Trezor and conquering "Device ID" revelation concerns

[Coin-Keeper]

I feel that this subject should get a separate thread so that it doesn't get missed by Trezor wallet users.  I expressed some concerns in the thread "How to buy a hardware wallet" awhile back.  Since that time I have been experimenting/coding.

Quick reflection from that earlier thread:

When a Trezor user connects to the website trezor (dot) io, Sat Labs captures the exact and specific Trezor device id in the url while opening your wallet.  In theory you can instruct the webpage to "forget" your Trezor when you exit, BUT how can you know for sure that it isn't retained?  You can't and who knows where 3 letter agencies will be in a few years.  If you maintain more than one wallet it will mean that the SAME device ID will be captured in a subsequent url during connection at trezor (dot) io, even if its a different wallet than the previous one.  So if I have connected to a web wallet, and maybe even made some rookie mistakes (e.g.- IP connection mistake) which could cost me some significant privacy issues, what can I do short of replacing my hardware wallet?  Do I just live with continuing to use that device ID that was handed out by operator error as a rookie?

Answer:  NO need to do that because eliminating that mistake from your Trezor is somewhat easy.

Recently I received another Trezor T and while looking at the Serial number on the package I realized this is not the device Id that reflected in my wallet.  So I went on examining a few things and discovered that when you reset your Trezor the device ID changes.  Yes, it actually changes completely.  I have done this 4 times to make sure what I am posting here is accurate.  BTW - I also did 4 complete recovery operations using the EXACT same SEED and passphrases to make sure the wallet addresses are the same.  They are of course!  My earlier concerns, which are genuine and to be considered by those requiring anonymity and privacy, are now easy to abate.  It has always been easy to simply create a new wallet and send your coins to it (mix/tumble if the error is large) replacing the compromised wallet's mpk's with new ones.  There is an art to using crypto and remaining under the radar.  Some have no need or reason to, but many want to remain "out of sight".  To me it was always of concern that the device ID was static and once a mistake was made you were stuck with that crappy device ID.  Not any more!

So take this post in relation to your needs with crypto.  It makes no sense to reset your hardware wallet and then return to the same operator errors.  There would be no sense in wasting your time.  This post is so that as you mature in crypto use and IF you want to go under the radar after mistakes, you can eliminate the device id component of your "trail" left by earlier mistakes.

[witcher_sense]

Thank you for the information, it is going to help all Trezor users, and especially newcommers. Additionaly, according to Trezor Wiki SatoshiLabs company doesn't collect sensitive data about customers and about devices users purchase and use. Device ID is a unique number, which is generated upon initial setup. It is not hardcoded into device and changes every time you setup a new wallet. Moreover, this ID is never sent to servers because it is after "#" in the url. Source: https://www.reddit.com/r/TREZOR/comments/bk574e/linkage_of_device_id_and_your_privacy/



It should also be noted that it is possible to setup a new wallet without web interface. For advanced users only.


https://wiki.trezor.io/Using_trezorctl_commands_with_Trezor
https://github.com/trezor/trezor-firmware/tree/master/python
https://www.reddit.com/r/TREZOR/comments/2nlwc9/is_it_possible_to_setup_a_trezor_device_without/

[dkbit98]

I am having hard time trusting hardware wallet manufacturers when they say they don't collect any users data.

It should also be noted that it is possible to setup a new wallet without web interface. For advanced users only.

I think that it is now possible to create wallet with their Trezor Suite application, that is still in beta but working without any issues and has Tor integrated, and this is much better than using web version.

[witcher_sense]

I am having hard time trusting hardware wallet manufacturers when they say they don't collect any users data.

I am too, and some of the hardware manufacturers (Trezor included) may well collect data on purpose for any unbeknownst reason. But the thing is that it is always possible to purchase hardware in a more anonymous way without revealing any sensitive information, so it is not necessary to trust anyone except the hardware itself. You don't have to update your wallet either, you can always use your hardware wallet with old firmware, no one can force you to update it. The most important question is if not hardware manufacturers, whom should we trust? Will any DIY solutions that we may come up with be better than a hardware wallet created by people who are security experts?

[Coin-Keeper]

First off, let me say that I appreciate the "merit" members have sent to me for this thread.  I humbly thank you.

It should also be noted that it is possible to setup a new wallet without web interface. For advanced users only.

I thought about adding a bunch of those methods (they are actually easy) here but in the end I felt it might have been too much info in one place.  Most importantly I wanted newer Trezor users to see how easy it is to correct for errors they may have made.  Not only can you create a new wallet without any 3rd party web connection, you can actually make full transactions as well IF you are running your own bitcoin core.  These have a small learning curve but you could conduct "business" off book of any 3rd party system if you wanted to.  Not many here will run their own core, but just mentioning the possibilities if that is an aspiration.