Bitcoin Forum

Any thoughts? I want to store by BTC safely and securely offline. Anybody got any experience of using trezzor for that? Positives and negatives?

i only heard pos things about it.

there are other hardware wallets too:

https://bitcointalk.org/index.php?topic=899253.0


in any case i would recommend to split your funds. 30% hardware wallet; 30% paper wallet....

It depends if you are rich enough and owns a lot of coins you want to put in Trezzor. Currently Trezor hardware wallet cost something like $120 and I've seen people who keep less than $100 value of bitcoin on their hardware wallet that is huge waste imo. If you want to keep more than dozen Bitcoins there its is fine if you buy one. You could, however, be safe enough without spending a penny on hardware wallet. Your choice.

I found it a little bit difficult at first, but it is a very secure way to use and store your Bitcoin. As Slark says it is only worthwhile if you have quite a bit of value in Bitcoin.

Positives:

TREZOR is an offline Bitcoin wallet. It holds your private keys and know how to sign a transaction without the need to connect to the internet. Trezor seems to give you the best of both worlds as it acts as a highly secured cold storage (i.e. offline) device but still allows you flexibility when wanting to spend your coins. The device is pretty small and you can carry it around on your Keychain or even in your pocket. So you can store your Bitcoins offline on TREZOR and whenever you want to spend them just connect your TREZOR device to any computer and you can spend them. TREZOR uses a limited USB connection – just like your computer mouse or keyboard. A mouse tells the computer where it is, but the computer cannot move the mouse. So only Bitcoin transactions can go from the computer to Trezor and back. This is why even compromised and infected computers can be used with TREZOR safely.

Negatives:

None that outweighs the positives. :D

besides this vulnerability, http://johoe.mooo.com/trezor-power-analysis/, which was fixed quickly you can say that it's relatively safe, no one know if in the future another hole like that will happen again...

remember that besides the vernam cipher nothing is 100% safe

Vulnerabilities have kept showing up for it. Let's be honest, it's not safe. But it's probably better than some of the other options.

Never heard of Trezzor ...

I think they're over-rated personally. If you just keep your coins offline and use a secure computer that's all you need. Just make sure you've got a back up or two and you should be fine.

...

I have both a Trezor and a Ledger Nano (bought both some 8 months ago).  I am happy with both.  I have used both of them over 15 times each, and I cannot detect any problems with either.

The Ledger costs less.

I have not upgraded the firmware with either device.  Also, there may be new versions of the Trezor as well as Ledger Nano, I may buy another Nano to see (as well as have some BTC in yet another device hidden elsewhere).

Negatives:

• The wallet is very small, therefore easy to mis-place, lose, or have stolen if left around
• It's electronic, so it is vulnerable to a battery wearing out or exposure to water and other elements

If stolen, can it be cracked or are the balances lost forever (if the owner doesn't have the private key held elsewhere)?

Personally, I think Trezor wallets are the "bang for the buck" when it comes to hardware wallets. I never have one, but the reviews I've seen is sufficient enough for me to tell that this hardware wallet is indeed very good to have. But in any case. an offline machine is also a great way to keep your coins in a cold storage, though it does not offer mobility compared to a Trezor wallet.

if you want store something for long-term (years), securely and offline, go with bunch of paper wallets generated and distribute them to multiple locations.

Trezor is more or less for somebody, who is actively using bitcoin and needs another (hardware) layer of security..I'm just too conservative to use some "small USB gadget" for more than 100USD, if I can use paper + for Trezor backup you need to store paper with recovery seed anyway...

Even if the logic and mathematics are perfect and the op-sec is good, there can still be implementation details that allow side channel attacks, such as the Trezor power issue. In practice, the Vernam cipher is not 100% safe.

This article from NSA is interesting. https://www.nsa.gov/public_info/_files/cryptologic_spectrum/tempest.pdf (https://www.nsa.gov/public_info/_files/cryptologic_spectrum/tempest.pdf)

vernam cipher is not 100% safe in practice, not because there is an hole in the cipher or something, but because of the messenger

it's like you have x+18 =y(where 18 is the ciphertext and y is the key that you don't know) how can you solve this? it's impossible without knowing at least the key(y), because x and y could have multiple value

if the messenger of the y is caught and y stolen then yes you can decrypt it, but as i said above it's not because the vernam cipher isn't 100% secure

I think it's something like paperwallet. I would recommend it to you, I will buy it later. I hope it won't be waste.

If you want to store BTC safely and securely offline then why don't you use Electrum ? It's great to operate cold wallet with Electrum  :D

Do you even own one? They don't have batteries...

LMAO  :D

How does it work? I think it comes with a display, so.. ?

See this page (https://doc.satoshilabs.com/trezor-user/securityphilosophy.html) for more info

Oh this, thanks. I thought it's safe, but that much? Amazing!

There's some really cool features also, you can set two different passphrases to hide large amounts

That's too complicated for a lazy guy like me.. :P I don't have more than 10 BTC and I definitely won't lost my TREZOR. I will read more about TREZOR, I'm going to love it even more! :D

why spending money on TREZOR when you have breadwallet app for iPhone?  it also works on a secure environment - iOS. (you would use an old iphone just for this wallet making it even more secure).

 So I could buy 2 set them up as clones and put one in a bank safety deposit box? 
 then if my in house breaks or is stolen I could go to my safety deposit box and access the wallet? 
 if true to both questions and you have a decent amount of coins I would consider buying it.

and if I was buying 2.

 I may as well buy 3.

   since 2 = 238 usd and 3 = 299 usd

It has many vulnerabilities.. some of which are continuously being found and attempted fixed. Still, there are many rumors about the Check guys peddling this little thing...... I would be very very careful getting one of those.

But also consider... many of us have USB's that suddenly stop working.

I respect their price and do you know why? They are basically selling the idea, tell me, will you sell TREZOR for $10? For $20? No, you will try to take as much as you can because it's unique!
I can make that amount every week just from signature campaign, it's not that high.. :)

I've considered buying an electronic wallet like Trezzor before but

a) I don't have enough BTC to care that much
b) Im paranoid about electronic devices and trust more a BIP38 (a paper wallet with a password) than something thats prone to failure, needs updates etc.

So far I do this.


I have paper wallets in my safety deposit box.

I have some in a coinbase account.

I have some in a blockchain.info hot wallet.

I have a node with an empty wallet.

trezzor wallet is the best so far in the markeet i can only find their 1 compitator which is LEDGER wallet both hardware wallets are great but i find trezzor more secure however LEDGER wallet is fancy usb and etc but not as secure as trezzor

I no longer use web wallets, they're simply not safe enough. For my hot wallet I use my Trezor, for cold I use paper wallets and store them in a safe deposit box ( insured! (https://safedepositboxinsurance.com/)  ;) )
I also keep my recovery card (https://doc.satoshilabs.com/trezor-user/fillingoutyourrecoverycard.html) in my safe deposit box

Paper wallets will always be the safest.

You can't make clones, each device has a separate private key and even if you could 'clone' it, it would be pointless in purchasing more than one device.
Just make sure you never misplace your Trezor and your recovery card at the same time, then you would be truly screwed. If someone steals your Trezor they can't access your funds because you have a PIN setup, each time you enter the PIN incorrectly you get locked out longer and longer at each failed attempt. You would have plenty of time to get your recovery card from your safe deposit box and recover your funds before the thieve could ever access them.

Wow...shill much?

WHYYYYYYYYYYY?

A safety deposit box is the same as a bank account. You don't control it..the bank ultimately does.

Coinbase? Why not just keep your money with Paypal?

Blockchain.info hot wallet? WHYYYYYYYYYY?

Mycelium phone wallet for day-to-day purchases. Trezor for long term, but accessible. Paper wallets printed securely and stored somewhere OTHER THAN A BANK FOR GOD'S SAKE for long-long term.

I am amazed by the lack of foresight in some people. No offense.

I won't comment on their BOM or whether the price is reasonable or not. If you think it's too much then don't buy it.

I have two trezors. One as a backup. I've always managed to get a deal and not pay full price.

My experience with their tech support as been great. They respond quickly and are well informed.

My most recent question to them was regarding using the trezor for both Bitcoin and Litecoin. Their response was knowledgeable and thoughtful.

FYI, you can use the same Trezor For Bitcoin and Litecoin and it generates different key sets on a per coin basis. For Litecoin I use Electrum LTC and for Bitcoin I use myTrezor and Electrum all with the same Trezor device.

It's really a nice product and worth it for me.

Your point about not being able to clone a trezor is only partially accurate. A trezor is basically a hardware HD wallet. During its initialization process, you're provided with the 24 word passphrase which is the human readable representation of the seed value for the wallet.

You can definitely recover another Trezor with the same backed up passphrase and both units will have the same seed and key set. Basically the restored backup would be identical to the original.

Currently I have a backup unit, but I've kept it in the box and have not used it to recover my main unit's seed value. That's because I figured that if I never use the backup, I might as well leave it in the box unopened. Maybe in the future they'll come out with a Trezor 2 and I can sell or give away my unopened backup.

As an alternative to having a backup Trezor, you could restore the passphrase to a software wallet. I think that Electrum V2 supports the same standard, but I'm not sure.

Of course you'd only want to restore to a software wallet if it was an emergency, like your Trezor was stolen and you want to move the funds out fast to another wallet under your control.

I wasn't aware you could do that, but still you don't want two devices to share the same seed and key set. If one Trezor gets stolen then the other is also unsafe.


Yes, I agree having a backup Trezor is a good idea. I just wanted to make a point against what philipma1957 said, he was suggesting to buy 3 trezors but have them all be clones of each other (which is a terrible idea)


Yes, but it's not like the bank owns the contents of the box, you do. It's illegal for the bank to open the safe deposit box without you being present.

True. If your Trezor is stolen, you have to assume that the thief will eventually guess your PIN. So you have to move your funds as fast as you can.

But if you don't have a trusted computer (and therefore don't want to risk a local software wallet), you could use a "cloned" Trezor to move the funds temporarily to another wallet (maybe Coinbase if you have no other options). At that point, it wouldn't matter what the thief does because the funds associated with the keys in the device he stole would be worthless.

Then you could initialize the backup Trezor from scratch with a brand new, uncompromised seed, then transfer from your temporary wallet back to the "new" Trezor. Since it has a different seed and key set, it's just as secure as a brand new Trezor.

I agree that this scenario is a bit of a stretch. In my case, I've assumed that if my Trezor is stolen, I'll use Electrum on my laptop to quickly recover the seed, then send the Bitcoin to my backup Trezor, which I would initialize with a new seed. I'm on Macintosh and am security conscious, so I think the brief possibility of exposure of possibly compromised keys is worth the speed to move the coins.

But other people on more vulnerable operating systems (not to start an OS war or anything) might want to go the the other route for safety sake. In this scenario, having a cloned Trezor just for the ability to safely move the coins out of the hands of an attacker isn't necessarily a bad idea.

Another thought on the Trezor. If you mine directly to a Trezor address (like I do), then you can end up with lots of inputs. And if you don't have much hash power (like me) then there's lots of small inputs ;)

If you go to spend these inputs later, it can take a very long time. I believe this is because lots of little amounts translate to lots of signing operations when spending. Since the Trezor processor performs all of the signing operations in the device itself (which is the whole point security-wise), and it's not very fast, it can take minutes (or longer) to complete.

To deal with this I have two Trezor "accounts", which effectively translates to key sets. My main account is for savings. The secondary account is where I receive mining proceeds.

Periodically when I reach an arbitrary mined threshold (like 1 bitcoin), I transfer from the mining account to a receiving address on the main savings account. This consolidates the many received inputs and makes later spending from the main account more streamlined.

Note that other than this consolidation, I rarely spend directly from the Trezor. I usually buy things from Breadwallet on my phone. Periodically I top off my phone's Breadwallet from the Trezor, but I limit the amount to a few hundred dollars worth.

This way I get the security of a hardware wallet for savings, but the convenience of a mobile wallet for spending. So far this has worked well for me.

No, I don't own one.

The link you provided "for more information" doesn't talk about power generation, it only says there is no battery. If the fob has a screen it has to generate power...so it must have some source to generate power. Even a watch stops ticking...any thoughts on how Trezor keeps ticking?

I plan to hodl some coins for a very long time. I don't want to pick up my Trezor one day in 10 years and find a blank screen.

http://superuser.com/questions/376498/what-is-the-secret-behind-the-non-volatile-effect-of-the-flash-memories

i agree with this.  trezor is a great piece of hardware with great software support.  
i use it as a "warm" wallet.  
any significant btc holdings still go to very cold storage on encrypted paper wallets.

lmk if you have better advice.

i think he is talking about a safebox in his house, he can control it easily if he know the combination

mycelium isn't even the ebst for androind, "bitcoin wallet" is

trezor have not a real purpose is a gimmick device, why i should waste 120, that can be used to purchase almost 0.5 btc, and instead buying a $4 usb that can do the same basically, ok there isn't offline signing, but you have that with armory or electrum...

That's a good decision to put them into your safety deposit box. Nice idea! :)

One time pads (vernam ciphers) are unbreakable because EVERY plain text is a decryption of any given cipher text. This is because the plain text is just XOR'd with the pad to create the cipher text and to break it (determine the pad/key) requires cycling thru keys to get a reasonably plausible plain text. Then you realize you could cycle some more and get another (in fact any) plausible plain text, etc.
You're right that the pads need to be communicated and a failure there is a bad thing.
But the weakness in practice is the reuse of a pad ... the NSA caught the Russian's out doing that and managed to decrypt a whole bunch of messages.

The seed words could be put into your box. Then if your trezor was stolen you can quickly enter the seed into a wallet that supports hd seeds, transfer the bitcoin. Wait for a new trezor to arrive.

I haven't seen any mention of the use of trezor to sign login challenges. It doesn't work on many sites yet, but where it does it's lovely.
No need to store or reuse passwords any more.

It was developed by Czechs. We made engines to German tanks.

Yes, and we are proud of it! It made Czech Republic more famous :P

if you re-use the key it's clear that you are reducing the security of this method, but that's your fault, the only downside of that ciphers is the key length, not very practical to have a key that is long like the text

yes, actually bitcoin is quite popular here in Czech Republic, I think mainly because of Slush/Stick duo and lot of guys willing to risk, invest and check new technologies.

Even on google trend it is not so bad at all so at least something, in my country, I'm little bit proud off:)

Trezor is probably the best BTC wallet  ;) Safe and enough developed  :)

And still has a lot of safety vulnerabilities that a paper wallet doesn't.

Such as?

It can be lost and then there's no way to recover it, I think.

How can you make statements like that when you clearly don't know the first thing about trezors?

If it's lost, you use the hd seed you've kept safely and recover the coins to another wallet (trezor, or software).

What happened to the original metallic looking cases for Trezor wallets?

There's a silver metallic version in a pic that keeps floating around...

What about the guy that took it from you? I think he can brute force it, or no? I read some articles about this.

He can ... eventually.
Each time he tries a pin that fails, there's an extra wait time added for the next one. Unless you're very unlucky you have plenty of time to move your coins.

Trezor is the ultimate device for security-meets-user friendliness. The device is the best option for maintaining security of your coins without losing the ability to use them as you please.

Yup.

It's also good for logging into services. Once you see how nicely that works, you'll wish every site did it that way.

Ok, good. I think it's pretty amazing and I would definitely buy it in a next 7 days.

It doubles the wait each failed attempt, I believe that's infinite (no good reason why not, the code is on github)

That's pretty much unbeatable security. If your password or whatever it uses is strong, then you are probably safe even if it's stolen.

Yesz. But physical possession of the device means they could crack it eventually, given enough resources. So you wouldn't rely on it.
Point is, it's not a disaster like losing your cash wallet is.

Yes, if someone could for instance acquire the means to extract the contents of the Trezors memory using SPI clip type method (attaching electrodes to the EEPROM or whatever memory type the little ARM M3 in the Trezor uses for persistent memory). It's possible that the password scheme for Trezor actually encrypts the contents of the persistent memory. Not sure on that though.

It's a pretty useless thing right now. With a trezor you still need to have a paper with seed.

With a paper wallet you also have a piece of paper.

For both you need a piece of paper to be safe, so apart from the other vulnerabilities we have heard about Trezor is just another thing to try to keep safe apart from the paper.

..

Also, a weakness of online wallets is that the people behind it might change the code to snatch the private keys etc... well, for Trezor there are the same issues... putting trust in some guys in Czech Republic..

Writing down your hd seed for a trezor is a damn sight easier than explaining to someone how to make a paper wallet.
Trezors are handy as a hot wallet as well, unlike paper wallets.

As far as the trezor firmware being malware, well ... i'm sure i'd rather trust that open source, reviewed code, than the closed source, probably unreviewed code run by your average website.

I already asked you to specify the vulnerabilities you think Trezor has. Is this the best you've got?

I haven't bought one myself, but I know people who has, and they say it's very good. They're pretty expensive though, if you have alot of coins, I suggest you get it. It's the most secure way to store them.

for those that put all their trust in paper wallets, i believe you are taking much more risk than you think you are.

paper wallets are not any more safe than any other wallet and have some worrying attack vectors.  they require too much 'trust' on behalf of the non-technical user.  you have to trust that the paper wallet generator was written by someone with good intentions, and that the code hasn't been compromised since they wrote it.   and the average user isn't qualified to decide if thats the case.   Also, you get what you pay for.  if it was free you have no comeback - who do you complain to (or sue) if in the future someone steals your coins from a deliberately or accidentally weak bitcoin address?

imho, they're unsafe for the average person to use and are better if the person using them is extremely techie and has personally examined and understood the (open) source, compiled it themselves, and is using it on a computer not connected to the internet (ideally, ever)

for everyone else, i.e., most of us... you really cant be sure if you're running a good version or a hacked version of the paper wallet generator code.  And if you got it from a publicly available web site like bitaddress.org or any other paper wallet generator how do you know its not been compromised or weakened after the author wrote it?    you won't know if the seed generation was weakened so someone can brute-force the address at a later date ... you won't know if the web site you got the code from has been redirected via a dns or bgp hack to a rogue version of the code.   you don't and won't know til far in the future if your bitcoins are protected til you find out they're not.

then there's your own computer.  does it have malware on it, before you print out the paper wallet?  perhaps even afterwards.   even if the paper wallet you downloaded and printed out is good, if there's any spyware watching what you're doing on your computer - or if your printer is on a network, any other computer on your network could spy on your printouts... or even your printer could have malware in it.. many printers are internet connected these days... etc... basically, using paper wallets have lots of attack vectors and you need a LOT of trust to use them.

At least, with a commercially available wallet, either hardware or offline software, you've paid someone for the wallet so there is a person or company to kick and to know who made it and who takes responsibility for it.  whether its Trezor, Ledger, Armory, MultiBit, Electrum (or perhaps ChooseCase, that is both hardware, and multi sig).. at least there is someone behind those products that has a commercial responsibility and you know who they are and their work is being scrutinised by all at large, and in the case of hardware wallets, there are very few attack vectors once you trust the people who made them and the scrutiny of the open source... and the protocol for using offline wallets seems likely to be safer than randomly punching up a web address (like bitaddress.org) and printing out a paper wallet that 'the internet' has given you.  seems fraught with danger and has too many systemwide holes to be trusted.

paper wallets downloaded from the internet, and printed out on your own computer seem to be for very trusting people who are willing to take a big risk with their bitcoins.

 

I was wondering about the trezzor wallet as well. I have heard both good and bad things about it, but I do not have any personal experience with it myself. I am considering purchasing one, though I am not sure if I will.

That's a horrible idea, what if your house is broken into and someone grabs your lockbox? you pry those things open in seconds with a crowbar

I honestly believe my methods are the safest possible:

Trezor is legit. The hardware is open-source so if you don't trust their manufacturing process, you can build one yourself or have someone you trust build one for you.

CoinPayments uses Trezor as a passwordless login. Lets you basically have a multi wallet. Really wish more places would support these kinds of logins.

Also they offer $20 off if you're planning to buy one...

https://www.buytrezor.com/coinpayments/

i've had been waiting for years for a good hard wallet solution. i waited a while to get a trezor just to see how others fared first. when they had their recent july 4th sale, i got one. it is a great little device and i feel good storing some keys on it. it is easy to use. the setup is laborious, but it is important and i appreciate the thoroughness. if this trial run goes as expected i'll likely get a few more for extra safety and for gifts for others with similar needs.

im looking forward to using it with mycelium too. anyone have any experience with that?  

safe deposit box can be broken as well it's not they are immune to thieves, the big thing to have when you hold plenty of money isn't the security of it but the awareness of the people about it, in other word don't tell to anyone that you're holdin a big amount and you're safe

The best investment you can get to secure your Bitcoins. Really, nothing but the positives about the Trezor.
Only negative is the price, kind of steep but this also depends how many Bitcoins you have. In my opinion, anybody over 10 Bitcoins should have one. If you have 10 BTCs, at the current prices, this is only 4% to secure your investment.

As Trezor gets more used, I imagine the price will go down as well.

It doesn't matter if my safe deposit box is robbed, that's what the insurance policy is for. I make a claim and get my money back. It's much safer to keep your paper wallets at a bank versus hiding them somewhere inside your house.


There's multiple projects on GitHub. Compile on an air gapped computer and you're completely safe.


Only the people who preordered got the aluminum trezors, it was a rip off imo they cost 1 BTC each

Trezor works very well with Mycelium. Actually the only safe way to use bitcoin from your phone. Also price is being reduced Monday August 10.

almost, but not quite.  the plastic ones were 1 btc.  the metal ones were 3 btc.

they're cheaper now!  those of us who pre-ordered paid a lot for our early trezors.  nowadays i think it was worth every penny of the $300 i paid.. even though at one point, i thought i had paid the equivalent of $3000 for my trezor. (3 btc at $1000/btc).

This is the thing for me as well the high price, I would hope the price would continue to come down a bit more. I have read the reviews and think it is a good idea, but the $120 price is a bit high, even if they have come down from $300+.

For me, I would think the trezor is best suited to carry 1-5 BTC around for easy of access with some piece of mine they are secure. For people with larger amounts of BTC to secure (10's or 100's+), I believe they would prefer to keep them in separate paper wallets for maximum security. I just cannot see trusting high amounts of BTC to a single wallet or device.

they should drop it to 50 bucks, they would sell so much more, i would definitely buy one  over any other device at that price. seems like there just a bunch of tech savy guys that didnt hire a marketing dude.  i really do want one tho, not at this price when i have way cheaper options.

If you had that deposit box in Japan, then the insurance probably wouldn't pay out as Japanese law says a Bitcoin doesn't even exist and therefore you cannot be compensated for something that you didn't lose in the first place.

Bearing in mind all the new laws that are shifting around crypto, I wouldn't trust any insurance company to pay out. Insurance companies make their money with clauses and slide-rule identification at point of claim.

If they can find a law that means they don't have to pay out, they will.

Fortunately, I live in the United States where bitcoin is considered property. I just e-mailed the insurance company also to confirm I'd be covered  ;)


I didn't inquire about paper wallets, but I assume the same would hold true.

That's good. Not so long ago Bitcoin insurance was a touchy subject, then Lloyds of London published their insurance guide for it and it seems the standard practices for Bitcoin insurance are being implemented.

To anyone else looking to get a Trezor, I put it in another thread but figure it might be helpful here too: Trezor is now down to $99 and the price for the DHL delivery is lowered too.

$99 is for the white and grey Trezor though, the black one is a touch more expensive. I'm guessing the colors white and grey are less popular for Trezor?

Actually i have never tried it before, Blockchain is the best for me.