If Casa had access to mobile keys then it would make us a custodian, which we're quite careful to avoid becoming since our business isn't set up for it nor do we KYC clients.
Casa open sourcing the app wouldn't guarantee that mobile keys couldn't be stolen, just like how coldcard being open source didn't prevent keys from being stolen.
The only way to guarantee that a malicious Casa app can't steal the mobile key is to swap it for a hardware key so that the app never has access.
Jameson Lopp
npub17u…wt4tp
2026-08-15 10:28:41 UTC
in reply to nevent1q…qqm0
Author Public Key
npub17u5dneh8qjp43ecfxr6u5e9sjamsmxyuekrg2nlxrrk6nj9rsyrqywt4tpSeen on
wss://nostr.lopp.socialPublished at
2026-08-15 10:28:41 UTCEvent JSON
{
"id": "3c110c5100f520c08fcb90aa8da4fbc0b00c34dc6bdcb38ed28675d514062b50",
"pubkey": "f728d9e6e7048358e70930f5ca64b097770d989ccd86854fe618eda9c8a38106",
"created_at": 1786789721,
"kind": 1,
"tags": [
[
"alt",
"A short note: If Casa had access to mobile keys then it would ma..."
],
[
"e",
"f258bb8b0e44bb525160193ec1ac39d5b8accc20815503a2f5496f822d1c5649",
"wss://relay.damus.io/",
"root",
"c97ec698e40a5579bd1b634bf1518db64c8abf74960d3cda9bb4759f625ea5e4"
],
[
"e",
"a9ea476112013896e9174596c6d5c32c14bb9dc1f5e18025b14509d7e6048434",
"wss://relay.primal.net/",
"",
"c97ec698e40a5579bd1b634bf1518db64c8abf74960d3cda9bb4759f625ea5e4"
],
[
"e",
"c27bc527f22fb1bb83308adef3af25e8693bcb82631dd2de7ee17e734e83a986",
"wss://relay.primal.net/",
"reply",
"c47f186f3bf579b8ee2eec52398d73174412cee39438bd0937498c89e3d4457b"
],
[
"p",
"916cb5ff07d3b51cef7f6b6b7f5479b1001b401c0e82558ee1a22504c7d507c9",
"wss://nostr-pub.wellorder.net/"
],
[
"p",
"1f9e547c2f31942623b8ad1d07713282e8640fd8cf474e9f79f18ace8af216ed",
"wss://nostr-pub.wellorder.net/"
],
[
"p",
"3c4f51561243524f307ed2ee272c7cf4a782404fbe3a176606043b6ad427ee77",
"wss://nos.lol/"
],
[
"p",
"50d94fc2d8580c682b071a542f8b1e31a200b0508bab95a33bef0855df281d63",
"wss://relay.snort.social/"
],
[
"p",
"f728d9e6e7048358e70930f5ca64b097770d989ccd86854fe618eda9c8a38106",
"wss://nostr.lopp.social/"
],
[
"p",
"c761dc761dbe60d1879a9852bba96fee63eeab0d73911c55365c5ecf204949a2",
"wss://henhouse.social/relay"
],
[
"p",
"c97ec698e40a5579bd1b634bf1518db64c8abf74960d3cda9bb4759f625ea5e4",
"wss://henhouse.social/relay"
],
[
"p",
"c47f186f3bf579b8ee2eec52398d73174412cee39438bd0937498c89e3d4457b",
"wss://relay.primal.net/"
],
[
"client",
"Amethyst"
]
],
"content": "If Casa had access to mobile keys then it would make us a custodian, which we're quite careful to avoid becoming since our business isn't set up for it nor do we KYC clients.\n\nCasa open sourcing the app wouldn't guarantee that mobile keys couldn't be stolen, just like how coldcard being open source didn't prevent keys from being stolen.\n\nThe only way to guarantee that a malicious Casa app can't steal the mobile key is to swap it for a hardware key so that the app never has access.",
"sig": "ef9392bc42ae7f9c8969c3d804d831b56c3923cea3685beeee996a78827f9ee52c38902f1490447f2e4e5e5eda5a27e7dd73e04407ce1000564e6bcbe86ab12e"
}