Cake wallet - Requesting honest reviews

[Karl_3000]

Perhaps, but not necessarily. I have Cake Wallet installed on my phone with a new test seed loaded into it, but I have never deposited any crypto to any of its addresses. I also have Electrum for mobile on my phone, but never used that either. I have those only for testing. You could beat me all day long with a wrench and I still wouldn't be able to give you anything from those two wallets.

The point is, the app itself is a good indicator but not absolute proof that it's used and is funded.

The attacker may not know much about the wallet also, but if he knows about the wallet, he may notice that the person is lying. The reason I said that is because the wallet will first request for pin. If you put the duress pin, the wallet will delete which we know. It would have been good if the wallet do not ask to set another pin after the wallet has been wiped but it will request the user to set the new pin just like how you first set new pin after you downloaded the wallet. But you are right that some attackers may not know about this, if it is me, I will know. But the attacker will not still be able to steal the coins.

[Pmalek]

The attacker may not know much about the wallet also, but if he knows about the wallet, he may notice that the person is lying. The reason I said that is because the wallet will first request for pin. If you put the duress pin, the wallet will delete which we know. It would have been good if the wallet do not ask to set another pin after the wallet has been wiped but it will request the user to set the new pin just like how you first set new pin after you downloaded the wallet. But you are right that some attackers may not know about this, if it is me, I will know. But the attacker will not still be able to steal the coins.

Thanks for the new information. This was indeed a weird and clumsy way to implement the feature by the Cake wallet developers. Wiping the wallet and then taking you straight to the initial onboarding stage might raise a  few eyebrows. At least they didn't add an accompanying message, informing the user that they have entered a Duress PIN and wiped their wallet for safety reasons. That would have been awful. I still, think the Duress PIN should load a fake new wallet with no balance on it.

[Z-tight]

For those that only use pin without fingerprint, you can enter the duress pin but all your wallet would be deleted.  This can let the wrench attacker to easily know that you are probably lying.

Thanks for testing this feature and posting the results here. I also agree with you that it would be easy for the attacker to know that the person is lying and that can be dangerous with a wrench to your head. Extending your seed phrase with a passphrase in wallets with this feature, is still the best means to claim plausible deniability.

I still, think the Duress PIN should load a fake new wallet with no balance on it.

How would this work, a fake wallet? Would it be a wallet with no seed phrase, what about the addresses on it, would there be any? This sounds like a lot of work and could even cause some confusion to certain users.

[Karl_3000]

Thanks for testing this feature and posting the results here. I also agree with you that it would be easy for the attacker to know that the person is lying and that can be dangerous with a wrench to your head. Extending your seed phrase with a passphrase in wallets with this feature, is still the best means to claim plausible deniability.

I will really prefer the use of passphrase to extend the seed phrase but that means only the wallet that does not have the passphrase will be on your device while the ones that has the passphrase will not be on your device.

But there are other good ways of having the duress feature on a bitcoin wallet. Example is the one on Unstoppable wallet which can still be accessed without going for premium I think. Let me explain how it works.

Assuming you have 3 wallets on Unstoppable, you can set duress password for second wallet. If you use your fingerprint print or the duress password, it will take you to that second wallet and you will not be able to see the first and third wallets. Even if you go to where you can see your wallet seed phrase and passphrase, you will only be able to seed the seed phrase and passphrase for the second wallet. If you want to access all the three wallets, you will need your wallet password and not the duress password. There is no how an attacker can know about the other wallets. This has been the best duress feature that I have seen on a wallet. But the problem with Unstoppable wallet is that it is only available on Android and Apple, unlike Cake wallet that support more operating systems including Linux.

[Pmalek]

How would this work, a fake wallet? Would it be a wallet with no seed phrase, what about the addresses on it, would there be any? This sounds like a lot of work and could even cause some confusion to certain users.

It can be a brand-new wallet with zero balance that has nothing to do with your actual wallet and whose addresses aren't derived from your real seed. Just some random addresses thrown together.

Additional advanced duress settings could be configured for the feature. For example, you could enter a fake balance, like 0.057 BTC, that was supposedly in your wallet. You would also be able to enter a date in the past when that bitcoin left your wallet and moved elsewhere. The wallet's fake history shows you had bitcoin, but not anymore.

If an attacker asks for your bitcoin, you show them that you had some in the past, but you sold it 7 months ago. The fake wallet, with the fake history "proves" that. I seriously doubt the attacker would sit there and go through your addresses in detail and check that for himself on a block explorer and figure out it's all fake. He would simply see that the bitcoin is not there anymore. You had some 7 months ago but now it's gone.

[Karl_3000]

How would this work, a fake wallet? Would it be a wallet with no seed phrase, what about the addresses on it, would there be any? This sounds like a lot of work and could even cause some confusion to certain users.

It can be a brand-new wallet with zero balance that has nothing to do with your actual wallet and whose addresses aren't derived from your real seed. Just some random addresses thrown together.

Additional advanced duress settings could be configured for the feature. For example, you could enter a fake balance, like 0.057 BTC, that was supposedly in your wallet. You would also be able to enter a date in the past when that bitcoin left your wallet and moved elsewhere. The wallet's fake history shows you had bitcoin, but not anymore.

If an attacker asks for your bitcoin, you show them that you had some in the past, but you sold it 7 months ago. The fake wallet, with the fake history "proves" that. I seriously doubt the attacker would sit there and go through your addresses in detail and check that for himself on a block explorer and figure out it's all fake. He would simply see that the bitcoin is not there anymore. You had some 7 months ago but now it's gone.

What if all the wallet is deleted but remaining just one which you set not to be deleted after you input the duress pin? Let us say you have 3 wallets, the wallet let you set 'one of the not to be deleted wallet' after using the duress pin. You can have just little amount of money on the wallet. If the attack come, you input the duress pin, the remaining two wallets we automatically be deleted but leaving just one wallet. I do not know if that is possible but I know that there are many possibilities to what programmers can do.

[Pmalek]

What if all the wallet is deleted but remaining just one which you set not to be deleted after you input the duress pin? Let us say you have 3 wallets, the wallet let you set 'one of the not to be deleted wallet' after using the duress pin. You can have just little amount of money on the wallet. If the attack come, you input the duress pin, the remaining two wallets we automatically be deleted but leaving just one wallet. I do not know if that is possible but I know that there are many possibilities to what programmers can do.

You wouldn't need a duress PIN for that. There are surely wallets that allow you to create multiple accounts, with each one behind its own PIN code. PIN #1 unlock and displays account #1, PIN #2 shows account #2, etc. You can also get similar results with passphrases. A non-passphrase wallet unlocks with your PIN. Enter a passphrase, and it gives you access to a hidden wallet. You can create as many passphrases and hidden wallets as you like.

[Brown Wolf]

I did not use this wallet yet, but i think https://github.com/sethforprivacy is one of it’s founder who is kind of famous. I think you can trust Cake wallet if it is open source.

This forum has a dedicated section for Anroid wallets, why not for iOS users? What iOS wallets are famous in this forum?

[pooya87]

I think you can trust Cake wallet if it is open source.

Being open source is only the first requirement for a wallet software to be trusted but it is not enough. The code has to be reviewed by experts and other interested parties. The binaries they release also has to become deterministic (aka reproducible) so that it can be proven that it actually corresponds to the open source code we are seeing.

Cake Wallet is somewhat new when compared with other old projects like Electrum, but they should head in that direction to address the missing characteristics in order to become truly trusted.

This forum has a dedicated section for Anroid wallets, why not for iOS users? What iOS wallets are famous in this forum?

I've seen people suggest BlueWallet for iOS

[Brown Wolf]

I agree.
Thanks for the suggestion.
Is this the correct one? https://imgur.com/a/FEpSHI9

I know there are fake apps in App Store as well. So, I will have to be careful.

[Lucius]

@Brown Wolf, no one can tell you for sure if an app is fake based on an image - and in my opinion you have two choices to minimize the risk. The first is to visit the official site (https://bluewallet.io/) and from there click on their official PlayStore link, and the second is to also visit their official Github link from the same source and download the app from there.

As far as I know, there is no way to verify their files before installation.

[Z-tight]

I know there are fake apps in App Store as well. So, I will have to be careful.

True, you do have to be careful. You can get the right application by going through their official website that has already been linked above. However, even after downloading the right application, you still have to be careful, because it is an online wallet and you should not deposit a large amount of money in an online wallet. Your device could be compormised or already infected with malware and you'd lose your funds upon depositing it.

[Karl_3000]

This forum has a dedicated section for Anroid wallets, why not for iOS users? What iOS wallets are famous in this forum?

I've seen people suggest BlueWallet for iOS

Bluewallet is a very good wallet, with better fee estimation than before after the recent update. It also has sending to multiple addresses, coin control and some other good characteristics bitcoin wallets should have including signing and verifying of bitcoin message and including using it as a watch only wallet. Recently the wallet supported taproot addresses in a way they you can now generate taproot addresses on the wallet.

But I think it will be good if Brown Wolf that asked the question also know that Cake wallet also has the iOS version: https://apps.apple.com/us/app/cake-wallet/id1334702542

If you go to their official website which is https://cakewallet.com/ on iOS device, you should be able to click on the download which will take you to the app store directly for the download.

Another wallet that people talked about on this forum that is supporting bitcoin is Unstoppable wallet.
https://unstoppable.money/
https://apps.apple.com/us/app/unstoppable-crypto-wallet/id1447619907

It is good to first visit the official site instead and download it on your iOS device.
https://bluewallet.io/
https://cakewallet.com/
https://unstoppable.money/

I just added the App store link to let you know it that they are on App store for iOS devices.

It is good to know that having huge amount of bitcoin on an online wallet this not good, make use of offline wallet instead but you can have small amount of bitcoin that you can lose and not affect you financially on an online wallet.

[AakZaki]

I just downloaded Cake Wallet, it is currently on version 5.6.3 and what I see is that the coin options are more numerous than those mentioned in the OP.

• Monero (XMR)
• Bitcoin (BTC)
• Ethereum (ETH)
• Litecoin (LTC)
• Bitcoin Cash (BCH)
• Polygon (POL)
• PTron (TRX)
• Dogecoin (DOGE)
• ETH Base (BASE)
• Solana (SOL)
• Nano (XNO)
• Zano (ZANO)
• Decred (DCR)

I like the flexible app interface that supports both Light and Dark Mode. However, in the buy menu it is quite painful to look at, as Kryptonim has a price rate around 5% higher than the real-time price for a 1 BTC purchase. But there is MoonPay there, which still offers a reasonable price.