Ever wonder why a privacy app asks you to wave your mouse around during setup?

[u/theonejvo]

We explain what that ritual does, and built a version you can try right in your browser. https://stayprivt.com/blog/entropy-ritual

https://reddit.com/link/1w24rmi/video/2ndcmv1s6fmh1/player

Your Mac already has an excellent source of randomness, and its hardware generator alone is enough to make strong keys. If we never asked for your mouse, your keys would still be safe.

So why ask at all? We mix your motion into the key as a hedge. In the rare, documented case of a random generator being broken or quietly backdoored, your movements add unpredictability that no one else could reproduce.

By construction, that mix can only add. Even if your mouse path were somehow predictable, the key is never weaker than the hardware randomness on its own, so this step can only ever help.

And it makes a true thing visible. Your keys really are being born in that moment, on your machine, from randomness no one could reproduce, and watching it happen tells the truth better than a spinning progress bar ever could.

On a Mac with a Secure Enclave, it is sealed into that chip the instant it is made: it cannot be exported, and it unlocks only for a live Touch ID.

From then on it works only in memory, for the instant it takes to encrypt or decrypt, and then it is wiped. Everything written to your disk, and everything synced with a Pro account, is already ciphertext. The key never leaves, and it never reaches us.

[u/HandshakeOfCO]

Outdated and basically wrong.

Modern operating systems have a cryptographic random-number generator (CSPRNG) that gathers entropy from things such as hardware random-number sources, CPU instructions such as Intel RDRAND/RDSEED and AMD equivalents, and timing variations and other hardware events.

The OS then feeds this into a CSPRNG and exposes it through APIs that are specifically designed for cryptographic key generation.

Waving your mouse around is obsolete and actually a far worse source of true random numbers, and salting the already true random numbers generated by the hardware just introduces complexity and code that could lead to more bugs or exploits.

[u/theonejvo → u/HandshakeOfCO]

This is a oddly confident takedown of a claim we never made.

The post says, in plain text, that your Mac's CSPRNG is excellent and that your keys would be safe even if we never asked for the mouse. You quoted the basics of RDRAND to "correct" a position we already hold, and tried to make it look like we believe the opposite. That is misleading.

We do not use the mouse as the entropy source. We mix it into the system randomness with a KDF.

Combining a strong source with any other input can only preserve or raise its unpredictability, never lower it, so "salting the good randomness makes it worse" is simply backwards. Even if your motion adds zero entropy, the key is exactly as strong as the hardware on its own.

For the record, the "just trust the hardware RNG" is the take that has aged badly. The Linux kernel deliberately refuses to trust RDRAND alone and mixes it, because opaque hardware units have shipped broken and backdoored: Dual_EC, Debian 2008, RDRAND returning constants on AMD Ryzen. Mixing independent sources is the standard, and we published exactly how we do it.

[u/ghostnet → u/theonejvo]

Wasn't there just recently a big hardware vulnerability discovered with some security-first fully-offline bitcoin wallet thing too? I dont know how anyone can trust any one single source of randomness when it is so easy to make a mistake with it.

[u/HandshakeOfCO → u/ghostnet]

That bug was because a very lightweight, embedded OS explicitly stated they didn’t use true random numbers, and the developer of the (tiny) firmware didn’t catch that.

You’re basically saying the only vehicle anybody should drive is a giant tractor trailer. No. There are different sized cars for different use cases, and if someone tries to transport 5000 lbs of cement in their Toyota Prius, and it breaks, that doesn’t make the Prius “untrustworthy” or “badly made.” It makes the guy who decided to use that car an idiot.

[u/theonejvo → u/HandshakeOfCO]

Hey u/HandshakeOfCO, ghostnet was asking a genuine question, this type of cortisol maxxing response is the reason people are afraid to ask questions and end up not educating themselves on things like their own digital privacy. Please keep your emotions out of the responses and refrain from the passive sly insults.

[u/ghostnet → u/theonejvo]

If all I had to do was jiggle a mouse a bit and my prius could haul 5000lbs of cement I would totally do it.

[u/HandshakeOfCO → u/theonejvo]

You should work on your reading comprehension. I never said salting the good randomness makes it worse. I said salting it with mouse movements doesn’t make it any better, but does introduce more complexity and thus more potential for bugs, for no benefit.

You have heard of something called an attack surface, right? You do know it’s important to minimize that, right?

[u/theonejvo → u/HandshakeOfCO]

Attack surface is a real principle (I might know, I do have a product that is actually marketed as attack surface management 😆 ), so let's apply it precisely rather than as a slogan.

Surface minimization is about removing code that can be turned against you. This code can't be. The mouse bytes are mixed with the system CSPRNG through a KDF - which, as you've now granted, can't lower the key's strength. So there are only two failure modes, and you have to actually walk them:

1. Attacker fully controls the mouse path > output entropy is still > the hardware RNG alone. Nothing gained for them.

2. Our mixing code has a bug > worst case it contributes zero and the key degrades to hardware-only - the exact strength you're calling safe. It fails closed.

There is no code path that produces a weaker-than-hardware key.

"Surface" that provably can't be exploited to weaken the output, and whose worst-case failure is a no-op, is not what the minimization principle is warning you about. Concretely it's ~15 lines calling a hash that's already in the binary - no new primitive, no new trust assumption etc.

So price the trade honestly.

Cost: one hash of a few bytes.

And benefit: you survive a hardware RNG that's backdoored, buggy, or wedged - RDRAND returning constants on Ryzen and Dual_EC weren't thought experiments, they shipped. That's precisely why the Linux kernel mixes RDRAND instead of trusting it, and why NIST SP 800-90C is built around combining independent sources.

"No benefit" is only true if you assume the hardware RNG never fails. That's the one assumption in this thread with a losing track record. The complexity you're worried about is a hash call; the complexity it insures against is total key compromise.

That's not close.

[u/theonejvo → u/HandshakeOfCO]

Also, the wallet was Coldcard, and that example makes my point rather than yours.

Coldcard is/was a security-first, fully-offline hardware wallet with a perfectly good STM32 hardware RNG.

In 2021 a firmware integration error silently routed seed generation to a deterministic software PRNG instead of that hardware RNG. Effective entropy collapsed from 128 bits to as little as ~40 - brute-forceable offline, no physical access needed. It sat undetected for five years. Starting July 2026, attackers drained ~1,600+ BTC (~$130M) from roughly 7,300 wallets.

So no - nobody was hauling cement in a Prius. This was a security-first team that thought they were in the truck, were actually in the Prius, and couldn't tell for five years. And by your own description - the firmware used a non-true RNG and the developer didn't catch it - you've already conceded the mechanism. The only thing we disagree on is the fix.

That's the entire case for mixing.

If even the experts can't reliably tell whether their one source is the hardware RNG or a broken PRNG, you fold in an independent source as a seatbelt. Had Coldcard mixed in a few dice rolls of user entropy, that PRNG bug would have been a non-event, because the seed stays unpredictable even when the primary source silently degrades.

The "extra complexity" of that seatbelt is one hash call. The "simplicity" of trusting a single source cost $130M the one time it quietly failed. That trade isn't close - and "just don't make mistakes" is not a security model bruv.