Trezor's company blog covers hardware wallet security, firmware updates, two-factor authentication, data breaches and cryptocurrency device design.
HN commenters cite it for explanations of authentication and secure element tradeoffs, and users praise how Trezor handles vulnerabilities and its open design.
The original response about these type of issues [1] rubs me the wrong way
In particular this statement:
> That being said, we were surprised by Ledger’s announcement of this issue, especially after being explicitly asked by Ledger not to publicize the issue, due to possible implications for the whole microchip industry, beyond hardware wallets, such as the medical and automotive industries.
As I understand they are using a standard STM32 chip for these wallets, and relying on it's basic protection. Companies make real processes designed for securely storing data, why aren't they using them? Instead they are suggesting that there is no alternative and everyone is vulnerable to this style of attack.
Edit: I missed some of the backstory. They don't mention that option as their competitor (who found the security issues) already uses a secure element, like a sane person.
[1] - https://blog.trezor.io/our-response-to-ledgers-mitbitcoinexpo-findings-194f1b0a97d4
There's a very simple solution if you care about security.
Buy a hardware wallet (e.g. Trezor in my example) note down the 24 words that are basically your privatekey. But enable the passphrase (25th word/phrase) which you type yourself and could keep just in your mind.
You have the safety of multiple backups for the 24 words and the extra security from burglars and others with the 25th passphrase.
https://blog.trezor.io/hide-your-trezor-wallets-with-multiple-passphrases-f2e0834026eb
It also serves as a plausible deniability because when you input your passphrase it will never say it's incorrect, it will merely open a different wallet (generate a different private key).
Helps with the $5 wrench attack. You could setup a "fake" wallet with some activity and a low amount of Bitcoins, and have a different passphrase for the real wallet with the big amount.
BYOB, freedom comes at a price.
Wow lots to unpack there.
For those reading, the title says "Trezor Ditches a Controversial KYC Feature, Plans Features to 'Cut Off Regulatory Overreach'"
Apparently Trezor added a KYC system called AOPP. Then backlash. Then they said they would roll it back (as of the article).
Have they rolled it back yet? They said it will be rolled out in February. Edit: Trezor blog post about the rollback here: https://blog.trezor.io/a-decision-on-aopp-789540c2930b?gi=f39ad0a68391
I always wondered what Trezor's fundraising plan is. My guess is once they started to see the money come in from taking fees they started to say "we'll be the next Coinbase!!!".
Do you have any more analysis of this addition to Trezor? As a Trezor user, this reminds me of Apple's push for on-device scanning. That Trezor even added this feature temporarily has me looking for alternatives. Anyone have suggestions?
A 2012 Bitcoin hack victim was none other than a lead developer of Bitcoin. Back then, they ran a Bitcoin faucet on it that gave out a paltry 0.25 Bitcoin at a time.
I never bothered to jump through those hoops for like a dollar (now about US$10k):
http://gavintech.blogspot.com/2012/03/bitcoin-faucet-hacked.html?m=1
He only lost 5 bitcoin (like $20 then or $200k today), but another lost 3100, or around… $124 million today:
https://bitcointalk.org/index.php?topic=66916.0
They ran a Bitcoin mining pool and this hack motivated them to create a hardware wallet:
https://blog.trezor.io/how-trezor-was-born-from-a-hacking-attack-that-affected-slush-pool-7a538f03fd8f
I was wondering the same thing - here's an article I found that describes both approaches. Not being in the cryptography space myself I can't comment on how accurate it is, but passes my engineering smell test.
https://blog.trezor.io/why-you-should-never-use-google-authenticator-again-e166d09d4324
Edit - sorry that this is really an ad for the writer's products. On the other hand, there's a hell of a bounty for proving them insecure / untrustworthy, whatever your feelings on "the other crypto".
Has anyone used hardware-based password manager like Trezor Password Manager? [1] [2]
Initially Trezor was created as a bitcoin wallet but is much more these days.
The issue with 1Password is that it's not accessible in Linux and no U2F (yubikey etc) support AFAIK...
[1] https://trezor.io/passwords/
[2] https://blog.trezor.io/satoshilabs-launches-trezor-password-manager-the-ultimately-secure-no-master-password-cloud-1b260e5fbe6b#.gjgqeattk