I would hope that RFC6979 deterministic signatures would be the standard for hardware wallets (that's what Trezor uses). Anyway, I doubt this would be used as an attack vector, since it's not guaranteed that the attacker would be the one claiming the funds (see: white hat returning lost BC.i funds). |
|
|
|
Dude, you should stop "contributing", you don't know what you're talking about. |
|
|
|
Can someone estimate how many bitcoins your TREZOR must hold to be worth this immense effort?
Yes, if the person has access to the Trezor, they can see the extended public keys and calculate the value held by the device. I'm not sure if this is true if a passphrase is used, since it is concatenated with the seed. |
|
|
|
You should only recover it if it's connected to an offline computer (preferred Ubuntu).
Note that the Trezor asks for the seed words in random order. There are 24! different combinations of the seed words, only one of which is valid. An attacker would still have to try on average half of the 620,448,401,733,239,439,360,000 possible combinations, which would take quite some time (by design). Using an offline computer for recovery is only necessary when you want to keep using the same seed. If you lost your Trezor, you should switch seeds anyway, and using an offline computer to move the funds is perfectly safe. |
|
|
|
How to remedy this?
Right now? Spend the time to have the Trezor sign a transaction consolidating all of those inputs into one. In the future? Don't have tiny amounts of bitcoin sent to a Trezor address. Also, you'd be paying the fees whether you're using MyTrezor or any other wallet. |
|
|
|
I can live with 0.0001 BTC fee, I just dislike how it fragments my otherwise round amounts.
Also, a Coin Control is still needed to forbid merge of funds which sometimes should not be merged.
Electrum offers this ability, but until then you can use the accounts feature to keep those funds separate. |
|
|
|
But I think, that it should be wise to drop "Bits Of Proof" if that's the "so called backend" and replace it with something more decent, perhaps "chain.com" can be a contender?
Unfortunately no other blockchain explorers understand BIP32 ... Bits of Proof delivered a software without not a single TREZOR would have been useful or sold until now. It supports your technology just as you wished for. It serves hundreds of your customer in every moment for more than a half a year. You could be regarded fortunate having such a partner. Unfortunately you do not see it. Just a hint for both of you: this is not the place for this discussion, it makes both of your companies look bad. |
|
|
|
For what it's worth, I got the trezor working with electrum by following the instructions posted earlier.
I had to install a half dozen python packages before it would actually start, but each time it would tell me what was missing. Then it recognized my trezor right away, and showed all the right addresses and balances.
I wanted to try to sign a message (since mytrezor.com doesn't have that functionality) but I couldn't get that part to work. Some error came from the QR code part of the app.
You probably also need to install the python-trezor module. I think a way to somewhat bypass the dependency hell is to use the installer: When I do that, it downloads all the necessary python packages (except python-trezor, which is only needed at run time). Not for me. It was electrum that was missing dependencies, not python-trezor. And it's electrum's issue where signing messages doesn't work. I am guessing it is some library version incompatibility or something. I don't really have time to investigate right now, but the issue is I'd click sign and it would just hang. The console would show a traceback, something to do with QR codes (which is odd because there is no QR code involved). Did you install python-trezor? It is a dependency for the Electrum Trezor plugin. Also, I was suggesting that you use the installer for Electrum, not just python-trezor. |
|
|
|
For what it's worth, I got the trezor working with electrum by following the instructions posted earlier.
I had to install a half dozen python packages before it would actually start, but each time it would tell me what was missing. Then it recognized my trezor right away, and showed all the right addresses and balances.
I wanted to try to sign a message (since mytrezor.com doesn't have that functionality) but I couldn't get that part to work. Some error came from the QR code part of the app.
You probably also need to install the python-trezor module. I think a way to somewhat bypass the dependency hell is to use the installer: When I do that, it downloads all the necessary python packages (except python-trezor, which is only needed at run time). |
|
|
|
Is it easy to set up to use with electrum? I have never used that client before... I have been waiTing to see whIch clients shOuld be easiest to use with Trezor, as I have jusT been using the web wallet for that portion of my holdings
It took me 4-6 hours of troubleshooting to get Electrum 2.0 working built from source on my Mac. I didn't try on Windows, but I imagine it is more difficult. If you're using Linux, it shouldn't be that bad, follow the "Development version" instructions here. You also have to have the python-trezor python module installed. Using it is as straightforward as Electrum with its own wallet, once you've satisfied the dependencies. |
|
|
|
Aren't you using Chromium by any change? (not Chrome)
Nope, Google Chrome 37.0.2062.124. This is what the log shows ["error","Wed, 08 Oct 2014 13:49:00 GMT","[app] Loading http transport failed",{"cors":"rejected"}]
["log","Wed, 08 Oct 2014 13:49:01 GMT","[trezor] Loaded plugin 1.0.5"] That "http transport failed" isn't indicative of a problem, I see that during normal operation. |
|
|
|
I'm on OSX. I was able to setup and use the Trezor in Safari (I don't use Safari generally), but it won't work in Chrome (my main browser). It asks me to install the browser plugin, which I do, but then that message doesn't go away.
Chrome is not supported on Mac OS X at the moment. That's odd, it seems to work for me. Can I provide some information to troubleshoot this issue perhaps? |
|
|
|
The server was not fixed. It was restarted. This will happen again soon. I look forward to Electrum release so I have a backup solution when this happens next time.
You don't have to wait until the release, you can follow the instructions here under "Development version". |
|
|
|
how many wallets support Trezor now?
It's not so much how many wallets does Trezor support, but how many wallets support Trezor. To the best of my knowledge, only MyTrezor still unless you can follow these instructions (under Development Version) for Electrum. |
|
|
|
Thanks for pointing me in the right direction. Here was my final script: import sys
sys.path.append('..')
from armoryengine.ALL import *
receivingAddresses = [...]
walletFile = "..."
wallet = PyBtcWallet().readWalletFile(walletFile)
TheBDM.registerWallet(wallet.cppWallet)
TheBDM.setBlocking(doblock=True, newTimeout=60*60)
TheBDM.setOnlineMode()
for address in wallet.getAddrList():
uxto = wallet.getAddrTxOutList(address.getAddr160())
if len(uxto) == 0:
continue
addressBalance = sum([o.getValue() for o in uxto])
keyMap = {o.getRecipientScrAddr(): address.binPublicKey65.toBinStr() for o in uxto}
outputs = [[addrStr_to_script(receivingAddresses.pop()), addressBalance]]
tx = UnsignedTransaction().createFromTxOutSelection(uxto, outputs, keyMap)
fileName = "armory_{0}_{1}BTC.unsigned.tx".format(tx.asciiID, coin2str(addressBalance, 0, False, 0))
with open(fileName, 'w') as txFile:
txFile.write(tx.serializeAscii())
TheBDM.execCleanShutdown() Basically, I wanted these unsigned transactions handy to more easily transfer funds to the Trezor as needed/became more comfortable with its security model. I wanted a 1-1 address correspondence between my Armory and Trezor addresses, with no mixing. Fees are negligible because they've been sitting around for so long. |
|
|
|
Hi Armory dev team/community! I'm trying to migrate my cold storage wallet from Armory to my Trezor. I have a bunch of outputs to different addresses, and what I'd like to do is create an UnsignedTransaction for each address, spending all of the funds (minus fees) to a Trezor address (assume I have a sufficient number of these available in a Python list). I've got a lot of these outputs, so I really don't want to do this through the GUI. I didn't see an easy way to do this using armoryd, so I am writing a Python script. Here's my code so far: import sys
sys.path.append('..')
from armoryengine.ALL import *
walletFile = "[REDACTED]"
wallet = PyBtcWallet().readWalletFile(walletFile)
TheBDM.registerWallet(wallet.cppWallet)
TheBDM.setOnlineMode(goOnline=True, wait=True)
for o in wallet.getTxOutList():
output = PyUnspentTxOut(o)
output.pprint()
TheBDM.execCleanShutdown(wait=True) Every time I run this, I get a Segmentation fault with nothing in the logs. I'm on a Mac and am working from git master. Any ideas? Here's what I do have in my logs: -INFO - 1412470223: (BlockUtils.cpp:4441) Finished blockchain scan in 6.04233 seconds
-INFO - 1412470223: (BlockUtils.cpp:4460) Updating registered addresses
-INFO - 1412470223: (BlockUtils.cpp:4468) Scanning Wallets
-INFO - 1412470223: (BlockUtils.cpp:4479) Scanning Wallet #1 from height 0
-INFO - 1412470223: (BlockUtils.cpp:4800) Saving wallet history to DB
Segmentation fault: 11 |
|
|
|
for what it's worth as an independant audit, the bootloader functionally does what it's supposed to do and doesn't contain a backdoor. (+ proof of RE) The bootloader is written in Python? I'm a bit surprised about that. |
|
|
|
are only USB sticks right from the factory affected or old used ones as well?
As I understand it,USB Sitcks in use cannot get compromised
Nope, the whole reason why this is such a bad exploit is that most USB devices (not just flash drives) can have their firmware reprogrammed via software. |
|
|
|
Can the Trezor use all inputs for outgoing transactions? I think there (myTREZOR.com) is minimum for transaction inputs.
It's not worth using them. It creates a bigger transaction and you'll end up paying more in the end (because the transaction fee will be higher). Also, the Trezor isn't exactly a powerhouse. I signed a couple transactions with tens of mining reward inputs. One time it took over ten minutes to complete. |
|
|
|
Is the metal model still available for purchase?
As is answered twice per page no, and it probably never will be. |
|
|
|
|
Show Posts
