I know this forum is blessed with some very knowledgeable individuals, and maybe some of them can help me with what I am searching for.
Let's say I am reading the Bitcoin whitepaper or a thread on the forum with plenty of text. I need a piece of software that can automatically find and highlight a list of words of my choosing. This is quite easy to do with the CTRL + F option if it's just one word, but if I need the same thing for 40 or 50 words, what are my options? I don't want to manually check each one.

I have found some suggestions to use Word macros, but I am not comfortable downloading and installing things like that from random people from the internet. Still, if that's the only way to do it, I will have to reconsider it.

Any of you statistics and data fans know of any other options?   

[address poisoning scams]

Many of you have probably heard, and some have even experienced address poisoning scams. It's a relatively new type of fraudulent scheme, which has become popular in the last 30-40 days. It appears on blockchains with cheap transaction fees, allowing scammers to send many low-cost transactions. I have not read about cases where this affected the Bitcoin network, but it’s still worth knowing about just in case you experience it in your BTC wallet in the future. Hardware wallet manufacturers, like Ledger have reported that scammers are targeting their users as well. So, stay alert.   

What is Address Poisoning, and How Does it Work?

This scam works by sending potential victims small (near-zero) crypto transactions. You will see a new entry in your transaction history when that happens. The address that sends the coins/tokens will look similar to yours. The first and last two to four characters will be identical.

The scammer wants to make you think that this is your own address. So, you copy it from your transaction history when sending coins to yourself or give it to a different party to pay you. In that case, the funds will be transferred to the fraudster and not to you. 

On which Blockchains is Address Poisoning Common? 

Users of the following blockchain networks have already experienced address poisoning in one way or the other:

1.   Tron
2.   Binance Smart Chain
3.   Polygon
4.   Ethereum
5.   Maybe others

Safety Measures and What to do Next

If you were a victim of address poisoning, there are no reasons to panic. No one is targeting you personally. Fraudsters prey on those who make frequent transactions and move significant sums of money.

Your coins aren't at risk. Your private keys/seed hasn't leaked, and no one has gained control of your addresses, no matter the transaction history. There is no protection against address poisoning, per se, because you can't restrict someone from sending you crypto. It's safe to use those coins as well. 

There are a few things you should always do to stay safe when sending and receiving crypto:


•   Never copy addresses from your wallet's transaction history.
•   Never copy addresses from a blockchain explorer.
•   Always generate or copy addresses from your wallet's receive or addresses tab.
•   When sending coins elsewhere, copy the address from the source/destination.
•   If you are transferring crypto to a different person, ask the other party for the correct address.
•   Verify the full address, not just the first and last couple of characters.
•   If you use a hardware wallet, ensure the address in your software matches the one shown on your device's screen.   
•   Be prepared to double and triple-check if needed because cryptocurrency transactions are irreversible. So, once your money is gone, it's lost forever. As can be seen, it's better to spend an extra minute checking what you are doing than regretting you didn't.


For more information on address poisoning scams, take a look at these sources:

Beware Of Address Poisoning Scams
Address Poisoning Attack, A Continuing Threat
SlowMist: Another Airdrop Scam, but with a twist

[Intervju]

Otkako sam pogledao video o hakiranju Trezora, želio sam razgovarati s Joe "Kingpin" Grand-om lično. Javio sam mu se i pitao ga je li zainteresiran da obavi intervju sa mnom koji bi bio objavljen na Bitcointalk forumu? Svidjela mu se ideja i nakon nekoliko pokušaja, napokon smo poklopili termine i završili posao.


Za one koji ne znaju ko je Joe Grand, evo nekoliko informacija o njemu.

Joe Grand je posato haker 1982. kada je imao samo 7 godina. Njegov brat je posjedovao Atari 400 i koristio ga je za skupljanje video igrica. Joe-a je odmah privukla tehnologija te je svaki dan prije i poslije škole provodio uz računar. Zanimalo ga je da pronađe nove načine za razmjenu igrica s drugim ljudima i tako je započela njegova priča. Nakon određenog perioda, naučio je kako besplatno telefonirati i povezivati se sa kompjuterskim sustavima udaljenim od njega kako bi mogao dobiti još više igrica.

Joe je ubrzo shvatio da postoje ljudi koji trguju i drugim stvarima, ne samo video igricama. Imali su informacije o pristupanju različitim kompjuterskim sustavima. Poznavali su druge metode besplatnih telefonskih poziva ili otvaranja posebnih linija za zabavu i telekonferencije gdje se više ljudi moglo okupiti i razgovarati preko telefona. Za Joe-a je postalo normalna stvar posjedovati informacije koje druga djeca nisu imala.

Joe je bio uhapšen kad je imao 16 godina jer je provalio u telefonsku kompaniju kako bi ukrao opremu. Srećom, bio je maloljetan u to vrijeme i nije završio u zatvoru. Joe je želio učiti, ali je shvatio da krađa nije pravi način da se dođe do informacija. Nakon tog događaja pridružio se hakerskoj grupi pod nazivom L0pht Heavy Industries koja se sastojala od starijih hakera od njega.

Članovi ove skupine su hakirali svoje vlastite sustave kako bi pronalazili ranjivosti i onda bi kontaktirali dobavljače softvera (uglavnom Microsoft). L0pht je naučio Joe-a o važnosti dijeljenja informacija i činjenju dobrih stvari za širenje pozitivnih priča o hakiranju. Godine 1998. Joe je svjedočio pred američkim Kongresom zajedno sa ostalim članovima L0pht-a o stanju računarske sigurnosti u vladi i o tome koliko su kompjuterski sustavi loši od pojave interneta. Tada je šira javnost shvatila da hakeri mogu biti dobri i da se s njima isplati raditi.

Od kraja 2002. Joe radi sam, stvara svoje projekte, drži govore, predaje i povremeno snima video klipove o inžinjerstvu i hakiranju.

Intervju

Intervju je obavljen na nekoliko načina i u više faza. Najprije sam poslao listu pitanja Joe-u preko emaila. Odgovorio je na neka od njih u svojim YouTube AMA-ima uživo (linkovi se mogu naći u nastavku). O onim pitanjima koja nisu odgovorena emailom, razgovarali smo nedavno preko Zoom-a. Joe je zatim uredio svoje odgovore radi jasnoće i ažuriranja informacija.
 

1. Kakav je osjećaj biti haker? Kako te gledaju ljudi koji znaju šta možeš uraditi? Vide li tehnološkog čarobnjaka ili zlikovca?

Joe: Biti haker je sve što sam ikada znao i sve što sam ikada radio. Znatiželjan sam i volim učiti nove stvari a posebno one koje nisu opće poznate. Kada spomenem da sam haker, većina ljudi misli da radim nešto ilegalno. Čak je i moja žena u početku tako mislila. Ali to nije tako – hakiranje se može koristiti za dobro i za zlo kao i skoro sve u životu. Pomažem ljudima tako što otkrivam sigurnosne probleme i obavještavam kompanije o tim problemima kako bi se oni mogli popraviti. Pomažem ljudima podučavajući ih o onome što znam kako bi se mogli odbraniti ili poboljšati svoje proizvode. Pretpostavljam da ovisi o osobi; neki me vide kao negativca, drugi kao tehnološkog čarobnjaka.


2. Govorio si o drugčijem razmišljanju u svom Live AMA-u i kako te je hapšenje u dobi od 16 godina navelo da prestaneš sa delikventnim hakerskim aktivnostima. Postavši član L0phta učinilo te je boljom osobom. Šta misliš šta bi se dogodilo da nikada nisi upoznao te dečke? Vjeruješ li da bi takve aktivnosti mogle rezultirati ozbiljnom zatvorskom kaznom i životom u kriminalu?

Joe: Članovi L0pht-a su me primili nakon što sam upao u probleme. Bilo je to iskustvo koje je promijenilo moj život i prava prekretnica. Svi ostali dečki su bili stariji od mene i djelovali su mi kao odgovorne osobe. Ugledao sam se na njih i na neki način ih oponašao. Roditelji su me pustili u L0pht, koji je bio hakersko okupljalište u mom rodnom gradu Bostonu u Massachusettsu, jer su znali da imam strast prema hakiranju i da je L0pht dobro mjesto za to. Da nisam bio uhapšen kao klinac, sa sigurnošću mogu reći da bih nastavio praviti probleme i možda bi završio u zatvoru.


3. Nakon hakiranja Trezor One uređaja, jesi li pokušao slične napade na neke druge proizvođače hardverskih novčanika? Možemo li očekivati nešto slično u budućnosti? Radi li ekipa možda na nečemu dok mi razgovaramo?

Joe: Da, radili smo na drugim projektima hakiranja novčanika, kako hardverskih tako i softverskih. Objavili smo još jedan video u Junu 2022 (hack Samsung Galaxy telefona), ali većinu hakiranja novčanika koje radimo ne snimamo.

Hakiranje sa softverske strane je prilično jasno i dobro definiran problem, naročito kad je riječ o hakiranju lozinki. Ograničenja u računarskoj snazi i snazi kriptografije već su jasno definirana. Mala je vjerojatnoća da ćete izgubiti nečije kriptovalute ako hakirate lozinku njihovog novčanika ili na neki drugi način iskorištavate softverski novčanik. Ili ćete saznati lozinku od novčanika i ostvariti pristup kriptu ili nećete.

Ali hardver je drugačiji. Čak su i napadi koji su poznati vrlo nepredvidljivi i nisu tako pouzdani kao softverska strana stvari. Rizik od gubitka pristupa kriptovalutama je mnogo veći i obično je uzrokovan slučajnim brisanjem memorije ili pokretanjem neke sigurnosne protumjere tokom napada. Potrebno je puno vremena za istraživanje da bi se uopšte došlo do tačke za početak izvođenja napada na određeni hardverski novčanik. Zatim, napad mora biti uspješan na način da možete doći do privatnog ključa, seed-a ili drugih podataka na koje ciljate. A postavlja se i pitanje je li osoba stvarno imala tu količinu kriptovaluta koju je mislila da ima. Stoga moramo biti pažljiviji u vezi kojih projekata hakiranja hardvera preuzimamo.


4. Član sam Bitcointalk-a već nekoliko godina i viđao sam teme u kojima su se ljudi žalili da su izgubili pristup svojim kriptovalutama. Izgubljeni seed-ovi, pokvareni hard diskovi, zaboravljeni PIN-ovi i lozinke, itd. Da li si ikada razmišljao o korištenju ovog foruma i pronalaženju sličnih tema u kojima bi i ti i druga strana mogli imati koristi od povratka sredstava?

Joe: Zapravo nisam ni znao za Bitcointalk dok mi se ti nisi javio e-mailom. Nisam toliko obraćao pažnju na svijet kriptovaluta dok nisam hakirao Trezor novčanik. Znao sam da postoji zajednica kripto entuzijasta, ali nisam znao da postoji tako aktivan forum isključivo za to. Nikada nisam razmišljao o pretraživanju tema na forumu - to baš i nije moj način rada i osjećao bih se čudno da to radim. Puno je prirodniji proces kada ljudi dođu nama a ne da mi kontaktiramo njih. Ako neko nudi neželjenu pomoć u svijetu kriptovaluta, svakako morate biti na oprezu i paziti s kim imate posla.

Kada tražite pomoć za povrat kriptovaluta, jako je važno da ste sigurni da razgovarate sa pravom osobom, a ne sa nekim prevarantom. Postoje imitatori Joe Grand-a na društvenim mrežama (osobito na Instagramu, ali i na TikToku, Twitteru itd.) koji nude pomoć ljudima i traže novac unaprijed, a ja obično čujem za to tek kad neko bude prevaren. Čim se jedan lažni nalog blokira, pojavi se drugi. Mene nije teško pronaći – ostvarivanje kontakta sa mnom putem moje web stranice je najbolji i najpouzdaniji način da znate da razgovarate sa mnom, a ne s nekim ko se pretvara da sam ja.


5. Šta nam možeš reći o offspec.io? Kako bi vaša tvrtka mogla pomoći nekome sa Bitcointalk-a, na primjer?

Joe: offspec.io je mali tim kojeg smo okupili kao rezultat mog hakiranja Trezor novčanika. Dok sam radio na tom projektu, supruga mi je rekla da bih trebao snimiti video o hakiranju jer je većina videa koje sam do tad objavljivao bila fokusirana na inžinjerstvo i "ljudi moraju vidjeti da si još uvijek haker". Obratio sam se svom prijatelju koji snima filmove i odlučili smo to napraviti. Nakon uspješnog hakiranja novčanika, moj prijatelj je rekao da bi ovo trebalo postati naše zanimanje. I bio je u pravu - toliko ima ljudi kojima je potrebna pomoć.

Ja sam hardverski haker i onaj kojeg većina ljudi prepoznaje zbog naših videa, ali imamo i softverske hakere koji rade na razbijanju lozinki i sličnim analizima i par drugih osoba koje rade iza scene na pravnoj strani stvari i direktnoj komunikaciji sa potencijalnim klijentima.

Otkako je izašao prvi video, primili smo stotine i stotine e-mailova od raznih ljudi sa različitim problemima. Pomažemo onima kojima možemo, ali nažalost mnogi ljudi su prevareni na neki način - ili su slali kriptovalute na lažne mjenjačnice ili su ulagali u neke lažne coine, itd. Nismo u mogućnosti da pomogemo ljudima koji su prevareni - priroda kriptovaluta je takva da je malo vjerojatno da se povrate sredstva na zakonit način bez pomoći organa za provođenje zakona, što je također malo vjerojatno da će se dogoditi.

Bez obzira na to kako su ljudi izgubili pristup svojim kriptovalutama, moraju znati da nisu sami. Ne bi se trebali osjećati "glupo" jer su zaboravili šifru, izgubili komadić papira gdje je bio zapisan seed ili su bili prevareni. Sve su to stvari koje se čovjeku mogu desiti i to se događa mnogima od nas.


6. Kakvu budućnost vidite za Off Spec i gdje želite da bude za 5 ili 10 godina?

Joe: Nemamo plan. Šta god da se dogodi, dogodit će se. Volio bih snimiti još videa koji kombiniraju tehničke elemente povratka kriptovaluta sa ličnom stranom ljudi kojima je potrebna pomoć. I naravno, želimo nastaviti pomagati ljudima dok god je to nešto u čemu uživamo. Hakiranje novčanika nije naš primarni posao. To je samo jedna usluga koju nudimo kako bismo pokušali pomoći ljudima da povrate svoja sredstva.


7. Tvoj fokus je na hardveru, ali pretpostavljam da znaš više o softveru od prosječne osobe. Jesam li u pravu?

Joe: Po zanimanju sam kompjuterski inžinjer, tako da je moj fokus primarno na hardveru, ali imam iskustva sa kodiranjnjem i dovoljno poznajem softver za ono što meni treba za posao. Uglavnom pišem kod za hardverske projekte na kojima radim, obično u C ili assembly, i za kontrolu hardverskih alata koji se koriste za hakiranje, poput rada u Python-u kako bi mogao raditi sa ChipWhisperer-om za izvođenje fault injection napada ili analize napona. Dovoljno sam dobar, ali sebe nikada ne bih nazvao programerom.


8. Koje je tvoje iskreno mišljenje o kriptovalutama, posebno o Bitcoinu? To je open-source protokol. Jesi li ikada istraživao kodnu bazu tražeći ranjivosti ili da bi vidio kako su Satoshi i drugi programeri stvorili ovaj digitalni novac kojeg koristimo danas?

Joe: Mislim da postoje neki zanimljivi elementi kod kriptovaluta i blockchain tehnologije koji bi zapravo mogli imati praktičnu svrhu. Koncept digitalnih valuta i decentraliziranog finansijskog sustava, između ostalog, zvuči sjajno i postoje neki legitimni i zanimljivi projekti, ali broj prevara, shitcoina, itd. otežava prihvaćanje i povjerenje javnosti. Još uvijek postoje mnoga neriješena pitanja o tome kako bi se te tehnologije trebale koristiti. Je li Bitcoin imovina ili valuta? Jesmo li mi samo učesnici u Ponzi šemi i HODL-amo u nadi da će drugi ljudi u budućnosti to još više cijeniti kako bismo mogli profitirati? Ili ga koristimo kao valutu umjesto fiata? Kako može biti i jedno i drugo u isto vrijeme? Ima li digitalno "vlasništvo" non-fungible tokena zaista ikakvu stvarnu vrijednost ili je sve to samo subjektivno? Je li to išta drugačije od toga kako se vrednuju materijalni kolekcionarski predmeti? Mislim da kripto još uvijek nije neovisan finansijski sustav. Čak i uz rast kriptovaluta i blockchaina u posljednjih 10+ godina, još uvijek se sve to čini nevjerojatno rizičnim i spekulativnim.


9. Najbolji Bitcoin i kripto novčanici i softveri su open-source. Jesi li ikada istraživao neke od najpopularnijih novčanika, poput Bitcoin Core-a ili Electrum-a?

Joe: Nisam pregledao kodne baze open-source softverskih novčanika, ali sam čitao kodne baze open-source hardverskih novčanika tražeći potencijalne ranjivosti koje mogu iskoristiti preko hardverskih napada. Open-source platforme olakšavaju pažljivo provjeravanje koda, ali to ne znači nužno da su sigurnije jer smo vidjeli mnoge primjere sigurnosnih propusta u open-source programima. Uz sve rečeno, lično ne bih vjerovao niti koristio bilo šta što je povezano sa kriptovalutoma a da nije open-source, posebno zbog rizika od virusa i prevara. Ja sam veliki zagovornik open-source projekata i većinu svog rada činim dostupnim na taj način – ne nužno zbog sigurnosti, već kako bih omogućio drugim ljudima da ih provjere, da ih nadograđuju ili da uzmu nešto što je njima korisno i ugrade to u svoje vlastite projekte.


10. Koristiš li ti Bitcoin?

Joe: Ne baš. Jedva da imam išta od kriptovaluta. Jednostavno nemam želudac za to, pogotovo zato što radim za sebe i nikad ne znam odakle će doći moja sljedeća plata. Još 2010. godine moja žena mi je predložila da kupim Bitcoin jer su ga svi moji prijatelji kupovali, ali nisam želio uložiti svoj novac u to i izgubiti ga. Ali, naravno, trebao sam je poslušati.


11. Šta nam možeš reći o secure element čipovima u hardverskim novčanicima? Ledger novčanici, na primjer, imaju secure element, ali su ti čipovi closed-source. Bitcoin zajednica je generalno zabrinuta u vezi svega što je closed-source. Koje opasnosti vidiš u closed-source softveru i hardveru? Jesmo li zabrinuti sa razlogom? Jesi li ikada pokušao hakirati secure element čip?

Joe: Kada radite sa nečim što je closed-source, vi zapravo imate posla sa crnom kutijom. Vi ne znate šta imate u rukama. I dalje možemo izvršiti reverse-engineering na closed-source sustavima ali za to je potrebno više truda. Ljudi koji podržavaju closed-source projekte reći će da se neprijateljima open-source-a olakšava pregledanje koda ili hardvera radi pronalaženja ranjivosti, ali to također znači da čim neko pronađe problem i progovori o njemu, svi drugi to odmah mogu potvrditi i implementirati metode kako bi se zaštitili. To se može učiniti neovisno o proizvođaču, gdje bismo inače čekali da oni "učine pravu stvar" i riješe probleme umjesto nas.

Što se tiče Ledger-a, oni imaju closed-source proizvod. Oni koriste sigurnosni element za kojeg možete dobiti dokumentaciju samo ako potpišete ugovor o povjerljivosti sa dobavljačem čipova a tu "privilegiju" imaju samo odabrani kupci. Iako je secure elements čipove znatno teže hakirati od mikrokontrolera za opću namjenu, jedini način na koji se njihova sigurnost može testirati ili provjeriti je od strane onih koji imaju pristup skupoj i specijaliziranoj opremi, što ograničava broj ljudi koji zapravo to mogu učiniti.

U stvarnosti, i open-source i closed-source hardverski dizajni mogu imati velike nedostatke koji bi mogli potkopati sigurnost ili integritet cijelog proizvoda. Jednostavno možda nećemo saznati za njih dok neko ne odluči izaći u javnost s tom informacijom. Ako su vezani ugovorom o povjerljivosti, to se možda nikada neće ni dogoditi.


12. Ti radiš samostalno. Moglo bi se reći da si freelancer. Jesi li ikada radio za neku veliku tvrtku ili razmišljao o takvoj karijeri?

Joe: Nakon što sam završio fakultet 1997., radio sam kao inžinjer dizajna za kompaniju koja se zove Continuum i koja se bavi razvojem proizvoda. Tu sam naučio kako pravilno dizajnirati elektroničke sustave i kako ih odvesti od prototipa do masovne proizvodnje. U to vrijeme su imali oko 100 ljudi. 2000. godine napustio sam Continuum kako bih pokrenuo @stake sa momcima iz L0phta. To je jedna od prvih konzultantskih kompanija za računarksu sigurnost. Osamostalio sam se krajem 2002. godine i nikad se nisam pokajao. Uvijek sam imao problema sa ljudima koji su mi govorili šta treba da radim i prilično sam siguran da ne bih mogao dugo izdržati u nekoj velikoj kompaniji.


13. Kako danas očuvati privatnost i ostati anoniman na internetu sa svom ovom tehnologijom oko nas?

Joe: Moja glavna briga ovih dana je kako se moji podaci, povijest internet preglednika, upiti za pretraživanje itd. prikupljaju, koriste i prodaju. Zgrožen sam količinom reklama koje nam se stalno guraju pod nos. Glavni alati koje ja koristim su blokeri za pračenje i oglašavanje kao što su Adblock Plus, uBlock Origin i Ghostery. Koristim Little Snitch za monitoring ili blokiranje dolaznih i odlaznih konekcija za određene aplikacije. Koristim ili VPN ili Tor Browser kako bih zaštitio svoju privatnost na internetu. Također bih toplo preporučio da se pretplatite na Crypto-Gram newsletter Bruce-a Schneier-a kako biste bili u toku sa informacijama o sigurnosti i privatnosti.


14. Koji je tvoj najveći uspjeh u hakerinju, a šta ti je najveći neuspjeh?

Joe: Moj najveći uspjeh je to što mogu imati karijeru hakera i što mogu dijeliti ono što volim s drugim ljudima. Nisam nikada očekivao da će se to dogoditi i iznimno sam zahvalan što imam ovu priliku. Potrebno je puno samokontrole i motivacije da ostanete fokusirani, ali ja i ne bih želio da bude drugačije.

Ponekad razmišljam o stvarima koje sam mogao učiniti drugačije ili o greškama koje sam napravio, ali umjesto da na to gledam kao na svoje neuspjehe, na njih gledam kao na priliku za učenje ili razvoj. Da se bilo šta u mojoj prošlosti dogodilo drugačije, možda ne bih završio ovdje gdje sam sada. Dakle, stvarno ne žalim ni za čim.




Za više informacija o Joe-u:
- Zvanična web stranica i projekti: https://www.grandideastudio.com
- Usluge hakiranja novčanika i oporavka kriptovaluta: https://www.offspec.io
- YouTube: https://www.youtube.com/@JoeGrand
- Mastodon: https://chaos.social/@joegrand
- Službeni Discord server Joe Grand-a: https://discord.gg/wud8KnF2Gm

Joe ne koristi nijedne druge društvene mreže, stoga se čuvajte imitatora i prevaranata.

Izvori korišteni za ovu temu su 1. i 2. Live AMA Joe Grand-a, naš Zoom razgovor i dio teksta koje je napisao sam Joe.

[The Interview]

Ever since the Trezor hacking video was released, I wanted to talk with Joe “Kingpin” Grand – the man himself. So, I reached out to him and asked if he was interested in doing an interview that would be posted on the Bitcointalk forum? He liked the idea, and the piece is now done after some back-and-forth.

For those who don’t know who Joe is, let me first introduce you to him.

Joe Grand has been a hacker since 1982 when he was just a 7-year-old kid. His older brother owned an Atari 400 computer and used it to collect video games. Joe was immediately drawn to technology and spent every day before and after school with the computer. He was interested in finding different ways to trade games with other people, and that’s how his story began. Eventually, he figured out how to make free phone calls and connect to bulletin board systems further away from him so he could get more games.

Joe soon realized that there were people trading things other than just video games. They possessed information about accessing various computer systems. They knew other methods of making free phone calls or creating party lines and teleconferences where multiple people could gather and talk on the phone. For Joe, it became a quest to possess information that other kids didn’t have.

Joe was arrested when he was 16 for breaking into a telephone company to steal equipment. Luckily, he was underage and didn’t end up in jail. Joe wanted to learn but realized that breaking the law wasn’t the right way to do it. Following that incident, he joined a hacking group called L0pht Heavy Industries that consisted of hackers who became his mentors.

The members of this group would hack their own setups to find vulnerabilities and contact the vendors about the problems (mostly Microsoft at the time). The L0pht taught Joe the importance of sharing information and doing good things to spread positive messages about hacking. In 1998, Joe testified before the US Congress together with other members of the L0pht about the state of computer security in government and how bad security was with the relatively new "Internet." That’s when the general public realized that hackers can be good and are worth working with.

Since the end of 2002, Joe has been working on his own, creating projects, speaking, teaching, and occasionally making videos about engineering and hacking.

The Interview

The interview was conducted in several ways and stages. I initially sent a list of questions to Joe via email. He answered some of those in his live YouTube AMAs (links provided below). The ones that weren’t covered that way were discussed on a Zoom call. Joe then edited the transcribed answers for clarity and to bring them up-to-date.
 

1. How does it feel to be a hacker? How do people who know what you can do look at you? Do they see a tech wizard or a villain?

Joe: Being a hacker is all I have ever known and all I have ever done. I'm curious and like to learn new things, especially things that aren't common knowledge. When I mention I'm a hacker, most people think I do something illegal. Even my wife initially thought so. But that's not the case - hacking can be used for good or evil just like anything else in life. I help people by discovering security problems and making vendors aware of those problems so they can be fixed. I help people by teaching what I know so they can defend themselves or make their products better. I guess it depends on the person; some see me as a villain, others as a "tech wizard."


2. You talk about a path change in your Live AMA and how getting arrested at 16 led you to stop delinquent hacking activities. Becoming a member of the L0pht made you better. What do you think would have happened if you had never met those guys? Do you believe your hacking could have resulted in serious prison time and a life of crime?

Joe: The members of the L0pht took me under their wing after I had gotten in trouble. It was a life-changing experience and a real turning point. All the other guys were older than me and seemed so responsible. I looked up to them and sort of mimicked their behavior. My parents let me go to the L0pht, which was a physical hacker space in my home town of Boston, Massachusetts, because they knew I was passionate about hacking and that the L0pht was a positive outlet for that. If I hadn't gotten arrested as a kid, I know for a fact that I would have kept causing trouble and could have ended up in jail.


3. After hacking the Trezor One, have you attempted other attacks against some other hardware wallet manufacturers? Can we expect something similar in the future? Are you maybe working on something as we speak?

Joe: Yes, we've been working on other wallet hacking projects, both hardware and software. We released another video in June 2022 (the Samsung Galaxy hack), but most of the wallet hacking we're doing isn't being filmed.

Software hacking is a well-defined problem, particularly for password cracking. The limitations of computing power and the strength of cryptography are known factors. It's unlikely that you'll lose someone’s crypto if you are cracking their wallet password or otherwise exploiting a software wallet. You either get access to the coins, or you don’t.

But hardware is different. Even with the attacks that are known, they're often unpredictable and not as reliable as the software side of things. The risk of losing access to the crypto is much higher - usually caused by accidentally wiping the memory or triggering some security countermeasure during an attack. It takes a lot of time to research to even get to the point where you can perform the attack on a particular hardware wallet. Then the attack still has to be successful in a way that you can obtain the private key, recovery seed, or other data you're targeting. There's also the issue of if the person actually had the crypto they thought they did. So we have to be more careful about what hardware hacking projects we take on.


4. I have been on Bitcointalk for several years and have seen threads where people have lost access to their crypto. Misplaced seeds, broken hard drives, forgotten PINs and passwords, etc. Have you ever thought about browsing this forum and searching for threads like that where both you and the other party could benefit from recovering the coins?

Joe: I actually wasn’t aware of Bitcointalk until you emailed me. I hadn’t been paying much attention to the cryptocurrency world until I hacked the Trezor wallet. I knew there was a community of crypto enthusiasts, but I didn’t realize there was such an active forum specifically for that. I never thought about searching threads on the forum - it's not really my style and I'd feel like an ambulance-chaser. It feels a lot more natural when people come to us instead of us reaching out to them. If someone offers unsolicited help in the cryptocurrency world, you definitely need to be careful and pay attention to who you're dealing with.

When looking for help in recovering your cryptocurrency, it's really important to make sure you're talking to the real person and not a scammer. There are Joe Grand impersonators on social media (especially Instagram, but also TikTok, Twitter, etc.) offering to help people and taking money upfront, and I usually don't hear about it until someone has gotten scammed by them. As soon as one impersonation account gets shut down, another pops up. I'm not a hard person to find - contacting me through my website is the best, most trusted way to know you're actually talking to me and not someone pretending to be me.


5. What can you tell us about offspec.io? How could your company help someone from Bitcointalk, for example?

Joe: offspec.io is a small team that we put together as a result of my hacking the Trezor wallet. While I was working on that project, my wife told me I should make a video about it because most of the videos I make are engineering-focused and "People need to see that you're still a hacker." I reached out to a friend of mine who is a filmmaker and we decided to film it. After successfully opening the wallet, my friend said this should become a business. And he was right - there are so many people that need help.

I'm primarily the hardware hacker and the one most people recognize because of our videos, but we also have some software folks that specialize in forensic analysis and password cracking and a few others that handle the business side and communicating with the customers.

Since the first video came out, we've received hundreds and hundreds of emails from various people with different problems. We help the ones we can, but unfortunately many of the people have been scammed in some way - either sending cryptocurrency to fake exchanges or investing in some fake coin, etc. We're not able to help people who have been scammed - the nature of cryptocurrency makes it unlikely to recover the funds in a legal manner without the help of law enforcement, which is also unlikely to happen.

Regardless of how people are locked out of their cryptocurrency, they need to know they're not alone. They shouldn't feel "stupid" for forgetting their password, losing a piece of paper with their recovery seed, or being scammed. It's all a matter of being human and these things happen to many of us.


6.What future do you see for the company, and where do you want it to be in 5 or 10 years?

Joe: We don’t have a plan. Whatever happens, happens. I would like to make more videos that combine the technical elements of cryptocurrency recovery with the personal side of the people who need help. And, of course, to keep helping people while it remains something we enjoy doing. Hacking wallets isn't our primary focus in life. It’s just a service we offer to try and help people free their coins.


7. Your focus is on hardware, but I assume you know more about software than the average Joe (pun intended). Am I right?

Joe: I'm a computer engineer by trade, so my focus is primarily on hardware, but I do have formal coding experience and I'm dangerous enough with software for what I need to do. I mostly write code for hardware projects I create, usually in either C or assembly, and for controlling hardware tools used for hacking, like writing Python to interface with the ChipWhisperer to perform fault injection or power analysis. I'm a decent coder, but I wouldn’t call myself a programmer by any means.


8. What is your honest opinion about cryptocurrencies, especially Bitcoin? It’s an open-source protocol. Have you ever inspected the codebase looking for vulnerabilities or to see how Satoshi and the other developers created the asset we have today?

Joe: I think there are some interesting elements of cryptocurrency and blockchain technologies that could actually have a practical purpose. The concept of digital currencies and decentralized finance among other things sound great and there are some legitimate, intelligent projects, but the number of scams, shitcoins, rug pulls, etc. are making it difficult for mainstream adoption and confidence. There are still many outstanding questions in how these technologies should be used. Is Bitcoin an asset or a currency? Are we are participants in a Ponzi scheme, HODLing in the hopes that other people in the future will value it higher so we can profit? Or, are we using it as currency instead of fiat? How can it be both at the same time? Does digital "ownership" of a non-fungible token really have any definable value or is it all just subjective? Is that any different than how physical collectables are valued? I don’t think crypto is an independent financial system yet. Even with the growth of cryptocurrency and blockchain in the past 10+ years, it still seems incredibly risky and speculative.


9. The best Bitcoin and crypto wallets and software are open-source. Have you ever looked into some of the most popular wallets, like Bitcoin Core or Electrum?

Joe: I haven't done any code reviews of open-source software wallets, but I've read through the code of open-source hardware wallets looking for potential vulnerabilities that I can exploit through hardware attacks. Open-source platforms make it easier to scrutinize the code, but it doesn't necessarily mean they're more secure, as we've seen plenty of examples of security vulnerabilities in open-source packages. With that said, I wouldn't personally trust or use anything cryptocurrency-related that isn't open-source, especially because of the risk of malware and scams. I'm a huge proponent of open-source projects and release most of my work this way - not necessarily for security but to allow people to look under the hood, to build upon it, or take a piece that's useful and put it into their own projects.


10. Do you use Bitcoin personally?

Joe: Not really. I barely hold any cryptocurrencies. I just don’t have the stomach for it, especially because I work for myself and never know where my next paycheck will come from. Back in 2010, my wife suggested that I should buy Bitcoin because all my friends were buying it, but I didn’t want to put my money into it and lose it. Of course, I should have listened to her.    


11. What can you tell us about secure elements in hardware wallets? Ledger wallets, for example, have secure elements, but those chips are closed-source. The Bitcoin community is generally worried about anything closed-source. What dangers do you see in closed-source software and hardware? Are we concerned for a reason? Have you ever attempted to hack a secure element?

Joe: When you're dealing with something closed-source, you're dealing with a black box. You don’t really know what you are getting. We can still reverse engineer closed-source systems, but it usually takes more effort. People who support closed-source projects will say that open-source makes it easier for adversaries to look at the code or hardware and find vulnerabilities, but it also means that as soon as somebody finds a problem and talks about it, everyone else can verify that right away and implement methods to protect themselves. This can be done independently of the product creator, vendor, etc. where otherwise we'd be waiting for them to "do the right thing" and fix the problems for us.

As for Ledger, they have a closed-source product. They use a secure element that you can only get documentation for if you sign a confidentiality agreement with the chip vendor, and that "privilege" is only given to select customers. While secure elements tend to be significantly more difficult to hack than a general-purpose microcontroller, the only way that their security can be tested or validated is by those with access to expensive, specialized equipment which limits the number of people that can actually do it.

In reality, both open-source and closed-source hardware designs can have fundamental flaws that could undermine the security or integrity of the entire product. We just might not know about them until someone decides to go public with that information. If they're bound by a confidentiality agreement, then that might never happen.


12. You work independently. One might say you are a freelancer. Have you ever worked for a big company or considered such a career path?

Joe: After graduating from college in 1997, I worked as an electrical engineer for Continuum, a product development company. That’s where I learned how to properly design electronic systems and how to bring them from prototype to mass production. At the time, they had about 100 people. In 2000, I left Continuum to start @stake, one of the first computer security consulting companies, with the guys from the L0pht. I went independent at the end of 2002 and never looked back. I've always had a hard time with people telling me what to do and I'm pretty sure I wouldn't be able to last very long at a large company. 


13. How does one maintain privacy and remain anonymous online today with all the technology around us?

Joe: My main concern these days is with how my data, browsing history, search queries, etc. is being collected, used, and sold. I'm also disgusted by the amount of advertising that's constantly being shoved in our faces. The main tools I use are advertising/tracker blockers like Adblock Plus, uBlock Origin, and Ghostery. I use Little Snitch to monitor or block incoming and outgoing connections from certain applications. I use either a VPN or the Tor Browser to help protect my privacy online. I'd also highly recommend subscribing to Bruce Schneier's Crypto-Gram newsletter to keep up-to-date on security and privacy matters.   


14. What would you say is your biggest hacking success story, and what is your biggest failure?

Joe: My biggest success is being able to have a career as a hacker and share what I love with other people. I never expected that to happen and I'm extremely grateful that I have this opportunity. It takes a lot of self-control and drive to stay focused, but I wouldn't want it any other way.

I sometimes reflect back on things I could have done differently or mistakes I've made, but instead of looking at those like failures, I look at them as opportunities to learn or grow. If anything in my past had happened differently, I might not have ended up where I am now. So, I don't really have any regrets.




For more information about Joe:
-   Main website and projects: https://www.grandideastudio.com
-   Wallet hacking and cryptocurrency recovery services: https://www.offspec.io
-   YouTube: https://www.youtube.com/@JoeGrand
-   Mastodon: https://chaos.social/@joegrand
-   Joe Grand's official Discord server: https://discord.gg/wud8KnF2Gm

Joe does not use any other social media platforms, so beware of impersonators and scammers.

Sources used for this thread are Joe Grand’s 1st and 2nd Live AMA, our Zoom talk, and words written directly by Joe.

This is an experiment to see if hardware wallet manufacturers and their 3rd-party newsletter partners will leak customer’s email data. It will be a long-term experiment that began a few days ago. I want to see how safe my email information is with some of the most popular hardware wallet vendors. We all remember the data leaks of Ledger and Trezor. Still, there are also suspicions that popular brands could be sharing or selling data to their 3rd-party partners.

To check that, I have done the following things:

•   I have created brand-new email addresses for each hardware wallet manufacturer.
•   Each email was used to subscribe to that brand’s newsletter (if there is one) and to contact the support team with a random question.
•   I will keep checking the accounts in the following months to see if any spam or 3rd-party emails were received.

Since the email accounts have not and will not be used for anything else, any spam, promotions, or offers I get can only result from the company’s misuse of my data. The goal is to see how safe it is to provide hardware wallet developers with sensitive information and how much of it (if any) will find its way to other places.

The following hardware wallet brands are being tested:

•   BitBox
•   Blockstream Jade
•   ColdCard
•   Foundation
•   KeepKey
•   Keystone
•   Ledger
•   OneKey
•   SafePal
•   Satochip
•   Trezor

I will try to update this thread with the latest information after 1, 3, and 6 months of waiting.

After that, the experiment ends. What do you think? Will I get any spam emails, and who is the likely culprit causing it? Many email providers delete messages classified as spam that end up in spam folders after 10 or 30 days, for example, so I will try to log in to the various places to check if there is anything new there.

[10% discount]

Ledger just started a new promo campaign offering a 10% discount on all purchases in their official shop. This offer is only available for the next 48 hours.
You need to apply the promo code NYKNYC during checkout to take advantage of it.

The second piece of news is the integration of the Binance exchange within Ledger Live. The accompanying blog post in the tweet is several months old, so I am unsure when Binance was officially integrated. Regardless, the partnership allows users to trade on Binance through the Ledger Live software. KYC is required, and I am sure Ledger earns a fee on each completed trade. You will surely get better rates using Binance directly if that's what you want. 

[2.0.6]

I have noticed there hasn't been an update to the Bitcoin app on my Ledger Nano S for quite some time. There usually is one, at least once or twice every couple of months.
We know that Ledger no longer sells the Nano S in their official shop, and it will not be manufactured any longer, either. But have they stopped releasing updates to the crypto apps that you can install through the Ledger Live Manager as well?

I don't know if the app version is the same or different depending on which hardware wallet you own.
The current version of my Bitcoin app for Nano S is 2.0.6.

A question for those using a Nano X or Nano S Plus: What is the newest version available for the Bitcoin app on your device?

I will contact their customer support if the app versions prove to be different. Some features may only be available on the Nano X or Nano S Plus because of its bigger internal memory, compared to the Nano S. So, it's not unusual per se. I would still like to know if future updates will be released for the Nano S as well or if it's time to consider an alternative. 

[15% discount]

New 15% discount!

Trezor currently has a new promotion, and to celebrate it, they are offering a 15% discount on Trezor One and Model T hardware wallets. This promotion will be valid until 8 November 2022.
So, if you are in the EU, the Trezor One will now cost you around €70, while Trezor T is approximately €220.

The reason for this is the introduction of Dollar-cost averaging (DCA) in Trezor Suite. Their term for it is Bitcoin savings account. Most already know that using the DCA investment strategy means buying a fixed USD/EUR amount of an asset at a fixed time. That can be once a week/month/year, etc.

Source: https://blog.trezor.io/save-bitcoin-with-dca-in-trezor-suite-6ce8f6a2ce75    

[Bitcoincleanup.com]

In a world increasingly worried about climate change and its effects on our planet, everything our leaders deem unwanted could be in trouble. We have heard numerous stories about how much energy Bitcoin uses. Those against Bitcoin often say that it requires more energy than whole countries.

But Bitcoin’s Proof-Of-Work consensus algorithm relies on that power to keep the blockchain safe. This will not be a discussion about PoW, its advantages, or disadvantages. It will also not be about how much renewable and clean energy is used in mining bitcoin already.

This is about why Bitcoin is scrutinized while other industries aren’t? For example, a report from 2019 shows that electronic devices on standby in the United States alone consume more electricity than the whole Bitcoin network would in over 3 years. Yet, nobody is talking about their impact on our environment.

If you want to read more about this, Bitcoin’s use of clean energy, PoW, and myths about Bitcoin’s energy consumption, check out Bitcoincleanup.com.  


Soon after US President Joseph Biden took office, he signed Executive Order 14067 - Ensuring Responsible Development of Digital Assets. This document mentions words like “environment,” “environmental impact,” “pollution,” “climate change,” “climate impact,” and similar terms dozens of times.

Both the EU and the US are discussing new crypto regulations. One of their agendas is, again, the crypto economy's impact on the environment. Let’s not talk about how the actual goal is to further restrict their citizens from using unregulated and decentralized assets they can’t control or adequately tax through their institutions and puppets in suits.

With all this in mind, what do you think will be the future of PoW and Bitcoin mining?

1.   Do you think it will be banned entirely after scaring people with climate change concerns?  
2.   Will they find ways to make it harder to mine Bitcoin? More regulation, bigger taxes, regular inspections, overly complicated paperwork, and heavy fines for not complying with CO2 emissions are some of the ways they could penalize entities involved with PoW mining.
3.   Do you think the world governments could incentivize those still mining with fossil fuels to transition to clean energy?
4.   Or will all this calm down one day, Bitcoin and its POW will be left alone, and world leaders will focus on other, more important things?

Please vote in the poll and share your thoughts and ideas below.

Trezor has launched a new version of its official website - https://trezor.io/.
It looks very slick if you ask me. The thing I feel is missing is a dark mode. I just hate looking at all the white.

- I am not sure if the old Trezor website posted information about the number of sold hardware wallets. But the new site states that Trezor has over 1 million customers. The Model T was sold over 300.000 times, but the clear winner is Model One with over 750.000 units sold.

- According to their blog announcement, the Knowledgebase section is also new. It helps you get started with your hardware wallet, you can learn about Bitcoin, the Trezor Suite, security, privacy, etc.  

- A new version of the Trezor Suite was also released today. Version 22.10.2. This comes in preparation for the CoinJoin feature that will be introduced in the future. The other change is a new tag next to multisig and transactions signed by multiple parties. They are now labelled in the Trezor Suite as Joint BTC transactions.  


More info is available here:
https://blog.trezor.io/new-trezor-website-and-trezor-suite-update-october-66788fedf4f3

Source

Crypto casinos used to be places where it was possible to bet on sports and play casino games without undergoing KYC and identity verification. Players were allowed to preserve their privacy but still partake in gambling. But things aren’t always as they seem.

These platforms often advertise themselves as NO KYC, but are they really?

We are at a point where KYC requirements are being abused. Those active in the scam accusations board can probably remember many cases where players have complained about unexpected requests to verify their identities. This wouldn’t be a problem if the rules were explained and honored from the beginning.

What is happening with KYC that is so troublesome?

When you open a betting account, most casinos won’t ask you who you are.
When you want to deposit cryptocurrencies, you’re welcome to do so.
If you want to bet and play games, there usually aren’t any problems.
If you lose your coins and you wish to deposit more, no one asks you anything.
No one is called a cheater or a rule breaker when they are losing. There are no TOS infringements, either.

But if you start winning and win big, you soon become the center of attention. All of a sudden, it becomes important who you are, where you are from, the origin of your coins, and whether you have any ulterior motives for being here.

I believe many problems and misunderstandings wouldn’t happen if crypto casinos were transparent and upfront with their players from the start.

You wouldn’t be banned because you were gambling from a restricted location only after you win. That is if the casino had checked this and informed you that you aren’t allowed to gamble there the moment you tried to register. Your withdrawal request wouldn’t have been rejected because you are underage if the casino verified your legal age during your first deposit or before that.

The way the system is set up now, you are welcome to deposit and lose, but please don’t win. Because if you do, you could be thoroughly investigated.

My question to the Bitcointalk community is this one: if it were up to you, would you keep the current status quo and have crypto casinos brand themselves as no KYC, only to ask for identity verification during withdrawal requests or big wins, or would you rather be required to complete KYC during the registration process and decide there and then whether you want to do that or not?

Please submit your votes in the poll, and share your thoughts below.

Ledger started a one-week discount campaign where you can get free shipping on your Nano S Plus or Nano X purchases starting today.
The offer is valid until 17 October and doesn't require the entry of a discount code during checkout.  
Halloween is coming up and maybe there will be other promotions and discounts from hardware wallet manufacturers. Due to the current state of the economy and the everlasting chip shortage, I doubt we will see big discounts. Offers such as free shipping or free accessories might be the best they can offer for now.  

Neki od vas su vjerovatno već čuli za NotATether-ovu inicijativu Bitcoincleanup.com ili vidjeli odgovarajuću temu u Bitcoin Discussion forumu. Za one koje nisu, riječ je o pokušaju da se zaustavi širenje neistina i poluistina o Bitcoinovom utrošku električne energije, štetnosti rudarenja PoW kriptovaluta, i pokušaju zabrane PoW modela bez kojeg je Bitcoin za sada nezamisliv.

Greenpeace pokušava da nametne i natjera Bitcoin da pređe na PoS. Greenpeace i njima slični "okolišno osviješteni" pojedinci lobiraju kod Američke vlade da se zabrani PoW. Dakle ovdje nije riječ o problemu koji se tiče prljavih izvora energije gde ekolozi žele da se takvi izvori ne koriste. Ovdje se udara na PoW model koji sve ove godine uspješno osigurava Bitcoin mrežu.


Ako neko ima volje i vremena, neka se uključi u akciju.

- U međuvremenu je pokrenuta i besplatna signature kampanja tako da oni koji nisu u plaćenim kampanjama mogu da pokažu svoju podršku i stave odgovarajući potpis, avatar, ili osobni tekst. Evo link od signature kampanje.
- Ako koristite društvene mreže, napišite neki post/tweet i podržite projekt. Koristite hashtagove #EcoFriendlyPoW i #EndTheFUD.
- Javite se prijatejima Bitcoina, YouTube zvijezdama, stranicama koje pišu kripto vijesti i pitajte ih žele li pomoći. Obavjestite ih o stranici.
- Da li imate svoju web stranicu, radio emisiju, TV emisiju, online publikaciju, YouTube kanal, ili bilo šta drugo što može pomoći? Razgovarajte o bitcoincleanup.com i o onome što se događa.
- Mogu se napisati i pisma saborksim zastupnicima gdje im se može objasniti šta je zapravo PoW. NotATether je već pripremio primjere takvih pisama koji se mogu prevesti, malo prilagoditi i uputiti saboru.

Za više informacija posjetite:
https://bitcoincleanup.com/
Bitcoincleanup.com: a website to stop Greenpeace's bitcoin FUD

Not that long ago, I researched the TOS agreements and Privacy Policies of some of the most popular hardware wallet manufacturers. Trezor was one of them.

I noticed the following sentences in their TOS, which got me curious:

You may at any time after your Device initialization create a recovery seed – a chain of randomly selected words. Recovery seed enables you to recover the information stored on your Device. Without a recovery seed, you may not recover information stored in your Device and your wallet and your cryptocurrency coins stored in the wallet may be lost forever.

Source: https://data.trezor.io/legal/wallet-terms.pdf


That sounded like you could start using a Trezor HW and skip the seed verification process. We know that this is dangerous, provides a false sense of security, and can lead to losing your coins.

Here are just a few examples of what has happened in the past with the Coinbase wallet because people didn’t write down their seed phrases:

Coinbase Wallet - Is my $ lost because I pressed this one button (dangerous)?
Coinbase Wallet: Re-set Face ID, recovery phrase not saved
Didn’t store 12 word phrase for coinbase wallet

Since I don’t own a Trezor, I wasn’t sure how the initial setup works. In that TOS/Privacy Policy thread, dkbit98 posted a YouTube video of a guy setting up his wallet. This is the video: https://www.youtube.com/watch?v=qvvzJ8EHh5U. If you check the screen at 5:30, when the guy explains the seed creation process, you will notice a button in Trezor Suite that allows you to skip backing up the seed. 

Here it is:



Since I wanted clarification from an official source, I emailed Trezor’s customer service, and they confirmed it is indeed possible to skip the seed backup and verification altogether.



I hope no one has ever lost money because they were lazy to back up their seed, and I hope no one ever will. But I would be happier if the option to skip backups wasn’t there at all. Coinbase is one thing, but Trezor could do better.

[Please note]

Please note: This is a free community project. It doesn't involve money and making a profit. It concerns all of us because Bitcoin's PoW is under attack. I am not officially involved with the project or site, and I have no stake or interest in it.

This thread is self-moderated to prevent anti-Bitcoin and anti-PoW FUD and spam.
As the subject says, I am looking for social media influencers and those with significant friends/followers counts. The idea is to promote https://bitcoincleanup.com/ and the truth about PoW. As NotATether said on his site: "It's time for us to rise up and defend our currency from external threats".

- There are no rules, there is no campaign manager, and no one will be checking what you do. Do anything you believe can benefit the cause. Our cause because there is no Bitcoin without PoW.
- Participation is free, and everything you do is voluntary.
- It doesn't matter how many friends or followers you have or on what social media you are, as long as you want to help.
- You don't have to report your activities if you don't want to. A separate campaign thread might be created in the future.   


How Can I Help?

Some Bitcointalk members have started wearing the Bitcoincleanup.com avatar and a personal text. You can do that as well if you want. Click here for more info. A signature is coming soon that you can wear.

- Post, tweet, and talk about the project on social media. Get your friends and Bitcoin enthusiasts involved as well.
- Share the hashtags #EcoFriendlyPoW and #EndTheFUD.
- Contact Bitcoin advocates, YouTube stars, crypto news sites, etc. and ask them if they want to help.
- You can write to your MP, senators, or members of Congress and explain to them what PoW really is. Prepared letter templates can be found on the official website.     
- Do you have a website, radio show, TV show, online publication, YouTube channel, or anything else that can help? Talk about bitcoincleanup.com and its message.

More information about the project:
https://bitcoincleanup.com/
Bitcoincleanup.com: a website to stop Greenpeace's bitcoin FUD

Related threads and discussions:
Would you be interested in promoting Bitcoin projects/services for free?
Forum advertising space for free signature/avatar advertisement

[Brand]

Several hardware wallet manufacturers have suffered hacks and data leaks in the past. This trend might not stop, and I think we will also read similar stories in the future.

That’s why I decided to check with the most popular hardware wallet creators if they support shipping to PO boxes and payments with cryptocurrencies. I sent emails to their support to ensure I got the correct information.

You can check out the results in the table below:

|	Brand	|	Shipping to PO Boxes?	|	Payments via Crypto?	|
|	BitBox	|	Yes, depends on country and courier.	|	Yes, BTC and LBTC via Crpyto.com Pay and BTCPay Server.	|
|	Blockstream Jade	|	Yes	|	Yes, BTC, LBTC, and USDt via BTCPay Server.	|
|	Coldcard	|	Yes	|	Yes, BTC.	|
|	Foundation Passport	|	Yes	|	Yes, BTC via BTCPay Server.	|
|	KeepKey	|	*Unknown	|	No	|
|	Keystone	|	No	|	Yes, via Coinbase Commerce and OpenNode.	|
|	Ledger	|	Yes, via regular mail. Not supported in USA.	|	Yes, via BitPay and Crypto.com Pay.	|
|	OneKey	|	Yes	|	Yes, via Coinbase Commerce and MixPay.	|
|	SafePal	|	No	|	Yes, via SafePal Pay.	|
|	Satochip	|	Yes	|	Yes, via Coinbase Commerce.	|
|	Trezor	|	Yes	|	Yes, BTC and LTC via Confirmo.net.	|

* Support agents are unsure, don't have precise information, or info is not available on official sources.


11 hardware wallet manufacturers were contacted, and all of them replied back.

When it comes to shipping to PO boxes, these are the results:
-   7 companies support sending shipments to PO boxes. It’s important to mention that not all carriers will ship packages to PO boxes in all countries.
-   2 companies don’t ship to PO boxes.
-   The support personnel of Coldcard and KeepKey weren’t sure exactly and couldn’t provide me with the correct information.  

In terms of paying via crypto, all popular brands support crypto payments. It would be weird if they didn’t, but that wasn't the case a few years ago for some of them. KeepKey support told me they accept crypto payments, but I couldn’t find an option to pay with cryptocurrencies in their shop. Once I get more info, I will update the table and thread.


More brands can be added to OP. For now, I decided to focus on the most popular ones. If you want to see a particular wallet in the table, feel free to request it below, and I will try to add it.

[Trezor]

Trezor and Ledger are the two most popular brands in the hardware wallet niche. Both manufacturers have their positives and negatives, but what do their Terms of Service agreements and Privacy Policies say?

Yes, those boring lists of rules you are asked to accept and must follow to keep using a service. Since most people don’t like reading those, I have decided to take a look at the ones provided by both Trezor and Ledger and highlight some of the most interesting findings, be it good or bad. I will copy/paste parts of the TOSs and Privacy Policies and offer my views on the content.

Additionally, I find Foundation Devices very appealing, so I will also take a look at them.   

Let’s get straight to it and look at the Terms and Conditions.


Trezor

Trezor’s official website links to 3 different TOS documents:

Website Terms of Use
Trezor Shop Terms and Conditions
Trezor Suite Terms and Conditions


Website Terms of Use

We are not responsible for the content of any sites that may be linked to from the Website or any bulletin board or forum associated with us or the Website.

In addition, a link to any other website does not imply that we endorse or accept any responsibility for the content or use of such other website. In no event shall any reference to any third party or third-party product or service be construed as our approval or endorsement of that third party or of any product or service provided by a third party.

In other words, all content you find on Trezor’s website is there for informational purposes only. Trezor provides no guarantees about the quality, security, or accuracy of the information or the services.

Under no circumstances shall any information on the Website or provided to you by us constitute financial, investment or professional advice, unless explicitly stated so.

Just because a particular site, coin, or service is mentioned doesn’t mean Trezor is advertising or suggesting people should invest in it.

We are not obliged to fulfill any of our obligation under these Terms of Use, if temporarily or permanently prevented by vis maior - event or circumstance that is extraordinary, unforeseeable and unpreventable by usual means and with proper care, and that occurred independently of our will; such vis maior event is, among other things, a serious hacking attack or power shortage.

Vis major is described as “natural occurrences that cause damage and are neither caused nor preventable by humans.” Trezor considers a “serious hacking attack” (something caused by humans that can be prevented by proper security measures) as vis major. Trezor is not responsible for any issues caused by hacking incidents on the website.   


Trezor Shop Terms and Conditions

you are entitled to withdraw from the Contract within fifteen (15) days from the date on which you or a third party named by you who does not deliver the products has taken the possession of the products.

If you are unsatisfied with your Trezor HW, you can return it within 15 days of receiving it.

In order to qualify for a full refund, the products must be returned unused and sealed in the original packaging, with all the original materials provided in their complete condition.

You will only receive a full refund if the package wasn’t opened and the device wasn’t used.

We shall not be responsible for any incidental or consequential damages which are incurred and/or have occurred in connection with the product or its purchase. We assume no responsibility for any loss or costs due to a third party's or the customer's loss of profit, or any other indirect cost or losses, however incurred.

Trezor is not responsible for any losses you incur when using their devices. If you lose money for any reason, you can’t hold Trezor accountable.


The next part concerns returning defective products and who bears the cost for those.

The costs incurred in connection with returning the product to us and back to you shall be always borne by you. If we find out that the product was defective or damaged and the damage or defect is covered by the Liability for Defects and/or Commercial Warranty, you are entitled to a refund of the necessary shipping costs.

Whenever you return a device under warranty that is not working as it should, you have to pay for the shipping fees. After Trezor inspects the device, they will refund the shipping charges only if the damage is covered by the warranty agreement.

If we conclude within the product inspection that the returned product was not damaged or defective or that the damage or defect is not covered by the Liability for Defects and/or Commercial Warranty, the costs for returning the product to you shall be due in advance, before we send the product back. In such an event and at our sole discretion, we might offer you a discount on a new product purchase as compensation for not returning the item to you.

 

If Trezor concludes that the device is not broken or the damage is not covered by the warranty, the shipping costs will not be returned, and you have to pay additional shipping fees to ship the product back to you.


Trezor Suite Terms and Conditions

…we strongly recommend creating a recovery seed and setting up a PIN as described below to keep your cryptocurrency coins safe. If you continue using the Device with Suite without further protection and back up, we shall assume no liability for any damage incurred as a consequence thereof.

This is a warning to create a recovery seed and a PIN to keep your crypto safe. Personal opinion: knowing that Trezor has an unsolvable vulnerability that can be mitigated by extending the seed with a passphrase, it would be desirable that Trezor mention the importance of using a passphrase.

You may at any time after your Device initialization create a recovery seed – a chain of randomly selected words. Recovery seed enables you to recover the information stored on your Device. Without a recovery seed, you may not recover information stored in your Device and your wallet and your cryptocurrency coins stored in the wallet may be lost forever.

Is it possible to use a Trezor for receiving and sending coins without having previously created a seed? This part of their TOS makes it sound like it is. If so, it’s something I really don’t like. It reminds me of a case of a user who made a thread a few years ago in which he lost access to his coins because his Coinbase wallet allowed him to start using it before creating a recovery phrase.

We shall not under any circumstances be held liable to you for any direct, indirect, special, consequential, punitive or any other damages and costs including but not limited to loss of profit, loss of revenue, loss of business opportunity arising out of or in connection with your access and use or inability to access and use of Suite services.

Trezor is not responsible for any losses that might result from using Trezor Suite.

Under no circumstances shall any information within Suite and/or Website or provided to you by us constitute financial, investment or professional advice, unless explicitly stated so.

Nothing you see written, mentioned, or promoted in the Trezor Suite shall be considered a good investment.

You must not endeavor to abuse any respective cryptocurrency network including but not limited to sending the cryptocurrency coins to multiple addresses at once (double spending).

You are not allowed to double-spend transactions with the Trezor Suite. Probably not to others or yourself.


Ledger

Similarly to Trezor, Ledger also has 3 different Terms of Use on its official website:

Sales Terms and Conditions
Website Terms of Use
Ledger Live Terms of Use

Depending on the payment method used for the purchase, a service provider called Flow can be utilized. If that is the case, the following TOS will be in effect:

International Order Terms and Conditions When Flow is the Seller of the Goods


Sales Terms and Conditions

These terms are in effect when the purchase is made via Visa, Mastercard, American Express, Bitpay, and PayPal. If the customer uses any other payment method, Flow’s TOS applies.

In accordance with the provisions of Article L. 221-18 of the French Consumer Code, you have the right to withdraw from the contract within a period of fourteen (14) days without reason and without bearing any costs, except for the costs of returning the Product, if necessary. The aforementioned period runs from the day of receipt of the Product by you or by a third party, other than the carrier, designated by you.

If you are unsatisfied with your Ledger wallet, you have the right to return it within 14 days of it being delivered to you for any reason. You will get your money back, but you might be required to pay the return shipping costs.

The costs of return of the Product are at your own expense. You must return the Product in perfect condition in its original packaging.

You can even return a used device (since they don’t mention that the box can’t be opened) as long as it’s in perfect condition and in the original box.

We will reimburse you for all amounts received, including delivery charges, within fourteen (14) days from the date we were notified of your withdrawal decision, but we may defer the refund until we have received the Product.

This statement is a bit contradictory compared with the previous one above, which says “you have the right to withdraw from the contract within a period of fourteen (14) days without reason and without bearing any costs, except for the costs of returning the Product, if necessary". Here it’s said they will reimburse you for all costs, but apparently, that’s not always the case.

TO THE FULLEST EXTENT PERMITTED BY LAW, LEDGER DISCLAIMS ANY AND ALL LIABILITY FOR LOSS OF PROFITS, INCOME, VALUE OR DATA, OR INDIRECT, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES.

Ledger is not responsible for any losses you incur using their products. That includes the loss of customer data. I wonder if they added this “data” part to the TOS following their data leak fiasco!?

TO THE FULLEST EXTENT PERMITTED BY LAW, LEDGER’S TOTAL LIABILITY FOR ANY CLAIM ARISING FROM THESE TC’s, INCLUDING ANY IMPLIED WARRANTIES, IS LIMITED TO THE AMOUNT YOU PAID TO PURCHASE THE PRODUCT.

If I understood correctly, if you lose all your coins with a Ledger HW, the company is only liable to (maybe) compensate you for the amount you spent to purchase your hardware wallet.

YOU EXPRESSLY RELIEVE LEDGER, ITS AFFILIATES, AGENTS AND EMPLOYEES FROM ANY AND ALL LIABILITY AND GUARANTEE THEM AGAINST ANY CLAIM, PROCEEDINGS OR LEGAL ACTION ARISING FROM OR RELATED TO THE USE OF THE PRODUCTS OR FOLLOWING A BREACH OF THESE TC’s, INCLUDING ANY LIABILITY AND FINANCIAL CHARGE RESULTING FROM CLAIMS, LOSSES OR DAMAGES, PROCEEDINGS AND JUDGMENTS, AND LEGAL AND ATTORNEY’S FEES.

This again confirms that Ledger is not to be held responsible for any losses the customer incurs by using Ledger HWs.


Website Terms of Use

The information included on the Site does not constitute legal, financial or investment advice and is not intended as a recommendation for buying, trading or selling crypto assets. It is recommended to seek advice from legal and financial experts before starting buying, trading or selling crypto assets. Ledger SAS, Ledger Technologies Inc., and all other companies mentioned on the Site will not be responsible for the consequences of reliance upon any opinion or statement contained herein or for any omission.

Additionally:

Any loss of data, crypto assets or profit is your sole responsibility.

No information on the site shall be considered as a recommendation to invest in a particular asset, and Ledger is not responsible for the results of any such actions by the customers.


Ledger Live Terms of Use

No liability... For the avoidance of doubt, and notwithstanding the generality of the Limitation of Liability under these Terms, you hereby agree that Ledger shall have no liability for any loss that incurs as a consequence of the risks highlighted in this section and/or your failure to follow the recommendations herein.

Ledger is not responsible for any losses you incur while using Ledger Live.

Ledger may perform code reviews and conduct security audits of Device Applications available on Ledger Live Manager, which does not constitute any kind of endorsement nor any guarantee that those applications are risk-free. Ledger does not warranty that Device Applications will be maintained over time and reserves the right to restrict or suspend access to them from Ledger Live for any reason for as long as deemed necessary.

This refers more to 3rd-party applications. Ledger does not guarantee they are safe to use, and they have the right to suspend and remove them from the Ledger Live Manager if they see fit.

Ledger is not responsible for the content, accuracy, security, availability, any performance, or failure to perform of the Third Party Services or any issue in relation with the use of Third Party Services. Ledger does not provide any guarantees that access to Third Party Services will not be interrupted or that there will be no delays, failures, errors, omissions, corruption or loss of transmitted information, data or funds, and Ledger shall not be liable for any such Third Party Services. You agree to use the Third Party Services at your own risk. It is your responsibility to review the third party’s terms and policies before using a Third Party Service.

And:

To the extent you choose to use such Third Party Services, you acknowledge that Ledger is not responsible for any issue in relation with the use of such Third Party Services, including any loss of funds.

Ledger is neither responsible nor liable nor guarantees for the 3rd-party services they have partnered with in Ledger Live (swaps, NFTs, buying, selling, exchanging coins, staking, etc.). They should be used at your own risk. 


Regarding staking, Ledger Says:

No guarantee of Rewards. LEDGER DOES NOT GUARANTEE THAT YOU WILL RECEIVE STAKING REWARDS OR ANY STAKING REWARD RATES. SUCCESSFUL TRANSFER OF THE REWARDS IS SUBJECT TO THE PROOF-OF-STAKE NETWORKS AND IS NOT UNDER LEDGER’S CONTROL.

And:

No custody. Ledger will never take custody over any of your rewards or assets and Ledger has no responsibility or control over any Proof-of-Stake network on which Ledger may exercise validation rights delegated by you.

Ledger doesn't guarantee nor are they responsible for paying out staking rewards. Ledger also doesn't have custody of staked coins, nor can they take control of them.

YOU EXPRESSLY UNDERSTAND AND AGREE THAT LEDGER AND ITS DIRECTORS AND EMPLOYEES SHALL NOT BE LIABLE TO YOU FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR EXEMPLARY DAMAGES, INCLUDING, BUT NOT LIMITED TO, DAMAGES FOR LOSS OF PROFITS, GOODWILL, USE, DATA, COST OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR OTHER INTANGIBLE LOSSES…

Ledger states one more time they are not responsible for any losses or damages that could result from the use of Ledger Live.

However, there is also this:

THE ABOVE LIMITATIONS DO NOT APPLY IN RESPECT OF LOSS RESULTING FROM (A) LEDGER’S FRAUD, WILFUL MISCONDUCT OR GROSS NEGLIGENCE, WILFUL MISCONDUCT OR FRAUD; OR (B) DEATH OR PERSONAL INJURY.

I wonder if having their servers hacked or data stolen by their employees and or partner companies can be considered gross negligence? Or if a person gets physically attacked and robbed due to data released about them following Ledger's data leak? 


Foundation Devices

Foundation Devices’ TOS can be found below:
Terms of Use

Foundation Devices further reserves the right any time after receipt of your order, without prior notice to you, to supply less than the quantity you ordered of any item.

Foundation doesn’t provide additional information for this part. But according to their TOS, if you order 10 devices, they have the right to ship to you only 7, for example, for any reason, and they aren’t required to inform you about this. 

IN NO EVENT WILL WE (AND OUR SUPPLIERS) BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY LOST PROFIT OR ANY INDIRECT, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, SPECIAL OR PUNITIVE DAMAGES ARISING FROM OR RELATING TO THIS AGREEMENT OR YOUR USE OF, OR INABILITY TO USE, THE SITE, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. ACCESS TO, AND USE OF, THE SITE ARE AT YOUR OWN DISCRETION AND RISK, AND YOU WILL BE SOLELY RESPONSIBLE FOR ANY DAMAGE TO YOUR COMPUTER SYSTEM OR LOSS OF DATA RESULTING THEREFROM.

And:

You hereby release and forever discharge us (and our officers, employees, agents, successors, and assigns) from, and hereby waive and relinquish, each and every past, present and future dispute, claim, controversy, demand, right, obligation, liability, action and cause of action of every kind and nature (including personal injuries, death, and property damage), that has arisen or arises directly or indirectly out of, or relates directly or indirectly to, any interactions with, or act or omission of, other Service users or Third Party Sites & Advertisements.

Foundation can’t be held responsible for any and all damages caused to you for using their website and services.

NOTWITHSTANDING ANYTHING TO THE CONTRARY CONTAINED HEREIN, OUR LIABILITY TO YOU FOR ANY DAMAGES ARISING FROM OR RELATED TO THIS AGREEMENT (FOR ANY CAUSE WHATSOEVER AND REGARDLESS OF THE FORM OF THE ACTION), WILL AT ALL TIMES BE LIMITED TO THE GREATER OF (A) ONE HUNDRED US DOLLARS ($100) OR (B) AMOUNTS YOU’VE PAID FOUNDATION DEVICES UNDER THIS AGREEMENT IN THE 12 MONTHS PERIOD IMMEDIATELY PRECEDING THE DAY THE CLAIM AROSE (IF ANY). THE EXISTENCE OF MORE THAN ONE CLAIM WILL NOT ENLARGE THIS LIMIT. YOU AGREE THAT OUR SUPPLIERS WILL HAVE NO LIABILITY OF ANY KIND ARISING FROM OR RELATING TO THIS AGREEMENT.

If Foundation is found guilty of any damages caused to the user, said user will be compensated with no more than $100 or the amount they paid for their hardware wallet(s).


Privacy Policies

With the TOS agreements out of the way, we can now check out what is stated in the Privacy Policies of the 3 companies.


Trezor

Trezor’s Privacy Policy

The collection of your personal data in connection to the use of the Website and access to and use of the Services is as limited as possible. We usually collect and process only the following personal data:

- your name, email address and any other personal data you provide us with when filling out one of the contact forms on the Website (such as Enterprise solutions, Affiliate and other).
- Information and feedback we receive from you that helps us improve our Website and your user experience.

Trezor collects and stores as little personal data as possible. At a minimum, they collect info such as your name, email address, and any other data you submit through a form on the website or other Trezor services.

In connection with provision of the above support, we collect and process also the following personal data:
- your email address;
- content of the emails you send us and other personal data related to our communication.

In case a customer contacts Trezor support, email addresses and other personal data related to the case will be collected.


When a purchase is made on the Trezor shop, the following data is collected:

- your delivery address to ensure correct delivery of the products;
- your email address and an encrypted version of your user profile password (we do NOT keep any records of the full representation of your password);
- information about the status of your orders, requests under your warranty and refund rights and logs of your bitcoin payments.

Trezor collects and stores your shipping address, email address, your account password in encrypted form, and bitcoin payment info.

Our Website contains links to payment gateways provided by third parties which you may use in order to make payments while using the Services. You will have to fill in your personal data related to the
payment when using the payment gateways.

These data are processed by the respective provider of the payment gateway as a data controller and the data processing is governed by terms and conditions and privacy policy of the payment gateway provider.

If payments are made through a particular payment gateway, that service provider will collect and store your personal data. Trezor has no control over what this 3rd-party collects and/or stores.

In order to fulfill our legal obligations such as those arising out of accounting laws, we may store certain parts of your personal data for various time periods as stated in those laws.

And:

We process and store your personal data only for the time necessary to meet the purposes of its processing specified above, or for the time consented by you, or for the time that is either necessary to comply with our obligations under the applicable law or set forth by the applicable law or in accordance therewith. We comply with the mandatory rules for data archiving.

Depending on the reasons for data storage and applicable laws, your personal data will be stored for various time periods. Exact numbers are not mentioned.


Regarding data storage when ordering from the Trezor shop:

We will process such personal data only for such a period of time that allows us to deliver you the products and fulfill our other legal obligations connected to the sale of the products. We anonymize this data no later than 3 months after the sale of the product to the fullest possible extent and store them only in this anonymized form in case you contact us with an issue so we can verify that the data you provide us with, after anonymization, match the anonymized database inputs. After the expiry of the warranty period, we delete the data altogether.

Customer data of those buying from the official shop is stored up to 3 months. After that, the information gets anonymized and stored in anonymous form for the duration of the warranty (2 years).  After the warranty expires, Trezor deletes customer data.

We take care of your personal data security and so we choose the partners to whom we entrust your personal data very carefully.

Trezor shares your personal data with partners they see fit.


The following parties can get access to customer data:

- persons who provide us with the technological services or technology operators that we use to
provide our services;
- persons who provide our services and websites with security and integrity and who regularly test such security and integrity;
- providers of accounting, legal and administrative services;
- our staff

The third point refers to government agencies and tax offices, for example. No information about which staff members can access customer data or why is available.

Another possible recipient of your personal data, who may receive your personal data from us mainly in connection with the cryptocurrency buy, sell and exchange services is a company of the SatoshiLabs Group group of companies, the commercial company Invity.io s.r.o.

Invity.io is a service for rating and comparing crypto exchanges and their exchange rates. This is another company that can receive the personal data of Trezor users who use the in-app exchange service. Trezor’s wording is “mainly,” not “exclusively” or “solely.”

When collecting, storing and processing personal data we sometimes may use personal data processors such as Google, which under some circumstances transmit your personal data to third countries. In such an event we always make sure such transmission is compliant with the Regulation. In particular, we specify that the personal data may be transmitted to the United States of America and in such event the transmission is compliant with the “Privacy Shield” program.

Trezor may use the services of Google or other companies in connection with data storage. One of the countries this data may be sent to is the United States.

On our Website we use cookies to analyze traffic and to personalize content and ads. We also use cookies for other purposes, such as to enable us to simplify the logging on process for registered users, to help ensure the security and authenticity of registered users, to provide mechanisms for online shopping and to enable traffic monitoring under our Affiliate Program. We will, as a data controller, collect, store and process any personal data collected by such cookies (the personal data may include your IP address, information about your activity on our website, information about your advertisement preferences etc.)

Trezor uses cookies on its website for various reasons: website traffic analysis and monitoring, personalized ads, simpler login process, etc. The data collected through these cookies are also stored, including IP addresses and ad preferences.

In relation to the personal data you shall have in particular the following rights:

- a right to withdraw your consent at any time;
- a right to correct or make additions to the personal data;
- a right to request restrictions to processing of your personal data;
- a right to object or complain against processing of your personal data under certain circumstances;
- a right to request transfer of your personal data;
- a right to access your personal data;
- a right to be informed of the personal data security breach under certain circumstances;
- a right to request deletion of your personal data (a right to be „forgotten“) under certain circumstances; and
- other rights set forth in Act No. 110/2019 Coll., on personal data processing (Personal Data Protection Act) and the Regulation.

Customers can request to have their personal data deleted, corrected, restricted, etc. They have the right to access their own data and be informed of data breaches and leaks. Some of these actions depend on the circumstances. 


Ledger

Ledger’s Privacy Policy

We store your Data only for the time needed to carry out the operations for which it was collected, except when we need to assert our legal rights or are legally required to retain it for a different period of time. At the end of these retention periods, your Data is erased or anonymised.

Ledger stores customer data for as long as it is required for normal operations or legal rights. Once the objectives have been achieved, the data is deleted or anonymized.


This is the type of data collected and stored in connection to purchasing on the Ledger store:

Name, email address, delivery and billing address, phone number, company name, intra-community VAT number, product bought, delivery method and payment, order amount, currency.

Retention period:

Active database: 3 months from delivery of the product Archive: 10 years (tax and accounting obligations).

This data is stored for 3 months in one database. After that, it gets moved to an archive and held there for 10 years. 


The following data is collected and stored for 5 years after making contact with Ledger support via the official site or social media:

Name, email and postal address, telephone number (for product exchanges), Handle used on social media, content of our exchanges, identification document (if verification is necessary).

Personal data is also collected and stored for various periods for marketing emails, website browsing, referral program, affiliate program, etc.

Your payment information is collected directly by our payment providers. Ledger only has access to a truncated version of this information for anti-fraud purposes.

Payment information is collected by the payment providers. Ledger can only access a small part of this data.


Ledger also collects user information through its Ledger Live application. This is the data that is collected:

Device session identifier, IP address*, clicks, actions (e.g. launching the application, use of transactional functionalities, pages viewed), properties (e.g. type, version, language and region recorded for your operating system), currency, time stamp, amount and status of transactions, transaction identifier, identifier used by our partners to identify you (when you use their services).

   

As reasons for collecting all this data, they state:

Bug-fixing, analytics to improve our products and services and identify additional services and functionalities you might need, processing requests for assistance, finding and preventing security problems, fraudulent activity and violations, optimising marketing operations (e.g. information on the most-used functionalities) and sending important information (e.g. security notifications).

This data is stored in Ledger servers for 5 years from collection.

Ledger Live does not contain identifying information that allows us to know your identity.(*Your IP address is only collected to be transmitted to our partners when this information is required to provide their services, and is not stored by Ledger) Ledger neither stores nor has access to your crypto assets and private keys. We only provide ‘cold storage’ services.

Ledger says they don’t collect or store identifying information. The collected IP addresses are provided to third parties who offer various services within Ledger Live.


If you use partner services within Ledger live, then:

…information (like your name, date of birth, postal address and IP address) can be collected by our partners (or by Ledger on their behalf) to meet their anti-money laundering and customer-identification obligations.

We share your Data with:

•   Our technical service providers who help provide the Services (e.g. delivery, online payments and combating fraud).
•   Our subsidiaries, when they help provide the Services.
•   Our partners who use your Data to offer you:
      o      Services accessible from Ledger Live, or
      o      Personalised adverts. The list of these partners can be found in our Cookies Policy.

•   Other companies to which we could sell or assign all or part of our activities.
•   The administrative or legal authorities or any other authorised third party where this data sharing is set out in law.

   

Ledger can share your data with government and tax agencies. And “other companies” could also obtain your data without providing more information on the type of other companies.

Additionally:

Ledger never sells your Data to third parties and we prohibit our service providers from re-using it for their own behalf.

Your Data is stored in France, but we might have to transfer it to countries located outside of the European Economic Area.

Foundation Devices

Foundation Privacy Policy


Personal information that is collected by Foundation includes:

…your first and last name, email and mailing addresses, phone number, credit card information, products purchased and, if purchasing using Bitcoin, the information collected in connection with such payment.

…information you provide when you contact us with questions, feedback, or otherwise correspond with us online.

… your city, state, country of residence, and postal code.

… information about payments to and from you and other details of products or services you have purchased from us.

Information we obtain from social media platforms. We may maintain pages for our Company on social media platforms, such as Facebook, LinkedIn, Twitter, Google, YouTube, Instagram, and other third party platforms.

Information we obtain from other third parties. We may receive personal information about you from third-party sources.

Personal information is also collected through cookies, namely:

We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, and activity occurring on or through the Service, including but not limited, your computer or mobile device operating system type and version number, manufacturer and model, device identifier (such as the Google Advertising ID or Apple ID for Advertising), browser type, screen resolution, IP address, the website you visited before browsing to our website, general location information such as city, state or geographic area; information about your use of and actions on the Service, such as pages or screens you viewed, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times, and length of access; and other personal information. Our service providers and business partners may collect this type of information over time and across third-party websites and mobile applications.

This data includes the type of device you use, your operating system, device model, IP address, location information, etc.


The collected information is used in various ways. Some of the interesting points include:

We may use your personal information and disclose it to law enforcement, government authorities, and private parties as we believe necessary or appropriate...

And:

We make personal information into anonymous, aggregated or de-identified data by removing information that makes the data personally identifiable to you. We may use this anonymous, aggregated or de-identified data and share it with third parties for our lawful business purposes, including to analyze and improve the Service and promote our business.

Your personal information could be shared with government agencies, police, tax authorities, etc. The data is anonymized and shared with 3rd-parties.

We do not share your personal information with third parties without your consent…

But:

except in the following circumstances…

We may share your personal information with third party companies and individuals that provide services on our behalf or help us operate the Service…

We may disclose your personal information to professional advisors, such as lawyers, bankers, auditors and insurers…

We may sell, transfer or otherwise share some or all of our business or assets, including your personal information, in connection with a business transaction (or potential business transaction) such as a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution.

Foundation needs your consent to share your personal data, but not in all instances. They are free to share your data with 3rd-party service providers, partners, individuals, etc. Your data can also be sold together with other company assets in case of bankruptcy, mergers, and similar business deals.

We are headquartered in the United States and have service providers in other countries, and your personal information may be transferred to the United States or other locations outside of your state, province, or country where privacy laws may not be as protective as those in your state, province, or country.

Customer information is stored in the USA but can also be transferred to other countries and territories.

Sources
All information was obtained from the following official sources:

https://shop.trezor.io/static/shared/about/terms-of-use.pdf
https://shop.trezor.io/static/shared/about/terms-conditions.pdf
https://data.trezor.io/legal/wallet-terms.pdf
https://shop.ledger.com/pages/terms-and-conditions
https://shop.ledger.com/pages/website-terms-of-use
https://shop.ledger.com/pages/ledger-live-terms-of-use
https://foundationdevices.com/terms/
https://shop.trezor.io/static/shared/privacy-policy.pdf
https://www.ledger.com/privacy-policy
https://foundationdevices.com/privacy/

[Local Rule:]

Before answering the question in the poll, please take a look at Forum advertising space for free signature/avatar advertisement. That way you will understand what this is about.

After reading the discussion, would you be interested in offering your signature space, avatar, and/or personal text to advertise good Bitcoin projects and services for free?
I would also appreciate if those who are interested could write a post saying they are. That way I will know who to contact if this turns into something real.

The first suggested project is the decentralized exchange Bisq.
CryptoHeadlineNews even created some avatars already. You can take a look at them here.

Local Rule:
No discussion of projects and whether or not this is a good idea here! Do that in the other thread. This topic and poll is only to find out how many people are interested in participating.  


Members interested in free promotion:

Pmalek, Rizzrack, Mbitr, BitcoinGirl.Club, Z-tight, eddie13, Maestro75, ETFbitcoin, Ucy, NeuroticFish

Depending on availability:

PX-Z, YOSHIE, skarais, LTU_btc, CryptoHeadlineNews, un_rank, FatFork, Findingnemo, Agbe, libert19

[How would this work?]

I just thought of something interesting while bumping one of my threads.
Bitcointalk rents out advertising space, right? We also have a news field on top where important announcements are made. Usually, it's about the latest Bitcoin Core release.

How great would it be if the forum made available some room to advertise a thread with a list of users who would be interested in advertising (via signatures, avatars, or personal texts) Bitcoin services for free?! Obviously, I am not talking about the usual casinos and stuff like that. I am talking about new projects or software developed by individuals who don't have the resources to pay for advertising. We as a community could do that and not charge them anything.

If ad space is asking too much, I understand. How about if the news field mentioned that thread and had a link to it?
Wouldn't this also be a great way to maybe attract some new Bitcointalk users - the right kind? People creating something of value and looking to get more exposure. We would obviously have to advertise the fact that we are willing to advertise good Bitcoin community projects outside of this forum. Social media like Reddit, Discord, Twitter, and other online communities. For that, we will need the help of people using those sites who have good-standing accounts/profiles and are willing to help.

How would this work?

1. We create a thread (I can do that) with a simple question asking forum members if they are willing to advertise Bitcoin projects for free? The thread would point to this discussion. Users can then make themselves available and mention if they want to offer their signature space, avatars, and/or personal text for this purpose.
There are people here that aren't part of paid signature campaigns and some who are but don't need their avatars and/or text field.

2. A user comes along and introduces their idea on the forum. If people like it, they offer the person free advertising. In exchange, whatever service and/or project gets developed has to be announced on Bitcointalk as well, have its own thread here with support, and maybe some special promotions or deals for Bitcointalk members. That way, the person who gets free advertisement also gives something back to the community.

3. The last step would be to create the signature and avatar and come up with a decent personal text message. We have people who offer these services here. We just have to see how much they would want for their work and if they would be willing to do it for free. Something simple that doesn't take too much time.


Is this something we can create here to benefit the Bitcoin ecosystem? One problem I see here is that maybe there aren't that many projects that would meet our criteria to be advertised.
Obviously, comments and suggestions are welcome.

[gesture.key]

After the Trezor One video, the hardware hacker Joe Grand posted a 2nd hacking video. This time he was working on a Samsung Galaxy S3 Android phone whose owner had forgotten the swipe pattern to unlock it. He thought he bought the coins in 2013, sent them to a wallet on his phone, and forgot about them for 7 years. The phone was configured to delete all data after 10 unsuccessful swipes. So once he finally gained access to it, the owner eventually gave up so as not to erase his data and wallet.    

Joe aimed to disassemble the phone and copy the whole personal storage from the chip to his laptop. From there, he wanted to figure out where the swipe pattern file was located. Joe plugged his cable into a connector and connected it to a debugging piece of hardware. But he couldn't establish a connection due to problems with the cable.

Since that didn’t work, Joe had to take the more difficult route, use a hardwired connection, and solder his own wires to the board. A total of 9 different connections were required. After some difficulties, it eventually worked, and Joe started copying the data from the phone.  

After the data was copied to the laptop, Joe started looking for the user partition for the personal data. He was interested in a system file called gesture.key. This file contains the cryptographic hash of the swap platform used on the phone. The hash can’t be converted back, but Joe had a list of all possible gesture combinations. He can run through these combinations to find the correct hash. He found the SHA-1 hash of the swap platform used on the phone.

Joe searched for the correct bites on his list and found only one match corresponding to the 2589 swipe pattern. So he reassembled the phone, powered it on, and the owner tried to unlock it with the 2589 swipe combination. It worked. They then opened the mycelium wallet on the phone and found only 0.003 BTC. A bit later, Joe was able to trace what happened to the owner’s coins. He purchased $400 worth of BTC in 2016, but a big part of it was sent to Bit Blender, which shut down in 2019. All in all, Joe recovered only about $2.000 worth of BTC.

• Never forget to make multiple physical backups of your recovery phrases so you can gain access to your crypto whenever you need to.
• Don’t be reckless with your coins, no matter how small the amount is. One day it can amount to something big.
• Don’t forget passwords, PINS, swipe patterns, and other important details that could cause a loss of money.

Source: https://www.youtube.com/watch?v=icBD5PiyoyI