Firmware Upgrades for Hardware wallets their weakness?

[dkbit98]

Not sure I agree. I think ColdCard is probably one of the more difficult hardware wallets to get a grasp out there.

I wouldn't say Coldcard is difficult to grasp, but it's certainly not device for everyone or for someone who owns shitcoins.
I don't think that Coldcard have best security features and they had history of misleading customers before with some false statements, but it's not bad hardware wallet to have if you like old calculators 

My laptops last 4-5 years, and then they die. It's always the motherboard that is the weak spot in my experience. I have had 3 laptops whose motherboards has failed in my lifetime. Buying a second-hand laptop is not an option for me because they simply aren't as good performance-wise and there is the added risk of hardware failures for outdated components.    

That's probably because you purchase junk consumer laptops, so it's your fault for wasting money.
I did not say buy crap laptops, but buy business class tanks like good old Thinkpad T series, or Dell Latitude/Precision... because they are indestructible, that is why military uses them.
You can easily find spare parts for them locally or online, and they are modular so you can replace each part, cpu, etc separately.

[1714464449]

1714464449

[1714464449]

1714464449

[1714464449]

1714464449

[1714464449]

1714464449

[1714464449]

1714464449

[Pmalek]

That's probably because you purchase junk consumer laptops, so it's your fault for wasting money.
I did not say buy crap laptops, but buy business class tanks like good old Thinkpad T series, or Dell Latitude/Precision... because they are indestructible, that is why military uses them.

They weren't consumer laptops. Well, one of them was a low-budget multimedia machine which I got a long, long time ago. The second one was a HP EliteBook and the third one was a Dell Vostro. The last two belong to the business class of laptops. The Dell Latitude and Precision series are even better. I have never worked on a Lenovo machine, but all the Thinkpads that caught my attention were really expensive devices.     

[NotATether]

People are mainly scared of applying firmware updates to hardware, in general, because of the risk that it bricks the device.

Generally, there is no warranty or support for when your device breaks due to a bad update. It is also unlikely that any technician can fix it, given that bricked hardware is virtually unusable. This forces the user to purchase a second device, data be damned.

For hardware wallets in particular, I would recommend a Linux "hypervisor" (extremely stripped down to reduce the amount of security updates required as much as possible) as the main OS that then boots up the actual hardware wallet OS.

This has the advantage that if the wallet OS breaks because of some firmware update, a technician can boot up a Linux shell and revert it to a known good version.

[ranochigo]

People are mainly scared of applying firmware updates to hardware, in general, because of the risk that it bricks the device.

Generally, there is no warranty or support for when your device breaks due to a bad update. It is also unlikely that any technician can fix it, given that bricked hardware is virtually unusable. This forces the user to purchase a second device, data be damned.

I think that it is fairly unlikely for hardware wallets to actually be bricked because most of them actually validate the firmware for any inconsistencies before applying it. Unsolvable bricks are far few and between.

For hardware wallets in particular, I would recommend a Linux "hypervisor" (extremely stripped down to reduce the amount of security updates required as much as possible) as the main OS that then boots up the actual hardware wallet OS.

This has the advantage that if the wallet OS breaks because of some firmware update, a technician can boot up a Linux shell and revert it to a known good version.

That might actually be counter-intuitive. Most hardware wallets are actually designed with proprietary firmware and bootloaders to try to minimize additional attack vectors and possible external problems. Running your hardware wallet inside a Linux Sandbox wouldn't help because you now have to consider the security of Linux as well.

No one would realistically send their hardware wallets or anything to Ledger or the hardware wallet manufacturer. I don't find a point in them giving out warranty if you realize that it is virtually impossible to check if the data is cleanly wiped from your device before sending it to them.

[vapourminer]

No one would realistically send their hardware wallets or anything to Ledger or the hardware wallet manufacturer. I don't find a point in them giving out warranty if you realize that it is virtually impossible to check if the data is cleanly wiped from your device before sending it to them.

agreed.

just buy a spare hardware wallet and be ready for failure. iow, backups of seeds on non digital media.

for example i've had a few harddrives/SSDs that failed over the years and i would not send in for warranty replacement simply because of the personal info thats on them. i just ate the cost. and its my fault if losing anything anyway if i didnt have the data backed up. same principle applies to hardware wallets. do not send anything out that has potentially valuable data that can be recovered. destroy it instead and roll with the backup.

[n0nce]

For hardware wallets in particular, I would recommend a Linux "hypervisor" (extremely stripped down to reduce the amount of security updates required as much as possible) as the main OS that then boots up the actual hardware wallet OS.

This layered approach is a little bit what Trezor Model T and Foundation Passport are doing; the actual firmware is MicroPython and it runs little Python scripts on top. I do believe that firmware released by these companies upgrades still replace the whole thing, but since the actual base firmware is probably fairly stock MicroPython runtime, there is less risk of the devs messing something up real bad.

No one would realistically send their hardware wallets or anything to Ledger or the hardware wallet manufacturer. I don't find a point in them giving out warranty if you realize that it is virtually impossible to check if the data is cleanly wiped from your device before sending it to them.

just buy a spare hardware wallet and be ready for failure. iow, backups of seeds on non digital media.

You don't even have to buy two devices up front; just get whatever is the latest and greatest / most secure whenever your existing hardware wallet breaks / bricks. As I said on page 1, the wallet is mostly an electronic representation of your seed which allows you to quickly use it. But the actual 'set in stone' secure location for your seed should be on paper or metal backup, stored in a handful of secure locations.

[ranochigo]

This layered approach is a little bit what Trezor Model T and Foundation Passport are doing; the actual firmware is MicroPython and it runs little Python scripts on top. I do believe that firmware released by these companies upgrades still replace the whole thing, but since the actual base firmware is probably fairly stock MicroPython runtime, there is less risk of the devs messing something up real bad.

Most bricks would likely happen when the bootloader is upgrading. It probably wouldn't matter what the firmware runs on, if you lose the method of communicating with the host device, then your HW wallet is bricked. I think that the devs are unlikely to really mess it up because there is a certain procedure to test the updates against their device before pushing it out. Failing to test it would just be general incompetence.

You don't even have to buy two devices up front; just get whatever is the latest and greatest / most secure whenever your existing hardware wallet breaks / bricks. As I said on page 1, the wallet is mostly an electronic representation of your seed which allows you to quickly use it. But the actual 'set in stone' secure location for your seed should be on paper or metal backup, stored in a handful of secure locations.

Largely depends on if you store everything in your hardware wallet. It might be wise to have a spare hardware wallet so you can seamlessly shift to your new hardware wallet when it breaks without any delay.

[n0nce]

Most bricks would likely happen when the bootloader is upgrading. It probably wouldn't matter what the firmware runs on, if you lose the method of communicating with the host device, then your HW wallet is bricked. I think that the devs are unlikely to really mess it up because there is a certain procedure to test the updates against their device before pushing it out. Failing to test it would just be general incompetence.

You don't even have to buy two devices up front; just get whatever is the latest and greatest / most secure whenever your existing hardware wallet breaks / bricks. As I said on page 1, the wallet is mostly an electronic representation of your seed which allows you to quickly use it. But the actual 'set in stone' secure location for your seed should be on paper or metal backup, stored in a handful of secure locations.

Largely depends on if you store everything in your hardware wallet. It might be wise to have a spare hardware wallet so you can seamlessly shift to your new hardware wallet when it breaks without any delay.

I guess, yes, of course if you need instant access to some BTC you can also restore a seed to a software wallet. If it's a large amount and you can't quickly get your hands on a hardware wallet (same-day kind of urgency and remember we're talking about large amounts) you could run to the store and quickly buy a fresh new laptop to rip the wireless connectivity out of and live boot Tails on. This way you could import the seed and do your important million-dollar transaction securely and quickly as well.

[Pmalek]

No one would realistically send their hardware wallets or anything to Ledger or the hardware wallet manufacturer. I don't find a point in them giving out warranty if you realize that it is virtually impossible to check if the data is cleanly wiped from your device before sending it to them.

I don't think they would ask you to return the hardware wallet if it was used when it broke, and even if you do, you shouldn't do it. It's not worth the headaches thinking whether or not someone along the way could extract some data from it. Saving $50, $100, or $200 by not purchasing a new HW, but risking losing $100.000 shouldn't be an option.

Judging by the experience of one of my colleagues, he was asked to return a device that came faulty and couldn't be used from the start. The old one, which was out of warranty, didn't even have to be returned. 

I guess, yes, of course if you need instant access to some BTC you can also restore a seed to a software wallet. If it's a large amount and you can't quickly get your hands on a hardware wallet (same-day kind of urgency and remember we're talking about large amounts) you could run to the store and quickly buy a fresh new laptop to rip the wireless connectivity out of and live boot Tails on. This way you could import the seed and do your important million-dollar transaction securely and quickly as well.

Or just be prepared for a scenario in which your hardware wallet will one day break. Keep some coins secured only with the seed. That's the amount you would need to access the same day your HW breaks. $100, $500, $5.000, everyone has different needs and spending habits. Keep the rest secured by (multiple) passphrases. If your hardware wallet breaks, and you need access to some coins in that exact hour, recover your Bitcoin through seed and use only those coins that aren't protected with a passphrase. 

[m2017]

I guess, yes, of course if you need instant access to some BTC you can also restore a seed to a software wallet. If it's a large amount and you can't quickly get your hands on a hardware wallet (same-day kind of urgency and remember we're talking about large amounts) you could run to the store and quickly buy a fresh new laptop to rip the wireless connectivity out of and live boot Tails on. This way you could import the seed and do your important million-dollar transaction securely and quickly as well.

Or just be prepared for a scenario in which your hardware wallet will one day break. Keep some coins secured only with the seed. That's the amount you would need to access the same day your HW breaks. $100, $500, $5.000, everyone has different needs and spending habits. Keep the rest secured by (multiple) passphrases. If your hardware wallet breaks, and you need access to some coins in that exact hour, recover your Bitcoin through seed and use only those coins that aren't protected with a passphrase. 

Your proposal is similar to classic risk diversification. I think it would not hurt many to take note of this and include the creation of a separate wallet with funds for "pocket money" in their to-do list. You are absolutely right that for one reason or another there may come a moment (like the HWs breakdown you are talking about) when need access to your balance, but using the main wallet will be risky (in general, perhaps the best option would be to have several main wallets). In this case, a wallet with a certain amount will come in handy. Even if the pocket money wallet is compromised, the damage will not be critical, but the benefits from such a wallet will be significant.

[Kakmakr]

Well, this was a very informative discussion indeed... I never thought it would give such brilliant feedback and comments when I started it. I think, if people can afford it, it might be a good idea to buy a second device and then to transfer the "tokens" to the second device... before you run the new firmware. 

A simple solution like this... will reduce the fear that are linked to the possibility that a firmware upgrade might "Brick" a hardware wallet and it will also encourage experimentation ...if you have a backup device.

                                                      Thank you for your valuable inputs and suggestions.

[Pmalek]

<Snip>

I don't think the chances of bricking your device during a firmware upgrade are that big to warrant having a second device that you would use only when you are making firmware upgrades on the main one. But that doesn't mean that having two is a bad idea for other purposes. People often forget that customers only complain and become vocal when they are unsatisfied, angry, and disappointed. Ledger has sold millions of hardware wallets. I think I remember sources talking about 3-4 millions. Even if you find 100 complaints right now where customers talk about bricking their hardware during a firmware upgrade, that's like 0.003% from 3 million. Even if it's 1000 or 2000, it's still insignificant. You aren't going to see 3 million people write: I performed the upgrade, everything was perfect! Most people don't do that, and that's why there is so much focus on the negative side of things.   

But if something like that happened to you, Ledger will replace your device for free even if it's no longer under warranty. There are documented cases of that even on this forum. I think the last one I read was from Maus0728 who said in one of his posts that his device got replaced with expired warranty. Their support personnel also confirmed this to me when I performed experiments and contacted them with various fake tickets to see how they handle user complaints.

[Welsh]

People often forget that customers only complain and become vocal when they are unsatisfied, angry, and disappointed. Ledger has sold millions of hardware wallets. I think I remember sources talking about 3-4 millions. Even if you find 100 complaints right now where customers talk about bricking their hardware during a firmware upgrade, that's like 0.003% from 3 million. Even if it's 1000 or 2000, it's still insignificant.   

But if something like that happened to you, Ledger will replace your device for free even if it's no longer under warranty.

Right, it's something that happens in everything we manufacture. For example, when you make cars, millions get made successfully, but not every car is as reliable as another. There's certain defects during the manufacturing process, which is unavoidable. You look at a pair of shoes, and they'll be slightly different, whether or not that difference can compromise their function, but it could, potentially.

It's the same here, there's a margin for error where certain devices can or will brick. It could be anything, during the upgrade sequence it could be something like not having a heat sink, and the device goes above operating conditions, or anything really.

However, this somewhat extends to software as well, since not everyone uses the software as specified, or if downloading, you might have not downloaded it correctly, or part of it was corrupted, which when the hardware wallet is fed that, it doesn't know what to do with it, hence the bricked device.

If they offer a replacement service for free, you can't really get any better than that. As long as you have your seed setup, it should be fine.