transaction to update the multisig every time the note change hands?

This is a trade-off; we could issue notes that never expire and do not require cutting to claim (and could be reloaded), however, this would require perpetual trust that we remain in existence without a fallback. Creating an expiration date mirrors how real money wears out after use. Our intent here isn't to sell more notes; in a medium-confidence scenario our hope is that after a long life in circulation the final holder of the notes re-keys them and puts them in a safe place until 2029 at which point they claim without cutting the notes (and retain them as collectable artifacts with no Bitcoin value thereafter). Our goal is not to sell more notes because they are cut/expired, but rather because we have new designs and denominations.

> This looks like a cool gift, but the necessity of destroying the note to move it, or otherwise trust the giver didn't copy the key, makes it a bad currency (I understand that cold-storage is the aimed use-case, not currency). My first thought on the landing page was that the keys were inaccessible to the holder without destroying the note for moving it to a known address (which would be somewhat alike trading in US dollars for gold, back in the day). I.e., that you could trust the note holds it's denomination as long as it is not cut. That would make it a proper offline and trustless currency. Is there a future where such notes will exist and does it require a major protocol update?

If there is anything beyond zero trust that we exist in some form into the future, the goal is that the recipient can re-key a note from an untrusted giver without cutting the note. In a medium trust world you can assume that a note hold value without scanning it so long as the expiration date is not past. But this requires several things -- (1) trusting that we will continue to exist and facilitate key rotation and (2) that the previous holder carried out some validation and is somewhat trustworthy -- e.g. potentially a bank or large retailer. For low value notes this doesn't seem completely unreasonable, but I appreciate why no one would treat the notes that way without some track record. Given a theoretical new chip which doesn't exist there are some additional possibilities here.

Your physical note itself expire 2029?

What? Why?

Decirculating old currencies can either happen intentionally or unintentionally.

Intentionally decirculating old currencies is called demurrage. Think Swiss bank notes. They tend to recall old notes every 30 years when they issue a new generation of notes. They are currently on generation nine and just recalled generation eight. Bitcoin Note is on generation one.

While it is somewhat common in centralized printed currencies like the franc or the pound it is an important feature of decentralized printed currencies to help dirciculate old notes as there is no central mechanism to cull old notes. One wants to put economic pressure to dicirculate old notes for a variety of reasons but perhaps one of the most important ones is because chips become less secure over time. (Analogously one wants to put economic pressure on miners to upgrade to the latest bitcoin network (such as when taproot came out).)

It's important to note, the Bitcoin stored on the note doesn't "disappear" after 2029 - but rather the multi-sig on the note reverts from 2-of-2 to 1-of-2 so the value can be claimed - in effect turning the note into something more like a claimable voucher or gift card. It contains value, you just generally wouldn't circulate it after then.

For a casual overview see: https://beyondmoney.net/monographs/demurrage-is-it-a-good-id... - that article doesn't talk about economic levers on non-centrally issued currencies because those are frankly quite novel.

Unintentionally dircirculating old notes is called revolution.

Oh.

So you took a non-physical asset, materialized it, and require a physical alteration to realize.

Why?

None of the reasons in comments or on your website make sense.

Cash is the most popular peer to peer payment medium. By far.

Most people don’t think about its implicit properties but it’s low trust, instant, final, anonymous, and works offline. If you care about transactions per second it outpaces Visa by a country mile.

That there is no onchain record of your transaction, instant settlement, and the receiving party can’t see your balance are nice enhancements for Bitcoin in certain types of transactions.

Further, most currencies be it yen or dollars, operate mostly electronically but still have a cash form. Now Bitcoin does too.

But it doesn’t. This concept will never play like actual cash.

It’s adding steps to a seamless process. Literally, adding seams.

I don’t think we’re on the same page.

Would you mind explaining to me how you think this works so we can clear any confusion?

> That's correct

Doesn't sound very "self-custodial" to me.

We can't transfer the funds under any circumstance. Custody always reverts to the user key on the note.

> Because with a phone alone they need to store their keys locally. With re-keyed notes (or notes from family members who have re-keyed them), they can immediately store notes in a safe place without the problem of phone hacks or loss.

In a safe place, like a wallet? This seems dramatic unnecessary. You can lose cash. And it’s measurable how much easier it is to lose paper money compared to a phone.

Hard cash went electronic. Why would electronic cash go hard?

Or a safe.

Because it's easier to understand and safely custody than private keys for the billions of people who know how to use cash but haven't encountered Bitcoin yet.

The re-keying seems like a hassle to get grandparents to do - wouldn't it be better if the cash value is linked to a generated wallet that is locked behind a very strong key? That way the cash becomes the physical representation of X amount if BTC with "real" backing?

Can you explain re-keying? Does that happen on-chain? If so, who pays for the transaction fees?

Yes; you are effectively requesting sending from the original 2-of-2 multisig to a new 2-of-2 multisig in the re-key procedure. The user broadcasts the transactions and pays the fees. For all transfers we're recommending using the lowest fee tier possible as given the fact that the notes are intended to be long-lived, rushing to load or re-key them doesn't make a ton of sense.