Show off your hardware wallet

[LoyceV]

If the issue for you is about the Ledger being closed source

I'm pretty sure the issue is Ledger's lying about "the seed can't leave the secure element":

the future firmware releases will add the ability to unsubscribe from this service

So they went from "the seed can never leave the secure element" to "don't worry, our software broadcasts your seed to our servers" to "trust me, we won't do that again if you don't want to"? Lol.

[Pmalek]

If the issue for you is about the Ledger being closed source, I believe the Trezor Safe 3 has the same issue? The firmware of the chip is closed source, like the Ledger and the SafePal.

The secure element on the Trezor Safe 3, like all other secure elements, is closed source. So Ledger and Trezor are similar in that regard. One difference is that Ledger's SE manufacturer required the signing of an NDA. The company can't disclose findings and vulnerabilities of the chip. Trezor's Optiga Trust SE doesn't need a signed NDA.
Besides that, other areas of Ledger's ecosystem are closed-source, which isn't the case with Trezor. The firmware on your device for example.   

[Wind_FURY]

If the issue for you is about the Ledger being closed source

I'm pretty sure the issue is Ledger's lying about "the seed can't leave the secure element":

the future firmware releases will add the ability to unsubscribe from this service

So they went from "the seed can never leave the secure element" to "don't worry, our software broadcasts your seed to our servers" to "trust me, we won't do that again if you don't want to"? Lol.

I'm confused. Is that when you have their "Ledger Seed Recovery" service on? OR the seed could still be broadcasted to Ledger's servers even if the service is OFF?

That's a serious issue.

But OK, the closed source firmware could also a real issue because we're also merely trusting the company that the device is secure.

[LoyceV]

I'm pretty sure the issue is Ledger's lying about "the seed can't leave the secure element":

I'm confused. Is that when you have their "Ledger Seed Recovery" service on? OR the seed could still be broadcasted to Ledger's servers even if the service is OFF?

It's impossible for us to know whether or not they still broadcast the seed phrase, but I'm sure as hell not going to trust a company that has lied before. Besides, if a firmware update can gain access to the seed phrases, a hacked firmware can do the same.

That's a serious issue.

That's an understatement

we're also merely trusting the company that the device is secure.

They've shown they can't be trusted, so I'm not trusting them. If I wanted to trust companies, I'd use banks instead of Bitcoin.

[Pmalek]

I'm confused. Is that when you have their "Ledger Seed Recovery" service on? OR the seed could still be broadcasted to Ledger's servers even if the service is OFF?

That's a serious issue.

That's just the thing, we don't know. What we do know is that they have said things that have turned out to be false before. Seed extraction code is embedded in all firmware on their new devices. No one can check how long it's been there because the code is not public. You can only choose to trust what they say is true. And let me remind you that Ledger has been saying that your keys can never leave the secure element. Turns out that they can easily be extracted with a few lines of code.

They have talked about making Ledger Recover or some parts of it open-source. That hasn't happened. Instead, they have released a second backup system, but this time as a physical card.

The entire idea behind Ledger Recover is for law enforcement to have a backdoor to your wallet. Shards of your seed are in the hands of different companies. If law enforcement needs Ledger to freeze your crypto, all they have to do is ask. Since everything is closed-source, there is no way of knowing if this freezing feature is possible against everyone running the latest Ledger firmware or if it's exclusive to those who have signed up and paid for Ledger Recover.

[NeuroticFish]

I'm confused. Is that when you have their "Ledger Seed Recovery" service on? OR the seed could still be broadcasted to Ledger's servers even if the service is OFF?

That's a serious issue.

That's just the thing, we don't know. What we do know is that they have said things that have turned out to be false before

It's not just that. It's also that we cannot know what surprises will "the next" firmware update come with. Maybe something is not enabled or broadcasted... now. But tomorrow?
And why take any risks if you can just get another HW at under 50$ for Black Friday?

[Wind_FURY]

OK, here's my SafePal X1. It arrived a few days ago, and I opened it today.

- Front of the box



- Back of the box



- Inside the box



- The hardware wallet was detached from the box. Is this OK? 👀



- 👍

[Pmalek]

OK, here's my SafePal X1. It arrived a few days ago, and I opened it today.

I will add your SafePal X1 to the collection in OP. You are the first user who has reported that they own this particular model. ajiz138 confirmed having a SafePal S1 earlier.
Looks like a calculator. After you have used it a bit, you can write some feedback in the Safepal hardware wallet review and opinions thread.

- The hardware wallet was detached from the box. Is this OK? 👀

I don't know if you are joking or if that was a serious question.
It probably got detached during shipping and handling by the personnel who sent it from A to B, etc.

I see there is a USB cable. Safepal claims to be airgapped. Is the cable there for firmware installation only or do you need to have the device connection to the PC at all times during use? I have never taken a closer look at Safepal devices.