[ESHOP launched] Trezor: Bitcoin hardware wallet

[jmw74]

What about using your trezor to digitally sign arbitrary data? Does it have that functionality? I'm guessing it does since they have plans to use it for authentication but not sure.

bump

I remember seeing Slush or Stick post somewhere that there are working on that.

I assume they realize Trezor's potential as a security device for anything, not just bitcoin.  I look forward to seeing what they come up with.

[slush]

The problem with passwords is that people know there is (at least one) password set on the device when it's plugged into the computer.

The solution is to press "Forget device" everytime you leave computer. Problem solved, even without any weird logic in mytrezor .

[slush]

What about using your trezor to digitally sign arbitrary data? Does it have that functionality? I'm guessing it does since they have plans to use it for authentication but not sure.

I remember that I already answered this earlier. TREZOR has support of signing bitcoin messages already (like Bitcoin-qt, Electrum and others), it's not in myTREZOR yet (will be very soon).

[dnaleor]

The problem with passwords is that people know there is (at least one) password set on the device when it's plugged into the computer.

The solution is to press "Forget device" everytime you leave computer. Problem solved, even without any weird logic in mytrezor .

Not really, when a burglar finds my Trezor and plugs it into a laptop, he sees that mytrezor is asking for a password... If we have the possibility to create an account without password protection, they can just empty the wallet (if no pin is set). Meanwhile, the large stash can be hidden with a password...

Of course, I could create 2 accounts with different recovery seed :-)

[Anon136]

What about using your trezor to digitally sign arbitrary data? Does it have that functionality? I'm guessing it does since they have plans to use it for authentication but not sure.

I remember that I already answered this earlier. TREZOR has support of signing bitcoin messages already (like Bitcoin-qt, Electrum and others), it's not in myTREZOR yet (will be very soon).

Sorry. I did a text search through all of the pages since then for my handle to make sure that you hadn't replied to me.

Anyway awesome. Can't wait.

[JorgeStolfi]

I wonder if any of you read Stanislaw Lem's Return from the Stars (1961) and recall the payment device described therein? 

Ifit weren't for one quaint detail, it would have been surprisingly prophetic...

[cor]

http://satoshilabs.com/news/2014-08-06-mytrezor-playground-free-coins-for-newbies/

Hey guys
you can introduce Bitcoin and TREZOR to your relatives
without being such a nerd
 
https://test.mytrezor.com

[bitpop]

Is there any security lost by restoring your Trezor using the recovery seed? I ask this because you have to type in the recovery seed on the computer. I know it is in a different order, but say if you had a keylogger, how much would this increase the chance of someone guessing your recovery seed, since they would know the words?

Yes definitely recover, move then wipe

[TwinWinNerD]

Is there any security lost by restoring your Trezor using the recovery seed? I ask this because you have to type in the recovery seed on the computer. I know it is in a different order, but say if you had a keylogger, how much would this increase the chance of someone guessing your recovery seed, since they would know the words?

The number of combinations with a 24 word seed after each word is known but the ranking is not, is:
24!   ~   6.2 × 10^23

[blubberli]

Hehe, I don't want to read the whole thread. Which shipping company you use? I only accept DHL.

[devthedev]

Hehe, I don't want to read the whole thread. Which shipping company you use? I only accept DHL.

Not sure, the tracking number is coming through with USPS for me.

[slush]

Hehe, I don't want to read the whole thread. Which shipping company you use? I only accept DHL.

DHL is in process, right now we do use national posts (USPS in US). Actually returning rate is quite low so far and no device has been lost yet. The only downside is that delivery may take some time to some countries, comparing to DHL...

[Anon136]

I only accept DHL.

May I ask why?

[klokan]

Is there any security lost by restoring your Trezor using the recovery seed? I ask this because you have to type in the recovery seed on the computer. I know it is in a different order, but say if you had a keylogger, how much would this increase the chance of someone guessing your recovery seed, since they would know the words?

The number of combinations with a 24 word seed after each word is known but the ranking is not, is:
24!   ~   6.2 × 10^23

You need to put this into perspective. When using 24 words, the Trezor seed is 256bit long, i.e., 1E77. Any single address generated is 160bit long, i.e., 1E48. Those are some huge numbers. 1E23 is child's play compared to that. If the number of combinations is 1E77 before you keylog the words and it becomes 1E23 after you keylog them, then the recovered Trezor is 1,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000 times less secure then the unrecovered one. Please note that Trezor uses key stretching techniques, so to find whether the 24 words that have been keylogged contain(ed) some BTC, you need to do more than 10^23 hashes. It should be something like 10^28. But there is also 10^13 Hash/s hardware out there. If something like that was manufactured for Trezor breaking then you would need 10^8 of those to break one recovered Trezor in a year time. I guess that considering price of such equipment and the possibility you break an empty(emptied) Trezor rules out such attack (for now). I would still recommend to transfer your funds to unrecovered Trezor after recovery to get 1E77 protection back. I would also not recommend using less than 24 words.

[dillpicklechips]

Is there any security lost by restoring your Trezor using the recovery seed? I ask this because you have to type in the recovery seed on the computer. I know it is in a different order, but say if you had a keylogger, how much would this increase the chance of someone guessing your recovery seed, since they would know the words?

The number of combinations with a 24 word seed after each word is known but the ranking is not, is:
24!   ~   6.2 × 10^23

You need to put this into perspective. When using 24 words, the Trezor seed is 256bit long, i.e., 1E77. Any single address generated is 160bit long, i.e., 1E48. Those are some huge numbers. 1E23 is child's play compared to that. If the number of combinations is 1E77 before you keylog the words and it becomes 1E23 after you keylog them, then the recovered Trezor is 1,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000 times less secure then the unrecovered one. Please note that Trezor uses key stretching techniques, so to find whether the 24 words that have been keylogged contain(ed) some BTC, you need to do more than 10^23 hashes. It should be something like 10^28. But there is also 10^13 Hash/s hardware out there. If something like that was manufactured for Trezor breaking then you would need 10^8 of those to break one recovered Trezor in a year time. I guess that considering price of such equipment and the possibility you break an empty(emptied) Trezor rules out such attack (for now). I would still recommend to transfer your funds to unrecovered Trezor after recovery to get 1E77 protection back. I would also not recommend using less than 24 words.

I'm pretty sure it also asks you to enter words not in your seed in case of a key logger as well.

[klokan]

Is there any security lost by restoring your Trezor using the recovery seed? I ask this because you have to type in the recovery seed on the computer. I know it is in a different order, but say if you had a keylogger, how much would this increase the chance of someone guessing your recovery seed, since they would know the words?

The number of combinations with a 24 word seed after each word is known but the ranking is not, is:
24!   ~   6.2 × 10^23

You need to put this into perspective. When using 24 words, the Trezor seed is 256bit long, i.e., 1E77. Any single address generated is 160bit long, i.e., 1E48. Those are some huge numbers. 1E23 is child's play compared to that. If the number of combinations is 1E77 before you keylog the words and it becomes 1E23 after you keylog them, then the recovered Trezor is 1,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000 times less secure then the unrecovered one. Please note that Trezor uses key stretching techniques, so to find whether the 24 words that have been keylogged contain(ed) some BTC, you need to do more than 10^23 hashes. It should be something like 10^28. But there is also 10^13 Hash/s hardware out there. If something like that was manufactured for Trezor breaking then you would need 10^8 of those to break one recovered Trezor in a year time. I guess that considering price of such equipment and the possibility you break an empty(emptied) Trezor rules out such attack (for now). I would still recommend to transfer your funds to unrecovered Trezor after recovery to get 1E77 protection back. I would also not recommend using less than 24 words.

I'm pretty sure it also asks you to enter words not in your seed in case of a key logger as well.

I'm pretty sure it does not ask for more words in case of 24 words seed: https://github.com/trezor/trezor-mcu/blob/master/firmware/recovery.c#L97

[Mental Fight]

interested wallet but when hardware lost ? get tsunami ? my money will loss ?

[idee2013]

interested wallet but when hardware lost ? get tsunami ? my money will loss ?

you can recovery everything...only if you lose you "paperwallet with the seeds" and the trezor everything will be lost.
Read the faq or the manual

[BurtW]

interested wallet but when hardware lost ? get tsunami ? my money will loss ?

Obviously, nobody would be excited about this product at all if this was the case.

[21pilot]

anyone interested in selling their metallic version of Trezor?
Or any time estimate when they will be available for sale again, slush?