my opinion is collectibles should be used as collectibles and nothing more then that. Removed loaded coins because there is no way to verify that their private key has not be compromised. The only way would be DIY coins which you load the coin after receiving it with your own private key but that defeats the reason you would want a "1 BTC" coin.

I am not active in that board, but I thought that they were buying gold/silver/bronze holdings that have a value equal to the bitcoin you will pay, for example a card with about 3 grams of gold or some value and not preloaded addresses.

The solution is simple, which is to leave an empty place and then leave the choice to the person to download it or not, but the idea in itself is opposite to the way Bitcoin works.

I hope someone can explain to me more if I'm doing something wrong and I'll try to find out exactly what they're selling.

If you want to do it completely trustlessly, then the only way to do it is a DIY solution where you add the key to the collectible yourself after you have received it.

You can spread the trust by having some kind of multi-sig set up where two or more different collectible producers add private keys to the collectible separately. But as mentioned, all you are doing there is spreading the trust, not eliminating it.

You could potentially do a multi-sig or split key set up where I generate one part and the collectible producer generates the other, but that then means your collectible on its own is worthless. Without my share/key/etc., then the collectible is unspendable, and you will have a hard time selling it to anyone else since they cannot trust that you and the producer are not conspiring together.

BIP38 doesn't work at all since at some point one party must know both the private key and the password.

Yes, in that case a DIY solution is useless. DIY would only work if you are keeping it for yourself. Similarly any multi-sig or split key method between buyer and producer runs in to the same problems when it comes to resale, in that the new owner is just trusting two people instead of one.

You could essentially use something like OpenDime's system and embed that inside a coin, but yeah, then you are paying a premium for the collectible itself. I can't see any way to do it trustlessly for both the first buyer and all future buyers without electronics in the collectible, though.

The complicated part isn't generating a random private key, but rather being able to prove to all future parties that it was both generated randomly and without influence, and has not been accessed or otherwise tampered with since then. Even with OpenDimes, has anyone verified that it is impossible to bypass the seal and view the private key without breaking the seal?

Surely any time lock which prevents the manufacturer from stealing the coins also prevents the users from moving the coins to safety.

Ok sure, but how can you verify that the factory haven't influenced the private key in some way? How can you verify the private key is even there at all? As far as I am aware, not even something like OpenDime provides a zero knowledge way of confirming there is a private key on the device which corresponds to the address it is showing you. It's possible, but again it's all additional cost.

You could certainly set it up so the coins are spendable by the manufacturer generated private key after a specific time, or before that time by some other set of keys, but then when selling that collectible on then the new owner is still left with the issues of trusting the people holding this second set of keys.

Most of these coins come with a certificate of authentication.
instead of releasing random coins they can make preorders,
buyer provides pub key and keeps partial priv.
maker creates
 the maker issue a template that the buyer prints half key on,
 if they resell it make sure its with it.
do a handwritten chain of ownership on the back(if wanted). if the holo is damaged its spent.
the only thing is a piece of paper to keep track of that everyone will, and does.
if the maker keeps all keys and get the single coin in hand again, they "could" sweep. a single coin.

but never an entire batch.

It's better than right now. they can all sweep. period.

Multisig is too risky. disagreement.

Split key generation would be user induced error.

There's a reason I've invested so much time in the splitkey ecosphere.    It's BTCrilliant  

I believe it was designed for this very scenario.  

Other projects like VanityPool used the same concepts and have never had an event.

From JLVS Github page
https://github.com/JeanLucPons/VanitySearch#generate-a-vanity-address-for-a-third-party-using-split-key

Generate a vanity address for a third party using split-key
It is possible to generate a vanity address for a third party in a safe manner using split-key.
For instance, Alice wants a nice prefix but does not have CPU power. Bob has the requested CPU power but cannot know the private key of Alice, Alice has to use a split-key.
*Added Or a Customer wants to buy a physical but doesn't want the issuing company knowing the key!

Step 1
Alice generates a key pair on her computer then send the generated public key and the wanted prefix to Bob. It can be done by email, nothing is secret. Nevertheless, Alice has to keep safely the private key and not expose it.

Note: The key pair is a standard SecpK1 key pair and can be generated with a third party software.

Step 2
Bob runs VanitySearch using the Alice's public key and the wanted prefix.

It generates a keyinfo.txt file containing the partial private key.

Bob sends back this file to Alice. It can also be done by email. The partial private key does not allow anyone to guess the final Alice's private key.

Step 3
Alice can then reconstructs the final private key using her private key (the one generated in step 1) and the keyinfo.txt from Bob.

How it works
Basically the -sp (start public key) adds the specified starting public key (let's call it Q) to the starting keys of each threads. That means that when you search (using -sp), you do not search for addr(k.G) but for addr(kpart.G+Q) where k is the private key in the first case and kpart the "partial private key" in the second case. G is the SecpK1 generator point.
Then the requester can reconstruct the final private key by doing kpart+ksecret (mod n) where kpart is the partial private key found by the searcher and ksecret is the private key of Q (Q=ksecret.G). This is the purpose of the -rp option.
The searcher has found a match for addr(kpart.G+ksecret.G) without knowing ksecret so the requester has the wanted address addr(kpart.G+Q) and the corresponding private key kpart+ksecret (mod n). The searcher is not able to guess this final private key because he doesn't know ksecret (he knows only Q).

Note: This explanation is simplified, it does not take care of symmetry and endomorphism optimizations but the idea is the same.




You guys can reinvent the wheel or overcomplicate things all you want but this is the cheap effective solution. no complicated signature chains , no more trust in the other person or makers.
just make a system based on split key generation. Anything else you can conjure up will be cost prohibitive or overthinking authoritative measures.


It's been done before on physicals. Not exactly as described but the groundworks all here
40mm x 3mm 30g Bitcoin Coin (loadable and customizable coin)

One coin at a time beats 100's, or thousands at a time like what happens now.

It gives people a fighting chance to detect it rather than hundreds of people getting their life savings stolen at once.

your forgetting 1 thing with split key generation. they are still your keys if you hold both pieces of the puzzle.

no one's custodial but the downstream owner.

therefore, colluding with a creator in this event would never yield a 100% rug sweep.

Sure; similar to any other hardware wallet (this would be a dumbed-down hardware wallet, in essence). But again, since those are sold dirt-cheap these days, even below the premium of these collectibles over their loaded value, it seems feasible. If they choose to use a smartcard chip, @tibu may have a business opportunity here. Not vouching for the security of his devices, as I never assessed it or even tested one of those cards, but that just sprung to mind.

He could also use this to impose a way higher premium (after-market prices..) or someone may just not be a daily Bitcointalk visitor. Collectibles as a general concept can be bought and stored for years or decades without 'checking on them' all the time. Imagine you're a big collector and suddenly you need to daily check that all the designers of all your Bitcoin collectibles are 'still trusted'. That can easily get out of hand.

I don't like to be the devil's advocate, however, a signed TX can be easily broadcasted anytime later. So no matter how smart the embedded device is, a previous owner can create and sign the transaction of spending the collectible's coins and... broadcast it years later. Or am I missing something?
Because if I'm right it's no use to embed smarter and more expensive devices into collectibles, this kind of stealing problems can still happen.