Bitcoin Forum
October 23, 2018, 05:43:52 PM *
News: Make sure you are not using versions of Bitcoin Core other than 0.17.0 [Torrent], 0.16.3, 0.15.2, or 0.14.3. More info.
 
   Home   Help Search Donate Login Register  
Pages: [1] 2 »  All
  Print  
Author Topic: Are Hardware Wallets to be trusted?  (Read 667 times)
Political Sniper
Newbie
*
Offline Offline

Activity: 4
Merit: 0


View Profile
December 06, 2017, 12:45:52 AM
 #1

We all know the securityissues with Microsoft and specifically it's privacy concerns. But, I never seen anyone talking about the actual hardware you are using and trusting with your private keys. There's been evidence that previously reputable companies have been spying on it's customers via keyloggers. Just take dell for instance: http://www.zerohedge.com/news/2017-05-12/hp-laptops-discovered-be-spying-users-keylogger

Every time you are importing your private keys, or signing an address you are ultimately trusting the hardware which you are using. Even if you sign/import on a offline computer. You are still trusting the developers of the hardware which you are using. I don't think I'm completely crazy in thinking this is a genuine issue and should at least be discussed. There's been several companies which have spied on it's users through different means; Apple, dell and Microsoft are some of the biggest developers/manufacturers in the world and arguably the most 'trusted' in their field.

These hardware wallets which are very popular among the community today; Trezor and Ledger more specifically are seen as gods gift among the community and everyone believes they are 100% safe. But, can we really trust those behind the development? Can we trust that the government haven't got their hands in things? Please understand I'm not calling out the hardware wallets as scams or anything like that. I actually believe they are very user friendly and are a great storage option for a hot wallet which you need to access somewhat securely regularly.

But, these hardware wallets have been developed and manufactured by less renowned people than the companies mentioned above. Yet they were simply embraced by the community without any questions.

I'm just gong to quote some websites which I believe have concerns about this and hardware wallets too.
Quote from: bitslog
How much do you trust your hardware wallet?

When it comes down to how much you should trust your hardware, an issue that is becoming more popular nowadays, deterministic subliminal channel-free signature schemes seems to offer a great advantage. I’ve come to this conclusion while designing the Firmcoin and analyzing the possible adversaries for a hardware wallet.  Even if you trust your private keys to your hardware wallet, you generally don’t trust it as much as giving the hardware wallet full Internet access. not even wireless communication. You provide the hardware wallet with a transaction to sign, and you get it signed. In the case of a Bitcoin hardware wallet, which uses ECDSA, the best you can have is a subliminal-free but interactive signing protocol, that still poses some risks.

Read more here: https://bitslog.wordpress.com/2014/06/09/deterministic-signatures-subliminal-channels-and-hardware-wallets/

Ultimately, I would like some discussion on the safety of using hardware wallets specifically or generating/importing/exporting private keys on them.
1540316632
Hero Member
*
Offline Offline

Posts: 1540316632

View Profile Personal Message (Offline)

Ignore
1540316632
Reply with quote  #2

1540316632
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1540316632
Hero Member
*
Offline Offline

Posts: 1540316632

View Profile Personal Message (Offline)

Ignore
1540316632
Reply with quote  #2

1540316632
Report to moderator
1540316632
Hero Member
*
Offline Offline

Posts: 1540316632

View Profile Personal Message (Offline)

Ignore
1540316632
Reply with quote  #2

1540316632
Report to moderator
Jmesser80
Member
**
Offline Offline

Activity: 67
Merit: 10


View Profile
December 06, 2017, 01:33:55 AM
 #2

I’m probably not one who can answer the question about how safe the hardware wallets are, I don’t know programming or code etc. but the larger companies, Microsoft Apple Samsung, all had to start out as small companies no one knew about but have built trust in the products through time. Although I do agree vigilance is needed that’s why It’s good to have forums like this to bring possible issues to light.

jseverson
Hero Member
*****
Offline Offline

Activity: 756
Merit: 634


View Profile
December 06, 2017, 01:35:01 AM
 #3

We all know the securityissues with Microsoft and specifically it's privacy concerns. But, I never seen anyone talking about the actual hardware you are using and trusting with your private keys. There's been evidence that previously reputable companies have been spying on it's customers via keyloggers. Just take dell for instance: http://www.zerohedge.com/news/2017-05-12/hp-laptops-discovered-be-spying-users-keylogger

Wow that's disturbing. I read about this a while ago but I thought it was just some statistics gathering software or something. I had no idea it was actually recording keystrokes on an unencrypted file, according to https://www.cnet.com/news/keylogger-discovered-on-some-hp-laptops-conexant/. Either way, this is why I support open-source software. Everything is up for review, so you know exactly what you're getting into. I have stopped trusting Windows for some time now, opting for Linux for more sensitive activites, and this just proves I'm right.

As for hardware wallets, I have to be honest that I have no idea how they work internally, but the fact that they have been completely safe thus far suggests that they're quite trustworthy. There are probably some out there that houses hundreds of thousands of coins. But then again, there are only no incidents until there has been an incident, so that could change in a hurry. I personally still trust them because it's not like they're running on some kind of freemium model, but that's just me.

Nightwatchman
Newbie
*
Offline Offline

Activity: 60
Merit: 0


View Profile
December 06, 2017, 02:01:20 AM
 #4

The more valuable Bitcoin becomes, the harder it is to blindly trust any method of coin storage.

At one point I'm sure Mt Gox customers trusted the exchange.

The Ledger Nano S plug in for Chrome (Mac) has some holes in it, which has put me on full alert.

FWIW, I spread my coins in many different places to mitigate the risk of any one of them falling over.
no0dlepunk
Sr. Member
****
Offline Offline

Activity: 476
Merit: 258

I AM CASHLESS!!!!


View Profile
December 06, 2017, 02:08:37 AM
 #5

I have read the OP and all I can say is - YES, hardware wallets are safe and could be trusted. I personally recommend Hardware Wallet HW. I've been using it for a year already, and so far I haven't gotten any issues at all. I have a hard plastic card that holds my private keys which makes it impossible for a hack.

███████████████████████▄▄▄
████████████████████████████▄▄
███████████████████████████████▄
████████ ▀█▀▀▀███████████████████
██████ ▀█▄     ▀████▌    █████████
███████▄      ▄██▀▀█▌    ██████████
███████     ▄██▀   █▌    ██████████
███████    ▐█▀     █▌    ██████████
███████    ▐█     ▐██    ██████████
███████    ██▌         ▄ ▀█████████
███████             ▄▄ ▀█▄████████
███████████████████████▄█████████
███████████████████████████████▀
████████████████████████████▀▀
███████████████████████▀▀▀
Digiwage
▬▬▬▬▬▬▬   ANN  Whitepaper  Twitter  Discord  Reddit   ▬▬▬▬▬▬▬
Decentralized Freelance Workplace










███████████████████████▄▄▄
████████████████████████████▄▄
███████████████████████████████▄
████████ ▀█▀▀▀███████████████████
██████ ▀█▄     ▀████▌    █████████
███████▄      ▄██▀▀█▌    ██████████
███████     ▄██▀   █▌    ██████████
███████    ▐█▀     █▌    ██████████
███████    ▐█     ▐██    ██████████
███████    ██▌         ▄ ▀█████████
███████             ▄▄ ▀█▄████████
███████████████████████▄█████████
███████████████████████████████▀
████████████████████████████▀▀
███████████████████████▀▀▀
Join our
Workplace










dawoodkhan97
Member
**
Offline Offline

Activity: 196
Merit: 10

LibertyLance - Where Freelancing Meets Blockchain


View Profile WWW
December 08, 2017, 07:53:34 PM
 #6

Hard wallets make it nearly impossible to hack
bitcoins and I have not heard of a single case
where a person's hard wallet was hacked unless
he forgot its private key.

Other than that hard wallets are the best and
secure medium for bitcoin storage.

/ / _  LibertyLance  |  First Ever Decentralized Gig Based Marketplace
ANN  Whitepaper  One Pager   ▬▬▬  SUBSCRIBE NOW  ▬▬▬   Twitter  Facebook  Telegram
▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬   Private Sale Starts on May 29th   ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬
odolvlobo
Legendary
*
Offline Offline

Activity: 2282
Merit: 1162



View Profile
December 08, 2017, 07:57:48 PM
 #7

Start here: https://doc.satoshilabs.com/trezor-faq/software.html#why-should-i-trust-trezor-with-my-private-keys

Buy bitcoins with cash from somebody near you: LocalBitcoins
Buy stuff on Amazon at a discount with bitcoins: Purse.io
Join an anti-signature campaign: DannyHamilton's ignore list
Xavofat
Hero Member
*****
Offline Offline

Activity: 882
Merit: 518

Satoshi wanted "small, casual transactions".


View Profile WWW
December 08, 2017, 08:07:27 PM
 #8

But, can we really trust those behind the development? Can we trust that the government haven't got their hands in things?
You don't understand the importance of open source code.  Most major companies' code is closed source, so your average user can't just take a look and see whether the code that they produced is safe.

The hardware wallets require for you to consent to an update, so if an update contains malicious code, it's almost certain that several reputable users will have reviewed the code and publicised the problem.

Therefore, the reputation of the developers (while it is actually very good for TREZOR by the way - they own Slush Pool for example) is pretty much irrelevant in this case.
The more valuable Bitcoin becomes, the harder it is to blindly trust any method of coin storage.
That's why we have offline storage.
martin.k
Newbie
*
Offline Offline

Activity: 52
Merit: 0


View Profile
December 08, 2017, 08:13:01 PM
 #9

Trusting is the hardest thing in Cryptocurrency world. You can easily be scammed in no time.
I am also searching for a good hardware wallet, but could not find any yet!
xSkyer
Full Member
***
Offline Offline

Activity: 196
Merit: 100


★777Coin.com★ Fun BTC Casino!


View Profile
December 08, 2017, 08:23:47 PM
 #10

Quote
These hardware wallets which are very popular among the community today; Trezor and Ledger more specifically are seen as gods gift among the community and everyone believes they are 100% safe. But, can we really trust those behind the development?

That is why I decided to replace my Ledger Nano S with the latest Trezor T. Trezor software is open-source so everyone can check if the code is bug-free or if there are any backdoors. Ledger devices are based on secure elements which have limited space and capabilities and most importantly, we can't see what happens inside it. Also, Ledger has started working with Intel which is known for problems with Intel Management Engine. I don't trust developers, I trust community that checks the code provided by them.

megynacuna
Sr. Member
****
Offline Offline

Activity: 644
Merit: 250


★Bitvest.io★ Play Plinko or Invest!


View Profile
December 08, 2017, 09:02:02 PM
 #11

Quote
These hardware wallets which are very popular among the community today; Trezor and Ledger more specifically are seen as gods gift among the community and everyone believes they are 100% safe. But, can we really trust those behind the development?

That is why I decided to replace my Ledger Nano S with the latest Trezor T. Trezor software is open-source so everyone can check if the code is bug-free or if there are any backdoors. Ledger devices are based on secure elements which have limited space and capabilities and most importantly, we can't see what happens inside it. Also, Ledger has started working with Intel which is known for problems with Intel Management Engine. I don't trust developers, I trust community that checks the code provided by them.

Exactly, Trezor is very reliable and open source, it makes it have more room for development and improvements. I recently forked out 150$ for one and i think it's worth my investment because i've started taking my bitcoin saving seriously due to the astronomical rate at which it is rising in value.



BITVEST DICE
HAS BEEN RELEASED!


▄████████████████████▄
██████████████████████
██████████▀▀██████████
█████████░░░░█████████
██████████▄▄██████████
███████▀▀████▀▀███████
██████░░░░██░░░░██████
███████▄▄████▄▄███████
████▀▀████▀▀████▀▀████
███░░░░██░░░░██░░░░███
████▄▄████▄▄████▄▄████
██████████████████████
▀████████████████████▀
▄████████████████████▄
██████████████████████
█████▀▀█▀▀▀▀▀▀██▀▀████
█████░░░░░░░░░░░░░▄███
█████░░░░░░░░░░░░▄████
█████░░▄███▄░░░░██████
█████▄▄███▀░░░░▄██████
█████████░░░░░░███████
████████░░░░░░░███████
███████░░░░░░░░███████
███████▄▄▄▄▄▄▄▄███████
██████████████████████
▀████████████████████▀
▄████████████████████▄
███████████████▀▀▀▀▀▀▀
███████████▀▀▄▄█░░░░░█
█████████▀░░█████░░░░█
███████▀░░░░░████▀░░░▀
██████░░░░░░░░▀▄▄█████
█████░▄░░░░░▄██████▀▀█
████░████▄░███████░░░░
███░█████░█████████░░█
███░░░▀█░██████████░░█
███░░░░░░████▀▀██▀░░░░
███░░░░░░███░░░░░░░░░░
▀██░▄▄▄▄░████▄▄██▄░░░░
▄████████████▀▀▀▀▀▀▀██▄
█████████████░█▀▀▀█░███
██████████▀▀░█▀░░░▀█░▀▀
███████▀░▄▄█░█░░░░░█░█▄
████▀░▄▄████░▀█░░░█▀░██
███░▄████▀▀░▄░▀█░█▀░▄░▀
█▀░███▀▀▀░░███░▀█▀░███░
▀░███▀░░░░░████▄░▄████░
░███▀░░░░░░░█████████░░
░███░░░░░░░░░███████░░░
███▀░██░░░░░░▀░▄▄▄░▀░░░
███░██████▄▄░▄█████▄░▄▄
▀██░████████░███████░█▀
▄████████████████████▄
████████▀▀░░░▀▀███████
███▀▀░░░░░▄▄▄░░░░▀▀▀██
██░▀▀▄▄░░░▀▀▀░░░▄▄▀▀██
██░▄▄░░▀▀▄▄░▄▄▀▀░░░░██
██░▀▀░░░░░░█░░░░░██░██
██░░░▄▄░░░░█░██░░░░░██
██░░░▀▀░░░░█░░░░░░░░██
██░░░░░▄▄░░█░░░░░██░██
██▄░░░░▀▀░░█░██░░░░░██
█████▄▄░░░░█░░░░▄▄████
█████████▄▄█▄▄████████
▀████████████████████▀




Rainbot
Daily Quests
Faucet
HongKong
Hero Member
*****
Offline Offline

Activity: 798
Merit: 500



View Profile
December 08, 2017, 09:08:06 PM
 #12

Hard wallets make it nearly impossible to hack
bitcoins and I have not heard of a single case
where a person's hard wallet was hacked unless
he forgot its private key.

Other than that hard wallets are the best and
secure medium for bitcoin storage.
You are somewhat correct. If there were any hacks involving a Hardware wallet then it would most likely be an inside job from the company that built that wallet.

            ████████████████████
           ██████████████████████
          ████                ████
         ████   █████   ████   ████
        ████   ███████ ██████   ████
       ████   ████ ████   ████   ████
      ████   ████   ████   ████   ████
     ████   ████  ██ ████   ████ 
    ████   ████   ██  ████
    ████   ████   ███  ████
    ████   ████   ███
    ████   ████   ███
    ████   ████   ███
    ████   ████   ███    ███
     ████   ████   ████ ████ ████
      ████   ████   ████ ██ ████  ████
       ████   ████   ████ ████   ████
        ████   ██████ ██████    ████
         ████   ████   ████    ████
          ████                ████
           ██████████████████████
            ████████████████████
I N D X
okissabam
Sr. Member
****
Offline Offline

Activity: 644
Merit: 250



View Profile
December 08, 2017, 09:10:11 PM
 #13

I think these hardware wallets are trusted because I haven't heard any complaint from a person who owns it that they've had problems or were ever hacked when they stored their coins, so most probably they are very reliable.

███▄                 ▄███           ▄▄███▀▀█▄▄                   ▄▄█████▄▄           ███▄               ███    ▀██▄             ▄██▀
█████               ▄████       ▄▄████▄█ ██ ████▄▄           ▄▄████▀▀▀▀▀████▄▄       █████              ███      ███           ███
██████             ██████      ▀▀██▄█████▄▄███▄█▀▀▀         ███▀▀         ▀▀███      ███▀██▄            ███       ▀██▄       ▄██▀
███▀███▄         ▄██▀ ███     ███▄▀███▀████████ ████       ███               ███     ███  ███           ███         ███     ███
███  ▀███       ███▀  ███    █████ █████████  █▄▀▀▀▄█     ███                 ███    ███   ▀██▄         ███          ▀██▄ ▄██▀
███    ███▄   ▄███    ███   ▀████▀▄██████▀█████████▀██   ███                   ███   ███     ███        ███            ▀███▀
███     ▀███▄███▀     ███   █▄▄▄▄███  ████████▀███████   ███                   ███   ███      ▀██▄      ███            █████
███       █████       ███   ██▀██████████▀████████████   ███                   ███   ███        ███     ███           ██▀ ▀██
███        ▀█▀        ███    ███████▀████████▀▀▀███▄█     ███                 ███    ███         ▀██▄   ███         ▄██▀   ▀██▄
███                   ███
     █  █▀█████████ ███ ███       ███               ███     ███           ███  ███        ██▀       ▀██
███                   ███
      █████▀▄▄▀█▄██▄▀▀▀▄██         ███▄▄         ▄▄███      ███            ▀██▄███      ▄██▀         ▀██▄
███                   ███
       ▀▀██▄▀▀▄███▀████▀▀           ▀▀████▄▄▄▄▄████▀▀       ███              █████     ███             ███
███                   ███
           ▀▀██████▀▀                   ▀▀█████▀▀           ███               ▀███   ▄██▀               ▀██▄
.
.TRADE, EARN & OWN THE EXCHANGE
████   WHITEPAPER    FACEBOOK    TWITTER    LINKEDIN    TELEGRAM    CRUNCHBASE   ████
|FREETRADING &
ICO LISTING
|SUPERIORTO NASDAQ
AND LSE
|US$ 29MRAISED IN
2 WEEKS
|
[]
TraderInc
Full Member
***
Offline Offline

Activity: 308
Merit: 109



View Profile
December 08, 2017, 09:20:19 PM
 #14

any word on keeper's key or the third popular one after nano and trezor ?

ELEMENTH
⇐ ● BLOCKCHAIN FOR E-COMMERCE Pre-ICO is LIVE ● ⇒
○ ○ ○ ➀ WEBSITE WHITEPAPER BITCOINTALK TELEGRAM TWITTER FACEBOOK REDDIT ○ ○ ○
gundala
Full Member
***
Offline Offline

Activity: 364
Merit: 102


View Profile
December 08, 2017, 09:28:38 PM
 #15

I think these hardware wallets are trusted because I haven't heard any complaint from a person who owns it that they've had problems or were ever hacked when they stored their coins, so most probably they are very reliable.

besides, wallet hardware can hardly be hacked because your private key is stored offline.
so this wallet is safe enough to be used to store digital coins. however, the price is rather expensive.

sofi@
Full Member
***
Offline Offline

Activity: 238
Merit: 108


View Profile
December 08, 2017, 09:41:20 PM
 #16

Hard wallets so far are good way to kep your bitcoins unlike online wallets it can't be hack or stolen the only problem maybe is how you will keep it in a place that no one can steal it. But one issue you must take in is that regardless of what wallet you are goin to take crypto currency as its nature is too risky so whether you have better wallets if the price of cryptos suddenly fall back chances are you can still lose everything in an instant

aplistir
Full Member
***
Offline Offline

Activity: 274
Merit: 119



View Profile
December 08, 2017, 10:55:24 PM
 #17

according to https://www.cnet.com/news/keylogger-discovered-on-some-hp-laptops-conexant/. Either way, this is why I support open-source software. Everything is up for review, so you know exactly what you're getting into. I have stopped trusting Windows for some time now, opting for Linux for more sensitive activites, and this just proves I'm right.
Have you ever tried to read the source code of Linux? There is so much code that it is pretty impossible to go through that. I would not be surprised if there were some surprises hidden in there too. NSA could have some programmers "contributing" to developing Linux, who could know. A well designed "bug" could be all that they want.

But I too trust Linux much more than windows, which really is spying its users.

Quote from: jseverson
As for hardware wallets, I have to be honest that I have no idea how they work internally, but the fact that they have been completely safe thus far suggests that they're quite trustworthy. There are probably some out there that houses hundreds of thousands of coins. But then again, there are only no incidents until there has been an incident, so that could change in a hurry. I personally still trust them because it's not like they're running on some kind of freemium model, but that's just me.
I trust hw-wallets too, but there could always be a bug in them too. Paper wallets are safer, if the key has been made with a good RNG.

My Address: 121f7zb2U4g9iM4MiJTDhEzqeZGHzq5wLh
bob123
Hero Member
*****
Offline Offline

Activity: 714
Merit: 616



View Profile WWW
December 09, 2017, 08:24:01 AM
 #18

These hardware wallets which are very popular among the community today; Trezor and Ledger more specifically are seen as gods gift among the community and everyone believes they are 100% safe. But, can we really trust those behind the development? Can we trust that the government haven't got their hands in things?

You don't really have to trust someone. You can verify everything by yourself because the 'important' parts of the wallets are open source
and therefore accessable by everyone who has access to the internet. To verify the hardware isn't as easy as verifying the software, but you can
still compare which chips are built-in and (theoretically) 'reproduce' it on an emulator? I mean, this second step is only for extremely paranoid people.
But this still could be an exaggerated option. 

Ultimately, I would like some discussion on the safety of using hardware wallets specifically or generating/importing/exporting private keys on them.

Hardware wallets are kinda made for generating private keys (randomly).
But you shouldn't be able to import/export private keys into/from a hardware wallet. Such a private key should be looked at as compromised.
Therefore, to guarantee the integrity and confidentality of your keys they only can (and should) be generated on your HW device.

boogersguy
Newbie
*
Offline Offline

Activity: 19
Merit: 0


View Profile
December 10, 2017, 04:56:46 PM
 #19

Seems most of the people responding here didn't bother to read about subliminal channels before giving their 2c of wisdom. 

It looks like covert messages can be embedded in the signature itself.  This would be bad. Real bad. 

My simpleton solution would be to use paper wallets and sign transactions offline with a vetted copy of something like coinb.in where you can review the code line by line to verify that "k" is not being gamed.

Thoughts, smart people?

Political Sniper
Newbie
*
Offline Offline

Activity: 4
Merit: 0


View Profile
December 11, 2017, 04:38:25 PM
 #20

Quote
These hardware wallets which are very popular among the community today; Trezor and Ledger more specifically are seen as gods gift among the community and everyone believes they are 100% safe. But, can we really trust those behind the development?

That is why I decided to replace my Ledger Nano S with the latest Trezor T. Trezor software is open-source so everyone can check if the code is bug-free or if there are any backdoors. Ledger devices are based on secure elements which have limited space and capabilities and most importantly, we can't see what happens inside it. Also, Ledger has started working with Intel which is known for problems with Intel Management Engine. I don't trust developers, I trust community that checks the code provided by them.

I'm not really taking about the code which is being used. Although, the code is open source and I do support open source software I'm more concerned about the hardware which is almost undetectable by the average user of Bitcoin.

Code can be checked because it's extracting information which uses CPU and you can monitor via your computer. But hardware isn't that straight forward.
Pages: [1] 2 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!