Trezor AOPP Integration

[SFR10]

I'm honestly wondering how it was introduced in the first place without anyone noticing, and the big negative reaction only coming in January 2022.
~Snipped~

This may sound like I'm trying to defend Trezor ^{[I'm not, even though I'm using one of their products]} but to be fair, Trezor added that feature just "two weeks ago"...

Let this be a lesson to better verify what we are actually installing and continue supporting when updating our wallets..

I'm pretty sure I've read the "Trezor Suite's January update" before I installed it, but for some reason, I didn't pay enough attention to that feature until ChiBitCTy created this thread ^[SMH].

[n0nce]

In conclusion, it seems to me that many in here (I'm guilty of this as well! ) have been using wallets with AOPP withing the last year without noticing it.

Yeah but we can't actually follow all the updates coming out all the time for various crypto wallets, and people don't pay much attention and they just click update button, especially tiktok short attention span generation.
I was following reactions for BitBox hardware wallet and people are not happy at all about this, but developers don't have any intention to remove full support for AOPP.

To be honest, I am from now on going to carefully read the release notes of the wallets I'm using, for sure. It's much better than noticing it like a year later as in this case.

Let this be a lesson to better verify what we are actually installing and continue supporting when updating our wallets..

I'm pretty sure I've read the "Trezor Suite's January update" before I installed it, but for some reason, I didn't pay enough attention to that feature until ChiBitCTy created this thread ^[SMH].

Yeah, that's exactly what I mean. Somehow people collectively noticed just now that half the wallets around have incorporated AOPP in their products.


By the way; I just wanted to see if there were any news about Passport v2 and found out that apparently @zherbert and his team have a very strong stance against AOPP, basically saying what we concluded in this topic earlier: it's technically just a shortcut to signing messages (which Passport can do), but they don't want to implement it because of the 'symbolic' of not agreeing to make deanonymizing users easy.

Our concern is if this is just a first step towards more surveillance. Next up might be to require KYC for all UTXOs associated with the transfer, or something like that.

It's a slippery slope, and if we all just blindly comply with this, we set the groundwork for more pain.

Just wanted to put this out here..

[Pmalek]

I took this screenshot few days ago and I can't find it again on their aopp.group website (they removed wallets section from main page)...

It was there, I saw it as well. They might have removed the wallets section, but they forgot something else. If you click on 'Ecosystem', you will see some quotes and feedback from wallet developers on what they have to say about AOPP. That's almost the same thing because they posted which companies those people work for.
 
Right now, we have BlueWallet, bittr, BitBox, Pocket, Aktionariat, 21 Analytics.

[o_e_l_e_o]

What's up with Brave, bad service? I have it and use it sometimes...thought it was pretty legit but what do i know!

I take major issues with how it is run. While marketing themselves as this magic bullet of privacy and anti-tracking, they accept money from companies such as Facebook and Twitter to whitelist their trackers. They still serve ads, just ads that they get paid for instead of other people, and in doing so inject their code in to every single website you visit to remove the native ads and replace them with their own, which is a security risk. They secretly hijack your browser and auto-redirect URLs you enter to include their referral codes. They accept a lot of money from Binance to inject Binance widgets in to the browser and to share your data with Binance. And don't even get me started on how a "privacy" browser can be asking its users for KYC.

All in all, it's probably better than Chrome, but it's far inferior to Firefox in terms of security and privacy. They do a lot of shady stuff behind the scenes, accepting money to sell out on both the privacy and the security of their users, while outright lying in their advertising and marketing.

By the way; I just wanted to see if there were any news about Passport v2 and found out that apparently @zherbert and his team have a very strong stance against AOPP, basically saying what we concluded in this topic earlier: it's technically just a shortcut to signing messages (which Passport can do), but they don't want to implement it because of the 'symbolic' of not agreeing to make deanonymizing users easy.

Man, in my search for a new hardware wallet, Passport are really making it hard not to like them. I just wish they would remove all the unnecessary and risky bloatware they fill their device up with. I'll never buy one unless they do.

[n0nce]

All in all, it's probably better than Chrome, but it's far inferior to Firefox in terms of security and privacy. They do a lot of shady stuff behind the scenes, accepting money to sell out on both the privacy and the security of their users, while outright lying in their advertising and marketing.

I heard Chromium ('degoogled') should be a good choice as well, but I don't really like the idea of using it myself.

By the way; I just wanted to see if there were any news about Passport v2 and found out that apparently @zherbert and his team have a very strong stance against AOPP, basically saying what we concluded in this topic earlier: it's technically just a shortcut to signing messages (which Passport can do), but they don't want to implement it because of the 'symbolic' of not agreeing to make deanonymizing users easy.

Man, in my search for a new hardware wallet, Passport are really making it hard not to like them. I just wish they would remove all the unnecessary and risky bloatware they fill their device up with. I'll never buy one unless they do.

I feel the same; but I have to be cautious not to sound like a Passport shill, lol. Though I can always point people to my review, that I think did criticize everything that's wrong / bad about it. Excited to see what changes will be in the v2 and of course going to review it sooner or later as well..

[bitmover]

All in all, it's probably better than Chrome, but it's far inferior to Firefox in terms of security and privacy. They do a lot of shady stuff behind the scenes, accepting money to sell out on both the privacy and the security of their users, while outright lying in their advertising and marketing.

I heard Chromium ('degoogled') should be a good choice as well, but I don't really like the idea of using it myself.

I use firefox as well.

I recently added up these settings to get a better privacy experience in firefox. They called it hardening firefox. This guides helps to prevent telemetry and a few configurations which harms our privacy in the default firefox configuration.
https://chrisx.xyz/blog/yet-another-firefox-hardening-guide/

[o_e_l_e_o]

I heard Chromium ('degoogled') should be a good choice as well, but I don't really like the idea of using it myself.

If you really need to use a Chromium based browser for some testing or some broken website which won't work otherwise, then Ungoogled Chromium or Bromite for Android are probably your best bet. But no matter how much tweaking you do of Chromium, you will never be able to remove all the deeply embedded crap from Google.

I recently added up these settings to get a better privacy experience in firefox. They called it hardening firefox. This guides helps to prevent telemetry and a few configurations which harms our privacy in the default firefox configuration.

There are lots of different tools you can use to harden Firefox. Probably the most comprehensive one is to download and use the Arkenfox profile: https://github.com/arkenfox/user.js. If you want something more specific, then you can use this tool to build a custom profile suited to your needs: https://ffprofile.com/. There are also forks of Firefox with a lot of hardening built in, such as: https://librewolf.net/.

[dkbit98]

All in all, it's probably better than Chrome, but it's far inferior to Firefox in terms of security and privacy. They do a lot of shady stuff behind the scenes, accepting money to sell out on both the privacy and the security of their users, while outright lying in their advertising and marketing.

Isn't Mozilla doing something similar with Firefox like Brave, behind the scenes? They even returned google as their default search option
If you want more privacy open source browser than try using Librewolf that is fork of Firefox, and for real privacy just use Tor browser.

By the way; I just wanted to see if there were any news about Passport v2 and found out that apparently @zherbert and his team have a very strong stance against AOPP, basically saying what we concluded in this topic earlier: it's technically just a shortcut to signing messages (which Passport can do), but they don't want to implement it because of the 'symbolic' of not agreeing to make deanonymizing users easy.

Getting back to AOPP, what do you guys think will be next hardware wallet to make AOPP integration? Maybe Ledger is next?
I know Keystone wallet is strongly against it and they even had 10% discount code for seven days using Coupon code NoAOPP  
https://nitter.kavin.rocks/KeystoneWallet/status/1486817891202654211

[bitmover]

Getting back to AOPP, what do you guys think will be next hardware wallet to make AOPP integration? Maybe Ledger is next?
I know Keystone wallet is strongly against it and they even had 10% discount code for seven days using Coupon code NoAOPP  
https://nitter.kavin.rocks/KeystoneWallet/status/1486817891202654211

after the disastrous reception of Trezor's implementation of AOPP, which they were basically forced to rollback, i doubt Ledger or any other hardware wallet will freely implement it.

I think they will only do such implementation if forced by legislation. My guess.


edit:
Blue wallet also removed AOPP integration:
https://twitter.com/bluewalletio/status/1486805550608392194

[Pmalek]

Blue wallet also removed AOPP integration:

Many developers are now afraid of losing customers because of the shitstorm AOPP caused.

Samourai Wallet has stated they will not be implementing AOPP and gave a long list of reasons why.

The mobile lightning wallet Zeus has said the following about AOPP:

We'd rather nuke our app than support something harmful to Bitcoin like AOPP.

Source: https://twitter.com/ZeusLN/status/1486788819198218241

Blockstream also doesn't want it.

[o_e_l_e_o]

Isn't Mozilla doing something similar with Firefox like Brave, behind the scenes? They even returned google as their default search option

Yeah, I've been less and less impressed with some of the decisions being made by Mozilla as time goes on, not least of a company supposedly focused on privacy, security, and self ownership of your data deciding to no longer accept cryptocurrency donations.

Samourai Wallet has stated they will not be implementing AOPP and gave a long list of reasons why.

A great point made by Samourai:

That is nonsense and by buying into this system you are legitimizing the concept that self custody requires permission & compliance.

Requiring that a bank or exchange gives you permission to hold your own coins means, by definition, that said bank or exchange can refuse to give you permission to hold your own coins. This is the exact opposite of what bitcoin stands for, and by supporting AOPP you are supporting this nonsense.

Now that Trezor, BlueWallet, and Sparrow Wallet are all removing support, that leaves only BitBox, correct? And considering they helped to design it I can't see them removing support for it any time soon.

Good job to the community for speaking out so loudly against this privacy invading nonsense. Now you just need to stop using centralized exchanges altogether!

[Pmalek]

Now that Trezor, BlueWallet, and Sparrow Wallet are all removing support, that leaves only BitBox, correct?

Among the popular wallets, yes, BitBox is the one that still hasn't turned its back on AOPP. But there are also less-known service providers like Bittr and Pocket, or Aktionariat (whatever that is). Maybe there are more wallets but they haven't publicly announced their support. Seeing the shit they had to take once it became known who did it, the next step could be to try and implement it in secret without telling anyone about it. Especially if they are already closed-source.     

[o_e_l_e_o]

Maybe there are more wallets but they haven't publicly announced their support. Seeing the shit they had to take once it became known who did it, the next step could be to try and implement it in secret without telling anyone about it.

I've checked the GitHubs of all the wallets I use and have found no mention of it, which is reassuring. Implementing it in secret isn't really going to work, since the user will either have to choose to activate it to approve a certain address for an exchange, or will link their wallet to the exchange to have the exchange do it for them, in which case it will be obvious what is happening in the background. They might be able to add it to their wallet in secret, but everyone will know it is there as soon as they are presented with the option to start using it.

[LoyceV]

True, but it's possible some company bet there's less resistance if they implement it in secret rather than announce that they'll implement it.

Unless they're getting paid to implement it, I don't think they'll have any reason to add a feature in secret. Who's going to use it if they don't know it exists?

[ChiBitCTy]

What's up with Brave, bad service? I have it and use it sometimes...thought it was pretty legit but what do i know!

I take major issues with how it is run. While marketing themselves as this magic bullet of privacy and anti-tracking, they accept money from companies such as Facebook and Twitter to whitelist their trackers. They still serve ads, just ads that they get paid for instead of other people, and in doing so inject their code in to every single website you visit to remove the native ads and replace them with their own, which is a security risk. They secretly hijack your browser and auto-redirect URLs you enter to include their referral codes. They accept a lot of money from Binance to inject Binance widgets in to the browser and to share your data with Binance. And don't even get me started on how a "privacy" browser can be asking its users for KYC.

All in all, it's probably better than Chrome, but it's far inferior to Firefox in terms of security and privacy. They do a lot of shady stuff behind the scenes, accepting money to sell out on both the privacy and the security of their users, while outright lying in their advertising and marketing.

Appreciate the explanation. Was certainly not aware of any of this.

All in all, it's probably better than Chrome, but it's far inferior to Firefox in terms of security and privacy. They do a lot of shady stuff behind the scenes, accepting money to sell out on both the privacy and the security of their users, while outright lying in their advertising and marketing.

I heard Chromium ('degoogled') should be a good choice as well, but I don't really like the idea of using it myself.

I use firefox as well.

I recently added up these settings to get a better privacy experience in firefox. They called it hardening firefox. This guides helps to prevent telemetry and a few configurations which harms our privacy in the default firefox configuration.
https://chrisx.xyz/blog/yet-another-firefox-hardening-guide/

So it’s just all about better privacy? Isn’t DuckDuck Go better than Firefox just off the bat though? It’s great that these browsers are trying to do a good job of making things more private, but there’s a reason I still use chrome at times, it’s a million times better than anything else and it’s not even close. I just wish the others could catch up a little.

[Pmalek]

So it’s just all about better privacy? Isn’t DuckDuck Go better than Firefox just off the bat though? It’s great that these browsers are trying to do a good job of making things more private, but there’s a reason I still use chrome at times, it’s a million times better than anything else and it’s not even close. I just wish the others could catch up a little.

Firefox is an internet browser just like Google Chrome. DuckDuckGo is a search engine, like Google's search engine. The Chrome browser is faster, but that speed has privacy implications. If your anonymity is your #1 concern, Google Chrome and all Google services aren't the way to go to maintain that.

[o_e_l_e_o]

It’s great that these browsers are trying to do a good job of making things more private, but there’s a reason I still use chrome at times, it’s a million times better than anything else and it’s not even close.

Genuine question: In what way is it better? I use Firefox and Tor. Obviously Tor has the usual drawbacks, speed issues, etc., but that is the price you pay for using Tor. Firefox, on the other hand, is both fast and secure and way less resource intensive than Chrome in my experience. Chrome seems to eat RAM like there's no tomorrow.

DuckDuckGo is a search engine, like Google's search engine.

DuckDuckGo have a privacy focused browser app on both Android and iOS, and are currently working on a desktop version too.

And yeah, DDG probably is better than Firefox out-of-the-box, but Firefox provides far more customization and tweaking which allow you to make it very strong from a privacy point of the view if that is your goal, even on mobile versions. Or for desktop go with the LibreWolf fork of Firefox which has all these tweaks already implemented for you.

[ChiBitCTy]

It’s great that these browsers are trying to do a good job of making things more private, but there’s a reason I still use chrome at times, it’s a million times better than anything else and it’s not even close.

Genuine question: In what way is it better? I use Firefox and Tor. Obviously Tor has the usual drawbacks, speed issues, etc., but that is the price you pay for using Tor. Firefox, on the other hand, is both fast and secure and way less resource intensive than Chrome in my experience. Chrome seems to eat RAM like there's no tomorrow.

DuckDuckGo is a search engine, like Google's search engine.

DuckDuckGo have a privacy focused browser app on both Android and iOS, and are currently working on a desktop version too.

And yeah, DDG probably is better than Firefox out-of-the-box, but Firefox provides far more customization and tweaking which allow you to make it very strong from a privacy point of the view if that is your goal, even on mobile versions. Or for desktop go with the LibreWolf fork of Firefox which has all these tweaks already implemented for you.

Thanks for the info. Google is far better in quite a few ways but I’ll provide some examples. I’m a coin collector so when trying to search for coins by name, chrome will return FAR better/more efficient results than anything else. That includes just the normal search and the photo search option. Another example, I often share Satoshis smart contract escrow proposal thread from here. If you search “Satoshi bitcointalk escrow” on DDG it’s not even on the first page. Search for it on chrome and it comes up very first link. Just a couple examples. Believe me I don’t like using Chrome, but often it’s necessary. I mean there’s a reason it’s by far the most used browser right.

[o_e_l_e_o]

-snip-

Sure, I agree that DDG search results often aren't quite as good as Google's, but the Google search engine is quite distinct from the Chrome browser. No reason you can't use Google search on Firefox. And if you want to take it to the next level, then you can use something like https://www.startpage.com, which searches Google privately on your behalf and returns you the results without any tracking or other nonsense. I always use this when I'm looking for bitcointalk threads since I agree DDG just doesn't index them well at all. Or go a step further and use https://searx.me, which does the same thing of searching other search engines privately for you, but you can build a profile (or multiple different profiles) specifying which search engines to search.

[Pmalek]

Google is far better in quite a few ways but I’ll provide some examples. I’m a coin collector so when trying to search for coins by name, chrome will return FAR better/more efficient results than anything else. That includes just the normal search and the photo search option.

I would be careful with doing that. Google will gladly advertise phishing sites and display them on top of the search results with an ad notification next to the name. That practice has led people to lose their money or credentials by logging in to fake sites pretending to be legitimate ones. We have seen that with exchanges, software wallets, and other services relating to cryptocurrencies.