Yes, the Keepkey is a worthless black bricklet

[The Sceptical Chymist]

I’ve posted my about my frustration and disappointment with the Keepkey wallet a couple of times—for some reason I bought one on Amazon last year when I didn’t know too much about hardware wallets.  Long story short, it’s been hiding in its box since I tried using it shortly after receiving it but last night I gave it a second shot.

I got an e-mail from ShapeShift that had the wonderful title of “Buy Bitcoin Easily With Your Debit Card”.  Why wonderful?  Because ever since Circle jerked us all around and made their way out of the bitcoin world and wesellcrypto.com shat the bed, I haven’t had an easy way to do what ShapeShift is telling me they can help me out with, i.e., buying bitcoin with a debit card.

Another long story short, I didn’t read the fine print and did not realize the significance of that omission until after I’d gotten myself all set up and KYC’ed with ShapeShift (sort of; I didn’t have to submit a photo but did have to give them some personal info).  Turns out my state is excluded from being able to partake in that buy-bitcoin-with-debit-card service.

As I said, I finally got the damn Keepkey working.  And it’s so goddamn annoying in comparison to a Ledger, it’s not even funny.  The main issues I find head-slappingly, teeth-grittingly irritating:

1) The number of altcoins supported is laughable.  
2) The PIN input is a stupid puzzle-type thing that’s completely unnecessary.  
3) The Keepkey/ShapeShift website kept opening new tabs whenever I clicked a link.  
4) They basically required me to register with ShapeShift in order to use the Keepkey, and I find that ludicrous—I’ve heard there’s a way around that, but it sure isn’t obvious from any of their instructions.  And again, if you compare the Keepkey’s ease of use to that of the Ledger, the Ledger wins hands down every time.
5) And my final thought and last foul morsel of annoyance is that the Keepkey is just a mechanism to get people to use ShapeShift, but you wouldn’t know that if you were just on Amazon and saw the Keepkey description, which is exactly how I got suckered into buying this piece of shit.  

Luckily it wasn’t that expensive and the box it came in will make a nice place to put my silver coins in.  If I can figure out what to do with the actual device, there might be some closure for me but I won’t hold my breath.  It’s too light to be a paperweight and too plain looking to put in the display case.  

Some people might be able to figure out a way around the ShapeShift thing and may love their Keepkey, but it's way too hard to just set up and use easily and intuitively.  As many of you probably know, I'm no tech geek and I also have little patience for bad design, so the Keepkey seems to be aimed toward either suckers or tech-savvy people who like figuring out stupid problems that shouldn't be problems in the first place.

Love to hear your thoughts on my thoughts.

Edit:  Oh wait!!  I forgot that I had to download the fucking Brave browser in order to get everything to work properly.  I found that to be almost a slap in the face, the icing on the shit cake, and the last straw.  To me, that's just downright disrespectful.

[DireWolfM14]

I've only used mine with hapeShift just to test it's functionality, and didn't care for it much.  Maybe that's largely the cause of your frustrations.  I purchased mine before the merger with ShapeShift, and first used it with the Chrome extension which has issues syncing properly at times.  I've also used it with Electrum, but sometimes it wouldn't be recognized unless I ran Electrum with admin privileges.  Apparently it's compatible with MEW but I've never tried to use it with that app.

My main issues with the KeepKey is that it's native apps (the Chrome extension and ShapShift) only allow for legacy bitcoin addresses.  That's alleviated by using it with Electrum.  Besides that, I agree that it's very limited when it comes to altcoins, but that doesn't concern me too much.  It's definitely an affordable hardware wallet, and if you plan on using only for storing bitcoin along with Electrum it's probably not a bad choice.  

Ledger and Trezor are by far easier to use with their native apps.  If you own or trade lots of altcoins you'll want to avoid the KeepKey due to it's limitations.

Overall, I agree with you that it's not the best choice for a hardware wallet.

[jackg]

Have you tried a trezor?  (I kept thinking that while reading your post)...

Yeah I seem to remember the keep key being about $20 so there might be a reason for that... Coinbase claim to accept card (haven't used it because I'm not paying the visa fees).

I'd like more altcoins with the trezor, maybe the ledger has them, but you could also probably get away with some simple software solution to allow it - like some coins have it built into the site tools afaik.

I don't know how much I like brave, was it just a chromium based browser you needed or was it exactly brace (might have been sponsored or something if so)? I don't even like putting metamask on Firefox as it can edit your clipboard.

[Lucius]

Some people might be able to figure out a way around the ShapeShift thing and may love their Keepkey, but it's way too hard to just set up and use easily and intuitively.  As many of you probably know, I'm no tech geek and I also have little patience for bad design, so the Keepkey seems to be aimed toward either suckers or tech-savvy people who like figuring out stupid problems that shouldn't be problems in the first place.

When I was buying hardware wallets, what I was most interested in was the security it offered, then ease of use, and of course the price. Ledger&Trezor are not by accident where they are, because they are fairly easy to use (for most), and have gained users' trust over the years.

I never even considered buying some other HWs, and when I see what the user experience is with ShapeShi(f)t, I see I was totally right. But I think some things just need to be accepted as they are, maybe there are really people who enjoy something that is complicated, or it might be better to say in what works on slightly different principles.

Have you tried a trezor?  (I kept thinking that while reading your post)...

As far as I know The Pharmacist is a Ledger user, and everything he can get with Trezor, he can get with Ledger, even more considering that Ledger is using Secure Element, and that Trezor has a vulnerability in the form of seeding hacking (physical access) if not used passphrase which should be at least 37 characters.

[The Sceptical Chymist]

maybe there are really people who enjoy something that is complicated, or it might be better to say in what works on slightly different principles.

You are correct, and my OP here is just my opinion--but I do think most people are not looking for an overly complicated hardware wallet if they're looking for one at all.  And if some people love the Keepkey, cool.  It actually does have a nice display and has a very simple design.  It's just all that other stuff that puts a very bad taste in my mouth.

As far as I know The Pharmacist is a Ledger user

You got it.  I own a few altcoins that I wouldn't consider obscure, but I like to keep them on a hardware wallet and that's one of the best things about the Ledger, lots of altcoin support.  And it's sooo much easier to use than the damn Keepkey.

Have you tried a trezor?  (I kept thinking that while reading your post)...

No, because I don't need another hardware wallet right now and I don't particularly care for the look of it.  And yes, that's important to me.  Aesthetics in all things, you know.

[jackg]

Ahhh @lucius it was a seed passphrase and not actual passphrase you needed to set (I ought to get round to doing that) since the actual pass phrase on the gui can't be longer than 20 characters afaik. Although I think people would go for the casascius in a physical attack anyway if they found out where both are stored.

@the Pharmacist, yeah I was kinda curious as to the criticisms of that device too since you had one for keepkey 🤣.

If it has a lot of additions and is more complex to fully complete the setup it does sound like once you've done that you'll continue to be able to keep accessing everything so it might just be a short few hours to try to get everything working for you to not have to set much up again in the future and have something fully usable.

[bitmover]

Edit:  Oh wait!!  I forgot that I had to download the fucking Brave browser in order to get everything to work properly.  I found that to be almost a slap in the face, the icing on the shit cake, and the last straw.  To me, that's just downright disrespectful.

I think that this is disrespectful as well.

If a company needs to force users to download a third party browser  (this is more invasive than watching ads) just to make some money, probably it is not a good company... Hey, you already paid for their product,.

Ledger and Trezor are the best around, no doubt..

[The Sceptical Chymist]

At least it can be used as doorstopper.

Too light, even for a cat door.

Followup:  I sent a message to ShapeShift, directing them to this thread.  It wasn't even easy to figure out how to send them a message, since the links to communicate with them are buried--or in any case, they're harder to reach than they should be.  And yes, I'm probably being overly critical and certainly nitpicky but they're a business and they should care about customer service.

This is what I got back:

"Thanks the message. Sorry to see all the frustrations you are having/had with KeepKey/ShapeShift.

Believe it or not, I've shared your post with the team so they can get a better understanding of our user's experience. We appreciate the feedback and are working hard to optimize our services.

Have a great day!

Best,
Mark, CBP"

So I'm at least glad someone replied to my concerns.  The damn Keepkey device could be so much better than it is, and as I said I like the simple-looking, minimalistic aesthetics of it (way better than the Trezor but perhaps bigger than it should be, at least compared to a Ledger).  A pretty-looking brick just won't cut it if it's harder to use than it needs to be, and especially if it doesn't support anywhere near the number of coins the Ledger does.  Anyway, that's probably all I have to say on the matter.  Hopefully the ShapeShift/Keepkey team can improve on what they've built, because the potential is there.

[PrimeNumber7]

Why do you need to buy bitcoin with a debit card? If you are willing to link your checking account, you can use a larger variety of exchanges. You would probably have to wait a few days each time you deposit money into your exchange account.

Accepting debit cards is risky for an exchange and you are going to have to pay a premium for that risk if you are buying coin with a debit card.

I saw marketing materials for the keepkey and my initial thought is it is a marketing gimmick for shapeshift. My guess is keepkey doesn’t support many altcoins that are not available via shapeshift.

[HCP]

A pretty-looking brick just won't cut it if it's harder to use than it needs to be

Maybe keep it as a "pretty-looking decoy brick"... Keep(Key)™ it on your desk, so if someone breaks in they'll find the KeepKey and assume they've hit the jackpot and miss your cunningly hidden Casascius coins and Ledger

[NeuroticFish]

At least it can be used as doorstopper.

Too light, even for a cat door.

It can be used as decoy if you ever face the 5$ wrench issue. Just give them your KeepKey 

[LoyceV]

I have one of those, but until now didn't install it. I was worried about the KYC-thing when I bought it, but from a quick search it looked like it can still be used without KYC.
So quick question: can it or can it not be used without KYC? If it can't, there's literally no use left for the thing. Cold storage is supposed to be private.

[Lucius]

Ahhh @lucius it was a seed passphrase and not actual passphrase you needed to set (I ought to get round to doing that) since the actual pass phrase on the gui can't be longer than 20 characters afaik.

I'm not a user of Trezor, but from what I can read passphrase can be up to 50 characters long, and PIN can be up to nine digits long. What exactly do you mean when you say "can't be longer than 20 characters", I must admit I do not understand.

However it turns out, if users in not set strong passphrase and his device is stolen/lost, with little knowledge and in a fairly inexpensive way seed can be extracted, and weak passphrase brute-forced = coin lost.

[DireWolfM14]

I have one of those, but until now didn't install it. I was worried about the KYC-thing when I bought it, but from a quick search it looked like it can still be used without KYC.
So quick question: can it or can it not be used without KYC? If it can't, there's literally no use left for the thing. Cold storage is supposed to be private.

It can be used without KYC if it's used with Electrum or the KeepKey Chrome extension, which is still available in the app store.  It's not so much that the hardware wallet itself requires KYC for any reason, but rather ShapeShift.com does.  ShapeShift purchased or merged with KeepKey a little over a year ago, and they are marketing the service and the wallet as a package deal.

[Zicadis]

I haven't suffered these same issues when using the KeepKey.

I was able to connect to ShapeShift using Chrome and you only need to register to ShapeShift if you want to exchange cryptocurrencies as far as I'm aware.

Realistically you need to balance the fact that the KeepKey is arguably the cheapest wallet on the market nowadays, the 50% off voucher going around makes it under $20 which is pretty crazy.

Sure it hasn't got amazing security and doesn't support many assets, but it's a decent first step for noobs and certainly more secure than most software wallets.

Definitely a decent stopgap for those savings for a better wallet like the Ledger Nano X.

[malevolent]

Glad I didn't even bother getting any of these when they were being sold at a discounted price.

As far as I know The Pharmacist is a Ledger user, and everything he can get with Trezor, he can get with Ledger, even more considering that Ledger is using Secure Element, and that Trezor has a vulnerability in the form of seeding hacking (physical access) if not used passphrase which should be at least 37 characters.

That is incorrect.

Ledger's Secure Element uses closed hardware and closed source software, you win some, you lose some.

You don't need a 37 character long passphrase to protect your seed, that would give you security comparable to a passphrase wherein 24 words are randomly chosen out of a set of 2048 words, so 256 bits of entropy. A passphrase much shorter or much less complex than that is still going to provide adequate security, 5-6 words randomly chosen out of a set of 300k words will provide 90.97–109.16 bits of security. Good luck with accessing the seed even with such a 'weak' passphrase.

[HCP]

I assume that the KeepKey, being based on the same hardware as Trezor, suffers from the same security vulnerability as the Trezor devices (voltage glitching to extract seed)?

[jackg]

I assume that the KeepKey, being based on the same hardware as Trezor, suffers from the same security vulnerability as the Trezor devices (voltage glitching to extract seed)?

That's still not possible to do with a strong enough password, perhaps this video from computerphile may be helpful: https://youtu.be/3NjQ9b3pgIg

Also, I thought they did something to fix the voltage a while ago or was that with ledgers same vulnerability?

[HCP]

So I did some digging and yes, it is possible to extract the seed (and bruteforce the PIN) from the KeepKey...

https://blog.kraken.com/post/3245/flaw-found-in-keepkey-crypto-hardware-wallet/
https://blog.kraken.com/post/3248/flaw-found-in-keepkey-crypto-hardware-wallet-part-2/

But like the Trezor... if you have a (strong) passphrase set, you should be "OK"

Enable Your BIP39 Passphrase with the KeepKey Client
- This passphrase is a bit clunky to use in practice but is not stored on the device and therefore isn’t vulnerable to this attack.

I've not used a KeepKey, with it's "native UI" or Electrum... so I'm not sure exactly how "clunky" it is to use a passphrase with this device... with the Trezor ONE it's relatively simple... if somewhat vulnerable to keylogging.

Any KeepKey owners can comment? Do you put it in with the device or via the computer keyboard like Trezor One?

[DireWolfM14]

with the Trezor ONE it's relatively simple... if somewhat vulnerable to keylogging.

Any KeepKey owners can comment? Do you put it in with the device or via the computer keyboard like Trezor One?

Yes, the KeepKey is compatible with Bip39 passphrase, and it's pretty simple to set up using Electrum or the Chrome extension.  I have not tried to use the ShapShift app set up passphrases, so I don't know if that's possible.    

In the Chrome extension you click on the gear (settings) and, IRRC it's under the advanced menu.

In Electrum you click on the little KeepKey logo in the bottom right had corner of the window, which will bring up the hardware wallet's settings dialog box.  You can manage your pin and your Bip39 passphrase under the "Advanced" tab.  Once the passphrase has been established, to log into passphrase enabled wallet files a dialog box will pop up on the host computer for you to enter your passphrase.  You do so by entering it into the keyboard, just like with the Trezor One.