[GUIDE] How to buy a Hardware Wallet the right way

[dkbit98]

I'm actually going to order a cheap Fire 7 tablet, the cheapest one, it's about $50. Keep it offline, factory reset it again upon arrival, and sideload latest verified Electrum through the microsd slot, and use that as my "hardware" wallet. Turn on Airplane mode, turn off wifi, turn off bluetooth, and there are a few other privacy or app settings but that's not very much relevant if the device is permanently offline and in air gap.

It could work for you but Fire is still running on modified Android OS and I would much more trust some old Netbook with Linux OS, that you can easily replace hard disk and battery, and totally disable wi-fi.

Android and iOS may have government backdoors enabling them to unlock devices whenever they want, and they even introduced a bill in US Senate that would force all devices and software providers in the US to build backdoors into their products.
This would mean much easier access and bypassing password, and there is separate issue with backdoor in Android apps, and with Amazon software and devices in general.

[1714118649]

1714118649

[1714118649]

1714118649

[1714118649]

1714118649

[Dabs]

I understand completely.

But I take it the tablet device will not be able to connect to any wifi network if it does not know the password, and it also won't connect to any bluetooth device if the other device does not pair with it.

I'm also going to play around with the tablet and see what other "hacks" I can do on it, I mean it's easy enough to root and install google (but why do that in this particular case). There is probably a way to install AOSP / Custom ROM on it and disable everything.

The alternative is indeed an older laptop or even a cheap desktop, but those are a little more bulky and I would need to get the other hardware for QR code scanning.

The tablet would be just another signature in a multi-sig setup.

Can also probably open up the thing and physically disable the wifi chips / antenna.

I'm confident enough that it will function as intended if it is never allowed to connect to anything and turned off after every use, and kept inside a faraday cage when stored. (inside a locked safe, or a room with lots of air / concrete walls.)

I'd actually trust this tablet brand new, than any of the other hardware wallets or their manufacturers out there, but that's just me.

If it does not work as intended, then at least I still have a cheap tablet my todler can play with. (or for me to do some candy crush game or whatever.) This may fit the bill as an offline music player (occasionally connected / Spotify / mp3 download) with bluetooth speakers / bluetooth car.

The main convenience of the other hardware wallets is size, but I have no intention of bringing this outside where it will be stored anyway. It will either be in a safe second location (such as a bank vault) or safe in the home or somewhere, but nowhere near the main computers or hot wallets. In this case, it's smaller than any laptop or desktop computer with Linux.

Android is still a form of Linux, but rather restricted. I'm sure there are ways to break it and render everything useless but the app you need.

[jerry0]

Will most likely order another nano ledger s directly from ledger.  I have bought one from them directly with my name and address a while back and got a second one later on a while back.


When i order another nano ledger s from ledger... most likely i will do this as oppose to ledger nano x or trezor... i assume its fine just ordering it to my address since they already have it in their records? 


I mean do ppl here get a PO box at their local USPS solely for this?  Obviously i would rather have it sent to a location where i could pick it up myself.  But if i already ordered through them, i guess no issue doing it like i did previously?

[Dabs]

Amazon should be a reseller, or they sell through Amazon.

I did get my Fire 7 Tablet, and it's on sale right now too. Factory reset the thing, disabled everything, disabled amazon apps, no google apps, airplane mode, then side loaded Electrum.

Have done a few transactions already and it's working like a charm for me.

It is still a tablet and larger than a ledger or trezor, but it already has it's own camera and screen, to copy transactions using QR codes.

[jakesun64]

You can also ask yourself, do you really need a Hardware wallet at all?
They are not perfect and there are alternative ways for storing your crypto, including offline computer or smartphone with installed wallet and only used for this purpose.


*This list is work in progress and any suggestions are appreciated

I am thinking the same and am thinking about going the paper wallet route. Do you know any resources of this and the pros and cons. No matter what you do you have to have your private keys and passphrase written down, hidden and retreavable. How do you use a paper wallet. and still have the security and anonymity as when you have a hard wallet?

[dkbit98]

I am thinking the same and am thinking about going the paper wallet route. Do you know any resources of this and the pros and cons. No matter what you do you have to have your private keys and passphrase written down, hidden and retreavable. How do you use a paper wallet. and still have the security and anonymity as when you have a hard wallet?

Please don't make duplicate posts, and go off-topic with paper wallets.
I have already answered your question in other topic you created: https://bitcointalk.org/index.php?topic=5334859

Like IRS confirmed, hardware wallets are very secure so they need help hacking them, but they are not perfect:
+plus: hardware wallets are more secure than software wallets on online computer, easier to use for most people.
-minus: They are not free and you need to pay for them; there is chance of malicious firmware and phishing websites, some of them have closed source code and can have hidden backdoor.

[n0nce]

I'm really pissed at Ledger right now. Getting not only phishing e-mails but actual fucking phone calls from a "Ledger" caller ID to my phone number, which I only gave them because they supposedly need it for shipping. I don't have a feasible way of giving out a disposable phone number with each online order.

Has anyone of you ever gotten a phone call about a shipment? Because I haven't. So one day, when I cancelled my landline subscription, I decided not to hand out phone numbers for deliveries anymore. I just always come up with something new that has the right number of digits and never had any issue.
I believe I once had a support session with some online shop and when they asked me to verify my phone number (which I obviously didn't remember anymore), they were immediately happy with me claiming I just change them often to benefit from new subscriber promotions.

[JL0]

@n0nce

What did you do when you ordered the Passport Wallet? You have to enter a phone number there.

[o_e_l_e_o]

I've not given out my real phone number to a business in years. I either leave the field blank, or fill it with something obviously fake but which fulfills the criteria, such as all 1s.

If you need to receive a one time message for confirmation or something along those lines, then there are plenty of websites you can find with a quick web search which offer free online SMS inboxes linked to various phone numbers. Anyone else who wants can also read the message you receive, so you have no privacy or security, but it does the job in some cases.

If you really need an active phone number, then depending on your country you can usually pick up a SIM for a couple of bucks (or sometimes free) and stick it in an old reset-to-factory-settings phone. Either destroy the SIM once you are done, or as I do, keep it for a few months and use as a general burner phone whenever you need to. Repeat every few months with a new SIM.

[dkbit98]

Has anyone of you ever gotten a phone call about a shipment? Because I haven't. So one day, when I cancelled my landline subscription, I decided not to hand out phone numbers for deliveries anymore. I just always come up with something new that has the right number of digits and never had any issue.

Smart move.
I use different prepaid mobile number not directly connected with my real life identity, and I use it only for ordering stuff.
I generally keep my phone turned off when I sleep, and recently during sleep I received bunch of calls in the same time, some even came from surrounding countries.
When I tried to call one of those numbers I received voice message that number is not in function, so caller probably use some fake number ID's.
I suspect this was some scammers or fake tech support but I can't prove anything.

[n0nce]

@n0nce

What did you do when you ordered the Passport Wallet? You have to enter a phone number there.

Just as I said above..

If you need to receive a one time message for confirmation or something along those lines, then there are plenty of websites you can find with a quick web search which offer free online SMS inboxes linked to various phone numbers. Anyone else who wants can also read the message you receive, so you have no privacy or security, but it does the job in some cases.

I don't even know if shipping companies / online shops ever even use the phone number you provide; since for obvious reasons, I have no recent experiences to make conclusions off of. If it is enforced, there are web solutions, as you say, but I often encounter this only for signup forms, not for ordering a product.
Those often don't work and are obviously open to anyone; so an alternative, that I haven't tried yet, could be a short-term private number such as: https://sms4sats.com/

If you really need an active phone number, then depending on your country you can usually pick up a SIM for a couple of bucks (or sometimes free) and stick it in an old reset-to-factory-settings phone. Either destroy the SIM once you are done, or as I do, keep it for a few months and use as a general burner phone whenever you need to. Repeat every few months with a new SIM.

From my knowledge, in EU it's now mandatory to collect KYC information, however you can get pre-registered cards in small 'telephone shops' if you ask for it.

But personally, I can almost always get around phone number requirements completely, in one way or another.

[o_e_l_e_o]

so an alternative, that I haven't tried yet, could be a short-term private number such as: https://sms4sats.com/

Oh, that looks cool. I'll try to remember to give it a shot next time it would come in handy. As I said though, I always have a burner phone on constant SIM rotation and frequent factory resets for this exact purpose.

From my knowledge, in EU it's now mandatory to collect KYC information, however you can get pre-registered cards in small 'telephone shops' if you ask for it.

You mean you can't purchase a SIM card without handing over KYC data? Even a prepaid one or one which you simply top up with cash? Am I handing my info over to the cashier in the store? Or I have to upload documents online when I register the SIM? That's ridiculous.

Hell, I can buy prepaid SIMs from a vending machine if I wanted.

[RickDeckard]

From my knowledge, in EU it's now mandatory to collect KYC information, however you can get pre-registered cards in small 'telephone shops' if you ask for it.

You mean you can't purchase a SIM card without handing over KYC data? Even a prepaid one or one which you simply top up with cash? Am I handing my info over to the cashier in the store? Or I have to upload documents online when I register the SIM? That's ridiculous.

Hell, I can buy prepaid SIMs from a vending machine if I wanted.

I was also shocked by this information since where I am at the moment I never met any kind of this measures whenever I had to buy a SIM card (either on a supermarket or in a vending machine). However it seems that some countries in the EU applied KYC procedures for prepaid SIMS as a way to fight against counter-terrorism[1] (it started upon the terror attacks of Paris in 2015[2]). If this source[3] is updated (and correct) then countries like Germany, Belgium, France (and others) do ask your personal information whenever you buy such a card. This study[4] actually makes an effort in trying to understand if this rule ends up enforcing a stricter control but as we can see in the conclusion it's not so clear that it works as intended:

Despite the lack of any empirical evidence, many governments believe mandatory SIM registration does help in the fight against crime and terrorism. However, there are many others that, on balance, believe they can address the issues in other ways and see the benefits of an ‘unregistered’ pre-paid mobile SIM market. These are national decisions and are dependent on national circumstances and may also be dependent on the issues the registration is targeted to address.

I would like to see some kind of study, for instance in Germany, where they would compare the rate of crime before and after implementing this measure. My guess is that the results would be unoticable at the cost of their citizens privacy ...
[1]https://www.miteksystems.com/blog/mobile-identity-verification-key-to-mitigate-the-effects-of-eus-mandatory-sim-card
[2]https://www.linkedin.com/pulse/sim-card-kyc-spotlight-paul-van-der-schueren
[3]https://prepaid-data-sim-card.fandom.com/wiki/Registration_Policies_Per_Country
[4]https://www.gsma.com/publicpolicy/wp-content/uploads/2016/04/GSMA2016_Report_MandatoryRegistrationOfPrepaidSIMCards.pdf

[Pmalek]

Has anyone of you ever gotten a phone call about a shipment? Because I haven't.

I guess you have never tried ordering something in the Balkans then, have you? Depending on the shipping company, the driver, and your luck, you might have to search for him on your block. Some dudes call you when they are close to check if you are home and if they can deliver to the assigned address. If they are not from your city, don't know how to work the GPS, or something else, they aren't always sure where to find you. So you have to find them.
If you can get a private and prepaid SIM card, just keep one of those around with some old phone you used in the past that you activate when you expect a delivery.

You mean you can't purchase a SIM card without handing over KYC data? Even a prepaid one or one which you simply top up with cash? Am I handing my info over to the cashier in the store? Or I have to upload documents online when I register the SIM? That's ridiculous.

Even the prepaid cards you buy on gas stations or shopping malls require online registration. You don't have to submit any documents though and you aren't giving any info to the cashier. Until you register and fill out the forms, the card remains inactive. In my experience, you can sometimes get the card unblocked relatively quickly, like 10-15 mins after data submission, but it can also take an hour or two. I can only conclude that someone somewhere is checking your entries.

[o_e_l_e_o]

My guess is that the results would be unoticable at the cost of their citizens privacy ...

Of course they would be. There is no evidence that even mass surveillance programs such as what the US and its allies conduct around the world has any effect in preventing terrorism or other crimes. Something as simple as making people register their details against a SIM card will also achieve nothing. Like terrorists wouldn't be able to buy some random sucker's documents from the darkweb for a few bucks. It's never about preventing crime, although that's usually how it's marketed because then it's easier to get people to voluntarily surrender their rights.

You don't have to submit any documents though and you aren't giving any info to the cashier.

So nothing stopping you entering a bunch of fake information then?

[Pmalek]

So nothing stopping you entering a bunch of fake information then?

Yeah, you could do that. Worse case scenario is they block your SIM card and you just threw away €20 or something for purchasing it. You have to submit an address and your name among other things. They probably check that data and compare it with entries in some central database. That could create some red flags.

If it's a real address, they might see that a married couple already registered their phones with that address. If it's a fake address that doesn't exist, they might discover that. If you use a real name from someone you find on the Internet, their checks might show that person is already registered and lives somewhere else. If you sign up with Donald Duck from Thanksgiving Street 47/c, they can tell you that address doesn't exist, and ask for additional info and maybe proof of identity and address.

It depends on how thorough their checks are. Maybe they are randomly picking lucky winners whose data will be reviewed in detail, while others are accepted without any major problems.   

[n0nce]

From my knowledge, in EU it's now mandatory to collect KYC information, however you can get pre-registered cards in small 'telephone shops' if you ask for it.

You mean you can't purchase a SIM card without handing over KYC data? Even a prepaid one or one which you simply top up with cash? Am I handing my info over to the cashier in the store? Or I have to upload documents online when I register the SIM? That's ridiculous.

No, you can get them in a grocery store, without giving the cashier any data, but it's not activated out of the box. You have to go to some online website and activate it before it becomes usable. At least that's what I've heard; I still use a card from before these new laws.

Hell, I can buy prepaid SIMs from a vending machine if I wanted.

And they work right out the gate? Like, you can plug it into a phone and it works immediately?

It seems that some countries in the EU applied KYC procedures for prepaid SIMS as a way to fight against counter-terrorism[1] (it started upon the terror attacks of Paris in 2015[2]).

Maybe they claim to do this to fight against terrorism, but fighting against counter-terrorism would be a bit hysterical.
Joke aside, these types of measures are almost always unfounded and just arbitrary new ways of gaining more and more control over the population. It is clear that all these types of measures don't work. AML doesn't stop money laundering, KYC doesn't stop fraud and none of the above stops terrorism.

I would like to see some kind of study, for instance in Germany, where they would compare the rate of crime before and after implementing this measure. My guess is that the results would be unoticable at the cost of their citizens privacy ...

My guess is the same as yours, Rick. Sad but true.

Has anyone of you ever gotten a phone call about a shipment? Because I haven't.

I guess you have never tried ordering something in the Balkans then, have you? Depending on the shipping company, the driver, and your luck, you might have to search for him on your block. Some dudes call you when they are close to check if you are home and if they can deliver to the assigned address. If they are not from your city, don't know how to work the GPS, or something else, they aren't always sure where to find you. So you have to find them.
If you can get a private and prepaid SIM card, just keep one of those around with some old phone you used in the past that you activate when you expect a delivery.

I don't think I've actually ordered something while in the Balkans! Thanks, I will keep it in mind for the future; it sure sounds funny; having to run around town to find the delivery driver..

You don't have to submit any documents though and you aren't giving any info to the cashier.

So nothing stopping you entering a bunch of fake information then?

I thought you actually have to do CEX-style KYC (video camera and ID card), but it's possible that I'm wrong; as I said, I don't have personal experience on this. However, as Pmalek says, with fake information it might work, but very clearly fake information will probably be filtered out automatically.

[Pmalek]

I thought you actually have to do CEX-style KYC (video camera and ID card), but it's possible that I'm wrong; as I said, I don't have personal experience on this. However, as Pmalek says, with fake information it might work, but very clearly fake information will probably be filtered out automatically.

Unless they added personal document verification into the mix in the last couple of years, it shouldn't be a requirement. It could also depend on the network provider, who knows. It's been a couple of years since I last purchased and activated a EU SIM card.

[o_e_l_e_o]

-snip-

A good way around this is to use one of those fake office addresses which is used by dozens of different companies as a registration address or just somewhere to receive their mail. It would be entirely reasonable for hundreds of different people to be registered to such an address. Search for "virtual business address" or similar to see what I mean.

No, you can get them in a grocery store, without giving the cashier any data, but it's not activated out of the box. You have to go to some online website and activate it before it becomes usable.

Yeah, so fake information seems fine.

And they work right out the gate? Like, you can plug it into a phone and it works immediately?

Depends partly on the type of SIM you buy, the carrier, and where you are buying it. Some require registration but accept any old nonsense as above, some work immediately.

[malevolent]

At this point most of the world has SIM card registration if you want to be able to use them: https://www.comparitech.com/blog/vpn-privacy/sim-card-registration-laws/

Sometimes it's to 'fight against terrorism', sometimes it's 'just in case' surveillance, sometimes it's for tax reasons, etc. In Poland at least buying a SIM card registered on someone else's name, or from a different country isn't difficult or expensive ($5-10).