From d0011d1633147718adcdd53466d787a4f5af85df Mon Sep 17 00:00:00 2001 From: Epic Curious <109078515+epiccurious@users.noreply.github.com> Date: Sat, 2 Dec 2023 09:12:30 -0500 Subject: [PATCH 01/13] Add mention of evil maid attacks --- README.md | 30 ++++++++++++++++++++++-------- flash_your_device | 2 +- 2 files changed, 23 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index cf1802a..84d57e1 100644 --- a/README.md +++ b/README.md @@ -6,15 +6,16 @@ This guide is designed for the general user who is not incompetant with computer - [Background](#background) - [What is a Jade?](#what-is-a-jade) - - [Motivation](#motivation) + - [Motivation (Who Should Follow This Guide?)](#motivation-who-should-follow-this-guide) - [Who Should NOT Follow This Guide?](#who-should-not-follow-this-guide) + - [Keep Your DIY Jade Secured](#keep-your-diy-jade-secured) - [Current Limitations of Third-Party DIY Hardware](#current-limitations-of-third-party-diy-hardware) -- [Overview of Hardware Options](#overview-of-hardware-options) +- [Hardware Options](#hardware-options) - [TTGO T-Display](#ttgo-t-display) - [M5Stack M5StickC PLUS](#m5stack-m5stickc-plus) - [M5Stack Core Basic](#m5stack-core-basic) - [M5Stack FIRE v2.6](#m5stack-fire-v26) -- [Set Up Instructions](#set-up-instructions) +- [Set-Up Instructions](#set-up-instructions) - [Use the Semi-Automated Script](#use-the-semi-automated-script) - [Use a Device-Specific Script](#use-a-device-specific-script) - [Run the Commands Manually](#run-the-commands-manually) @@ -28,7 +29,7 @@ This guide is designed for the general user who is not incompetant with computer The firmware that runs Jade can also run other general purpose hardware that shares the same ESP32 microcontroller. -### Motivation +### Motivation (Who Should Follow This Guide) Why Should I Follow This Guide? @@ -46,16 +47,24 @@ You understand that the person who sells you hardware for your bitcoin shouldn't 2. You want to learn how to use the Jade hardware wallet. Refer to [the Jade's help center documentation](https://help.blockstream.com/hc/en-us/categories/900000061906-Blockstream-Jade/) or [contact Blockstream](https://help.blockstream.com/hc/en-us/requests/new) for software support. -3. You're a normie who can't be bothered to learn how to operate a computer through the command line. We will be using the Terminal console, which some people find scary. It's not hard, I promise. +3. You can't be bothered to operate a computer through the command line. We will be using the Terminal console, which some people find scary. It's not hard, I promise. -4. You aren't willing to use macOS or [Linux](https://ubuntu.com/tutorials/install-ubuntu-desktop). (This guide only supports macOS and Debian Linux for now but will eventually add support for other Linux distributions.) +4. You aren't willing to use [Linux](https://ubuntu.com/tutorials/install-ubuntu-desktop), macOS (running Arm-based hardware), or ChromeOS. This guide only supports Debian Linux, macOS, and ChromeOS for now but will eventually add support for other Linux distributions. + +### Keep Your DIY Jade Secured + +Evil maid attacks, such as [this one done by hackers for a competitor](https://www.ledger.com/blog/firmware-extraction-evil-maid-attacks-on-blockstream-jade-hardware-wallet), will become easier and cheaper to perform over time. + +As a countermeasure, keep your DIY Jade locked up with restricted access in a safe or lockbox. Don't let your house cleaner see it. **You need to control physical access** to your DIY Jade hardware wallet at all times. ### Current Limitations of Third-Party DIY Hardware - No camera support. To build a DIY Jade with camera support, [please refer here](https://www.youtube.com/watch?v=V2yVKag2wlc). - Need a documented process for updating firmware. -## Overview of Hardware Options +[[back to top]](#table-of-contents) + +## Hardware Options You are better off buying the hardware directly from the hardware vendor than through a third-party channel like Amazon or Alibaba. In many cases, it's cheaper to buy direct too. @@ -92,7 +101,9 @@ You are better off buying the hardware directly from the hardware vendor than th - **MSRP: [$50](https://shop.m5stack.com/products/m5stack-fire-iot-development-kit-psram-v2-6)** - Nice 3-button design, a bigger battery, and a magnetic charging base -## Set Up Instructions +[[back to top]](#table-of-contents) + +## Set-Up Instructions There are three options for flashing your device: - [**Install with the Semi-Automated Script**](#install-with-the-semi-automated-script) (easiest way) @@ -106,6 +117,7 @@ This option is recommended for the average user who doesn't know how to read and 1. Open the Terminal. - On Linux, press `Ctrl+Alt+T`. - On macOS, press `Command+Space`, type terminal, and press `return`. + - on ChromeOS, install Linux under Settings -> Advanced -> Developers. Then press `search 🔍` on the keyboard, type terminal and press `enter`. 2. Copy-paste the following full command in Terminal (you might have to scroll right): ```bash @@ -208,6 +220,8 @@ TODO: Add macOS instructions. After the build and flash process completes, you should see the Jade initialization screen on your device. +[[back to top]](#table-of-contents) + ## Acknowledgements Inspiration for this project came from: diff --git a/flash_your_device b/flash_your_device index 719ba14..555213d 100755 --- a/flash_your_device +++ b/flash_your_device @@ -198,7 +198,7 @@ echo -e "Ready to install Jade ${jade_version} on your ${chosen_device}.\n (Thi read -srn1 -p " PRESS ANY KEY to continue... " && echo final_confirmation_sleep_time="10" -echo -ne "\nJade ${jade_version} installion will begin in ${final_confirmation_sleep_time} seconds.\nPress Ctrl+C to cancel... " +echo -ne "\nContinuing Jade ${jade_version} installion in ${final_confirmation_sleep_time} seconds.\nPress Ctrl+C to abort ... " sleep "${final_confirmation_sleep_time}" echo From 97c136a7455a587de2f875385a315d13ea6d8fb5 Mon Sep 17 00:00:00 2001 From: Epic Curious <109078515+epiccurious@users.noreply.github.com> Date: Sat, 16 Dec 2023 18:10:27 -0500 Subject: [PATCH 02/13] doc: improve wording --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 84d57e1..87961a0 100644 --- a/README.md +++ b/README.md @@ -49,7 +49,7 @@ You understand that the person who sells you hardware for your bitcoin shouldn't 3. You can't be bothered to operate a computer through the command line. We will be using the Terminal console, which some people find scary. It's not hard, I promise. -4. You aren't willing to use [Linux](https://ubuntu.com/tutorials/install-ubuntu-desktop), macOS (running Arm-based hardware), or ChromeOS. This guide only supports Debian Linux, macOS, and ChromeOS for now but will eventually add support for other Linux distributions. +4. You aren't willing to use [Linux](https://ubuntu.com/tutorials/install-ubuntu-desktop), macOS (running modern Arm-based hardware), or ChromOS. (This guide only supports Debian-based Linux, macOS, and ChromeOS for now but will eventually add support for other Linux distributions.) ### Keep Your DIY Jade Secured From ec5a266327858ac3096a9b209a10971e5f7bc2e5 Mon Sep 17 00:00:00 2001 From: Epic Curious <109078515+epiccurious@users.noreply.github.com> Date: Sat, 16 Dec 2023 19:38:46 -0500 Subject: [PATCH 03/13] doc: acc note about decoy devices --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 87961a0..3a6d32e 100644 --- a/README.md +++ b/README.md @@ -55,7 +55,9 @@ You understand that the person who sells you hardware for your bitcoin shouldn't Evil maid attacks, such as [this one done by hackers for a competitor](https://www.ledger.com/blog/firmware-extraction-evil-maid-attacks-on-blockstream-jade-hardware-wallet), will become easier and cheaper to perform over time. -As a countermeasure, keep your DIY Jade locked up with restricted access in a safe or lockbox. Don't let your house cleaner see it. **You need to control physical access** to your DIY Jade hardware wallet at all times. +It's not just a risk of someone hacking or altering YOUR device. An evil maid can also swap your device with a new malicious device ([[#1]](https://usa.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/28299/), [[#2]](https://media.ccc.de/v/35c3-9563-wallet_fail), [[#3]](https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7), [[#4]](https://www.reddit.com/r/ledgerwallet/comments/o154gz/comment/h1zagmk/)). + +As a countermeasure to evil maid attacks, **you need to control physical access** to your DIY Jade hardware wallet at all times. Keep your DIY Jade locked up in a safe, lockbox, or some other method of restricting access. Don't let your house cleaner see it. ### Current Limitations of Third-Party DIY Hardware From 84829030b3ef504091033f23ab0a8653d256a8c3 Mon Sep 17 00:00:00 2001 From: Epic Curious <109078515+epiccurious@users.noreply.github.com> Date: Sat, 16 Dec 2023 19:41:42 -0500 Subject: [PATCH 04/13] fix: use archived link --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 3a6d32e..60437d5 100644 --- a/README.md +++ b/README.md @@ -55,7 +55,7 @@ You understand that the person who sells you hardware for your bitcoin shouldn't Evil maid attacks, such as [this one done by hackers for a competitor](https://www.ledger.com/blog/firmware-extraction-evil-maid-attacks-on-blockstream-jade-hardware-wallet), will become easier and cheaper to perform over time. -It's not just a risk of someone hacking or altering YOUR device. An evil maid can also swap your device with a new malicious device ([[#1]](https://usa.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/28299/), [[#2]](https://media.ccc.de/v/35c3-9563-wallet_fail), [[#3]](https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7), [[#4]](https://www.reddit.com/r/ledgerwallet/comments/o154gz/comment/h1zagmk/)). +It's not just a risk of someone hacking or altering YOUR device. An evil maid can also swap your device with a new malicious device ([[#1]](https://usa.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/28299/), [[#2]](https://media.ccc.de/v/35c3-9563-wallet_fail), [[#3]](https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7), [[#4]](https://web.archive.org/web/20220820031918/https://www.reddit.com/r/ledgerwallet/comments/o154gz/comment/h1zagmk/)). As a countermeasure to evil maid attacks, **you need to control physical access** to your DIY Jade hardware wallet at all times. Keep your DIY Jade locked up in a safe, lockbox, or some other method of restricting access. Don't let your house cleaner see it. From 325b225415c87484866d3703d73e94be41d559d1 Mon Sep 17 00:00:00 2001 From: Epic Curious <109078515+epiccurious@users.noreply.github.com> Date: Sat, 16 Dec 2023 19:43:57 -0500 Subject: [PATCH 05/13] doc: improve search key format --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 60437d5..2fb5cca 100644 --- a/README.md +++ b/README.md @@ -119,7 +119,7 @@ This option is recommended for the average user who doesn't know how to read and 1. Open the Terminal. - On Linux, press `Ctrl+Alt+T`. - On macOS, press `Command+Space`, type terminal, and press `return`. - - on ChromeOS, install Linux under Settings -> Advanced -> Developers. Then press `search 🔍` on the keyboard, type terminal and press `enter`. + - on ChromeOS, install Linux under Settings -> Advanced -> Developers. Then press `🔍 (search)` on the keyboard, type terminal and press `enter`. 2. Copy-paste the following full command in Terminal (you might have to scroll right): ```bash From 536830a3f6ccdb6db5d4a7ee9b0154fd8b11716a Mon Sep 17 00:00:00 2001 From: Epic Curious <109078515+epiccurious@users.noreply.github.com> Date: Sat, 16 Dec 2023 19:51:33 -0500 Subject: [PATCH 06/13] doc: improve formatting --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 2fb5cca..0617c17 100644 --- a/README.md +++ b/README.md @@ -55,7 +55,9 @@ You understand that the person who sells you hardware for your bitcoin shouldn't Evil maid attacks, such as [this one done by hackers for a competitor](https://www.ledger.com/blog/firmware-extraction-evil-maid-attacks-on-blockstream-jade-hardware-wallet), will become easier and cheaper to perform over time. -It's not just a risk of someone hacking or altering YOUR device. An evil maid can also swap your device with a new malicious device ([[#1]](https://usa.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/28299/), [[#2]](https://media.ccc.de/v/35c3-9563-wallet_fail), [[#3]](https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7), [[#4]](https://web.archive.org/web/20220820031918/https://www.reddit.com/r/ledgerwallet/comments/o154gz/comment/h1zagmk/)). +It's not just a risk of someone hacking or altering YOUR device. An evil maid can also swap your device with a new malicious device. + +Further reading: ([[#1]](https://usa.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/28299/), [[#2]](https://media.ccc.de/v/35c3-9563-wallet_fail), [[#3]](https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7), [[#4]](https://web.archive.org/web/20220820031918/https://www.reddit.com/r/ledgerwallet/comments/o154gz/comment/h1zagmk/)). As a countermeasure to evil maid attacks, **you need to control physical access** to your DIY Jade hardware wallet at all times. Keep your DIY Jade locked up in a safe, lockbox, or some other method of restricting access. Don't let your house cleaner see it. From 4554a034fc189cc3dd8d5833c5e1f51d809d4878 Mon Sep 17 00:00:00 2001 From: Epic Curious <109078515+epiccurious@users.noreply.github.com> Date: Sat, 16 Dec 2023 20:02:07 -0500 Subject: [PATCH 07/13] doc: Use capitalization and repetition for user's attention --- README.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 0617c17..11914b1 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ This guide is designed for the general user who is not incompetant with computer - [What is a Jade?](#what-is-a-jade) - [Motivation (Who Should Follow This Guide?)](#motivation-who-should-follow-this-guide) - [Who Should NOT Follow This Guide?](#who-should-not-follow-this-guide) - - [Keep Your DIY Jade Secured](#keep-your-diy-jade-secured) + - [Keep Your DIY Jade Secured](#must-read-keep-your-diy-jade-secured) - [Current Limitations of Third-Party DIY Hardware](#current-limitations-of-third-party-diy-hardware) - [Hardware Options](#hardware-options) - [TTGO T-Display](#ttgo-t-display) @@ -51,15 +51,15 @@ You understand that the person who sells you hardware for your bitcoin shouldn't 4. You aren't willing to use [Linux](https://ubuntu.com/tutorials/install-ubuntu-desktop), macOS (running modern Arm-based hardware), or ChromOS. (This guide only supports Debian-based Linux, macOS, and ChromeOS for now but will eventually add support for other Linux distributions.) -### Keep Your DIY Jade Secured +### MUST READ: Keep Your DIY Jade Secured -Evil maid attacks, such as [this one done by hackers for a competitor](https://www.ledger.com/blog/firmware-extraction-evil-maid-attacks-on-blockstream-jade-hardware-wallet), will become easier and cheaper to perform over time. +**You need to control physical access to your DIY Jade** -It's not just a risk of someone hacking or altering YOUR device. An evil maid can also swap your device with a new malicious device. +Evil maid attacks, such as [this one done by hackers for a competitor](https://www.ledger.com/blog/firmware-extraction-evil-maid-attacks-on-blockstream-jade-hardware-wallet), will become easier and cheaper to perform over time. -Further reading: ([[#1]](https://usa.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/28299/), [[#2]](https://media.ccc.de/v/35c3-9563-wallet_fail), [[#3]](https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7), [[#4]](https://web.archive.org/web/20220820031918/https://www.reddit.com/r/ledgerwallet/comments/o154gz/comment/h1zagmk/)). +It's not just a risk of someone hacking or altering YOUR device. An evil maid can also swap your device with a new malicious device. (For further reading, please see [[#1]](https://usa.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/28299/), [[#2]](https://media.ccc.de/v/35c3-9563-wallet_fail), [[#3]](https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7), [[#4]](https://web.archive.org/web/20220820031918/https://www.reddit.com/r/ledgerwallet/comments/o154gz/comment/h1zagmk/)) -As a countermeasure to evil maid attacks, **you need to control physical access** to your DIY Jade hardware wallet at all times. Keep your DIY Jade locked up in a safe, lockbox, or some other method of restricting access. Don't let your house cleaner see it. +As a countermeasure to evil maid attacks, **you need to control physical access to your DIY Jade** hardware wallet at all times. Keep your DIY Jade locked up in a safe, lockbox, or some other method of restricting access. Don't let your house cleaner see it. ### Current Limitations of Third-Party DIY Hardware From 224c383f763a9add1c10db7f35d9cc7127cf5023 Mon Sep 17 00:00:00 2001 From: Epic Curious <109078515+epiccurious@users.noreply.github.com> Date: Sat, 16 Dec 2023 20:09:21 -0500 Subject: [PATCH 08/13] doc: some more improvements --- README.md | 60 ++++++++++++++++++++++++++++++++++++------------------- 1 file changed, 39 insertions(+), 21 deletions(-) diff --git a/README.md b/README.md index 11914b1..3c6624b 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ This guide is designed for the general user who is not incompetant with computer - [What is a Jade?](#what-is-a-jade) - [Motivation (Who Should Follow This Guide?)](#motivation-who-should-follow-this-guide) - [Who Should NOT Follow This Guide?](#who-should-not-follow-this-guide) - - [Keep Your DIY Jade Secured](#must-read-keep-your-diy-jade-secured) + - [MUST READ: Keep Your DIY Jade Secured](#must-read-keep-your-diy-jade-secured) - [Current Limitations of Third-Party DIY Hardware](#current-limitations-of-third-party-diy-hardware) - [Hardware Options](#hardware-options) - [TTGO T-Display](#ttgo-t-display) @@ -118,40 +118,45 @@ There are three options for flashing your device: This option is recommended for the average user who doesn't know how to read and write bash. -1. Open the Terminal. +1. Read [this section about physically securing your DIY Jade]([MUST READ: Keep Your DIY Jade Secured](#must-read-keep-your-diy-jade-secured)). + +2. Open the Terminal. - On Linux, press `Ctrl+Alt+T`. - On macOS, press `Command+Space`, type terminal, and press `return`. - on ChromeOS, install Linux under Settings -> Advanced -> Developers. Then press `🔍 (search)` on the keyboard, type terminal and press `enter`. -2. Copy-paste the following full command in Terminal (you might have to scroll right): +3. Run the following command (via copy-paste) in Terminal. ```bash /bin/bash -c "$(curl -sSL https://github.com/epiccurious/jade-diy/raw/master/flash_your_device)" ``` -3. When the script asks, choose your device (#1-#4). +4. When the script asks, choose your device (#1-#4). After the script completes, you should see the Jade initialization screen on your device. ### Use a Device-Specific Script -1. Open the Terminal. On Linux, press `Ctrl+Alt+T`. On macOS, press `Command+Space`, type terminal, and press `return`. +1. Read [this section about physically securing your DIY Jade]([MUST READ: Keep Your DIY Jade Secured](#must-read-keep-your-diy-jade-secured)). -2. Connect your device to your computer via USB. +2. Open the Terminal. + - On Linux, press `Ctrl+Alt+T`. + - On macOS, press `Command+Space`, type terminal, and press `return`. + - on ChromeOS, install Linux under Settings -> Advanced -> Developers. Then press `🔍 (search)` on the keyboard, type terminal and press `enter`. -3. Run one of the following in Terminal: - - If you're using the TTGO T-Dispay, run: +3. Run one of the following commands (via copy-paste) in Terminal. + - For the TTGO T-Dispay: ``` /bin/bash -c "$(curl -sSL https://github.com/epiccurious/jade-diy/raw/master/device_specific/flash_the_ttgo_tdisplay)" ``` - - If you're using the M5Stack M5StickC PLUS, run: + - For the M5Stack M5StickC PLUS: ``` /bin/bash -c "$(curl -sSL https://github.com/epiccurious/jade-diy/raw/master/device_specific/flash_the_m5stack_m5stickc_plus)" ``` - - If you're using the M5Stack Core Basic, run: + - For the M5Stack Core Basic: ``` /bin/bash -c "$(curl -sSL https://github.com/epiccurious/jade-diy/raw/master/device_specific/flash_the_m5stack_core_basic)" ``` - - If you're using the M5Stack FIRE, run: + - For the M5Stack FIRE: ``` /bin/bash -c "$(curl -sSL https://github.com/epiccurious/jade-diy/raw/master/device_specific/flash_the_m5stack_fire)" ``` @@ -162,9 +167,11 @@ After the script completes, you should see the Jade initialization screen on you This options is provided for people who want to run the commands themselves. -1. Open the Terminal. On Linux, press `Ctrl+Alt+T`. On macOS, press `Command+Space`, type terminal, and press `return`. +1. Read [this section about physically securing your DIY Jade]([MUST READ: Keep Your DIY Jade Secured](#must-read-keep-your-diy-jade-secured)). -2. Install the required software packages. On a slow computer, this step can take over 20 minutes. Copy-and-paste the following lines into Terminal: +2. Open the Terminal. On Linux, press `Ctrl+Alt+T`. On macOS, press `Command+Space`, type terminal, and press `return`. + +3. Install the required software packages. On a slow computer, this step can take over 20 minutes. Copy-and-paste the following lines into Terminal: ```bash sudo apt update sudo apt install -y cmake git python3-pip python3-venv @@ -176,14 +183,14 @@ This options is provided for people who want to run the commands themselves. ``` TODO: Add instructions for installing macOS dependendies. -3. Download the Jade source code. Copy-and-paste the following lines into Terminal: +4. Download the Jade source code. Copy-and-paste the following lines into Terminal: ```bash git clone --recursive https://github.com/blockstream/jade "${HOME}"/jade cd "${HOME}"/jade/ git checkout $(git tag | grep -v miner | sort -V | tail -1) ``` -4. Load the pre-built configuration file for your DIY hardware. +5. Load the pre-built configuration file for your DIY hardware. - For the TTGO T-Display, run: ```bash cp configs/sdkconfig_display_ttgo_tdisplay.defaults sdkconfig.defaults @@ -201,27 +208,38 @@ TODO: Add instructions for installing macOS dependendies. cp configs/sdkconfig_display_m5fire.defaults sdkconfig.defaults ``` -5. Modify the configuration file you just loaded to disable logging in debug mode (a.k.a. "research and development" mode). +6. Modify the configuration file you just loaded to disable logging in debug mode (a.k.a. "research and development" mode). ```bash sed -i.bak '/CONFIG_DEBUG_MODE/d' ./sdkconfig.defaults sed -i.bak '1s/^/CONFIG_LOG_DEFUALT_LEVEL_NONE=y\n/' sdkconfig.defaults rm sdkconfig.defaults.bak ``` - -6. Connect your device to your computer via USB. -7. Enable read-write permissions for your device. +7. Build the firmware. + ``` + idf.py build + ``` + +8. Connect your device to your computer via USB. + +9. Enable read-write permissions for your device. ```bash [ -f /dev/ttyACM0 ] && sudo chmod o+rw /dev/ttyACM0 - [ -f /dev/ttyUSB0 ] && sudo chmod a+rw /dev/ttyUSB0 + [ -f /dev/ttyUSB0 ] && sudo chmod o+rw /dev/ttyUSB0 ``` TODO: Add macOS instructions. -8. Flash (install) Jade onto your device. On a slow computer, this step can take over 10 minutes. Run the following command in Terminal: +10. Flash (install) Jade onto your device. On a slow computer, this step can take over 10 minutes. Run the following command in Terminal: ```bash idf.py -b 115200 flash ``` +11. Either disable read-write permissions for your device or disconnect it. (Default permissions will be restored when you re-connect it.) + ```bash + [ -f /dev/ttyACM0 ] && sudo chmod o-rw /dev/ttyACM0 + [ -f /dev/ttyUSB0 ] && sudo chmod o-rw /dev/ttyUSB0 + ``` + After the build and flash process completes, you should see the Jade initialization screen on your device. [[back to top]](#table-of-contents) From 0206fe54a2267f02ef8a952a53b4bfcb8aff2bca Mon Sep 17 00:00:00 2001 From: Epic Curious <109078515+epiccurious@users.noreply.github.com> Date: Sat, 16 Dec 2023 20:09:55 -0500 Subject: [PATCH 09/13] doc: add missing period --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 3c6624b..15971fe 100644 --- a/README.md +++ b/README.md @@ -57,7 +57,7 @@ You understand that the person who sells you hardware for your bitcoin shouldn't Evil maid attacks, such as [this one done by hackers for a competitor](https://www.ledger.com/blog/firmware-extraction-evil-maid-attacks-on-blockstream-jade-hardware-wallet), will become easier and cheaper to perform over time. -It's not just a risk of someone hacking or altering YOUR device. An evil maid can also swap your device with a new malicious device. (For further reading, please see [[#1]](https://usa.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/28299/), [[#2]](https://media.ccc.de/v/35c3-9563-wallet_fail), [[#3]](https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7), [[#4]](https://web.archive.org/web/20220820031918/https://www.reddit.com/r/ledgerwallet/comments/o154gz/comment/h1zagmk/)) +It's not just a risk of someone hacking or altering YOUR device. An evil maid can also swap your device with a new malicious device. (For further reading, please see [[#1]](https://usa.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/28299/), [[#2]](https://media.ccc.de/v/35c3-9563-wallet_fail), [[#3]](https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7), [[#4]](https://web.archive.org/web/20220820031918/https://www.reddit.com/r/ledgerwallet/comments/o154gz/comment/h1zagmk/)). As a countermeasure to evil maid attacks, **you need to control physical access to your DIY Jade** hardware wallet at all times. Keep your DIY Jade locked up in a safe, lockbox, or some other method of restricting access. Don't let your house cleaner see it. From d0a93115219350664a72e74f63ecccbc465b7c4b Mon Sep 17 00:00:00 2001 From: Epic Curious <109078515+epiccurious@users.noreply.github.com> Date: Sat, 16 Dec 2023 20:10:56 -0500 Subject: [PATCH 10/13] doc: improve formatting --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 15971fe..70999e7 100644 --- a/README.md +++ b/README.md @@ -59,7 +59,9 @@ Evil maid attacks, such as [this one done by hackers for a competitor](https://w It's not just a risk of someone hacking or altering YOUR device. An evil maid can also swap your device with a new malicious device. (For further reading, please see [[#1]](https://usa.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/28299/), [[#2]](https://media.ccc.de/v/35c3-9563-wallet_fail), [[#3]](https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7), [[#4]](https://web.archive.org/web/20220820031918/https://www.reddit.com/r/ledgerwallet/comments/o154gz/comment/h1zagmk/)). -As a countermeasure to evil maid attacks, **you need to control physical access to your DIY Jade** hardware wallet at all times. Keep your DIY Jade locked up in a safe, lockbox, or some other method of restricting access. Don't let your house cleaner see it. +As a countermeasure to evil maid attacks, **you need to control physical access to your DIY Jade** hardware wallet at all times. Keep your DIY Jade locked up in a safe, lockbox, or some other method of restricting access. + +Don't let your house cleaner see your DIY Jade. ### Current Limitations of Third-Party DIY Hardware From 5e7537eb7f9bf63235670ccbdbc9df8d3de7d4ed Mon Sep 17 00:00:00 2001 From: Epic Curious <109078515+epiccurious@users.noreply.github.com> Date: Sat, 16 Dec 2023 20:18:17 -0500 Subject: [PATCH 11/13] doc: improve --- README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 70999e7..8c9fe91 100644 --- a/README.md +++ b/README.md @@ -53,15 +53,15 @@ You understand that the person who sells you hardware for your bitcoin shouldn't ### MUST READ: Keep Your DIY Jade Secured -**You need to control physical access to your DIY Jade** +tl;dr: ***You need to control physical access to your DIY Jade.*** Evil maid attacks, such as [this one done by hackers for a competitor](https://www.ledger.com/blog/firmware-extraction-evil-maid-attacks-on-blockstream-jade-hardware-wallet), will become easier and cheaper to perform over time. -It's not just a risk of someone hacking or altering YOUR device. An evil maid can also swap your device with a new malicious device. (For further reading, please see [[#1]](https://usa.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/28299/), [[#2]](https://media.ccc.de/v/35c3-9563-wallet_fail), [[#3]](https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7), [[#4]](https://web.archive.org/web/20220820031918/https://www.reddit.com/r/ledgerwallet/comments/o154gz/comment/h1zagmk/)). +It's not just a risk of someone hacking or altering YOUR device. An evil maid can also swap your device with a new malicious device. -As a countermeasure to evil maid attacks, **you need to control physical access to your DIY Jade** hardware wallet at all times. Keep your DIY Jade locked up in a safe, lockbox, or some other method of restricting access. +**As a countermeasure, you need to control physical access to your DIY Jade** hardware wallet at all times. Keep your DIY Jade locked up in a safe, lockbox, or some other method of restricting access. Don't let your house cleaner see your DIY Jade. -Don't let your house cleaner see your DIY Jade. +For further reading, please see [[#1]](https://usa.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/28299/), [[#2]](https://media.ccc.de/v/35c3-9563-wallet_fail), [[#3]](https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7), [[#4]](https://web.archive.org/web/20220820031918/https://www.reddit.com/r/ledgerwallet/comments/o154gz/comment/h1zagmk/). ### Current Limitations of Third-Party DIY Hardware From 838d12d989be1118759a180c1ceb07470c7ddab1 Mon Sep 17 00:00:00 2001 From: Epic Curious <109078515+epiccurious@users.noreply.github.com> Date: Sat, 16 Dec 2023 20:19:33 -0500 Subject: [PATCH 12/13] doc: improve again --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 8c9fe91..e92730d 100644 --- a/README.md +++ b/README.md @@ -59,7 +59,7 @@ Evil maid attacks, such as [this one done by hackers for a competitor](https://w It's not just a risk of someone hacking or altering YOUR device. An evil maid can also swap your device with a new malicious device. -**As a countermeasure, you need to control physical access to your DIY Jade** hardware wallet at all times. Keep your DIY Jade locked up in a safe, lockbox, or some other method of restricting access. Don't let your house cleaner see your DIY Jade. +**You need to control physical access to your DIY Jade** hardware wallet at all times as a countermeasure. Keep your DIY Jade locked up in a safe, lockbox, or some other method of restricting access. Don't let your house cleaner see your DIY Jade. For further reading, please see [[#1]](https://usa.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/28299/), [[#2]](https://media.ccc.de/v/35c3-9563-wallet_fail), [[#3]](https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7), [[#4]](https://web.archive.org/web/20220820031918/https://www.reddit.com/r/ledgerwallet/comments/o154gz/comment/h1zagmk/). From 20d90f25ffea506805ac2c84515d53ce6f14f70a Mon Sep 17 00:00:00 2001 From: Epic Curious <109078515+epiccurious@users.noreply.github.com> Date: Sat, 16 Dec 2023 20:21:54 -0500 Subject: [PATCH 13/13] fix: broken link syntax --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index e92730d..5b553ee 100644 --- a/README.md +++ b/README.md @@ -120,7 +120,7 @@ There are three options for flashing your device: This option is recommended for the average user who doesn't know how to read and write bash. -1. Read [this section about physically securing your DIY Jade]([MUST READ: Keep Your DIY Jade Secured](#must-read-keep-your-diy-jade-secured)). +1. Read [this section about physically securing your DIY Jade](#must-read-keep-your-diy-jade-secured). 2. Open the Terminal. - On Linux, press `Ctrl+Alt+T`. @@ -138,7 +138,7 @@ After the script completes, you should see the Jade initialization screen on you ### Use a Device-Specific Script -1. Read [this section about physically securing your DIY Jade]([MUST READ: Keep Your DIY Jade Secured](#must-read-keep-your-diy-jade-secured)). +1. Read [this section about physically securing your DIY Jade](#must-read-keep-your-diy-jade-secured). 2. Open the Terminal. - On Linux, press `Ctrl+Alt+T`. @@ -169,7 +169,7 @@ After the script completes, you should see the Jade initialization screen on you This options is provided for people who want to run the commands themselves. -1. Read [this section about physically securing your DIY Jade]([MUST READ: Keep Your DIY Jade Secured](#must-read-keep-your-diy-jade-secured)). +1. Read [this section about physically securing your DIY Jade](#must-read-keep-your-diy-jade-secured). 2. Open the Terminal. On Linux, press `Ctrl+Alt+T`. On macOS, press `Command+Space`, type terminal, and press `return`.