Yesterday, on the back and forth about BC Vault, their CTO, Alen Salamun, kept on saying their wallet was more secure, based on their product needing 5 items to be breached, and other wallets just 1.

Simple math. What is more secure? 1 thing you have to keep safe or 5 of them? Guys give me a break and overthink what you are saying. Up to this point you did absolutely nothing to compromise anything. Claiming phishing is an attck vector. Yes A BIG one for whole world.

— Alen Salamun (@AlenSalamun) February 1, 2020

To access the funds on BC Vault, you need:

1. Global password
2. Global PIN
3. Wallet password
4. Wallet PIN
5. Device or backup file

To access the funds on other wallets, you need:

1. The BIP39 words

I don’t see how you can possibly claim that BC Vault is more secure based on this comparison. All you can say is that it is different. It certainly is not “simple math”.

My BIP39 words are stored on a piece of paper around 200 miles from here, in a safe. I was told I would only have to enter them should my hardware wallet lose the key material. I do not need access to them, and probably never will. I do not need these words to spend funds. These words have never been entered into a computer.

Each time I want to use a BC Vault, I need to enter the passwords (which are entered into a computer) and a PIN (entered into the device). Entering data into a computer puts you at risk of phishing. Entering the PIN puts you at risk of shoulder surfing, among other attacks. A user will need to keep this information at hand to use the wallet, unlike BIP39 words.

In fact, I didn’t keep the BIP39 words on my Trezor, and hence it is impossible to access the funds without the device. This clearly demonstrates that you do not need the words to use the wallet.

This “simple math” is comparing apples and oranges, and is exactly the same path Bitfi went down. Bitfi claimed that their model of entering everything each time you used it was clearly better than storing keys in a secure box.

All we can say is that these are different security models.

It was inferred that I said this was worse or the same. It’s interesting how many vendors go down this route – when people compare their system to others, they automatically assume you said it was worse.

Your statement about 1 thing as “24 words” agains 5 as being the same. Look it up. You are claiming needed possesion of backup/device is trivial and so on. You sir are wrong.

— Alen Salamun (@AlenSalamun) February 1, 2020

My issue isn’t that they are different. It’s the claim that it is clearly better. Prove that 5 regularly used items are more secure than 1 infrequently used.

It’s not as simple as 5 > 1.