[ESHOP launched] Trezor: Bitcoin hardware wallet

[bitpop]

You are combining like three different threads. I paid 3 BTC and looking for a refund of 3 BTCs. He made an offer on my device and I told him what I thought about his offer. I never said refund me what I think the device is worth. Please read and understand what I write, not that hard.

Seems I did, sorry. 

But I stand for the first point (about the refund).  If the 3 BTC that you send them were worth X euros when you send them, you paid X euros, and you are entitled to a refund of X euros.

They weren't priced in euros or usd when I purchased mine, they were priced 3 BTC for mine and 1 BTC for the plastic.

I have a hypothetical question for you. Lets say bitcoin had crashed all the way and were currently now worth $1 each, would you still be wanting your refund in btc?

No he only wants what he's entitled to, $300 + 3 btc and to keep his Trezor

[JorgeStolfi]

But I don't understand why do you need to attack every Bitcoin related company?

Can't you see that I am NOT attacking the company, but trying to help it and its clients?

Can you tell us how would you improve it?

I gave some suggestions (keep it as simple as possible, make the firmware read-only, make the case a bit harder to fake/tamper, ...)

But some risks are probably not fixable, such as the need to trust the manufacturer, hijacking in the mail, social engineering and address substitution ... 

Clients must be warned of those risks, and the warranty must be carefully worded so that the company is not held liable for losses that come from them.

[gweedo]

They weren't priced in euros or usd when I purchased mine, they were priced 3 BTC for mine and 1 BTC for the plastic.

But, sincerely, I would not feel sorry for Satoshilabs if they are forced to refund you 3 BTC.  It would teach them not to quote prices in BTC (and, more generally, that business and religion do not mix).  

(Sorry for being cynical.  Maybe I need to take a long break  from this forum.)

In Czech Republic, accounting act #563/1991 § 4/12 mandates that all accounting is done in Czech Crowns and § 24/2a mandates that the value rate is taken at the day of the payment. Here is the law to calm gweedo's lawyer and Jorge's cynicism: http://www.zakonyprolidi.cz/cs/1991-563

You do know most these laws apply to legal tenders, and not bartering, which is what it really is called. Since bitcoin is not legal tender, we are technically bartering, which is subject to different laws.

Also I should get back what I paid, if they keep it in stones and sticks, I should get back bitcoins. I only supported them by pre-ordering and having about 5 people pre-order with me as well.

You are combining like three different threads. I paid 3 BTC and looking for a refund of 3 BTCs. He made an offer on my device and I told him what I thought about his offer. I never said refund me what I think the device is worth. Please read and understand what I write, not that hard.

Seems I did, sorry.  

But I stand for the first point (about the refund).  If the 3 BTC that you send them were worth X euros when you send them, you paid X euros, and you are entitled to a refund of X euros.

They weren't priced in euros or usd when I purchased mine, they were priced 3 BTC for mine and 1 BTC for the plastic.

I have a hypothetical question for you. Lets say bitcoin had crashed all the way and were currently now worth $1 each, would you still be wanting your refund in btc?

Yes because it would net gain of nothing nor a net loss. I rather get back exactly what I paid with. Only fair way to do it in my books to be honest.

You are combining like three different threads. I paid 3 BTC and looking for a refund of 3 BTCs. He made an offer on my device and I told him what I thought about his offer. I never said refund me what I think the device is worth. Please read and understand what I write, not that hard.

Seems I did, sorry.  

But I stand for the first point (about the refund).  If the 3 BTC that you send them were worth X euros when you send them, you paid X euros, and you are entitled to a refund of X euros.

They weren't priced in euros or usd when I purchased mine, they were priced 3 BTC for mine and 1 BTC for the plastic.

I have a hypothetical question for you. Lets say bitcoin had crashed all the way and were currently now worth $1 each, would you still be wanting your refund in btc?

No he only wants what he's entitled to, $300 + 3 btc and to keep his Trezor

That is why I opted to use escrow so I can't swindle them and they can't swindle me. Also my trezor is basically unusable so I really don't want to keep it.

[JorgeStolfi]

PS. However it is true that I have very low opinion of many bitcoin companies, and I am rooting for their failure.  In particular, I view all the bitcoin investment funds as scams: they try to make bitcoin seem an attractive investment, when in fact it is gambling in a lottery with unknown odds and payoffs.   

[dexX7]

Your comparison is inaccurate, because a wallet file on a USB drive is just as easy to steal as a wallet file on a hard drive, if it's plugged in. Trezor isolates the private keys from the computer, which is the whole point. The host computer sends the Trezor the transaction, the Trezor signs it and sends it back, then the computer broadcasts it to the network. The private keys are never accessible by the host machine.

A Trezor acts as firewall between "the wallet that can be easily stolen from an USB stick" and your host.

It's less secure than paper wallets in the sense that there could be some sort of bug that would expose your seed, or individual private keys somehow.

Given that a Trezor and a pure offline machine are pretty similar, I tend to disagree here. Pro argument for Trezor: a pure offline machine is still a much more complex machine than a tiny single purpose device, even though, in reality, it's actually not a single purpose device, but a mini version of the complex machine, further restricted by some software as per default.

Assuming both Trezor as well as offline machine are never ever exposed, then they are even. Exposing one of them adds risk, that is without any doubt. A Trezor is likely more secure in an exposed context.

But the initial question was: is an exposed Trezor more secure than annever exposed offline wallet, right?

It's extremely safer than paper, especially when spending

You can't get total isolation and also be able to use the private keys (if you know how that could be done, I'd be very interested in hearing about it).

Well, just keep the offline machine isolated. Create your keys offline, sign your transactions offline. There is no need to connect the offline machine to an online machine or any other machine, ever. Moving data between devices via USB is by no means required, assuming you move data by hand or some other air gapped mechanism. Start here, if you want to use Bitcoin Core, but I'm pretty sure Electrum and especially Armory provide a way to handle offline transactions as well. Think of it this way: where you act as connection between the offline machine and the online machine by moving data around by hand, the Trezor basically does the same, whereby the firmware of the device fulfills your role of moving only the data that is considered as accepted. I think the key difference and the lack of comparsion in the whole discussion is rather based on the assumption that a Trezor is usually connected more frequently, because that it's purpose, while a pure offline wallet is usually used very rarely.

Trezor is, right now, the best of both worlds between hot and cold wallets.

Fully agree. Trezor is a great device and adds a nice layer of protection.


Nevertheless and by the way, it sucks to see some of you guys actually flame gweedo. You may argue about the way his problem was presented, but this doesn't magically solve any problem, which is, without a doubt, exisiting. That said, one of my first experiments with my Trezor was the attempt to feed it with data it probably doesn't understand, namely m-of-n multisig transactions. Guess what: the result was a never ending loop of errors which resulted in a complete browser freeze which I was only able to tame after unplugging the device. That being said, if this wasn't done intentionally and if real coins were involved - which I still could not access (for whatever reason that might be) several days later.. oh well.

My experience with the support was actually fine, with a response in probably less than 6 hours, assuring me that this problem is "known and taken care of by the devs".

[klokan]

But I don't understand why do you need to attack every Bitcoin related company?

Can't you see that I am NOT attacking the company, but trying to help it and its clients?

Can you tell us how would you improve it?

I gave some suggestions (keep it as simple as possible, make the firmware read-only, make the case a bit harder to fake/tamper, ...)

But some risks are probably not fixable, such as the need to trust the manufacturer, hijacking in the mail, social engineering and address substitution ... 

Clients must be warned of those risks, and the warranty must be carefully worded so that the company is not held liable for losses that come from them.

If the device was simpler than it is now, you would have the same comment and ask it to be simpler. You were expecting it to have hundreds of thousands of lines of code, while it has 20k. And your proposition is to make it simpler.
Similarly, if the case was harder to fake, you would again suggest to make it even harder to fake, because there is no unfakeable case. These comments are not helping.
The third and the last proposition about a firmware. When you want to flush it, you need to boot the device into firmware flushing mode (with both buttons pressed when plugging it into computer). It's not possible to hacker flush it whenever he wants. You need to continuously plug it in in special mode and confirm the firmware signature on the screen. User can decide never to update his firmware. In that case you may consider it "read-only".

Since all your improvement propositions were addresses and you warned us about the unfixable ones, then I believe your mission is done here. Thanks.

PS: Investing in any currency is "gambling in a lottery with unknown odds and payoffs" because currencies are not backed by anything these days. Some are more volatile, some are less volatile. Everybody knows that. I'm not "investing" into it myself, but I believe that the technology is extremely interesting and would make for a extremely good payment system if adopted worldwide. Please note the difference between "investment" and "payment system". The thing is that today, in the internet age, if I wanted to send you some brazilian reals for your valuable insight about how to improve this product, it would take at least a week for you to receive it and you would receive at most 95% of the value I sent you. Do you consider the existing payment system optimal? Can't you see some benefits in Bitcoin now?

[JorgeStolfi]

If [ bla bla bla  ] you [ bla bla bla].

An if you were not scolding me for things that you say I would do if I had not avoided to do them, you would be killing baby seals with a railroad share to make leg warmers for your pet unicorn.  What a shame. 

I believe your mission is done here. Thanks.

You are welcome.

Pif I wanted to send you some brazilian reals for your valuable insight about how to improve this product, it would take at least a week for you to receive it and you would receive at most 95% of the value I sent you. Do you consider the existing payment system optimal? Can't you see some benefits in Bitcoin now?

If you were to send me some bitcoin, I may get 75% of what you spent to buy it a week ago, and it may get stolen by a hacker or a trojan in my computer, unless i get a second computer just to handle it; and if it gets stolen or sent to the wrong address, nothing can be done, it is lost.  Can't you see why people are not rushing to use bitcoin now?

[stick]

It would teach them not to quote prices in BTC (and, more generally, that business and religion do not mix).  

Take a look at buytrezor.com -- we already learned and pegged the price in dollars. :-)

[Erdogan]

Summary for new readers:

The trezor is brilliant.

The most secure solution.

The most practical solution.

Easy to back up.

No need for a separate, airgapped computer.

The hierarchical deterministic wallet is brilliant.


Operational problems: You need a good USB-port to operate it. If you have problems, try another port.

[klokan]

If [ bla bla bla  ] you [ bla bla bla].

An if you were not scolding me for things that you say I would do if I had not avoided to do them, you would be killing baby seals with a railroad share to make leg warmers for your pet unicorn.  What a shame.  

I believe your mission is done here. Thanks.

You are welcome.

Pif I wanted to send you some brazilian reals for your valuable insight about how to improve this product, it would take at least a week for you to receive it and you would receive at most 95% of the value I sent you. Do you consider the existing payment system optimal? Can't you see some benefits in Bitcoin now?

If you were to send me some bitcoin, I may get 75% of what you spent to buy it a week ago, and it may get stolen by a hacker or a trojan in my computer, unless i get a second computer just to handle it; and if it gets stolen or sent to the wrong address, nothing can be done, it is lost.  Can't you see why people are not rushing to use bitcoin now?

I wouldn't send you Bitcoin if you did not have a Trezor, to protect you from thiefs and hackers. Also, I was talking about a hypothetical situation when Bitcoin would be adopted worldwide. If that is the case, price would not be that volatile. But, that would never happen if there are no guys developing such a great product like Trezor. The wide adoption would not happen today or next week. The Bitcoin will see a couple of price drops before that happens, so your warnings for investors are quite accurate. The point is, you should not dismiss the technology and the BTC as a payment method, because it's not going away.

[Valzador]

Is it a smart option to move all my bitcoins to trezor?

What happens if mytrezor.com gets shut down or something? How do I access my bitcoins then?

[dillpicklechips]

Is it a smart option to move all my bitcoins to trezor?

What happens if mytrezor.com gets shut down or something? How do I access my bitcoins then?

The trezor works with electrum and soon many more wallets.

[klondike_bar]

Is it a smart option to move all my bitcoins to trezor?

What happens if mytrezor.com gets shut down or something? How do I access my bitcoins then?

start small and play with the trezor. try moving bitcoins between different addresses on it or between seperately password-encrypted wallets on it to become comfortable.

Im sure after a week of use you will know its safe for all your bitcoin storage. Ive got about 10% of mine on it now and am confident enough to move the rest over when i get a chance to sweep the keys from my unsecured paper wallets (no password, so theft protection of them is a concern right now)

[TwinWinNerD]

Just tried to connect my TREZOR to my laptop.

"Device could not be opened. Make sure you don't have myTREZOR running in another tab or browser window!"

Any idea how to solve this? Obviously I only have 1 tab opened. I tried restarting and tried all 3 browers....

I am using a new cable with USB 2.0 and running on a powered USB hub.

Same setup works correctly on my normal PC

[blossbloss]

PS. However it is true that I have very low opinion of many bitcoin companies, and I am rooting for their failure.  In particular, I view all the bitcoin investment funds as scams: they try to make bitcoin seem an attractive investment, when in fact it is gambling in a lottery with unknown odds and payoffs.  

ALL investing is gambling in a lottery with unknown odds and payoffs.  There are scientific measures of volatility and associated risks, and these are priced in appropriately by the market.

On the other topic, your say you are rooting for bitcoin company failures.  Why? Do you think bitcoin is inherently dangerous for society?  I don't get it.

edit: typo

[JorgeStolfi]

ALL investing is gambling in a lottery with unknown odds and payoffs.  There are scientific measures of volatility and associated risks, and these are priced in appropriately by the market.

Indeed it is all a matter of degree.  But, for example, there are many people trying to convince people to invest in bitcoin as a hedge against inflation.  No rational analysis could justify that, even in countries like Argentina.  There are plenty of investments that will compensate for inflation and are fairly likely to survive a finacial/monetary crash.  No one knows what will be the price of bitcoin next month, nor how it would behave in a global economic crisis.

you say you are rooting for bitcoin company failures.  Why? Do you think bitcoin is inherently dangerous for society?

I am rooting for the failure of MANY bitcoin companies, because they are, at the very least, misleading customers.  All bitcoin investment funds are in this list.  I used to think that mining companies and makers of mining equipment were  honest -- just making a product that people wanted to buy -- but now I see that several of them are flat-out scams.  Ditto for certain bitcoin exchanges, perhaps all of them.

[instagibbs]

This is all kind of off-topic I think.

[JorgeStolfi]

This is all kind of off-topic I think.

Indeed, sorry.

[blossbloss]

This is all kind of off-topic I think.

Indeed, sorry.

Yes, sorry from me too.

[keithers]

It would be cool if the trezor web wallet could be updated so that you can also see the wallets balance in USD or Pounds, or Pesos, or whatever your local fiat currency is...