Seed Phrases: The Case for Bitkeys and Multisig by Default

If seed phrases are the single point of failure behind nearly every Bitcoin hack, maybe the fix isn't a better seed phrase, it's no seed phrase at all. Using a hands-on entropy demo (dice, letter tiles, and a printed seed sheet) as a jumping-off point, Andy and Ben walk through why they've come around to bitkey-style multisig as the right default for a mainstream audience, they argue that eliminating the single point of failure and defaulting to multisig removes the failure modes (loss, theft, forgetting) that make seed-phrase custody so unforgiving, even for people who understand Bitcoin deeply.

I think managing a seed in general is probably not the solution for most people. Of course there's always going to be the hardcore people that get the comfort from managing the seed and have a bunch of redundant processes, but the threat is that the seed is the money: if somebody gets hold of your seed, they can take all your money. So you have to go through great lengths to secure it

Andy

Yeah, I think managing a seed in general is probably not the solution for most people. Of course there’s always going to be the hardcore people that get the comfort from managing the seed and have a bunch of redundant processes, but the threat is that the seed is the money: if somebody gets hold of your seed, they can take all your money. So you have to go through great lengths to secure it: make sure no one’s going to stumble upon it, make sure you’re not going to forget where it is, make sure it won’t be compromised in case of a catastrophe (a flood, a fire, a break-in). There’s a lot of failure modes when you’re dealing with a seed, and I think one of the things we like about bitkeys is that they’ve abstracted that away from the user in a kind of multisig-native, secure way, which we quite like.

Ben

So we went on a little bit of a micro odyssey (timely, because there’s a new film called The Odyssey) around hardware wallets. I mean, frankly, I think there are a few things that go on:. you get into Bitcoin, someone tells you, “hey, you need the seed phrase”, you sort it out, put it away, and that’s, kind of by design, what it’s supposed to do; you never look at it again except in an emergency. So you kind of forget about it, and you can just send money there, and it’s long-term savings. This is why the Cold Card hack was so disgraceful. But maybe we’re like Bitcoin boomers. I mean, I used to think that, yeah, people use password managers, you use one password and you understand okay, I’ve got to keep one password safe and that gives me all my other passwords. But it’s quite easy to remember a memorable password that you broadly just don’t ever share anywhere, and also it’s not as consequential; it’s not all your money.

Ben

I thought back then that maybe people will just learn that, okay, there’s another password that you’ve got to keep really safe, and everyone will be fine. But now I see that’s absolute nonsense. It won’t. I can see it very clearly, especially having, in the past few weeks, very viscerally helped a lot of people I assumed (or incorrectly assumed) knew what they were doing, struggling to remember concepts they had learned and subsequently not having to worry about. But also I have friends who are just as technical, and they were just uncomfortable, right, because shit had got real. And I think as a result the Bitkey team is correct, conceptually and philosophically, that you should strive to get rid of seed phrases, and that the default should actually be multisig. I think this is very, very clear to me now: that that is actually correct for a mainstream audience.

Andy

With those two pieces you eliminate the single point of failure threat entirely. There’s not a seed that, if someone finds, you’re cooked. If you lose something, you’re fine, because it’s multisig, so you can recover parts of your keys; it’s still your keys, so there’s still your coins. There’s a lot to like there, for sure.

Ben

Yeah.