[ESHOP launched] Trezor: Bitcoin hardware wallet

[cor]

We have released firmware 1.3.3 with the TREZOR Connect for passwordless login to websites and apps.
 
Read more here http://satoshilabs.com/news/2015-04-07-trezor-firmware-1-3-3-connect-api/ and don't forget to update your firmware.

[jackbox]

On Chrome suddenly the MyTrezor.com plugin fails to load. In the log it says it timed out. On Firefox it works but I prefer to use Chrome. I cannot find any way to uninstall the plugin so it loads again. There is only an option to disable it. Does anyone know why it might exhibit this behavior on Chrome. Are there other plugins that can interfere with the Trezor plugin? I am stumped. I hope some can help.

Edit: I finally got it working. Newly installed anti-virus program (WebRoot) had denied the Trezor program permission to run.

[dsattler]

We have released firmware 1.3.3 with the TREZOR Connect for passwordless login to websites and apps.
 
Read more here http://satoshilabs.com/news/2015-04-07-trezor-firmware-1-3-3-connect-api/ and don't forget to update your firmware.

Great!
Can't wait to test Trezor Connect! I hope that lots of bitcoin-related sites will support this.

[devthedev]

We have released firmware 1.3.3 with the TREZOR Connect for passwordless login to websites and apps.
 
Read more here http://satoshilabs.com/news/2015-04-07-trezor-firmware-1-3-3-connect-api/ and don't forget to update your firmware.

Great!
Can't wait to test Trezor Connect! I hope that lots of bitcoin-related sites will support this.

This is gonna be great! How will it compare to hardware like the Yubikey?

[rammy2k2]

We have released firmware 1.3.3 with the TREZOR Connect for passwordless login to websites and apps.
 
Read more here http://satoshilabs.com/news/2015-04-07-trezor-firmware-1-3-3-connect-api/ and don't forget to update your firmware.

WOW ... really cool !
Good job Trezor team, as usual !

[jackbox]

When will we be able to see pics on the device when it is idle?

[¡ndustrialcoinmagic]

Im going to try the firm update and see how my trezor works.

[kkurtmann]

We have released firmware 1.3.3 with the TREZOR Connect for passwordless login to websites and apps.
 
Read more here http://satoshilabs.com/news/2015-04-07-trezor-firmware-1-3-3-connect-api/ and don't forget to update your firmware.

You guys are effing brilliant. This is a game changer in secure challenge/response authentication.

[Carlton Banks]

Any plans to support this:

https://bitcoinarmory.com/verisign-discusses-collaboration-with-armory-to-secure-payment-addresses/

It's quite new, but it sounds like a credible improvement to BIP70

[cypherdoc]

Any plans to support this:

https://bitcoinarmory.com/verisign-discusses-collaboration-with-armory-to-secure-payment-addresses/

It's quite new, but it sounds like a credible improvement to BIP70

i too would like to see full scale Armory integration.

[Carlton Banks]

Any plans to support this:

https://bitcoinarmory.com/verisign-discusses-collaboration-with-armory-to-secure-payment-addresses/

It's quite new, but it sounds like a credible improvement to BIP70

i too would like to see full scale Armory integration.

I believe I'm right in thinking that this DNSSEC stuff would need implementing as a firmware update, so Satoshi Labs can comment meaningfully on that. And this domain/address resolution system functions independently of allowing Trezors to be used with the Armory client. The latter work is definitely something Armory devs will need to do, the new wallet format will likely be a pretty sophisticated (read bespoke) version of BIP32

[Anon136]

buytrezor.com doesn't have a "sign in with trezor" option?

[jackbox]

buytrezor.com doesn't have a "sign in with trezor" option?

Because most people who shop there don't own a Trezor yet most likely.

[BitcoinIsLiberty]

Are there any privacy concerns with using the Trezor for signing into websites? Is master public key shared or info that can link bitcoin addresses with identities? Does each website use it's own private key/public key for authentication? 
-

[cor]

Are there any privacy concerns with using the Trezor for signing into websites? Is master public key shared or info that can link bitcoin addresses with identities? Does each website use it's own private key/public key for authentication? 
-

shortly:

no
no
yes

[randomguy7]

If you are not paying for the service, you are the market the product, not the customer.

[Spaceman_Spiff]

We have released firmware 1.3.3 with the TREZOR Connect for passwordless login to websites and apps.
 
Read more here http://satoshilabs.com/news/2015-04-07-trezor-firmware-1-3-3-connect-api/ and don't forget to update your firmware.

Very cool stuff !  Two thumbs up !

[Anon136]

Does anyone know a website that has integrated "sign in with trezor"? I would very much like to try it out.

[BitcoinIsLiberty]

Extracting the Private Key from a TREZOR... with a 70 $ Oscilloscope
http://johoe.mooo.com/trezor-power-analysis/

Conclusion

Side channel attacks are not as difficult as many people think. A simple power analysis requires only a simple oscilloscope and that can hardly be called expensive laboratory equipment. You also need basic soldering skills and deep knowledge about the code that is running. It took only a single recording of the computation of the public key, to recover the private key. On the bright side, this simple side channel attack can be mitigated by using constant-time code and as I showed this code does not have to be slow.

The new firmware 1.3.3 is immune against this attack since it (1) requires a PIN to compute the public key and (2) uses branch-free computations for deriving the public key from the private key.

There is no complete protection against all kind of attacks. If your TREZOR gets stolen and it has no passphrase protection (or if the passphrase is weak), you should transfer the coins to a different wallet. There are other attack vectors like fault injection that could still be used and may get around the PIN protection. Basically, they use the fact that the microprocessor does unexpected things if power supply or the clock signal is broken. These are much more difficult to perform, but they are probably less expensive than using an electron microscope to read the seed from the chip. Also, there may be a bug in the microprocessor that allows for circumventing the read-out protection.

Nice to see people working on breaking the Trezor and making it stronger!

[guitarplinker]

I'm liking the new feature where the PIN is required to check balances. I wasn't completely comfortable before with anyone on my main machine being able to see my bitcoin balance of my Trezor.

One thing that could be done to make PIN input a little more secure would be to change the location of numbers after a single number has been entered. Currently, if someone has a live video feed on a computer where someone is signing into their Trezor, they would be able to see duplicate numbers in their PIN. My idea would protect users from this, as well as people looking over their shoulders. It's probably a little over the top for security but it's still a decent idea in my mind.