Foundation Passport Official Thread

[satscraper]

~

I just checked using their comparison tool and it looks like both devices now use the ATECC608C variant. As for Passport Core, earlier production batches did indeed use the ATECC608B, and if I remember correctly, the very first units may have even used the ATECC608A during initial fabrication. But based on the latest info, it appears they’ve since transitioned to the ATECC608C

[satscraper]

Foundation released the firmware update for their Passport Core. Now the latest version is 2.3.8

There is still no MiniScript support in this release. It was promised in the first release following shipment of Passport Prime, but according to the latest information, that shipment hasn't started yet.

[satscraper]

I usually prefer not to rush into updating firmware instead waiting a couple of weeks to see if any potential issues are revealed and resolved. This time, the issue involved signing transactions in certain multisig setups.

The latest v2.3.9 release has fixed the relevant bug found in 2.3.8 and also improved error handling in Passport Core wallet.

[Lucius]

@satscraper, I recently tried to upgrade to version 2.3.9 through the SD card that came with the device, but as soon as the upgrade started, the following message appeared : Firmware update error: OSError, Info 5

I found an identical case on their support page, and as far as I can see, the user managed to upgrade the firmware only when he bought a new SD card. I must mention that the SD card works perfectly normally in the computer, but even when I formatted it, I still get the same error on Passport.

I currently have 2.3.5 firmware.

[satscraper]

@satscraper, I recently tried to upgrade to version 2.3.9 through the SD card that came with the device, but as soon as the upgrade started, the following message appeared : Firmware update error: OSError, Info 5

I found an identical case on their support page, and as far as I can see, the user managed to upgrade the firmware only when he bought a new SD card. I must mention that the SD card works perfectly normally in the computer, but even when I formatted it, I still get the same error on Passport.

I currently have 2.3.5 firmware.

Did you check the hash of the bin file on your SD card before proceeding with the update?

If yes, then I'm not sure what else to suggest in this case.

Previous to 2.3.5 v.2.3.2 - 2.3.4 did indeed have a bug that resulted in the "Firmware Update Error: OSError, Info 5" when users attempted the next update. However, they claimed that this issue was fixed in version 2.3.5:

That was the unintended bug introduced in 2.3.2, which is also still present in 2.3.4. The device is looking for a key to be present in the developer slot. Most users do not have this present, causing the freeze.

To resolve the v.2.3.2 issue they recommended downloading the developer's key first. However, they also warned that the following steps should only be performed after consulting with Foundation's staff:

So, I would recommend reaching out to them directly on their community site at community.foundation.xyz, where they seem to be quite active.

P.S. I'm still on v.2.3.5 myself, as I prefer not to update unless there's some security issue. One more question. What exactly happened to your device after it got stuck on this error? Were you able to get it back to working with version 2.3.5? Please keep the community updated.

[Lucius]

@satscraper, I'll answer your last question first - the entire failed update process only takes 1 second, after which an error message is displayed - and after that the device displays a message that it will continue to use firmware that is already on the device. So there is no fear that the device will reset or anything like that.

I didn't check the hash, and I don't think my error has anything to do with the developer key, because I have the same problem as the user in the link I posted in the previous post - he solved his problem with a new SD card.

What I'm going to try next is upgrading to 2.3.8 first, and if that doesn't work I'll look for some of my SD cards and try to upgrade with them.

[satscraper]

@satscraper, I'll answer your last question first - the entire failed update process only takes 1 second, after which an error message is displayed - and after that the device displays a message that it will continue to use firmware that is already on the device. So there is no fear that the device will reset or anything like that.

This is the best possible scenario among all that could happen.

I didn't check the hash,

It is not the wise choice as any download could potentially be corrupted or malicious. Corrupted bin file could cause update errors and should be ruled out as a possibility.

have the same problem as the user in the link I posted in the previous post - he solved his problem with a new SD card.

Would be nice if the new SD card assists you.

What I'm going to try next is upgrading to 2.3.8 first,

In my opinion, this is an unnecessary step that could add stress to the memory cells of your device. In fact, any flash action stresses memory, so I prefer to eliminate unnecessary actions. However, you're free to make your own decisions. Keep the community updated on your progress.

[Lucius]

The problem was with the SD card, because I was able to upgrade the firmware with another one without any problems. They obviously used to make much better quality things that lasted longer, because the SD card I used to update was from when Satoshi was just planning how to launch Bitcoin (2008).

~snip~
It is not the wise choice as any download could potentially be corrupted or malicious. Corrupted bin file could cause update errors and should be ruled out as a possibility.

You are right, I will check the hash in the future, and I checked it now and it was correct.

[satscraper]

Passport Prime has passed the security audit conducted by Keylabs, but shipments of this wallet to early access customers have not yet begun. According to Zach Herbert, the exact shipping date is still to be determined. In the meantime, the company is using this time to refine both the firmware (including KeyOS) and all Bitcoin apps that run on their cutting-edge device.

[dkbit98]

Passport Prime has passed the security audit conducted by Keylabs, but shipments of this wallet to early access customers have not yet begun. According to Zach Herbert, the exact shipping date is still to be determined. In the meantime, the company is using this time to refine both the firmware (including KeyOS) and all Bitcoin apps that run on their cutting-edge device.

This delays is one of the reasons why I am not a fan of purchasing devices in presale, especially from small companies.
It is also reasonable to expect that first firmware versions will also have some bugs, despite all security audits performed.
However, I am interested to see first customer reviews for Passport Prime.

[Pmalek]

Those interested in buying a Foundation Devices hardware device can use promo code "BRANDON" and get $10 off of their purchase. I tried the code with a Passport Core at checkout and it works. It's not a big discount, but still, why pay $10 more if you can pay $10 less. I found the code on social media and I am not sure how long it will be valid for.

[satscraper]

It is also reasonable to expect that first firmware versions will also have some bugs,

This is always true, especially when it involves the completely new product built on OS Foundation developed from the scratch.

Wise customer who wants such cutting-edge device should expect some bugs, not just in the software, but also in the hardware architecture and design.

Personally, my policy is to wait couple of years to ensure that this device has been proven over time rather than over any security audit.

[Forsyth Jones]

I hope the final product is worth all the delay, after all, it can't be easy to deliver on what they promised with this new Passport model.

I hope more encryption features like seed-xor and even seed-otp are added.

[satscraper]

Those interested in reading the full text of Passport Prime Security Audit prepared by Keylabs can find it here.

According to this text, there is still a vulnerability ^{though very, very narrow} in their hardware design that "provides potential attack vectors for sophisticated hardware analysis, allowing monitoring or manipulation of processor debug functions and secure element communications."

Keylabs' recommendation: "It is recommended to remove all debug interfaces and test pads in production hardware to eliminate this attack vector entirely."

It is unclear whether they took Keylabs' recommendations into account and removed those interfaces in the version of the product that goes to market.

P.S. I came across this document by accident, and it's unclear to me why the link to it is still not publicly available.

[Pmalek]

Passport Foundation warns its customers that they are aware that there have been reports of phishing emails being sent where scammers point people to a fake website. I am not going to post the website here for obvious reasons. The fake website also has a link to a non existing desktop version of the Envoy app.

Don't download it or click on links in emails. Foundation has not created an Envoy desktop app.

[satscraper]

I was mistaken when I said that the link to full text of the Passport Prime Security Audit is not publicly available, sorry for the confusion. It was actually published on October 3rd ^{but I found it today} here on their community site. In addition, you'll find there the link to Foundation’s response to Keylabs' findings. Specifically, Foundation addressed the critical comment regarding debug and test interfaces on the PCB, clarifying that "the connector for this debug board is not mounted for production" and that the JTAG interface is disabled during device provisioning. They also outlined the measures taken to eliminate other security issues raised by Keylabs, such as "PIN Check Timing Not Randomized" and "Bootloader Does Not Clear RAM on Boot", etc..

I believe their response is worth reading for anyone interested in Passport Prime.

[Lucius]

Passport Foundation warns its customers that they are aware that there have been reports of phishing emails being sent where scammers point people to a fake website.
~snip~

Did I miss something about how scammers know who to send phishing e-mails to, or do they send them randomly using some already existing leaked databases? I assume this is a classic seed stealer where the scammer tries to convince people to enter their seed on a fake website or in this case a fake desktop app.

[Pmalek]

Did I miss something about how scammers know who to send phishing e-mails to, or do they send them randomly using some already existing leaked databases?

I guess it's a combination of the two. Many different services have been leaked and had their databases stolen. If they find your info in one crypto-related database, they will just assume that you have accounts and use other services as well. So they will try different things to trick you. You need to reset the password for an exchange. A popular hardware wallet has been compromised and they ask you to download a new firmware or upload your seed "for security". And the common Nigerian prince scams where you have winnings waiting to be claimed in casinos, exchanges, banks, etc.

[m2017]

Those interested in buying a Foundation Devices hardware device can use promo code "BRANDON" and get $10 off of their purchase. I tried the code with a Passport Core at checkout and it works. It's not a big discount, but still, why pay $10 more if you can pay $10 less. I found the code on social media and I am not sure how long it will be valid for.

I checked, the promo code still works.

And if pay in bitcoins (isn't that what this cryptocurrency was created for?), you'll get another 3% discount, which will increase the discount to to approximately $16-19 (depending on the device model).

Foundation also give a $10 discount on shipping (I have no idea under what pretext), but if they give it, then why refuse.

But they're out of gift cards. Although, why bother (only if you're giving a physical gift of a card looks nice) when you can send a bitcoin directly as a gift (to a newbie who doesn't have a hardware wallet?).

[satscraper]

$115 shipping fee makes this device too expensive for non-US residents.

Within the US shipping is free.

There are logistics companies with warehouses in US that ship goods worldwide.

For example, if you use Meest America, you can have the product shipped from Foundation to your box in their US warehouse for free. The cost to deliver from Meest America to EU country is around $20 by air, or even less if you choose sea shipping.