Will Hardware Wallet Manufacturers Leak Customer’s Email Data?

[Pmalek]

This is an experiment to see if hardware wallet manufacturers and their 3rd-party newsletter partners will leak customer’s email data. It will be a long-term experiment that began a few days ago. I want to see how safe my email information is with some of the most popular hardware wallet vendors. We all remember the data leaks of Ledger and Trezor. Still, there are also suspicions that popular brands could be sharing or selling data to their 3rd-party partners.

To check that, I have done the following things:

•   I have created brand-new email addresses for each hardware wallet manufacturer.
•   Each email was used to subscribe to that brand’s newsletter (if there is one) and to contact the support team with a random question.
•   I will keep checking the accounts in the following months to see if any spam or 3rd-party emails were received.

Since the email accounts have not and will not be used for anything else, any spam, promotions, or offers I get can only result from the company’s misuse of my data. The goal is to see how safe it is to provide hardware wallet developers with sensitive information and how much of it (if any) will find its way to other places.

The following hardware wallet brands are being tested:

•   BitBox
•   Blockstream Jade
•   ColdCard
•   Foundation
•   KeepKey
•   Keystone
•   Ledger
•   OneKey
•   SafePal
•   Satochip
•   Trezor

I will try to update this thread with the latest information after 1, 3, and 6 months of waiting.

After that, the experiment ends. What do you think? Will I get any spam emails, and who is the likely culprit causing it? Many email providers delete messages classified as spam that end up in spam folders after 10 or 30 days, for example, so I will try to log in to the various places to check if there is anything new there.

[1715128123]

1715128123

[1715128123]

1715128123

[1715128123]

1715128123

[1715128123]

1715128123

[jackg]

Do you remember what happened to bitmex a few years ago (2019)? Their customer relations manager resigned (I think) by sending an email to everyone in the mailing list with their newsletter in a way they could all see each others' email addresses: https://blog.bitmex.com/email-privacy-issue-what-is-happening-and-how-can-we-help/

If their mailing providers are hacked, I wouldn't be surprised at this point though - it seems to be a target for attackers (especially customer support).

[Pmalek]

Do you remember what happened to bitmex a few years ago (2019)? Their customer relations manager resigned (I think) by sending an email to everyone in the mailing list with their newsletter in a way they could all see each others' email addresses: https://blog.bitmex.com/email-privacy-issue-what-is-happening-and-how-can-we-help/

I don't remember that particular case, but it can serve as proof how one individual or a small group of people can seriously affect a company's reputation. When something like that happens, no one will remember the incident as the time when <insert the manager's name here> leaked thousands of email addresses amongst other BitMex users. It will forever be remembered as the case when BitMex messed up and caused a severe data leak that affected most of their userbase.

[SFR10]

What do you think? Will I get any spam emails,

Now that you've laid your plans on the table, I'm no longer sure it could lead to accurate results ^{[since some of them have representatives on this forum, it would've been better not to disclose it until a month or a few has passed]}.

and who is the likely culprit causing it?

Cough... Led... Cough... ger

[dkbit98]

After that, the experiment ends. What do you think? Will I get any spam emails, and who is the likely culprit causing it? Many email providers delete messages classified as spam that end up in spam folders after 10 or 30 days, for example, so I will try to log in to the various places to check if there is anything new there.

I am already using separate email address for each new signup I make in last few years, not just cryptocurrency related, and it makes a huge difference.
This is just email subscription so it's not so serious like when you actually purchase their devices and send them your payment with name and shipping address.
Some of them already leaked information like Ledger and Trezor partially, but I never received any phishing emails on Trezor email.
My bet is on ledger to get hacked again, if they don't collapse before like their partners FTX.

[Pmalek]

Now that you've laid your plans on the table, I'm no longer sure it could lead to accurate results ^{[since some of them have representatives on this forum, it would've been better not to disclose it until a month or a few has passed]}.

Nah, I don't see this test bothering them in any way to make them change their habits, improve their security, or try to find the subscribers who signed up in the last days and kick them out of their mailing lists and their internal databases to try to influence the results of this experiment. 

This is just email subscription so it's not so serious like when you actually purchase their devices and send them your payment with name and shipping address.

True, but it's still hackable data that is sitting on some servers somewhere, potentially with third parties despite what happened to Shopify and MailChimp.

My bet is on ledger to get hacked again, if they don't collapse before like their partners FTX.

I don't think I will get anything out of the ordinary from any company besides the usual newsletter updates.

[DaveF]

Part of the issue is going to be WHERE you created the emails and what their anti-spam settings are AND what their email harvesting settings are and how long an address you used. I am really aggressive with my settings you get 5 chances to send to dave@------.com per IP in 1 hour, go over that you are banned for 30 days. With a lot of the big players you can try 1000s of times before getting slowed (not banned) for 6 hours. Multiply that my the hundreds of thousands of compromised servers out there trying to bulk send and unless you are using a really long address you will be getting spam in under a year.

There have been discussions at tech conferences over the years about how bad the big players in the industry are with this.

Not knowing who you used, if you went with one of the big players of free email:
If you don't get spam, then you can be confident that the manufacturers did not leak / sell the info.
If you do get spam, it's a tough thing to prove, unless you do it again with another provider that is more aggressive with blocking.

If you went with another provider, you can ignore everything I just said ;-)

-Dave

[Pmalek]

Part of the issue is going to be WHERE you created the emails and what their anti-spam settings are AND what their email harvesting settings are and how long an address you used.

Interesting feedback. I hadn't thought about that nor do I know much about it. I used 7 different email providers. All of them are free (obviously), so I did spread it around randomly. That could somewhat affect the results, but like you said, if I get spam, I can always try with a different email provider. But If I don't get spam the second time, that can also be for different reasons. Maybe there was a leak and they fixed it in the meantime, or the second provider just has better anti-spam settings that prevented the spam from reaching me, right? When it comes to the length of the email addresses, without revealing too much, they are all 9 characters+ (not counting the @ and domain name). The shortest one is 9 characters.

I am really aggressive with my settings you get 5 chances to send to dave@------.com per IP in 1 hour, go over that you are banned for 30 days.

Are you using a self-hosted service or do the usual big players allow users to configure such settings manually? 

Not knowing who you used, if you went with one of the big players of free email:
If you don't get spam, then you can be confident that the manufacturers did not leak / sell the info.
If you do get spam, it's a tough thing to prove, unless you do it again with another provider that is more aggressive with blocking.

If you went with another provider, you can ignore everything I just said ;-)

Both popular and less popular email service providers were used in the experiment. I can reveal all the names at the end.

[Coin-Keeper]

As I was reading through this thread I was questioning the "where" you set you email accounts up as being a factor!  For actual use on my end I use tutanota for my hardware wallet contact info.  I have never seen an email from 3rd party yet.  In fairness those are really secure against ads.

I applaud this test by you.  Looking forward to reading the results.

[DaveF]

I am really aggressive with my settings you get 5 chances to send to dave@------.com per IP in 1 hour, go over that you are banned for 30 days.

Are you using a self-hosted service or do the usual big players allow users to configure such settings manually? 

It's self hosted smartermail, they offer a 1 domain, 10 user free edition: https://www.smartertools.com/smartermail/business-email-server

I don't know where you are and what internet provider you use but, if they offer static IP allow you to open port 25 for incoming and outgoing mail you can run one yourself.

And actually I made a mistake, have it set to 5 bad address in 5 minutes before I block you for a month.

None of the big players do, sine lets face it as the saying goes if you don't pay for it you are the product. GMail, Yahoo, etc all rely on showing you ads based on your email. So getting as much to you as possible is in their best interest.

-Dave

[Pmalek]

As I was reading through this thread I was questioning the "where" you set you email accounts up as being a factor!  For actual use on my end I use tutanota for my hardware wallet contact info.  I have never seen an email from 3rd party yet.  In fairness those are really secure against ads.

I like Tutanota as well. It might seem a bit confusing to newbies in the beginning since they encrypt the emails you send and you have to password-protect them. I haven't checked to see if that feature can be turned off in the settings. Anyways, if you are sending an email to someone via Tutanota, you also need a way to inform the other party about the decryption password, otherwise they won't be able to open and read the message.

Let's just say that Tutanota may or may not be part of this experiment. I leave it to everyone's imagination. 

[Pmalek]

Update #1:

More than 1 month has passed since this experiment begun. I have checked the email addresses several times during this period and the last inspection was just a few minutes ago. Besides the standard newsletters, there hasn't been one spam message or a 3rd-party email sent to any of the email addresses used for this experiment.

[m2017]

Update #1:

More than 1 month has passed since this experiment begun. I have checked the email addresses several times during this period and the last inspection was just a few minutes ago. Besides the standard newsletters, there hasn't been one spam message or a 3rd-party email sent to any of the email addresses used for this experiment.

Congratulations to the hardware wallet manufacturers, the first stage has been passed. But a little time has passed and I think that by the end of the experiment everything can change and we will find out which company has a bad conscience. You can listen to their assurances that user data is safe, but it’s better to check it in the way Pmalek came up with.

I hope that the representatives of these manufactories don't follow your topic and don't deliberately hold back their 3rd-party from mailing.

[SFR10]

Besides the standard newsletters, there hasn't been one spam message or a 3rd-party email sent to any of the email addresses used for this experiment.

I'm glad there haven't been any spam messages, but perhaps you should go a step further and make fake purchases ^{[those emails are usually collected in the very first part (out of two or three) of making the purchase]} to see if the results would still remain the same after a month...
Any plans to expand the list to less popular brands that have been popping out in recent months?

[Pmalek]

I hope that the representatives of these manufactories don't follow your topic and don't deliberately hold back their 3rd-party from mailing.

No, the email newsletters are coming in just fine. It's certainly not something they would consider important enough to try to manipulate.

I'm glad there haven't been any spam messages, but perhaps you should go a step further and make fake purchases ^{[those emails are usually collected in the very first part (out of two or three) of making the purchase]} to see if the results would still remain the same after a month...

I could extend the experiment to that as well. I thought the order had to completed and paid for before the data got submitted and stored in their servers, but you are right, they might collect those even before the customers make the payments. Thanks for the tip.

Any plans to expand the list to less popular brands that have been popping out in recent months?

No, not for now. As you said yourself, they aren't that popular and don't hold a significant market share. I would like to keep the focus on the manufacturers that matter the most.

[DaveF]

Can you check the headers of the emails and see where newsletters are coming in from.
Although it was about something else, a lot of places do not do their own mass emails and send the work out, when you do you wind up with things like this:

Wonder if this is related or not: https://www.cointracker.io/blog/sendgrid-data-breach

Locking the front door and rolling down the security gate when you leave the store is all well and good, but did you check the window in the bathroom to make sure it's locked?
If they are not sending themselves then it may actually be worse then selling your data since at least someplace they will have some sort of an idea of who they sold it to.

-Dave

[Pmalek]

I will check that as well. I am sure some manufacturers have outsourced this task of sending newsletters to a marketing company and don't do the email sending themselves. I initially didn't consider differentiating between a leak that happened with a mass marketing agency that works with 100s of different companies and a leak that occurred from the servers of one particular hardware wallet manufacturer.

A breach is a breach, but in reality there is a difference. Getting your hands on the data of 100s of different big and small companies with millions of customers is worth more than just one hardware wallet brand with 100-200k of customers.         

[LoyceV]

6 months
~
After that, the experiment ends.

That's not enough, you should check back 5 years from now. If they leak private data, it's not very likely to happen every few months.

Many email providers delete messages classified as spam that end up in spam folders after 10 or 30 days, for example, so I will try to log in to the various places to check if there is anything new there.

Set a forward to one address to easily check them?

[Pmalek]

That's not enough, you should check back 5 years from now. If they leak private data, it's not very likely to happen every few months.

I will try to remember that unless the suffered brain damage from the imminent nuclear or biological war isn't as severe as I think they could be and I end up forgetting.

Set a forward to one address to easily check them?

That's a smart suggestion, but I don't know how reliable that is and if all emails will be forwarded including spam. I have never played around with email forwarding. I have used 6 different email clients, so there is also that.   

[joniboini]

That's a smart suggestion, but I don't know how reliable that is and if all emails will be forwarded including spam. I have never played around with email forwarding. I have used 6 different email clients, so there is also that.   

AFAIK, some providers allow you to label, auto-filter, and make a folder for e-mails coming from a specific domain. Based on my experience, Proton is one of them. Some reports claim that their filter is not the best though, so that's that. I'm sure other providers have more or less the same thing, so you might want to check them out. Most of them provide this feature for free, so there's no need to pay. CMIIW.

I will try to remember that unless the suffered brain damage from the imminent nuclear or biological war isn't as severe as I think they could be and I end up forgetting.

Have you considered doing this experiment with another member? So, using a shared e-mail for example. I don't know how complicated it would be if privacy issues is getting involved though. It is unfortunate but I agree with Loyce that an experiment like this needs a long time before you can see any result.