Thoughts about Passport hardware wallet

[dkbit98]

I'm kind of torn about it. Part of me is thinking it's OSS people can do what they want you released it that way.
The other part is yeah, if you are making money from someones code or plan to make money from someones code although you might not owe them money you should be contributing something.

Hardware wallet war saga continues  
Open source means open source and anyone can use your code...and it seems they are now thinking of using new creative commons license.

Reply from Foundation:
https://twitter.com/FOUNDATIONdvcs/status/1288980273791741952

One more interesting thing is that Passport team previously worked for Obelisk and selling miners:
https://www.bbb.org/us/ma/boston/profile/virtual-currency/obelisk-inc-0021-439541/complaints
https://twitter.com/zachherbert/status/1288504731988570120

[1713555499]

1713555499

[1713555499]

1713555499

[1713555499]

1713555499

[1713555499]

1713555499

[HCP]

...

One more member of this Ledger cult

It would appear that you didn't read anything I wrote except for the "I like it" part... so therefore I am part of this so-called "Ledger Cult"

Instead of deciding what you think I think of Ledger, lets try reading what I actually wrote:

...
And I'm not sure why you seem to think that everyone here "worships" the Ledger... I like it, but as someone else mentioned, it's far from perfect
...

Yep, obviously I'm the Ledger Cult Leader

Can anything bad be said about Ledger hardware wallet or not?

Obviously, there are lots of "bad things"™ that can be said about it... the buttons feel flimsy... entering PINs/Passphrases is problematic... the screen can't display all the data at once... their native software has a ton of issues... and some of their UI/UX decisions are just terribad, imo... adding all these shitcoins and shittokens instead of providing some "proper" features etc. Having said that, I can understand why they chose that path.

Does everything happening with Ledger needs to be justified?

I'm not even sure what you mean by this?

Justified by whom? Ledger? The "cult members"? Their detractors?

[LTU_btc]

Smart phones are getting bigger and bigger but most of people buy them more and more.
Old Nokia phone is smaller than modern smartphones people carry everyday.

Well, this is something what I don't like at all. When I'm looking for new phone, I try to find something what would be not too big for me because I need phone, not a tablet. For me it's not comfortable to use big phone with one hand or put it to my pocket. But offcourse, everyone has their own preferences.
BTW, I'm not sure where do you see so called "Ledger cult" here? Because I don't see anyone here praising that Ledger is perfect and that they aren't making mistakes.

[dkbit98]

Well, this is something what I don't like at all. When I'm looking for new phone, I try to find something what would be not too big for me because I need phone, not a tablet. For me it's not comfortable to use big phone with one hand or put it to my pocket. But offcourse, everyone has their own preferences.

You can try as much as you want but you can't find small smartphone anymore, they are all big and larger than Nokia phone shown before.
So I don't understand people want to have miniature hardware wallet and big smart phones  

I'm not sure where do you see so called "Ledger cult" here? Because I don't see anyone here praising that Ledger is perfect and that they aren't making mistakes.

I won't go more offtopic but there are some people here who are in love with their Ledger hardware wallet    and I won't name them.
If there are some mistakes and flaws people should expose them here, that is why forum exists.

[DaveF]

Looks like work is progressing on this. They tweeted an image of the prototype cases the other day:

Obviously it's just about impossible to tell from that one image but it looks a bit like really cheap plastic in that shot.
Probably just the way the picture was taken.

Link to twitter picture: https://pbs.twimg.com/media/Ef9YjYTXkAIXVrp?format=jpg&name=large

-Dave

[Lucius]

You can try as much as you want but you can't find small smartphone anymore, they are all big and larger than Nokia phone shown before.

They may not be as small as before, but there are some that are quite small (twice the size of today's standard sizes).
PalmPhone - 3.3-inch display or even smaller Unihertz Atom - 2.45-inch display

I won't go more offtopic but there are some people here who are in love with their Ledger hardware wallet    and I won't name them.
If there are some mistakes and flaws people should expose them here, that is why forum exists.

I’ve never hidden that I own Ledger HW, but that doesn’t mean I’m in some cult as you constantly imply it - nor is anyone else overly aggressive in defending that company. Every omission and vulnerability should be made public and discussed - but no big dramas should be made about some things that are not critical. In my opinion, Ledger has definitely gone in the wrong direction, and there is no doubt about it - but there is no documented case of someone being hacked because a vulnerability, which is the most important thing for me as a user.

[dkbit98]

They may not be as small as before, but there are some that are quite small (twice the size of today's standard sizes).
PalmPhone - 3.3-inch display or even smaller Unihertz Atom - 2.45-inch display

I think you mentioned Nokia 3310 before,
That phone is smaller than most smartphones today, and I shoed image comparison.
I can always dig out brick from 1980 and say, here it is.

[bob123]

This thing is ugly as hell.
But i guess it could be a good device for people who don't want to spend more than a few bucks.

Considering all the parts are pretty cheap, the whole device shouldn't cost more than ~20$.

And the good thing is, it won't ever be stolen since it looks like a 20y old mobile 

[dkbit98]

Considering all the parts are pretty cheap, the whole device shouldn't cost more than ~20$.

There is no way this wallet will be $20, and I would like to see you make one yourself.
It has camera and removable batteries, and it will be airgapped.
Maybe add few more zeroes for correct pricing sir  

Judging by their twitter account prototype is released:
https://twitter.com/FOUNDATIONdvcs/status/1296852586398654465

[NotATether]

This thing is ugly as hell.
But i guess it could be a good device for people who don't want to spend more than a few bucks.

Considering all the parts are pretty cheap, the whole device shouldn't cost more than ~20$.

And the good thing is, it won't ever be stolen since it looks like a 20y old mobile 

And that's its strong suit in my opinion. Personally I don't care how good-looking a device looks if I'm going to use it for security purposes, and I wouldn't use a glamorous hardware wallet if it turns out to be insecure. I like how the Passport can't be connected to anything, because people have made spying devices shaped in a USB port and that makes me feel slightly paranoid because however unrealistic it may be (emphasis on unrealistic) I still worry that USB hardware wallets like Ledger might be modified by someone to steal coins.

And also the buttons on the Passport are very big and easy to press, it's slightly easier to press the correct physical buttons than ones on the screen like on Trezor, which is especially important if you're typing a password, and a certain number of incorrect tries wipes the device.

[Lucius]

I think you mentioned Nokia 3310 before,
That phone is smaller than most smartphones today, and I shoed image comparison.
I can always dig out brick from 1980 and say, here it is.

You're wrong again, my previous post is the first in this thread - I didn't make any comparisons or mention the Nokia 3310. Also, if we compare  Unihertz Atom (96 * 45 * 18 mm) with Nokia 3310 (113 mm × 48 mm × 22 mm) it is clear that this smartphone is almost identical to the old dummy phones like Nokia 33/3210.


And as for this new model of hardware wallet, I think that regardless of the look and price, there will always be those who will buy it - but somehow it does not seem to me that they will have much success. Many models have appeared over the years, but have failed to impose themselves in a market that is mainly focused on the two main manufacturers. Given all their problems, it's a little strange to me that no one is trying (at least seriously) to enter the market with some competing hardware wallet model - Passport definitely doesn't seem like that to me.

And the good thing is, it won't ever be stolen since it looks like a 20y old mobile 

Or those children's toys that imitate mobile phones and make various sounds - which means that the ideal place to hide this device is right in the box with children's toys🐱‍💻

[dkbit98]

You're wrong again, my previous post is the first in this thread - I didn't make any comparisons or mention the Nokia 3310. Also, if we compare  Unihertz Atom (96 * 45 * 18 mm) with Nokia 3310 (113 mm × 48 mm × 22 mm) it is clear that this smartphone is almost identical to the old dummy phones like Nokia 33/3210.

Who the fuck knows about Unihertz Atom?
Only you probably, as I never heard about it like most people.
What phone do you have? Is it Unihertz Atom?? 

And whats up with that 'wrong again' attitude?

o_e_l_e_o posted that comparison link before (not you personally mr. Right)

[o_e_l_e_o]

It has camera and removable batteries, and it will be airgapped.

The removable battery is not proprietary or even similar to a phone's battery, though. It simply uses 2x standard AAA batteries. If anything, that should make it cheaper than using a more expensive rechargeable battery.

which means that the ideal place to hide this device is right in the box with children's toys🐱‍💻

Until your child decides to dunk it in their juice, take it in the bath, or leave it outside in the rain.

o_e_l_e_o posted that comparison link before

Yeah, and I stand by that. As someone who likes to carry a hardware wallet around in their pocket, a device which is 8 times larger in volume than the Nano S or the Trezor One does not fit my use case. But hey, YMMV.

[Lucius]

Who the fuck knows about Unihertz Atom?
Only you probably, as I never heard about it like most people.
What phone do you have? Is it Unihertz Atom?? 
And whats up with that 'wrong again' attitude?
o_e_l_e_o posted that comparison link before (not you personally mr. Right)

You obviously have some other problems besides imagining various cults and very negative reactions if someone unequivocally proves to you that you are wrong. First you claim that there are no smartphones the size of the Nokia 3310 - and I'll show you at least 2 such models that can be found by anyone who knows how to use the Internet.

Secondly if you claim that I wrote something then be sure that it is so, I am no Mr. Right - but neither am I o_e_l_e_o  or any other member - at least people in the crypto world should pay attention to details.

Without going further into the OT for me this discussion is over.

[dkbit98]

...

I am not scared to write what I think unlike some people.
And I do make mistakes.

Atleast you filled your signature quote mr.Right  
Adios

[bob123]

It has camera and removable batteries, and it will be airgapped.
Maybe add few more zeroes for correct pricing sir  

If it is not a high resolution camera, the cam itself only costs ~1$. That's more than enough for a camera module to scan QR codes.
The batteries are not included i'd guess. And the connectors for the battery are like a few cents.

The hardware cost of the device is definitely way below 10$.

I like how the Passport can't be connected to anything, because people have made spying devices shaped in a USB port and that makes me feel slightly paranoid because however unrealistic it may be (emphasis on unrealistic) I still worry that USB hardware wallets like Ledger might be modified by someone to steal coins.

This 20 year old mobile (a.k.a. "new" hardware wallet) also has interfaces to exploit vulnerabilities: The SD slot and the camera (yes, parsing data from a QR code can create vulnerabilities).
It's not like it is unhackable.

[dkbit98]

If it is not a high resolution camera, the cam itself only costs ~1$. That's more than enough for a camera module to scan QR codes.
The batteries are not included i'd guess. And the connectors for the battery are like a few cents.

The hardware cost of the device is definitely way below 10$.

Make it for $10 bucks, maybe you get rich.
We can also make a bet and see who will predict correct price for this device.

Trezor is also cheap to make, but they sell it for higher value because they want to make profit and not charity.

dkbit98 behaved quite irrational in that linked topic.
My guess would be that he is somehow affiliated with the cheap 1960's style hardware wallet.

Nope.  

One more interesting thing is that Passport team previously worked for Obelisk and selling miners:
https://www.bbb.org/us/ma/boston/profile/virtual-currency/obelisk-inc-0021-439541/complaints
https://twitter.com/zachherbert/status/1288504731988570120

[NotATether]

I like how the Passport can't be connected to anything, because people have made spying devices shaped in a USB port and that makes me feel slightly paranoid because however unrealistic it may be (emphasis on unrealistic) I still worry that USB hardware wallets like Ledger might be modified by someone to steal coins.

This 20 year old mobile (a.k.a. "new" hardware wallet) also has interfaces to exploit vulnerabilities: The SD slot and the camera (yes, parsing data from a QR code can create vulnerabilities).
It's not like it is unhackable.

I'm guessing the microSD card can be taken out and replaced, although I don't see a practical reason for doing that unless the entire hardware wallet state is stored on it. It could also be that the whole wallet OS is stored on it too, no details about that were given by the website however. They say the hardware is open but what really defines open hardware? An open hardware device sounds like skilled people will be able to reverse engineer the software running it, for the software must also be open for some open hardware to run on it, because by reason software that is proprietary and closed to the vendors making the hardware wallet can't be ran on open hardware.

All that sounds needlessly abstract and there has to be a standard to measure open hardware by. At least to me, someone showcasing open hardware feels like end users can build their own device with similar components from scratch, or at least having the ability to replace every single part inside (like software). No obscure screws or gluing that is not available in retail markets.

What I'm trying to say is, I don't think open hardware is inherently safer than conventional hardware, if someone can figure out all the signals sent to pins that make the device do different internal functions. Specifically, someone could build an SD card that sends a different encrypted private key belonging to a hacker when a read for that private key file is queued by the OS, and that's doable since the SD card ultimately handles reading and writing data.

It wouldn't be able to silently replace the private key file at write time with its own (stealing private keys) because the encryption happens in the memory module not in the SD card, so some attack vectors are thwarted but only as long as you can't control the piece of hardware that's responsible for the operation you want to tamper with. Now if someone also replaced the memory in open hardware with a malicious one that retains the private keys unencrypted when the device is trying to encrypt them to save to disk, then stealing the private key becomes possible, just take out the SD card and connect it somewhere else to copy the private key.

And that's just one of several attack vectors that open up by controlling a second component. So eventually, again assuming "open hardware" means people can build a lookalike or replace parts inside, the more components you can replace, the more parts of the device you control which means more security holes pop up, and thinking about security holes in the sense of real holes in a wall, if you keep drilling holes in the wall the whole wall will be gone, and if you have control of replacing over all hardware parts, the entire security system collapses.

Same thing applies to the camera, or any other hardware part for that matter, if someone can replace the camera with one that's programmed to change all QR codes into a set of predefined QR codes corresponding to hacker addresses and transactions.

Without going off topic I'll also mention that both an open CPU architecture, ARM cortex, and closed ones, Intel and AMD, were all vulnerable to a hardware flaw called Spectre that controls hardware how I described it above. And nobody even had to replace hardware parts for the flaw to get in, it was accidentally included in the hardware design. So both "open hardware" and closed hardware are both vulnerable to design errors.


The Passport doesn't feel like open hardware at all, because all we can see right now are a list of parts inside and some specifications. Every device has those.

[miner9problems]

Considering all the parts are pretty cheap, the whole device shouldn't cost more than ~20$.

There is no way this wallet will be $20, and I would like to see you make one yourself.
It has camera and removable batteries, and it will be airgapped.
Maybe add few more zeroes for correct pricing sir  

FAQ says it will be $299

https://foundationdevices.com/faqs/?v=7516fd43adaa

[dkbit98]

FAQ says it will be $299

https://foundationdevices.com/faqs/?v=7516fd43adaa

Nice find. They hide it deep in FAQ page.
I would never pay this much for any hardware wallet, especially something new like Passport,
but maybe other smarter members will take a challenge and make it 10 times cheaper, and I may buy from them,
but they probably never held soldering iron in their hands.