georgem
Legendary
Offline
Activity: 1484
Merit: 1007
spreadcoin.info
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 19, 2016, 11:25:34 PM |
|
I received my trezor a few days ago, it really is an awesome device. And now I finally have some free time. Now the testing and dissection can begin, ![Cool](https://bitcointalk.org/Smileys/default/cool.gif) Yep, that's IMHO the most awesome thing about the whole TREZOR project, that it is open source.
|
|
|
|
malevolent
can into space
Legendary
Offline
Activity: 3472
Merit: 1722
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2016, 12:02:02 AM |
|
Any chance for Satoshi Labs to start sending Trezors in envelopes without any mention of "Trezor" on them?
|
Signature space available for rent.
|
|
|
sugarfly
Full Member
![*](https://bitcointalk.org/Themes/custom1/images/star.gif) ![*](https://bitcointalk.org/Themes/custom1/images/star.gif)
Offline
Activity: 135
Merit: 100
Zettel-Dolphin
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2016, 12:04:19 AM Last edit: September 22, 2016, 08:07:39 AM by sugarfly |
|
Not sure if I maybe missed this somewhere but is there a way to change to change to labels of the individual accounts?
There where it says 'Account#1' 'Account#2' etc...
This is not yet possible, but new version of myTREZOR which will be released soon will allow that. I assume that those account names are not stored on the device itself but kept around on the myTREZOR website, right? -sf-
|
|
|
|
georgem
Legendary
Offline
Activity: 1484
Merit: 1007
spreadcoin.info
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2016, 12:32:52 AM |
|
Am I correct in assuming that the reason the trezor is so derpy these days when it used to be fast as lighting is the result of patching some power analysis attack vectors?
Are you talking about the mitigation as described in this article http://johoe.mooo.com/trezor-power-analysis/ ? On the bright side, this simple side channel attack can be mitigated by using constant-time code and as I showed this code does not have to be slow Hm, I bought my trezor just a few months ago, ... I think it's responsive enough, but I have no reference. how much faster were earlier models exactly?
|
|
|
|
Anon136
Legendary
Offline
Activity: 1722
Merit: 1217
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2016, 01:47:08 AM |
|
Yes that is what I was talking about. Hm, I bought my trezor just a few months ago, ... I think it's responsive enough, but I have no reference. how much faster were earlier models exactly?
It wasnt having to do with earlier models. My trezor seemed to slow down significantly after the firmware update that came right after the discovery of that attack vector. But now it's seems to be back to the way it used to be. Also I could have just been experiencing an unlucky series of server problems with mytrezor.com around that time. Not sure.
|
Rep Thread: https://bitcointalk.org/index.php?topic=381041If one can not confer upon another a right which he does not himself first possess, by what means does the state derive the right to engage in behaviors from which the public is prohibited?
|
|
|
georgem
Legendary
Offline
Activity: 1484
Merit: 1007
spreadcoin.info
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2016, 12:12:11 PM |
|
It wasnt having to do with earlier models. My trezor seemed to slow down significantly after the firmware update that came right after the discovery of that attack vector. But now it's seems to be back to the way it used to be. Also I could have just been experiencing an unlucky series of server problems with mytrezor.com around that time. Not sure.
I see. Maybe they patched the hole first, and then improved its efficiency later. Hm, so has the TREZOR been using the same hardware for 3-4 years now? No changes in MCU etc at all?
|
|
|
|
BitcoinNewsMagazine
Legendary
Offline
Activity: 1806
Merit: 1164
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2016, 12:38:35 PM |
|
First Trezors did not ship until summer 2014 - two years.
|
|
|
|
georgem
Legendary
Offline
Activity: 1484
Merit: 1007
spreadcoin.info
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2016, 01:03:02 PM |
|
First Trezors did not ship until summer 2014 - two years.
Yes, but if you include the early development phase, the hardware has basically stayed the same for 3-4 years? I just wonder, if there was a hardware change during that time, what was the motivation behind it? Just out of interest.
|
|
|
|
Anon136
Legendary
Offline
Activity: 1722
Merit: 1217
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2016, 02:14:13 PM |
|
I see. Maybe they patched the hole first, and then improved its efficiency later.
A quite reasonable explanation.
|
Rep Thread: https://bitcointalk.org/index.php?topic=381041If one can not confer upon another a right which he does not himself first possess, by what means does the state derive the right to engage in behaviors from which the public is prohibited?
|
|
|
ColderThanIce
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 21, 2016, 02:55:57 PM |
|
It wasnt having to do with earlier models. My trezor seemed to slow down significantly after the firmware update that came right after the discovery of that attack vector. But now it's seems to be back to the way it used to be. Also I could have just been experiencing an unlucky series of server problems with mytrezor.com around that time. Not sure.
I've found that using MyTrezor with a Trezor can sometimes slow things to a complete crawl, so I don't think it's any fault of the device itself. Whenever I've had issues with my Trezor being slow with MyTrezor, I switched to using Electrum with the Trezor and it was responsive again, so I suspect that most of these slow Trezor issues lie within the MyTrezor web app.
|
ROLLIN.IO | BITCOIN DICE GAME ⚁ ⚂ ⚃ ⚄ ⚅ ⚁ ⚂
| ███████████████████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██████████████████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██████████ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ███████ ███████ ████ ██ ██ ██ ██ ████
| ███████████ S O C I A L C H A T T I N G | ██ ████ ██████ ████████ ██████████ ████████████ ██████████████ ████████████████ ██████████████████ ████████████████████ ████████ ████████
████████
████████
| ██████████████ LEVEL UP SYSTEM WITH REWADS | ██████ ████████ ██████████ ████████████ ██████████████ ██████████████████ ████████████████████ █ ████████████████ █ ████████████████ █ ████████████████ █ ████████████████ ██████████████████ ████████████████ █████████████ ██████████ █████ | ██████████████ FREE BITCOINS |
|
|
|
Anon136
Legendary
Offline
Activity: 1722
Merit: 1217
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 22, 2016, 02:54:53 AM |
|
It wasnt having to do with earlier models. My trezor seemed to slow down significantly after the firmware update that came right after the discovery of that attack vector. But now it's seems to be back to the way it used to be. Also I could have just been experiencing an unlucky series of server problems with mytrezor.com around that time. Not sure.
I've found that using MyTrezor with a Trezor can sometimes slow things to a complete crawl, so I don't think it's any fault of the device itself. Whenever I've had issues with my Trezor being slow with MyTrezor, I switched to using Electrum with the Trezor and it was responsive again, so I suspect that most of these slow Trezor issues lie within the MyTrezor web app. Yes it certainly could have been just this.
|
Rep Thread: https://bitcointalk.org/index.php?topic=381041If one can not confer upon another a right which he does not himself first possess, by what means does the state derive the right to engage in behaviors from which the public is prohibited?
|
|
|
xbach
Newbie
Offline
Activity: 40
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 22, 2016, 08:32:09 AM |
|
It's good news, but there are problems: - Lack of source code (certainly no link)
- Play Store (unknown source and functionality, vendor delivers product as a binary only)
So the claim that the App will work with any Android phone isn't true: there is a requirement that the handset has Play Store software (and, as is often the case with Android apps, may well depend on software libraries in the Play Store app or from Google Play Services). I'm surprised that the developers aren't aware that this is an issue, particularly as they were using a modern Nexus device to test the app. So, my questions for Satoshi Labs: - Does the app have source code available?
- Does it depend on Play Store libraries?
- Can it be distributed as an .apk through more reliable channels?
Source code is available on GitHub: https://github.com/trezor/trezor-androidI really would not recommend rooting your device. A rogue app could access Mycelium database, for example, and grab the private keys. It wasnt having to do with earlier models. My trezor seemed to slow down significantly after the firmware update that came right after the discovery of that attack vector. But now it's seems to be back to the way it used to be. Also I could have just been experiencing an unlucky series of server problems with mytrezor.com around that time. Not sure.
I've found that using MyTrezor with a Trezor can sometimes slow things to a complete crawl, so I don't think it's any fault of the device itself. Whenever I've had issues with my Trezor being slow with MyTrezor, I switched to using Electrum with the Trezor and it was responsive again, so I suspect that most of these slow Trezor issues lie within the MyTrezor web app. There were some issues with the backend server, which were fixed. If there are some issues, you can switch the backend server in the Settings in the myTrezor.com webwallet.
|
|
|
|
Carlton Banks
Legendary
Offline
Activity: 3430
Merit: 3080
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 22, 2016, 08:56:43 AM |
|
Thanks again xbach, I eventually would have looked on github myself. I really would not recommend rooting your device. A rogue app could access Mycelium database, for example, and grab the private keys.
I disagree with this, there is no logic to it. My desktop computer is "rooted", it's impossible for it not to be. Never had a problem with other Apps run with root privileges have stolen BTC or broken something. I've only ever used rooted smartphones, and have had zero issues in nearly 5 years. And it's full of benefits: a culture of high quality community-driven software development now exists, and it can be used to protect your privacy, especially from Google. My smartphone runs without a Google Account, or Google Apps. Google have very little footprint in my phone, and I'm certainly not using any Google Services software. I know that rooting phones can easily brick the phone, that's why I'm super careful when doing it. I strongly recommend that all Android users check to see how well their phone is supported with after-market software, and if the support is good, root. Then say goodbye to Google.
|
Vires in numeris
|
|
|
xbach
Newbie
Offline
Activity: 40
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 22, 2016, 09:01:46 AM |
|
Thanks again xbach, I eventually would have looked on github myself. I really would not recommend rooting your device. A rogue app could access Mycelium database, for example, and grab the private keys.
I disagree with this, there is no logic to it. My desktop computer is "rooted", it's impossible for it not to be. Never had a problem with other Apps run with root privileges have stolen BTC or broken something. I've only ever used rooted smartphones, and have had zero issues in nearly 5 years. And it's full of benefits: a culture of high quality community-driven software development now exists, and it can be used to protect your privacy, especially from Google. My smartphone runs without a Google Account, or Google Apps. Google have very little footprint in my phone, and I'm certainly not using any Google Services software. I know that rooting phones can easily brick the phone, that's why I'm super careful when doing it. I strongly recommend that all Android users check to see how well their phone is supported with after-market software, and if the support is good, root. Then say goodbye to Google. Well, I agree, so I would reformulate: I wouldn't recommend people, who do not understand what "rooting" does, to root their phones ![Wink](https://bitcointalk.org/Smileys/default/wink.gif) . It is the same as running "sudo su", while not knowing what it does. Also, the binary, built from source, is also on github: https://github.com/trezor/webwallet-data/raw/master/android/trezor-app-1.0.1.apk
|
|
|
|
Carlton Banks
Legendary
Offline
Activity: 3430
Merit: 3080
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 22, 2016, 09:52:29 AM |
|
Well, I agree, so I would reformulate: I wouldn't recommend people, who do not understand what "rooting" does, to root their phones ![Wink](https://bitcointalk.org/Smileys/default/wink.gif) . It is the same as running "sudo su", while not knowing what it does. Totally agree with that advice. More people should learn this stuff! Brilliant, that's exactly what I was interested in. Presumably this means that there are no Play Store dependencies either (yay). Thank you, thank you, xbach.
|
Vires in numeris
|
|
|
Anon136
Legendary
Offline
Activity: 1722
Merit: 1217
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 24, 2016, 04:01:36 AM |
|
Can an attacker gain control of my private keys if he controls my mnemonic seed but my pin remains secure?
|
Rep Thread: https://bitcointalk.org/index.php?topic=381041If one can not confer upon another a right which he does not himself first possess, by what means does the state derive the right to engage in behaviors from which the public is prohibited?
|
|
|
NLNico
Legendary
Offline
Activity: 1876
Merit: 1295
DiceSites.com owner
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 24, 2016, 04:20:28 AM |
|
Yes. Seed = private key. PIN only protects for not getting into the device (and does a good job on that, because every invalid PIN adds a serious delay.)
You should add a passphrase though which functions as 25th word. This should be pretty long (let's say 8+ characters), otherwise it could be easily brute-forced with the seed. However, if you forget your passphrase, the funds are gone.
Basically it's much more important to keep your backup seed safe than the device.
|
|
|
|
Anon136
Legendary
Offline
Activity: 1722
Merit: 1217
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 24, 2016, 04:47:51 AM Last edit: August 24, 2016, 05:24:00 AM by Anon136 |
|
Yes. Seed = private key. PIN only protects for not getting into the device (and does a good job on that, because every invalid PIN adds a serious delay.)
You should add a passphrase though which functions as 25th word. This should be pretty long (let's say 8+ characters), otherwise it could be easily brute-forced with the seed. However, if you forget your passphrase, the funds are gone.
Basically it's much more important to keep your backup seed safe than the device.
This is such a bummer. I wish the pin was functionally a 25th word as well. I'm sure there are reasons why it cant actually be, but it would be nice if there were a way it could functionally be. I mean if someone ever got a hold of my seed and keylogged me I would be cooked. But not if the pin was functionally a 25th word.
|
Rep Thread: https://bitcointalk.org/index.php?topic=381041If one can not confer upon another a right which he does not himself first possess, by what means does the state derive the right to engage in behaviors from which the public is prohibited?
|
|
|
NLNico
Legendary
Offline
Activity: 1876
Merit: 1295
DiceSites.com owner
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 24, 2016, 05:22:13 AM |
|
Yeh, seed + keylogger is probably the biggest risk. I think PIN would be somewhat easy to brute-force if it were 25th word (compared to passphrase), but too lazy to do the math. I can still see it could be an advantage for advanced users though (since keylogger is less effective in that situation.)
Anyway, on a different subject, can anyone from SatoshiLabs tell me if an Android version of the TREZOR Password Manager is planned? I love the idea of using Trezor as password manager and would actually encourage others to use it even if they don't have any bitcoins. But Android version seems necessary for me personally. Even if it isn't as advanced as LastPass (easily fills in password in other apps etc), just a simple list + way to get password in Android app would do for now.
|
|
|
|
Anon136
Legendary
Offline
Activity: 1722
Merit: 1217
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 24, 2016, 05:24:58 AM |
|
Yeh, seed + keylogger is probably the biggest risk. I think PIN would be somewhat easy to brute-force if it were 25th word (compared to passphrase), but too lazy to do the math. I can still see it could be an advantage for advanced users though (since keylogger is less effective in that situation.)
Alternatively if the trezor could hold the 25th word in memory just like it does the 24 before it that would be awesome. (or you know the deterministic value that is derived from the seed). Just not writing down the last four words anywhere and remembering just those four is basically this but with the caviat that you have to memorize a new password rather than one you already have committed to memory. But yea having the pin as a 25th or 26th or w/e word certainly couldnt hurt even if it wasnt enough on its own. Maybe both. The pin as an extra word plus the ability to have a password that you need for recovery but not for day to day use entering in on mytrezor.com
|
Rep Thread: https://bitcointalk.org/index.php?topic=381041If one can not confer upon another a right which he does not himself first possess, by what means does the state derive the right to engage in behaviors from which the public is prohibited?
|
|
|
|