Check yourself: Verify before trust

Questions and answers, readable without JavaScript.

1. Who has to be able to move the funds for you to be in self-custody?

   • You, or a deliberately documented multisig policy — not merely an icon that says non-custodial
   • The exchange that shows the balance
   • Anyone with the wallet's browser extension
   • The miner who confirmed the last block
   Answer 1

   You, or a deliberately documented multisig policy — not merely an icon that says non-custodial

   The note's test is unilateral control of the private material that authorises spends. If that is not you, or your documented multisig policy, you are not in self-custody.

   Read the note → · Self-Custody Without Verify-Before-Trust Is a Slogan

2. What has to attest a published checksum list?

   • Nothing. A matching checksum is enough
   • The file size alone
   • Signatures from keys you choose to trust. A checksum the attacker can replace along with the file is a weak check
   • A screenshot of the download page
   Answer 2

   Signatures from keys you choose to trust. A checksum the attacker can replace along with the file is a weak check

   Compare the file to a published checksum list, then verify that list is signed by keys you accept as authentic. Checksum without signature is weak if both can be swapped.

   Read the note → · Self-Custody Without Verify-Before-Trust Is a Slogan

3. Why is copying a destination from transaction history a known failure?

   • History cannot store addresses
   • Bech32 has no checksum
   • Explorers always rewrite the first character
   • Address poisoning plants a lookalike, sharing prefix and suffix characters, so a later copy-from-history pays the attacker
   Answer 3

   Address poisoning plants a lookalike, sharing prefix and suffix characters, so a later copy-from-history pays the attacker

   Attackers dust a vanity-like address into your history. The note's countermeasure is to avoid copying destinations from history or explorers and to compare every character on a trusted display.

   Read the note → · Self-Custody Without Verify-Before-Trust Is a Slogan