Bitcoin Forum

No, and you would not want one anyway.
A hardware wallet should be 100% offline.
No potential for it to send data someplace or for some other way to connect without the user physically doing it.

No potential for someone to install apps that may compromise security no possibility to run something that should not be run and so on.

-Dave

It is, but it was discussed and it's a very bad idea (read below). Plus, it makes the phone unnecessarily more expensive for people not needing that feature, hence not good for business.


Unless that monkey also steals you (or a picture of you) or your finger, or the last items you've had your fingerprints on.
No. Phone security is weak and "the monkey" may move your money out before you even notice the phone is missing.

----
And about your initial question, I think hat Samsung had ideas in that direction, but a quick search has only revealed this topic (2021) (https://bitcointalk.org/index.php?topic=5337619) and this one (2019) (https://bitcointalk.org/index.php?topic=5101917.0) on the matter.

Hardware wallet are more secure than online wallets, but they are mostly connected to SPV client which makes them not private. Just as you can use Tor with other wallets, it can helps in anonymity, not security.

You have your phone on airplane mode, but it can easily be turned on. To discourage that kind of habit, it is best to remove the WiFi, Bluetooth, NFC and other components that can be used to connect to other devices and to the internet.

Has anyone seen the Solana Saga phone? Agree that relying on a phone's hardware wallet could lead to issues- but using it like a hot wallet could dramatically improve the user experience for mobile transactions

There are some hardware wallets that look like phones but they are actually hardware wallets, in first place this is Passport hardware wallet by Foundation.
Passport started as ColdCard fork but with open source software and hardware, with added improvements and much better look.
Keystone wallet also looks like smaller smartphone, and it only functions as hardware wallet.

You can use old smartphones for coins but I would not consider it to be safe as hardware wallet for several reasons, but you can use them in combination with other hardware wallets.

One guy even used old Nokia phone to turn it into Bitcoin wallet:
https://bitcointalk.org/index.php?topic=5420438.0

WiPhone can also be used for some Bitcoin wallet project:
https://bitcointalk.org/index.php?topic=5403646.0

Why are you trying to cram another feature into your phone? It already has a great amount of functionality, which makes the phone a multi-tool. As is usually the case with devices that try to combine the functions of many others, the quality of the functionality turns out to be worse. That is, the phone can have a hardware wallet function, but the level of protection will be much lower, and the risk of losing it also increases, since you always and everywhere carry the phone with you in everyday life. This is not suitable for large sums, because you don't carry all your savings with you and is only acceptable for pocket money, the loss of which you can afford. It is better not to combine the hardware wallet with the phone and keep it in a safe place. Moreover, you will rarely use HW anyway.

We'll have to choose between security and reliability between convenience and mobility.

Some voices are not convinced that everything can be properly turned off, see https://bitcointalk.org/index.php?topic=5377997
And, in your case at least, the point it to not turn everything off and use it as every day smartphone, isn't it? And that's, by far, much riskier.

It looks like the phone uses Qualcomm's latest technology on a secure chip. If I read it correctly, this won't be an exclusive technology for some manufacturers, so I won't be surprised if there will be more apps that support it in the future. The point is, it is not gonna be hardware or software exclusive, so I'd rather wait and just use any Android phone with open-source apps to manage my crypto right now if necessary.

Most of these hacks are done via phishing or social engineering anyway. A secure device won't help you at all if you just give your password to whoever asks you. CMIIW.

You can certainly add more features, but it also adds more attack vectors. It might work, but it will always be riskier to use compared to a dedicated device that is designed to cater to specific needs IMO. Don't know how balanced it will be but I personally don't want to risk security for extra mobility. I never bring my HW outside of my house or when I travel anyway. If I lose it that will be a disaster.

Even if there was something like that, why would you opt to use that instead of a standalone device that you only connect to when you need it to sign transactions and move your crypto? A phone that you use for all kinds of activities shouldn't be used as a storage for your private keys and seeds. Too many things could go wrong despite what the manufacturers say. Many people simply use their phones as a testing ground for games and dubious apps. They allow permissions and give apps rights without considering what it means. That's not an environment for your digital assets and their signing keys.

I doubt you will have much success trying that. Those components are surely all soldered to the main board, and unless you know what you are doing and have an engineering background, you are more than likely to destroy your phone. All the antennas and chips can be disabled on the software side, but who knows who and what can turn them on again if required to. 

I thought they were a fork of Trezor's codebase. Doesn't ColdCard work with a license that doesn't allow anyone to redistribute, use, or modify their code for their own purposes? Or maybe that wasn't the case when Passport forked it...

I wonder why HTC abandoned the HTC Exodus 1 and Exodus 1s product line around 2 years ago, which included another hardware-based wallet solution, see https://www.htcexodus.com/

IIRC it wasn't intended to be a cold wallet, but it was more secure than a piece of software while easier to handle than a hardware wallet, I guess.

ColdCard used some parts of Trezor code few years ago, and even if NVK keeps making excuses about it I posted proof of Trezor developer confirming this.
When Passport foundation hardware wallet was released they initially used original ColdCard code that was modified, after that NVK from ColdCard decided to change code from open source to common clause.
So the main reason for ColdCard changing their license is because they don't want people using any of their code  :P

OK, I get it now. I have already known about ColdCard's use of Trezor's open-source code to build their own product, but I thought they started off with a Common Clause license despite of that. Seems like they don't want to give their competitors a helping hand in any way, even by providing open-source code. It's cold blooded business but also scumbag behavior.   

Do you mean that inside your phone there is a "cold storage build-in wallet" or just a wallet that connects to hardware wallets?
I think Galaxy S10 can do that and I read somewhere that they have a phone that works as a full node, syncs, and you can run it as cold storage but I don't remember the exact name.

You are probably talking about the Samsung Blockchain Wallet (https://www.samsung.com/global/galaxy/apps/samsung-blockchain/), although I have never heard talks about it being a full node. I doubt it is to tell you the truth. This solution of theirs was first announced back in 2019. I don't know how popular it has become in the meantime. I don't remember reading any complaints or praises on Bitcointalk. It's both a wallet and a key manager. It's supposedly non-custodial, but who knows?!

There was some talk a long time ago that sensitive data gets backed up on Samsung's cloud and that's not something you want. But even if it's an opt in/opt out feature by Samsung, would you trust them not to back anything up even if they say they won't? It's surely not an open-source solution, so you can't verify anything on your own and you are stuck trusting a company whose main business is not crypto or the security of other peoples' funds. 

I didn't even know that the Samsung Blockchain Wallet has been launched since 2019, I didn't find a review from the forum regarding that information or maybe I have missed it. I've accessed the Galaxy store at https://galaxystore.samsung.com/prepost/000006169962 and found that the app has 0 user reviews and even though I don't get any information on installed apps.

If sensitive data from phrase can be backed up to cloud samsung without notification to user then it will be dangerous, but so far the backup to cloud samsung feature is not available and user can only backup recovery phrase for manual save for personal, but I also can't trust that app is open source. But regarding security, in October a vulnerability was detected in the application with the description "Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attackers to execute privileged actions." but the information has been added to samsung security website, maybe they have fixed the problem.

Well, that's not good enough. Most people do not update their apps, so are still running a vulnerable version that is easily exploited using a few pieces of Android malware.

It goes on to underscore why you should not store large stashes on mobile wallets.

I didn't research this Saga Phone deeper, and I didn't test it myself, but I don't consider this shitcoin wallet to be airgapped since it functions similar like regular smartphoens.
When we know how many times Solana shitchain stopped working for various reasons, makes me trust even less their magical Saga wallet.
Any device that have bluetooth, wifi, nfc, phone aim tower connection, and internet connection, can't be considered airgapped device.
I don't know how their seed vault works (could be similar like Samsung and Google phones), but I wouldn't waste a single sat on this presale ^(scam).

Correct. I think mobile phones cant replace hardware wallet features. Btw, still Im interested in knowing about this saga phone's price since it claims to be a blockchain based device (I know even HTC tried this before and failed) , where can one buy it ? Is there a thread about it in the forum? Specs ? Anyone? If someone got any legit source, you may post it here.

---

Wait. Now what?!!

Phones TPM speak PKCS11. As long as you're willing write in the native language (Kotlin or Objective-C), and the TPM lists EC as a supported feature (they all do RSA but EC is present maybe 50% of the time?), then you can do hardware exponentiation and signing. Vaults on phones are "fairly" well implemented from my experience, the material is correctly enclaved to the binary that created the entry, and with the proper options at creation, it will never reveal the private data.

Phones as a primary hardware wallet are useless, but as a secondary signer in a multisig scheme, why not?

I would prefer an iPhone about basically any computer wallet, simply because there are way less attack vectors. This does not mean that an iPhone can replace hardware wallets or that I would be comfortable to store large amounts, but still it is an option if you are just beginning with bitcoin and don’t want to invest to much money.

An old iPhone can also be „airgapped“/kept offline if you don’t need to spend coins easily.

I don't know where you can buy that crap and I don't know any spec, research it yourself.
This is just shitcoin junk device that will certainly die soon enough after they collect more money from people.
If you want to waste your money go for it, but don't expect to receive any security of device updates from Saga ponzi scheme.

Not really.
You can only be sure something is really airgapped if you remove parts that communicate with cell towers and internet.
I do however agree that old phones can be useful for bitcoin.

I don't know if you were thinking of something like that, but maybe it looks like it.

In this case you have indeed two devices : smartphone and cold wallet, but if you don't have a pc, it's still very practical and above all very secure.


https://shiftcrypto.ch/app/

There's no reason to attempt something like this, because a phone just runs an OS like a desktop does, and needs companion software to interact with the wallet anyway. In other words, it would not be a real hardware wallet, because it is connected to the internet, Bluetooth, NFC, and everything you would not want cold storage to be touching.

It's better to just stick with old-fashioned and stand-alone hardware wallets that have worked so well for us up to now.

Yes a phone can be turned into an airgapped device and used to store BTC, but it has to be done correctly, in a very safe enviroment. I recommend that one should just buy a good hardware wallet if they do not know how to securely set up an air-gapped device, some people set up this cold storage device and still connect it to the internet, that is a terrible decision, it should be totally disconnected from the internet, with airplane mode turned on and Wifi disconnected. It is easier to use a hardware wallet than this method, only use it if you cannot get a hardware wallet.

Old smartphone is usually free but a hardware wallet will cost you at least 50 usd. So I can see why people would consider a smartphone.


Even if a iPhone can be kept offline easily (just reset it and not safe any Wi-Fi passwords on it) I think it is still pretty safe if you connect it every few months to quickly send some coins. But that is just my personal opinion.

Using an air-gapped phone for cold storage is a good option, but only if you can set it up and use it in a safe environent, if you cannot, then buy a hardware wallet, $100 for a hardware wallet should not be a problem if you are storing anything from $1000 upwards.
This is the worry when people use air-gapped devices, they can lose their funds with one mistake or just bad operational security. Your air-gapped device should never be connected to the internet, the risk of losing your funds when you connect it to the internet is surely always there. It is very easy to send funds out of your air-gapped wallet without internet connection, all you need is another online watching-only device, this device would created the transaction, which your would import into your offline device through scanning the transaction QR code, then you use your offline device to sign the transaction and export it back into your watch-only device, and then you broadcast. Read the links below for more understanding on how to do it.

https://electrum.readthedocs.io/en/latest/coldstorage.html
https://bitcointalk.org/index.php?topic=5237614.msg54149363#msg54149363

Well yes obviously this is the correct answer if you want to know what would be the textbook solution to this question. If you however store such low amounts of bitcoin that it is not an option to buy a hardware wallet then this is still a good working solution. Remember that bitcoin was designed without hardware wallets in mind and has worked flawlessly for many years before hardware wallets.

I tend to agree, air-gapped and hardware weren't there before and AFAIK, the first Bitcoin wallet was the Bitcoin core which was released in 2009 and then a hardware wallet came up in the year 2014 and that was a Trezor one.

For me, as long as it is a non-custodial wallet and I have full control of the private key considering I'm safe especially if that is only a small amount.  An electrum wallet would be fine.

However, to answer OP's question.
Have you heard SikurPhone?  It runs on a modified version of the Android operating system which you can use as an air-gapped wallet.

Sure, but when BTC was also created there was no SegWit or Taproot address, there was also no Layer two solution like the Lightning network. The BTC network could not have remained exactly the way it was when it was created, that is why there are so many improvement proposals and recommendations for better security. There are also maintainers and developers who ensure that the network is running smoothly, and anyone can also check for bugs and report them, it is a community thingy for best security and compatibility possible.

However, Electrum on an online device is enough if the money you want to store is small and for spending often. When BTC was created it was not really worth stealing, that is why hardware wallets and better security recommendations were introduced when BTC's value began to increase.

I think that SikurPhone is outdated closed source junk and I would never used it as an airgapped device.
This phones reminds me a lot on those FBI made  ANOM phones that criminals used for ''safu'' fake encrypted communication.
Best alternative device I know is opensource Graphene OS that works with any Google Pixel phones, and everyone can install it and verify very fast.

Yes that is very true and I am myself a user and fan of hardware wallets. However I still fully belive that bitcoin is also secure in its original state that does not requiere a hardware wallet at all. I know people that own less than 50 USD worth of bitcoin and they will be for shure better of with and old phone as a "hardware" wallet than to not use any precaution at all.
In general I always tell people to use a hardware wallet of course, if the investment is big enough to justify it.

We already know that we can use a phone as a hardware wallet if it's air-gapped and never connected to any network. It's essentially the same thing as a hardware wallet, but it's a cheaper/free option if you can't afford to buy a hardware wallet. For example, you could set up an offline Electrum wallet on an old Android phone and keep it safe and air-gapped.

Bitcoin is highly secure in its original state, as you mentioned, but the problem can arise from a person's behavior and the way they use their wallet. Security is no joke when it comes to your money and assets, so everyone should be careful and take all the necessary security measures to keep their Bitcoin wallet safe.

Graphene OS looks good, I just found out about it.
But it officially only supports Google Pixel and the latest one already supports Google Pixel 7 Series.

It is indeed open source and anyone can develop it.
Looking at this Graphene OS forum and searching about implementation on other devices such as Xiaomi, Samsung etc.
Requires substantial Kernel development knowledge, AOSP development skills, resources, as well as considerable time to start porting on the desired device.
https://discuss.grapheneos.org/d/2482-can-grapheneos-be-built-for-other-devices-such-as-xiaomi/2

I used to do ROM porting for Android devices, but for Graphene OS it looks more complex and not easy to port.
This is also related to the security system in it.

Which devices will be supported in the future?
https://grapheneos.org/faq#future-devices

Besides Graphene OS, there are 2 more OS, LineageOS and CalyxOS.
have their own advantages and features.

As far as I know it is possible to add hardware to an iphone if it is separate from the iphone itself, that can still interact with it from the inside to sign a transaction to keep the bitcoin on the iphone Which is called a hardware wallet.

      You probably know that a hardware wallet is a device that stores bitcoins offline, which you can connect to your phone via usb or and once you do it, you can sign transactions without showing your private key.

You may have misunderstood the OP's intention. He wants a hardware Wallet that is directly embedded in the smartphone and becomes one like the Solana Saga Smartphone, not a separate wallet or Hardware wallet in general.

A Bitcoin wallet stored offline would indeed be better and more secure than a Wallet that is constantly online on a smartphone.

The optimal and recommended use of crypto wallets is hardware wallets.
Without internet or other wireless connections WIFI, Bluetooth.

Yes, but you can buy older Pixel devices that are still updated on regular basis, something like Pixel 5 is fairly cheap and affordable for most people.
There are other alternatives for Graphene OS that work with other Android devices but they are inferior compared to GOS and updates are not so frequent.
LineageOS, CalyxOS, Divest, etc are all fine and open source, but support for other Android devices is not great, and they often get broken with new updates.

Overall, smartphone as a hard wallet is a bad idea and I really hope that companies and people don't support it. At the moment, one rarely thinks that someone has a hardware wallet in his smarrphone but imagine, if it becomes popular, a phone theft rate will dramatically increase because bitcoins are like: once gone, gone forever and if we keep in mind the low security of smartphones (doesn't matter which method you use, especially on androids), then the answer is clear.

That was HTC (https://www.coindesk.com/markets/2019/10/19/htcs-latest-blockchain-phone-can-run-a-full-bitcoin-node/).

It's not a full node. Just a simple wallet. It also comes with Samsung Blockchain Keystore (https://developer.samsung.com/blockchain/keystore/overview.html).

Ledger Nano X has its mobile app through its Ledger live app and it supports iOs and android OS. Well, they're in the hot seat now thanks to their new added feature which is the ledger recover and it's good for everyone to know about it and there's a continuous discussion all about it.
Thread: Ledger Recovery - Send your (encrypted) recovery phrase to 3rd parties entities (https://bitcointalk.org/index.php?topic=5452900.0)
While this has just given me the idea of what OP is looking about. I've personally thought of this actual smartphones are hardwallets by simply downloading a wallet like Electrum mobile and keeping that phone offline, the same goes for those laptops that are used as an actual wallet for those that can't afford to buy a hardware wallet or chooses to use that with their spare laptop and keep it disconnected from the web as if it's an actual huge hardware as their wallets.

If OP is still interested, they can take a look at what the AirGap wallet is doing with its most recent service called AirGap Knox.
https://bitcointalk.org/index.php?topic=5342004.0

I am not advertising the service or anything, just mentioning it here because I heard about it recently. AirGap Knox is a device manager you install on your phone that blocks connectivity on the OS level and thus keeps your phone offline. However, it's a paid service and closed-source.

Pixel 5 used price is still around $300 and still quite expensive, but if it's only google pixel that can be installed graphene OS perfectly, it's quite worth-it (also depends on user needs).

Never installed Graphene OS or LineageOS, CalyxOS, Divest, etc. Maybe later I can install one of them.
A hardware wallet embedded in the smartphone is also not a bad idea, it can be an alternative without using a separate hardware wallet.

Rather than having to use a hardware wallet like LEDGER, I'd rather choose my own smartphone to be a custom hardware wallet that I can fully control LOL.

Dude I don't know what are you talking about and where you live, but I can find used Pixel 5 and 5a much cheaper, even Pixel 6a in good condition is below $300
Please check prices worldwide before you make some claims like this, and prices can be even cheaper for people who live in United States.
Models with A letter are smaller, made from plastic and have weaker camera but they are still good enough for GrapheneOS degoogled phone.

It takes few minutes to install everything, but you need to have minimal knowledge with system installation on other devices.

I don't want to rent a lot against ledger, I think I proved that I was correct when I criticized them in last few years, beacuse I had a feeling things are going in this direction  :P

I live in Indonesia man, Google Pixel prices are still expensive. The cheapest Pixel 5 is around the price of $200 - $300 and it depends on the condition and completeness of the device. and maybe it can be lower if without any accessories.
In the United States, it will certainly be cheaper especially used prices, will be much cheaper.

I often install several OS for Android, Custom ROM, etc.
But I have never flashed an OS that is related to crypto wallets or an OS that is more concerned with security.

Now that it has become a custody wallet, what to expect? People are starting to abandon it.
Everyone is withdrawing from Ledger hardware, for the security of their assets. If you have predicted it, then it has become real.
Just wait for its destruction or cancel the update.

Not sure if it's going to be enough if they come out and say we changed our mind and we have abandoned the idea of Ledger Recover. They have dealt a much bigger blow to the whole industry by revealing that private key sharing is and has always been possible. They made their plans public this time, what if they or someone else doesn't in the future? What if they can retrieve your seed even if you don't give your consent, or they make some changes where they don't even need to ask you?

Based on what I had found is that the trezor model is a type of hardware wallet that can be connected to any smartphone via usb, which allows you to transfer cryptocurrency even offline. Apart from this, the Samsung is also possible, because it has features called knox vault.

But not all smartphones have a built in cold storage wallet so it can be said to be secure. Most can also have vulnerabilities that hackers can get into to get crypto.

Changing their mind after the update is just like saying;
We are so sorry for letting you know about our decision.
We are withdrawing our decision.
Next time we will implement it without your knowledge.
https://www.talkimg.com/images/2023/06/06/wfZya.gif

Trezor only works with Android devices an not with with iPhones, and that is huge market share of smartphone.
I wouldn't agree that Samsung phones are safu just because they have knox vault, because it is bundled with bunch of crap and it's closed source device both hardware and software.
Optional alternative is Pixel phone that can run open source GrapheneOS, they also have secure storage and they used some of Samsung chips.
Problem with many smartphones is also short support, so they can soon become unusable unlike dedicated hardware wallets or even older laptop computers that run Linux OS.

If I remember correctly some companies already tried to build a dedicated secure chip for their CPU, like Qualcomm SPU unit. They can market those features and build a dedicated phone for crypto (some already exist I believe) if they wanted to. But it still doesn't solve the problem that a phone is a phone. Personally, I wouldn't use a phone as a hardware wallet even if they claim it is unhackable due to a secure chip, etc.

Most people definitely lost their trust in Ledger, especially after the latest Atomic Wallet exploit. Who knows, maybe the same thing can happen when Ledger makes their firmware can expose the user's seeds in one way or another. Unless they make everything open source and allow people to verify/develop their own app without relying on Ledger, I wouldn't use or recommend them to others.