[ESHOP launched] Trezor: Bitcoin hardware wallet

[DobZombie]

What's the ETA on these?

I want one already! 

[slush]

i guess it is not possible to put wallets of different coins on the same trezor?

You can use one seed for all cryptocurrencies. Right now we support BTC, NMC and LTC; With proper support in *coin software you can change currency in runtime and you'll see *coin history and balances. We're working with Litecoin developers to support Trezor in their client.

[NewLiberty]

Increasingly awesome.  This is going to make life easier in many ways.

[bitwhizz]

really looking forward to ordering one and using it

[Hawkix]

In a just few days .. http://www.bitcointrezor.com/news/trezor-european-bitcoin-convention

[coblee]

i guess it is not possible to put wallets of different coins on the same trezor?

You can use one seed for all cryptocurrencies. Right now we support BTC, NMC and LTC; With proper support in *coin software you can change currency in runtime and you'll see *coin history and balances. We're working with Litecoin developers to support Trezor in their client.

I just got my trezor dev unit. Will look into Litecoin support.

[nuffsaid420]

What's the ETA on these?

I want one already! 

[coblee]

I love the matrix used for entering your pin. That way even if the computer you used is compromised, they can't steal your pin because you will be typing in a different one each time. The only problem is that the matrix only has 9 spots. Nothing maps to a 0. My original pin had a 0 in it and I was stuck. I had to modify the emulator on the RPI to hack in my pin to change the pin. I suggest you do a server-side check on a new pin to make sure there's no 0 in it so that one doesn't accidentally make this mistake.

One more suggestion, allow reverse mapping of pin matrix as that is what's easiest for someone like me to remember.
For example, let's say your pin is 1234 and you are shown this matrix:

Code:

9 4 8
5 6 7
3 2 1

Right now, you'd have to find the spots that have 1,2,3, and 4 and then figure out the index of those spots. In this case it's 9872.
My suggestions is to also (or only?) accept the reverse mapping... where you lookup the spots that represents the index 1,2,3 and 4 and type the numbers in those spots, so 9485 (the first 4 numbers in the matrix)
The main reason is that a lot of people use visual memory and they will remember the location of their pin and it's much easier to figure out the encoded pin this way.

P.S. Is there a better place (forum/irc/etc) for suggestions like these?

[stick]

I suggest you do a server-side check on a new pin to make sure there's no 0 in it so that one doesn't accidentally make this mistake.

You are entering PIN during the initialization phase of the device. If there is no 0 in the matrix, you can't enter it.

Right now, you'd have to find the spots that have 1,2,3, and 4 and then figure out the index of those spots. In this case it's 9872.

If client has the proper implementation of pin matrix you won't be entering numerical indices (like 9872), but you'll click on blank squares (and clicks will be translated to indices by software). This will be much more intuitive and so there will be no need for reverse mapping you mentioned.

P.S. Is there a better place (forum/irc/etc) for suggestions like these?

Probably https://bitcointalk.org/index.php?topic=296078.0

[slush]

My original pin had a 0 in it and I was stuck. I had to modify the emulator on the RPI to hack in my pin to change the pin. I suggest you do a server-side check on a new pin to make sure there's no 0 in it so that one doesn't accidentally make this mistake.

I'm already aware of this problem and I'll fix it. This may happen during LoadDevice call, where PIN is entered directly, not via PinMatrix.

[coblee]

Right now, you'd have to find the spots that have 1,2,3, and 4 and then figure out the index of those spots. In this case it's 9872.

If client has the proper implementation of pin matrix you won't be entering numerical indices (like 9872), but you'll click on blank squares (and clicks will be translated to numbers by software). This will be much more intuitive and so there will be no need for reverse mapping you mentioned.

It is unfortunate that you are sending the pin matrix to the client. Because then, a hacked client can figure out your pin. If you don't send the pin matrix to the client, then there would be no way for a compromised client to figure out your pin. I think that would be a better solution. Please consider it.

[stick]

It is unfortunate that you are sending the pin matrix to the client. Because then, a hacked client can figure out your pin. If you don't send the pin matrix to the client, then there would be no way for a compromised client to figure out your pin. I think that would be a better solution. Please consider it.

Of course we are not sending the matrix to the client. If we did, it would defeat the whole purpose of it. I meant "indices" instead of "numbers" in this sentence:

(and clicks will be translated to numbers by software)

[coblee]

It is unfortunate that you are sending the pin matrix to the client. Because then, a hacked client can figure out your pin. If you don't send the pin matrix to the client, then there would be no way for a compromised client to figure out your pin. I think that would be a better solution. Please consider it.

Of course we are not sending the matrix to the client. If we did, it would defeat the whole purpose of it. I meant "indices" instead of "numbers" in this sentence:

and clicks will be translated to numbers by software

Oh sorry. I see what you mean. The client just displays the 3x3 boxes for you to click on.

[stick]

Oh sorry. I see what you mean. The client just displays the 3x3 boxes for you to click on.

Yes. It's quite straightforward concept, but hard to explain without any visualization.

[weaknesswaran]

Client displays:
OOO
OOO
OOO

trezor display (changes every time):
954
128
367


?

[stick]

?

TRUE

[dillpicklechips]

IMHO, Trezor could be VERY useful as a method of securing online identities. If the Trezor can secure millions it certainly can keep my identity safe. It could allow signing on to websites without any type of password. All I would have to do is associate a single Bitcoin address to a username. I could even use a different Bitcoin address for different online accounts. The website, instead of a password, would ask for a random string to be signed by a certain Bitcoin address at sign in.

My question is: Is there a BIP in the works that will standardize some type of communication between Bitcoin clients and application/website for those who wish to use "Bitcoin Identities" as a secure method of logging in? Or is a BIP even needed?

I really think this could be a killer app feature for the Trezor. I can see people using it for maintaining ultra secure sign-ins without owning any Bitcoins at all or remembering complicated passwords. Passwords could be a thing of the past. All you need is a little device like the Trezor!

[stick]

My question is: Is there a BIP in the works that will standardize some type of communication between Bitcoin clients and application/website for those who wish to use "Bitcoin Identities" as a secure method of logging in? Or is a BIP even needed?

We already had some discussion about this with slush and we certainly want to come up with an "Identity" BIP (that builds on top of BIP32). That way it will be standardized and easy to implement.

[Mike Hearn]

Trezor is at heart just a secure display with a couple of buttons and a small CPU. Such a thing has massive applications in all kinds of areas outside of Bitcoin. If they can scale up and get the costs down, stick and slush could build an decent sized business just selling these gadgets to businesses that want strong authorization of certain actions. Any company that currently uses 2-factor authentication for logging in could potentially benefit from the upgrade - including banks!

I think it'd make sense to pursue such markets, even though they aren't Bitcoin related. The money made from them can always be reinvested into other Bitcoin related research, and making the rest of the world more secure at the same time is a clear win for humanity.

[phelix]

I assume it would be possible to use Trezor for signing of arbitrary messages (provided some software effort)?

It would be cool to have a python library so one could easily play with it. If you go for Electrum please try to make it a separate and generic module.