About BitBox

[BlackHatCoiner]

Long story short shortest possible: I want to buy a hardware wallet, because the laptop I'm using for decent amounts is ready to drop and I don't want to use the internet connected Windows + Linux computer that I'm using right now; it's too risky for no reason. I do have some alternatives such as using another computer, but due to the convenience of hardware wallets, I think I'm just going to buy one.

I have two conditions:

• Make the purchase in the most private way.
• Use a reputable open-source wallet.

Therefore, I want to pay in cash, not via the internet, hand-in-hand and not for things like Ledger that have a closed-source firmware, even if no one has ever got stolen; I just don't feel good with myself if there are more transparent solutions and I stick with non-transparent ones.

So, what's the problem: I live in Greece and no matter my continual search, the only hardware wallets that I can purchase from a store are two: Ledger and BitBox01. Which leaves me with BitBox01 as it's open-source and reputable.

However, Shiftcrypto, which is the Swedish company that makes those, has announced that it's ended sales for BitBox01, to replace it with the upgraded BitBox02:

Why is BitBox01 no longer being sold?

The BitBox01 started development in 2014 and was released in 2016. Four years later, the industry has matured and changed significantly. When it comes to security, we believe users are best served with the most up-to-date products. The BitBox01 is superseded by the BitBox02.

For more information, please read our blog post.

Something tells me that it's a bad idea. Perhaps I should forget about the hardware wallet as I'm left with no choice. Your thoughts.

And, by the way, is there anyone who still uses BitBox01?

[Lucius]

Something tells me that it's a bad idea. Perhaps I should forget about the hardware wallet as I'm left with no choice. Your thoughts.

Why would it be a bad idea to replace the old version of that HW with a new one? Well, every manufacturer who cares about their reputation and wants to keep their customers and attract new ones launches something new on the market from time to time. If you want more security, and if you're sure this device can give you that, I don't see why you shouldn't invest in it.

Maybe I misunderstood what the problem was, because there is no new version on the link you posted - which means you can't buy it for cash even if you want to?

[Charles-Tim]

The reason I have been deciding not to get a hardware wallet is because of the data leak issue, once the data is given to those companies, then it can be hacked and leaked to hackers just like the Ledger customer's data that was breached. Data leak can happen to any company, the company can even sell the data or give it out to another party.

You are only holding bitcoin according to the OP, if holding only bitcoin, then I still see no reason to get a hardware wallet, wallet on airgapped device is still the best choice for privacy or a paper wallet, or to just buy directly like you have mentioned in the OP, but BitBox01 is never a good option because of the reasons Shiftcrypto mentioned and it is old version. I have one thing about the latest version which is BitBox02, how it supports Address Ownership Proof Protocol (AOPP) which is against privacy.

If you can have a good idea about how this can work, you can read this suggestion:

[GUIDE] How to buy a Hardware Wallet the right way

But this should be well thought of before buying hardware wallet, especially using fake name which I think is not advisable because of clearance after the wallet has been imported to your country. But in my opinion, I have thought of many options and I prefer wallet on airgapped device.

You can just buy a cheap PC that can do the task for you, make it airgapped and have another cold storage on it which is far better than going through all the stress of buying hardware wallet.

[o_e_l_e_o]

I have one thing about the latest version which is BitBox02, how it supports Address Ownership Proof Protocol (AOPP) which is against privacy.

Worse than that - Shift Crypto, the makers of BitBox, were the ones who initially proposed and designed AOPP. I wouldn't buy any product from a company which is so anti-privacy and pro-censorship.


Can you ship with fake or anonymous information? A PO Box or other drop off location? Or to a pseudonym at a different address that you can collect from later? Does Greece have general delivery/poste restante?

Having said that, given the never ending stream of problems that hardware wallets seem to be having, I currently strongly favor a properly airgapped and encrypted computer if you know what you are doing. If you've been working well with an airgapped set up so far, then it would seem that you already know what you are doing, and so there is a strong argument to be made to continue doing that.

[NeuroticFish]

I do have some alternatives such as using another computer, but due to the convenience of hardware wallets, I think I'm just going to buy one.

Imho you should use another computer, if you have that alternative, as cold storage, properly safeguarded and always offline/airgapped, at least until the point you are 100% that HW worth it for you and you are convinced 100% on which one to buy.
HW makes sense if you use bitcoin a lot from outside of your home, and the amounts are big. Else, a cold storage for the big funds and an unsafe wallet on your phone for small (daily?) funds can easily do the job.


Of course, this assumes you know what you're doing, but I expect so.

[BlackHatCoiner]

Maybe I misunderstood what the problem was, because there is no new version on the link you posted - which means you can't buy it for cash even if you want to?

That's the problem. There's no BitBox02 in my areas.

The reason I have been deciding not to get a hardware wallet is because of the data leak issue, once the data is given to those companies, then it can be hacked and leaked to hackers just like the Ledger customer's data that was breached.

And that's why I neither do want. I don't want to mess with throwaway phone numbers, email addresses etc. In the end, I'll, inevitably, have my real name included into a database. I've managed to use bitcoin anonymously so far and I could have screwed up in so many ways that I fortunately didn't. It's unjustifiable to do it now for a wallet.

I have one thing about the latest version which is BitBox02, how it supports Address Ownership Proof Protocol (AOPP) which is against privacy.

I wouldn't buy any product from a company which is so anti-privacy and pro-censorship.

I had no idea about this AOPP. But, how does this imply to users who've bought it with cash? As I've said, there's no way I'll ever have a hardware wallet delivered to my house; especially if it requires me to, essentially, submit KYC-kind of details.

Can you ship with fake or anonymous information?

There's Hellenic Post near me, but I don't understand how's this anonymous. I still have to give full name, email address/phone number and home address. No, I don't think I can just give fake information.

[Charles-Tim]

I had no idea about this AOPP.

It is a means people that are using centralized exchanges (people that have been verified, KYC) are able to prove that they are the owner of a noncustododial wallet address, a means of privacy invasion. But not having anything to do with privacy while buying hardware wallet.

[The Sceptical Chymist]

I have one thing about the latest version which is BitBox02, how it supports Address Ownership Proof Protocol (AOPP) which is against privacy.

Worse than that - Shift Crypto, the makers of BitBox, were the ones who initially proposed and designed AOPP. I wouldn't buy any product from a company which is so anti-privacy and pro-censorship.

Huh.  I had (and still have) no idea what that's all about, and I'll have to look into it--unless someone cares to explain it to me here as if I'm a 5-year old.  

Unless there's some factor I'm unaware of, I don't think the fact that a manufacturer is discontinuing one of their hardware wallets should count as a strike against them, and I thought the BitBox02 was one of the better HW wallets on the market--or at least better than the Ledger.  Someone correct me if I'm wrong on that point as well, because I'm in the same boat as OP.  Ledger's data leak soured me on them completely.

It is a means people that are using centralized exchanges (people that have been verified, KYC) are able to prove that they are the owner of a noncustododial wallet address, a means of privacy invasion. But not having anything to do with privacy while buying hardware wallet.

I'm not sure how that works, as I've never gone through a KYC procedure successfully in the past few years.  I've tried, but the pics I've submitted were never good enough, but that's another story.

[Charles-Tim]

]I'm not sure how that works, as I've never gone through a KYC procedure successfully in the past few years.  I've tried, but the pics I've submitted were never good enough, but that's another story.

There was an article about AOPP by Bitcoinmagazine

Why implementing AOPP could pose a risk to bitcoin long term

In Switzerland, anyone that uses custodial exchanges have to get verified, if users are verified and want to send bitcoin to external wallet address, AOPP helps in a way the user of the exchange that have been verified can be able to provide prove that he/she is the owner of an external wallet address.

I do not know the principle behind it, but I know there has even been a way this can be done which is signing a message with an address but which is not a good way either because it is a mean the government are invading privacy. There is nothing worse than wallet developers providing this in my opinion as the government are having means (provided by wallet developers) to invade privacy.

I just like that few wallets that were supporting AOPP before are no more supporting it. Without AOPP, there has always been data leak on exchanges, with AOPP, the severity of exchange data leak might be worse on bitcoin users as privacy is becoming impossible.

[The Sceptical Chymist]

<snip>

Thanks for that link, it helped me understand what AOPP is a little better.  What I don't understand is what it has to do with BitBox being a decent HW wallet or not.  Are they (or Shift Crypto) keeping records of who's purchased them or something?  Even if they are, that doesn't even sound like what the AOPP thing is all about.  I'm still a bit confused (but that's a normal state for me anyhow).

[BlackHatCoiner]

What I don't understand is what it has to do with BitBox being a decent HW wallet or not.

Me neither. If you buy the hardware wallet without giving the required info during the purchase, as they ask, there is nothing wrong with it, neither with Trezor. At least that's how I understand it.

From what I see in aopp.group, though, your wallet sends a signed message to the exchange, which doesn't make any sense.

What Information Will My Wallet Send to My Exchange?

The information the wallet sends to the exchange is a signed message. This message can contain whatever details the exchange considers enough to fulfill their compliance obligations, but only data the exchange already knows, since it is the one who crafts the message.

[Charles-Tim]

What I don't understand is what it has to do with BitBox being a decent HW wallet or not.  Are they (or Shift Crypto) keeping records of who's purchased them or something?  Even if they are, that doesn't even sound like what the AOPP thing is all about.  I'm still a bit confused (but that's a normal state for me anyhow).

If wallet developers decide to support what the government can use to effectively invade people's privacy, normally bitcoin community will not support that, they support what will help achieving privacy. If done in a country successfully, other countries may also make it a law, making their custizens to prove the ownership of external wallet addresses.

This (AOPP) has nothing to do with purchase of hardware wallet, if Shiftcrypto handle customers data appropriately and not sell it or give it out to third party, or not breached, then the data are in safe hand, but we could not even conclude this as mentioned above because we do not know which one would be the next to Ledger data leak.

Me neither. If you buy the hardware wallet without giving the required info during the purchase, as they ask, there is nothing wrong with it, neither with Trezor. At least that's how I understand it.

Exactly. But if you do not want to support AOPP, you should also not support any wallet that supports it. Only Switzerland supports AOPP for now, but there is possibility other countries will start making it mandatory, the reason bitcoin community should neither support it nor support any wallet that supports it.

[Lucius]

There's Hellenic Post near me, but I don't understand how's this anonymous. I still have to give full name, email address/phone number and home address. No, I don't think I can just give fake information.

In order to rent/open a PO box in your post office, of course you have to give them your personal data, but when ordering online, you only give the seller information about your PO box without your name and address. In theory, this is how things should work, but before any order, you should ask for an official opinion from the seller.

Specifically, if you want to buy Trezor, send them an inquiry whether they support sending the device to the PO box - in which case you have a PO box + TOR + payment with BTC = the best anonymity you can get online.

Alternatively, you have at least two other options:

- Find the nearest location outside your country where it is possible to buy the HW you want for cash, and then go there on vacation and buy HW
- Find someone trusted on the forum you trust to buy HW for you and send it to your home address.

[dkbit98]

Which leaves me with BitBox01 as it's open-source and reputable.

I would not buy that old outdated version of BitBox wallet and I think this is a bad idea.
It is inferior in every way compared to most hardware wallets that exist today and I don't think it's supported by Shiftcrypto anymore.

However, Shiftcrypto, which is the Swedish company

Shiftcrypto is Swiss based company, that is country called Switzerland, not Sweden  

Perhaps I should forget about the hardware wallet as I'm left with no choice. Your thoughts.

If you really want to buy hardware with cash you can visit some country that is bordering with Greece, like Bulgaria for example and buy BitBox02 there for cash.
You can find Bitbox02 in many other shops in Europe, Croatia, Slovenia, Germany, Romania, Netherlands, etc.
Find all official resellers on shiftcrypto website:
https://shiftcrypto.ch/buy/

I don't know if you want to use hardware wallet just for Bitcoin or for other shitcoins, but if it's only for good old BTC than you can buy Raspberry Pi zero locally and make your own SeedSigner signing device.
For ordering stuff online you should always use PO Boxes, alternative addresses/names/phone numbers.

[BlackHatCoiner]

How didn't I think of buying a Pi and do this myself, privately? Thanks dkbit98!

[dkbit98]

How didn't I think of buying a Pi and do this myself, privately? Thanks dkbit98!

One small problem is that raspberry pi zero is not always easy to find now due to chain supply issues, and even if you find them price probably won't be so cheap like it was before.
You can use rpilocator.com website with filter zero to find best deals on this devices and you can find, download and print SeedSigner .stl file cases for free on gobrrr.me, or similar websites.
More information about SeedSigner with instructions can be found on their website and github page:
https://seedsigner.com/
https://github.com/SeedSigner/seedsigner

[BlackHatCoiner]

One small problem is that raspberry pi zero is not always easy to find now due to chain supply issues, and even if you find them price probably won't be so cheap like it was before.

I see the problem. It's out of stock in Greece. What if I buy a RPi Pico? Does it have to be strictly zero?

[ABCbits]

One small problem is that raspberry pi zero is not always easy to find now due to chain supply issues, and even if you find them price probably won't be so cheap like it was before.

I see the problem. It's out of stock in Greece. What if I buy a RPi Pico?

RPi Pico is micro controller (similar with some Arduino). You can't run linux on it since it has 264 KB RAM.

Does it have to be strictly zero?

Most RPi should be fine (unless it's very old type), although faster device is not necessary when you only run linux + Bitcoin wallet (which only used for signing transaction).

[BlackHatCoiner]

[...]

Is there any of the products in this link (check "Availability") that satisfies the needs for SeedSigner? The only Pi that I've found available in my country is the one I have, RPi 4, which is a little bit pricey.

[dkbit98]

I see the problem. It's out of stock in Greece. What if I buy a RPi Pico? Does it have to be strictly zero?

You can't use Rpi Pico for anything serious, but keep an eye on local shops that could re-stock supplies from time to time.
I don't see big problem with ordering online adding alternative address, some shops even sell whole kits and they have option for paying with Bitcoin or Lightning.
Raspberry Pi is universal device and it's not directly connected with bitcoin, so you don't have to think if scammers or regulators will target you in future.