Show off your hardware wallet

[LuckyCrypto777]

A few years ago, my friend gave me this Ledger. He was the first of our group to learn about the world of blockchain and Bitcoin. Of course, this gift was part of his "program to get his best friends involved in the world of Bitcoin and blockchain" (not trading or speculation), but rather an invitation to see Bitcoin and blockchain for myself. This piqued my interest, because at that moment, I had something tangible, and related to Bitcoin in my hands!
It certainly motivated me at the time, and I consider it one of the most life-changing gifts of my life.
Of course, we still communicate, and discussing Bitcoin is one of our main topics that keeps us from getting lost in the distance.
I wish everyone had friends like that.

Thanks for sharing your story and the picture. I will add your name to the table.

Are you still using your Ledger Nano S today? How is the display quality after a few years? Several users have reported that the quality of their displays have deteriorated and at one point some people even experimented with replacing the displays on their own.

On a different note, are you familiar with Ledger's data leaks and the very controversial Ledger Recover (key extraction) feature that's built into all their devices? The Nano S is allegedly the only one that doesn't support Ledger Recover because of memory constraints.

Right now, I'm just keeping this crypto wallet in a safe, and it's currently empty. I'll transfer bitcoins to it only when I reach my accumulation goal. That will be something of a checkpoint for me.
Regarding the data leak: yes, I read this thread:
https://bitcointalk.org/index.php?topic=5593102.msg67107798#msg67107798

and it's a shame it happened this way. I didn't receive any suspicious emails, so I guess I wasn't affected by this incident.
Thanks for telling me about Ledger Recover, even though it doesn't apply to my model, I'll know about it now.

Update: Ledger users, attention
https://bitcointalk.org/index.php?topic=5596352.msg67223204#msg67223204

[Pmalek]

Right now, I'm just keeping this crypto wallet in a safe, and it's currently empty. I'll transfer bitcoins to it only when I reach my accumulation goal. That will be something of a checkpoint for me.

I see. In your previous post you mentioned that your friend gave you the hardware wallet as a gift. That means that you have been storing your coins elsewhere all this time. Is it another hardware wallet, a software wallet, or perhaps an exchange?

I didn't receive any suspicious emails, so I guess I wasn't affected by this incident.

Since you got it as a gift, there shouldn't be any of your personal data in Ledger's database unless your friend ordered it in your name with your personal info.

[LuckyCrypto777]

I see. In your previous post you mentioned that your friend gave you the hardware wallet as a gift. That means that you have been storing your coins elsewhere all this time. Is it another hardware wallet, a software wallet, or perhaps an exchange?

Thanks for asking.
I store my bitcoins on Electrum because I often see it getting the most praise on the forum. I never store them on exchanges.

Since you got it as a gift, there shouldn't be any of your personal data in Ledger's database unless your friend ordered it in your name with your personal info.

My friend would never use my data without my knowledge. He's the one who teaches me to be a little paranoid.

[Pmalek]

My friend would never use my data without my knowledge. He's the one who teaches me to be a little paranoid.

I wasn't claiming that he did, only stating the obvious. Your data couldn't have leaked from Ledger or a third-party if those parties never had any identifiable information on you.

Considering what has happened with Ledger's official reseller and the hardware implants, this might be a good opportunity for you to disassemble that Ledger device and perform a hardware integrity check on the board if you want to. Just know that doing that you void the warranty. But since you said that you got the Nano S a few years ago, it has probably expired anyways.

[examplens]

My friend would never use my data without my knowledge. He's the one who teaches me to be a little paranoid.

You don't have a guarantee for this.
It is enough to have one friend who has no sense of privacy and who will share your data somewhere out of good intentions. For example, he can enter you in a prize game because he thinks you will be happy if you unexpectedly win the first prize. I personally know such people.

[Wind_FURY]

This is what paranoia will make you do. 



I tried to disassemble my Trezor Safe 3 and concluded that if someone tampered with it, they would need to break the casing. I also went to a candy shop to use their scale, it was 15 Grams but the scale rounded off to the nearest five or round number. My Ledger is 20 Grams on that scale.

OK, I believe the Trezor is safe.

 

[bitmover]

A few years ago, my friend gave me this Ledger. He was the first of our group to learn about the world of blockchain and Bitcoin. Of course, this gift was part of his "program to get his best friends involved in the world of Bitcoin and blockchain" (not trading or speculation), but rather an invitation to see Bitcoin and blockchain for myself. This piqued my interest, because at that moment, I had something tangible, and related to Bitcoin in my hands!
It certainly motivated me at the time, and I consider it one of the most life-changing gifts of my life.
Of course, we still communicate, and discussing Bitcoin is one of our main topics that keeps us from getting lost in the distance.
I wish everyone had friends like that.

That was a nice gift, but a little expensive one as well. This person is really your friend.

Many years ago, in 2019, I gave a seed phrase containing bitcoins and instructions on how to recover them, to a friend of mine. At the time it was about $15  , but it is now probably about $200 or more

My friend never tried to recover those bitcoins. Maybe I should have given him something more tangible as your friend did. But I didnt want to spend so much

[LoyceV]

I also went to a candy shop to use their scale, it was 15 Grams but the scale rounded off to the nearest five or round number.

You'll probably get more accurate results if you ask your local jeweler or gold seller. I wouldn't recommend to ask your local drug dealer.

[Pmalek]

You don't have a guarantee for this.
It is enough to have one friend who has no sense of privacy and who will share your data somewhere out of good intentions. For example, he can enter you in a prize game because he thinks you will be happy if you unexpectedly win the first prize. I personally know such people.

There are no guarantees, that's true. However, I think LuckyCrypto777 mentioned that his friend is the more privacy-oriented between the two and the one who has a dosage of healthy paranoia in him.

I wouldn't recommend to ask your local drug dealer.

What if HE is the local drug dealer. That would make things so much easier.

[m2017]

I also went to a candy shop to use their scale

Did you really do it? I’d liketo see a line of users holding their hardware wallets in hands, waiting to weigh them.

Isn't that a pretty good idea for a meme?

This is what paranoia will make you do. 

Your paranoia is still only in the early stages.

By the way, in the "Show off your hardware wallet" topic, users will soon start showing off not the "exterior" of their HW-devices, but their "inside".

You'll probably get more accurate results if you ask your local jeweler or gold seller. I wouldn't recommend to ask your local drug dealer.

I can just picture a paranoid person, terrified that malicious hardware has been embedded in their hardware wallet, going to a local jeweler \ pastry chef to weigh it, completely forgetting about the "5$ wrench attack" scenario.

Can't these folks simply buy a set of jeweler's (or kitchen) scales - even if they aren't ultra-high precision?

Weighing a hardware wallets will soon cease to be a "cure for paranoia", as it wouldn't be difficult for attackers to match the weight to the correct specifications; the only 100% guarantee remains opening up the device. For now, at least. As previously discussed, attackers are becoming more technically sophisticated, and creating counterfeit circuit boards that are visually indistinguishable is only a matter of time.

[Wind_FURY]

I also went to a candy shop to use their scale, it was 15 Grams but the scale rounded off to the nearest five or round number.

You'll probably get more accurate results if you ask your local jeweler or gold seller. I wouldn't recommend to ask your local drug dealer.

THANK YOU FOR THAT SUGGESTION!

My friend's mother is a jeweller. I'll go there later this week. Although, I believe that my Trezor Safe 3 is safe, my paranoia is telling me to check with the jeweller's scale, and verify. Haha.

I also went to a candy shop to use their scale

Did you really do it? I’d liketo see a line of users holding their hardware wallets in hands, waiting to weigh them.

Isn't that a pretty good idea for a meme?

Yes.

This is what paranoia will make you do.  

Your paranoia is still only in the early stages.

By the way, in the "Show off your hardware wallet" topic, users will soon start showing off not the "exterior" of their HW-devices, but their "inside".

  

[Meuserna]

This is what paranoia will make you do. 

Your paranoia is still only in the early stages.

For me... my paranoia went down when I switched from learning about hardware wallets as gadgets and switched to learning about seed phrases, passphrases, addresses and keys.

I kept my coins on Coinbase until I got my first hardware wallet (a Ledger. P.S. Eff Ledger! What a dirty company).

I remember being almost afraid of my hardware wallet at first. This thing seemed so important. What if something happens to it? Everything shifted when I bought a second one, as a backup. When I entered my seed phrase into it, and used it to access my wallet... that was when it clicked: Coins are on the blockchain. The wallet holds the keys, not the coins. That's when everything became obvious to me, and my thinking shifted from devices to addresses, keys, and keeping my seed phrase safe.

These days, my hardware wallets are a Krux and a ShieldSigner (ShieldSigner is a more advanced fork of SeedSigner). I also own a Blockstream Jade which I only use if I want to triple-check something (which I only do when setting up a new wallet).

I love using Krux and ShieldSigner. Love! They're both air-gapped and stateless. I love NOT storing my seed phrase on a hardware wallet. The device acts more like a tool than a vault. And thanks to encrypted SeedQRs, it's easier to load a seed phrase on Krux or ShieldSigner than it is to enter a PIN code to unlock a traditional hardware wallet. Just scan the QR.

I also love being able to double check things on 2 different devices if I want to.

And I own a Trezor Safe 3, just for some sh!tcoins I bought before I knew what I was doing. They're junk, but for $50 on sale, I got a Trezor for 'em.

P.S. What's the best method for posting pictures here instead of links?

[LoyceV]

P.S. What's the best method for posting pictures here instead of links?

TalkImg.com - Image hosting for BitcoinTalk

[Pmalek]

These days, my hardware wallets are a Krux and a ShieldSigner (ShieldSigner is a more advanced fork of SeedSigner). I also own a Blockstream Jade which I only use if I want to triple-check something (which I only do when setting up a new wallet).

I love using Krux and ShieldSigner. Love! They're both air-gapped and stateless. I love NOT storing my seed phrase on a hardware wallet. The device acts more like a tool than a vault. And thanks to encrypted SeedQRs, it's easier to load a seed phrase on Krux or ShieldSigner than it is to enter a PIN code to unlock a traditional hardware wallet. Just scan the QR.

The Jade can work in two different ways: a regular hardware wallet, with the seed saved inside it or as a stateless signer, with the keys wiped every time you turn it off. Are trust issues the reason why you don't use your Jade for anything except checking your seed/keys/addresses? Jade doesn't support encrypted SeedQRs (or maybe the newer model does), just unencrypted SeedQRs. Maybe that's the reason you don't use it more.

[Meuserna]

These days, my hardware wallets are a Krux and a ShieldSigner (ShieldSigner is a more advanced fork of SeedSigner). I also own a Blockstream Jade which I only use if I want to triple-check something (which I only do when setting up a new wallet).

I love using Krux and ShieldSigner. Love! They're both air-gapped and stateless. I love NOT storing my seed phrase on a hardware wallet. The device acts more like a tool than a vault. And thanks to encrypted SeedQRs, it's easier to load a seed phrase on Krux or ShieldSigner than it is to enter a PIN code to unlock a traditional hardware wallet. Just scan the QR.

The Jade can work in two different ways: a regular hardware wallet, with the seed saved inside it or as a stateless signer, with the keys wiped every time you turn it off. Are trust issues the reason why you don't use your Jade for anything except checking your seed/keys/addresses? Jade doesn't support encrypted SeedQRs (or maybe the newer model does), just unencrypted SeedQRs. Maybe that's the reason you don't use it more.

I find the Jade workflow to be really clunky in use. And it doesn't have passphrase QR. That being said... I haven't used my Jade in around a year, so maybe they've improved the UI, workflow and features?

I believe passphrase QR is a must-have feature. Expecting users to manually type passphrases every time they use the wallet encourages people to either use weak passphrases or not use a passphrase at all. ColdCard users who didn't use passphrases got robbed. But even some who used weak passphrases got robbed, because weak passphrases can be cracked.

Strong passphrases are uncrackable. Pasphrase QR makes it easy to use very strong passphrases, because you can easily instantly load the passphrase by scanning a QR. I'm not going to say how long my passphrase is, but it's more than 6 words, and I can scan it faster than somebody could enter a 3 character passphrase.

Scan. Done.

[Pmalek]

I find the Jade workflow to be really clunky in use. And it doesn't have passphrase QR. That being said... I haven't used my Jade in around a year, so maybe they've improved the UI, workflow and features?

The newer firmware versions improve and modernize the UI somewhat but there is no significant change. I haven't noticed that they added new features. Just like you, I moved some of my coins to my Jade and I haven't touched them in a long time. I turn it on occasionally so that the battery doesn't die and once I upgraded the firmware. That's about it.

I believe passphrase QR is a must-have feature. Expecting users to manually type passphrases every time they use the wallet encourages people to either use weak passphrases or not use a passphrase at all.

Since you have some experience with Jade, you can imagine how fun it is to enter long and complex passphrases using that scroll wheel at the top. It takes a looong time, I can tell you that.

[DireWolfM14]

Scan. Done.

Which hardware wallets have that feature?  Honestly, I didn't know such a thing existed.

Please explain how that works.  So, you use a QR code generator to turn your passphrase into a QR code, and leave that QR code sitting on your desktop in a PDF?

[Meuserna]

Scan. Done.

Which hardware wallets have that feature?  Honestly, I didn't know such a thing existed.

Please explain how that works.  So, you use a QR code generator to turn your passphrase into a QR code, and leave that QR code sitting on your desktop in a PDF?

Nope. No QR sitting on your computer or phone. Nothing like that.

Here's how it works:

Krux and Kern are DIY hardware wallets that run on off the shelf hardware. Both feature passphrase QR and encrypted SeedQR. I haven't tried Kern yet, but Krux is fantastic, and the dev who did most of the work on Krux moved on to create Kern, which runs on more advanced (but still really affordable) hardware.

ShieldSigner is a fork of SeedSigner that adds passphrase QR, encrypted SeedQR, and even smartcard compatibility. It runs on SeedSigner hardware.

With this kind of hardware wallet, you use QR codes to load your seed & passphrase.

There are lots of ways to create a QR. One way is to literally hand draw a QR, which is easier than it sounds. You print a blank QR and fill in the squares with a pencil or pen by hand. These hardware wallets have a UI to make it easy (SeedSigner does too).

Another easy way to create a QR is to buy one of those cheap thermal printer cameras. They're cheap toys, but they do a good job of taking pictures of QRs, and they have no wifi or USB, so they're airgapped (which is hilarious. They're just toys). Take a pic of the QR with the toy camera. Slip the print into a credit-card holder type of plastic sleeve. It's great.

Because these hardware wallets don't save your seed or wallet on the device, there's nothing on the device to lock, which means there's no PIN code. Every time you boot the device, it's blank.

To load the wallet, Scan your seed QR. If you chose to create an encrypted seed QR, you'll need to either type your decryption key or scan a QR with your decryption key. So, scan, scan. Done. Got a passphrase? Type it, or scan the QR for it. Easy.

When you're done using the wallet & you turn it off (or restart), it wipes out the seed and the wallet. Nothing is saved. That means, the device is stateless. If somebody finds your device, no worries. There's nothing on it.

I know this is a different way of working compared to the traditional hardware wallet that saves your keys on the device. Once I switched to working this way, I knew I'd never go back to having my seed saved on a hardware wallet again. I think this way is so much better.

Airgapped: Internet thieves can't reach it.
Stateless: There's nothing on the device for hackers to extract.
Encrypted seed QR: If somebody finds the QR, it's just a QR that shows nothing, because it's encrypted.
Passphrase QR: Strong passphrases become super-easy.

And if you lose a QR? No problem. You backed up your seed phrase and passphrase on metal, right? Because we all know to do that.