Wallet Infrastructure Watch / Applications
In Brief
Yours Wallet has released version 5.1.0 with an optional USB-based second factor that can turn an ordinary removable drive into part of the wallet’s unlocking system while also maintaining an encrypted portable backup of wallet data.
When enabled, a password by itself is no longer sufficient to decrypt the wallet’s stored keys. A registered USB drive carries a separate random secret that participates in deriving the wallet’s encryption key, requiring both the user’s password and possession of a registered drive.
The same drive can also maintain an encrypted backup of the wallet’s BRC-100 storage, including transaction and derivation data that may be needed in addition to seed material to reconstruct the wallet on another computer.
Version 5.1.0 became available through the Chrome Web Store on September 17.
News Report
Yours Wallet has released version 5.1.0 with a new security and recovery architecture built around ordinary USB drives.
The new feature, announced by Yours on September 17 as USB Security Key, does not require a dedicated hardware authentication device, proprietary firmware or additional software.
Instead, users can register an ordinary USB flash drive or external drive that the operating system exposes as a folder.
Once USB protection is enabled, the drive becomes a second component required to unlock the wallet.
Yours says the password alone will no longer unlock it.
The project’s implementation documentation confirms that this is more than a software check for whether a particular drive happens to be connected. The secret stored on the USB device participates in the cryptographic process used to derive the key that decrypts the wallet’s locally stored private-key material.
An Ordinary USB Drive Becomes a Second Factor
Yours’ implementation creates a hidden .yours directory on the registered drive containing a small usb-key.json file.
That file carries a randomly generated 32-byte secret and an identifier for the particular drive registration.
Separately, Yours creates a 32-byte master factor. The master factor is not stored openly in the wallet or on the USB drive. Instead, the wallet keeps an encrypted copy — or wrapper — for each registered USB drive, with the secret on that drive required to recover it.
During unlocking, Yours first derives key material from the user’s password and the wallet’s salt. It then combines that password-derived material with the master factor recovered through the USB drive.
The resulting combined key decrypts the wallet’s stored account keys.
That distinction is important.
If the implementation merely asked, “Is this USB drive connected?” before accepting an otherwise sufficient password, somebody who bypassed the application-level check could potentially attack the password-encrypted wallet directly.
In Yours’ design, the USB-derived material forms part of the encryption-key derivation itself.
The project’s security documentation states that an attacker possessing a locked computer or a copy of its extension storage cannot decrypt the stored wallet keys using the password alone if the registered USB secret is absent.
Not a Hardware Wallet or FIDO Security Key
Although Yours describes the feature publicly as a “USB Security Key,” its own technical documentation draws a clear boundary around what that means.
An ordinary flash drive does not become a hardware wallet, YubiKey or FIDO/WebAuthn authenticator.
The drive performs no cryptographic signing itself and contains no tamper-resistant processor. Its secret is stored as a file and can be copied.
Yours therefore describes it technically as a possession factor rather than tamper-resistant security hardware. Private keys are still decrypted into the extension’s memory while the wallet is unlocked.
That gives the system a different objective.
Instead of requiring users to purchase specialized hardware, Yours adds a second source of key material using storage devices they may already own.
The protection is strongest when the wallet’s computer and registered USB drive are kept separately while the wallet is locked.
If somebody obtains both the password and a copy of the registered USB secret, that separation is lost.
Multiple USB Keys Can Be Registered
The architecture supports more than one registered drive.
Each USB drive receives its own random secret and identifier, while each can independently unwrap the same wallet master factor.
That allows, for example, one drive to remain on a keyring and another to be stored separately as a backup.
A user can remove individual registered drives without changing the entire wallet, while removing the final remaining drive is blocked unless USB protection itself is disabled.
Yours also provides a rotation process for a drive believed to have been lost or copied.
Rotation creates a new master factor and a new USB secret, re-encrypts the wallet’s stored account keys under the new derived encryption key and generates a new recovery code.
Any copy of the previous USB-key file then ceases to work against future wallet storage.
Recovery Code Provides an Emergency Path
Enabling USB protection also generates a recovery code representing the master factor needed for the second part of the key derivation.
Yours requires the user to confirm the recovery code during enrollment rather than simply displaying it once and assuming it has been recorded correctly.
If the USB drive is temporarily unavailable, the password and recovery code can be used to unlock the wallet for that session.
If a drive has actually been lost or may have been copied, the same recovery path can lead directly into rotation, replacing the old master factor and producing a new USB registration and recovery code.
If every registered USB drive and the recovery code are lost, Yours’ fallback is restoration from a previously created master backup.
The USB Drive Also Becomes a Wallet Backup
Version 5.1.0 goes further than using USB storage as an unlocking factor.
By default, registered drives can also maintain an encrypted backup of the wallet’s data.
This is particularly relevant to Yours because its current architecture is built around BRC-100 rather than treating the wallet as nothing more than a deterministic tree of keys.
The Yours repository explains that its BRC-100 wallet tracks both keys and transaction history to locate and manage assets. Its technical documentation for the USB feature goes further, stating that derivation metadata associated with BRC-100 outputs resides in wallet storage and cannot necessarily be recreated from the seed alone.
That changes what “wallet backup” means.
Recovering the cryptographic seed may reproduce keys.
It does not necessarily reproduce all of the state the wallet has accumulated about how those keys relate to transactions, outputs and application activity.
Yours already supports remote BRC-100 storage servers for preserving and synchronizing this information between devices. The USB system adds another form of backup that does not depend on a storage provider or a particular browser profile.
Encrypted Wallet State Travels With the Drive
The USB backup is not written to the drive as readable wallet data.
According to the implementation documentation, the backup includes encrypted account keys, wallet settings and transaction-storage chunks.
With the exception of a small restoration bootstrap file, the backup is encrypted using AES-GCM under a key derived from the wallet’s combined password-and-USB encryption material, with an additional Argon2id derivation step designed to increase the cost of offline password guessing.
Yours specifies 64 MiB of memory and three Argon2id passes for this backup-key derivation.
The backup process is incremental.
While the unlocked wallet is open and the USB drive is available, Yours can add changes to the drive rather than rebuilding the entire backup each time.
The system also uses generations: a new complete backup is written before the preceding generation is discarded. That is intended to ensure that an interrupted rebuild does not leave the USB drive without a restorable wallet copy.
The source code separately confirms that the master-backup system can export all wallet accounts together with their encrypted keys, settings and BRC-100 storage chunks.
Restoring on Another Computer
The combination turns the registered drive into something broader than a normal second-factor token.
On a fresh Yours installation, the USB restore process can recover wallet account information and storage, after which the password and USB secret reconstruct the encryption material needed to open the wallet.
The restore flow is designed to return the wallet with USB unlocking enabled using the same registered drive and recovery factor. Other previously registered drives can subsequently be rediscovered or added again.
This gives Yours two distinct recovery paths.
A conventional master-backup file is intentionally protected by the password alone so that losing every USB factor does not make the wallet backup unusable.
The USB-resident backup, by contrast, is tied to the registered drive and password and is intended to provide a portable working copy of the wallet’s broader state.
A Lost Backup Drive Has a Different Risk
Adding the wallet backup to the USB drive also changes the security assumptions around losing it.
When the drive contains only its random unlocking secret, that secret alone is not useful without a copy of the wallet’s encrypted storage and the password.
Once encrypted wallet storage is backed up to the same drive, however, a lost USB device contains both the USB factor and encrypted wallet data.
Yours explicitly documents the consequence: the lost drive then becomes an offline password-guessing target in much the same way as an encrypted wallet-backup file.
The additional Argon2id derivation raises the computational cost of password guesses, but it does not eliminate the importance of a strong password.
Users can turn USB backup off while retaining USB unlocking. Yours then removes the backup folder from currently available registered drives and marks other registered drives so their backup data can be erased the next time they are connected.
Protection Extends Beyond Initial Unlock
The USB requirement is strongest cryptographically at the point of wallet unlocking, but Yours also applies drive-presence checks to sensitive activity while the wallet remains open.
Its implementation checks for a recently verified registered drive before operations that sign, spend, encrypt or otherwise expose key-controlled capabilities to applications.
If no wallet window has recently confirmed the USB key, a prompt can require another USB confirmation before the operation proceeds.
Yours is careful not to describe this second layer as equivalent to the cryptographic protection during initial unlock.
Once the wallet is already unlocked, its derived session key and decrypted key material exist within the browser-extension environment. Malware operating on the same compromised machine is therefore outside the protection that an ordinary removable drive can provide.
The project’s threat model explicitly identifies malware on an already unlocked host as something the USB system does not protect against.
Chrome and Edge Dependence
The feature relies on the browser’s File System Access API to obtain permission to read and write the registered drive.
Yours therefore documents the USB function as available on browsers supporting the required API, principally Chrome and Edge, rather than as a browser-independent wallet feature.
The Chrome Web Store release of Yours Wallet 5.1.0 went live September 17.
BSV TIMES Read
The more consequential part of Yours Wallet 5.1.0 is not that it lets a user put another copy of wallet information on a USB drive.
It brings together two problems that are often treated separately: protecting access to the keys and preserving enough state to reconstruct the wallet.
In a simple deterministic wallet, backup can appear straightforward. Protect the seed, and the keys can be generated again.
A more capable application wallet accumulates something else: transaction relationships, derivation information, permissions, certificates, identities and other application state.
As the wallet becomes part of an application infrastructure rather than merely a token container, that state becomes increasingly important.
Yours’ BRC-100 architecture makes the distinction particularly visible.
Its own implementation notes state that the wallet’s derivation metadata may be required to spend particular outputs and cannot simply be reconstructed from the seed. The wallet therefore already supports independent storage infrastructure and synchronization rather than assuming that a seed phrase alone is the complete wallet.
Version 5.1.0 brings part of that infrastructure physically back into the user’s possession.
One ordinary USB drive can contribute secret material needed to decrypt the wallet while also keeping an encrypted copy of the state needed to reproduce it elsewhere.
That does not turn a flash drive into a hardware wallet, and Yours does not claim that it does.
In some respects, the distinction is what makes the development interesting.
The security model is being added in software to commodity storage rather than requiring a specialized signing device. A second drive can be placed elsewhere, individual keys can be rotated, the recovery code provides another route, and the encrypted wallet state can move independently of a particular computer or storage provider.
For BRC-100 wallets, this also illustrates a broader transition in what wallet recovery may have to mean.
The question is no longer only:
Can the user recover the private keys?
It increasingly becomes:
Can the user recover the wallet — its keys, transaction knowledge, derivation state and ability to continue operating?
Yours Wallet 5.1.0 addresses both questions in the same feature.
Source Links
Yours Wallet — Chrome Web Store
Yours Wallet — USB Key Security Design and Implementation Notes
Yours Wallet — Remote Storage Provider Guide
Posted on September 17, 2026
Leave a comment