Passphrase of Death (Bounty in BTC)

[tadamichi]

The service I used was Dave's WalletRecoveryServices and he managed to unlock the wallet in just a few hours.

Glad you found help this quickly and got your coins back.

So to sum it up: I really did enter a passphrase and I just didn't remember or write it down because I thought I could recall it from memory--it was really a facepalm moment when I received the password from Dave. It wasn't a typo of any sort. It was not a Trezor firmware update issue/hardware issue. It really was just a grave human error, with a lot of carelessness and complacency. Never again. I hope.

Please don't forget your passphrase, or it can lead to an early, painful demise.

I partly blame Trezors UX for the issue. Giving first users such an easy access to something they might not be fully educated about yet and without the correct terminology being used. Makes it too easy to shoot oneself in the foot and getting confused. In my opinion and from watching beginners use hardware wallets for the first time, a passphrase should only be easily accessible to people who know that they’re looking for it and it should be clearly labeled as such. Will send them some feedback.

[o_e_l_e_o]

So to sum it up: I really did enter a passphrase and I just didn't remember or write it down because I thought I could recall it from memory--it was really a facepalm moment when I received the password from Dave.

Great that you managed to recover your coins! Some suggestions for moving forward:

Obviously your current wallet is no longer secure and you should move all your coins to a new wallet. You did well in backing up the seed phrase on three separate pieces of paper, but you should also back up your passphrase (if you choose to use one this time) on separate pieces of paper. There is no point backing up your seed phrase and passphrase on the same piece of paper, since then the passphrase is adding nothing. And as I said before, once you've created your new wallet/seed phrase/passphrase/back ups/etc., make a note of the first address in your new wallet, then reset your Trezor or delete your wallet file, recover from your written back ups, and check the first address is still the same. Only then, once you are confident your back ups are correct and complete, should you then send coins to that new wallet.

[LoyceV]

Obviously your current wallet is no longer secure and you should move all your coins to a new wallet.

DO THIS

There is no point backing up your seed phrase and passphrase on the same piece of paper, since then the passphrase is adding nothing.

That's not entirely true: this scenario still protects you against a $5 wrench attack: the password gives you plausible deniability if the Trezor also shows (much smaller) funds when used without password. But indeed, the password doesn't protect you against an attacker who finds your backup if it's on the same piece of paper.

If Dave could find your password in a few hours, I'd say your password isn't strong enough.

[Pmalek]

There is no point backing up your seed phrase and passphrase on the same piece of paper, since then the passphrase is adding nothing.

That's not entirely true: this scenario still protects you against a $5 wrench attack: the password gives you plausible deniability if the Trezor also shows (much smaller) funds when used without password. But indeed, the password doesn't protect you against an attacker who finds your backup if it's on the same piece of paper.

Put a little bit of bitcoin on your non-passphrase protected account, but deposit a little more on the passphrase-protected one and store the same passphrase together with your seed. That way it looks you don't really know what you are dong. At the same time, the majority of your coins are on a different passphrase-protected account and that passphrase is written down and stored separately from the previously mentioned examples.