Trezor Safe 3 New Hardware Wallet

[m2017]

I hope you get your device eventually. But when you get it, I suggest you be careful and check that the device is in its original packaging and that it has not been tampered with. You never know...

Has UPS already had such incidents and cases? So that packages would be opened or worse, the contents would be replaced.

The new Trezor hardware wallet seems more popular than the company likely expected at first, which could explain why some customers are seeing delays in getting their orders. 

The reason for the delay and loss of the parcel in this case is unlikely to be the Trezor’s fault.

But I boycott UPS due to their worst services. I won't use their service ever.

What was the final response from UPS? Why were there problems with the parcel and do they admit that the service they provide is bad?

Perhaps someone picked it up pretending to be you or the package was stolen from you. 

How do you imagine stealing a package for the sake of a Trezor Safe 3 (Safe 3 sounds ironic in the context of this incident) while pretending to be the real recipient? In the spirit of "Mission Impossible"?

If the theft (or loss) of a parcel took place in this story, then only among the UPS’s employees.

[1714530087]

1714530087

[1714530087]

1714530087

[Pmalek]

How do you imagine stealing a package for the sake of a Trezor Safe 3 (Safe 3 sounds ironic in the context of this incident) while pretending to be the real recipient? In the spirit of "Mission Impossible"?

I guess you don't live or have heard of countries and places where people steal packages from people's doorsteps without knowing the content. They can't know what is inside it because the courier company puts it in either an envelope or a box, depending on the size of the shipment. It's not Mission Impossible.

And like I said, the shipments from Amazon are far from a reliable service. They will just leave it somewhere and tell you where you can pick it up so that they can finish for the day. That's why I asked the OP how the delivery guys usually handle deliveries and how professional the couriers in his surroundings are.

[dkbit98]

One update regarding spaced addresses in Trezor, I can confirm that new Trezor 3 safe have the option to show them both in Trezor Suite and in Trezor device.
Simply select Spaced instead of Continuous in Address display menu settings, and all Bitcoin addresses will be easier to read.
Trezor Suite also released beta version with new wipe code that can erase all data on the Trezor device as additional protective measure.
Note that Trezor One is still showing old style continuous addresses.

[n0nce]

I just saw this; from the product page, it looks like it's not airgapped, is it? I see no camera or microSD card slot. It seems like a refresh of the Model One, especially looking at the low price tag. That's nice, but I expected more from Trezor.

Just from my first impression, I think that putting a plastic screen flush with the device's case is a bad decision; the recessed screen in Model One made it pretty resistant against scratches or other damage, meanwhile this one reminds me of Shift Crypto's BitBox02 which scratches easily.

Also the case which sits right above the main circuit board, might allow for non-intrusive / not noticeable hardware attacks as have been performed on the Model One:

[dkbit98]

I just saw this; from the product page, it looks like it's not airgapped, is it? I see no camera or microSD card slot. It seems like a refresh of the Model One, especially looking at the low price tag. That's nice, but I expected more from Trezor.

If you are asking about Trezor 3 than no it's not airgapped device.
This is just refreshed version of Trezor One with additional secure element, better processor and few little improvements.
For price of €79 I think this is the best you can get, but I am sure Trezor is working on airgapped device with their own secure element.

Just from my first impression, I think that putting a plastic screen flush with the device's case is a bad decision; the recessed screen in Model One made it pretty resistant against scratches or other damage, meanwhile this one reminds me of Shift Crypto's BitBox02 which scratches easily.

Simple aftermarket foil (like for casio watches) is going to do wonders for protection screen of this device.
On my old Trezor One device I still have original factory foil, but on Trezor 3 they added dark black protection foil that needs to be fully removed from device.

[The Cryptovator]

But I boycott UPS due to their worst services. I won't use their service ever.

What was the final response from UPS? Why were there problems with the parcel and do they admit that the service they provide is bad?

They didn't accept their mistakes yet. From the central office, they don't respond at all. Then I mailed it to the regional department in my country. Unfortunately, they forward the mail to another cargo service, and it has been cc'd to me. After that, they disappeared. I haven't gotten any more replies from there. So I was obliged to contact trezor support, and they investigated the situation. After investigating, they gave me two options: either get a new device or get a full refund. I agree to a refund since I can't trust UPS anymore. And I am happy with Trezor's response; they refunded the full funds. So definitely, I am going to use Trezor and order from another country through my friend. I am waiting for Trezor again.

[JayJuanGee]

Someone had forwarded me this article, which largely seems to say that some Trezor support contact information such as e-mails and phone numbers had gotten hacked/breached going back to December 2021... and it also states that Trezor contacted affected users.

https://dailyhodl.com/2024/01/22/hardware-wallet-trezor-says-66000-of-its-users-affected-in-data-breach-last-week/

[apogio]

Someone had forwarded me this article, which largely seems to say that some Trezor support contact information such as e-mails and phone numbers had gotten hacked/breached going back to December 2021... and it also states that Trezor contacted affected users.

https://dailyhodl.com/2024/01/22/hardware-wallet-trezor-says-66000-of-its-users-affected-in-data-breach-last-week/

Without a doubt this is bad, but it can happen. To be honest Trezor contacted me in the past saying some of my personal data were leaked. Then they contacted me again saying that the previous mail was a scam.

I reckon that a company that is supposed to specialise in security systems, shouldn't behave like this , but you know sometimes things like these can happen.

The reason I am saying this is because I think the period matches the one mentioned in the article so it could be the same thing...

[n0nce]

I reckon that a company that is supposed to specialise in security systems, shouldn't behave like this , but you know sometimes things like these can happen.

I believe the problem is that they are so big that it's hard to run their 'promotional' stuff themselves (newsletters, support system, E-Mail ...). It's easier to use 'something as a service' than to host and maintain all the infrastructure yourself. That's why it's possible to both make a secure product, and simultaneously have insecurities in your customer data handling (which is terrible for privacy!).

However, we've seen from Foundation Devices that it's possible:

Your email is also no longer associated with your order number, but preserved in our self-hosted email marketing tool to update you with important company announcements, including security notifications and firmware updates. You can unsubscribe from our emails at any time.
[...]
Rather than using Google Analytics or another third-party tool that collects your personal information, Foundation uses a self-hosted instance of Matomo Analytics.

[apogio]

I believe the problem is that they are so big that it's hard to run their 'promotional' stuff themselves (newsletters, support system, E-Mail ...). It's easier to use 'something as a service' than to host and maintain all the infrastructure yourself. That's why it's possible to both make a secure product, and simultaneously have insecurities in your customer data handling (which is terrible for privacy!).

However, we've seen from Foundation Devices that it's possible:

Your email is also no longer associated with your order number, but preserved in our self-hosted email marketing tool to update you with important company announcements, including security notifications and firmware updates. You can unsubscribe from our emails at any time.
[...]
Rather than using Google Analytics or another third-party tool that collects your personal information, Foundation uses a self-hosted instance of Matomo Analytics.

I get your point, I don't like what happened to me either.

For me foundation devices is top notch. I don't think they are as big as Trezor though, as you said.

Another thing to consider is that the "Passport" is bitcoin-only, but Trezor supports multiple coins. As I have said in the past, when I was first introduced to cryptocurrencies I owned some altcoins, until 2021 when I fully moved to Bitcoin only. During this period I came across too many scammers. I think that's where the scammers shine, in the altcoins. You know, like Ponzi schemes, fake ICOs, NFTs etc. So, to this extend, I think trezor may be a "better" target for scamming.

[dkbit98]

I believe the problem is that they are so big that it's hard to run their 'promotional' stuff themselves (newsletters, support system, E-Mail ...). It's easier to use 'something as a service' than to host and maintain all the infrastructure yourself. That's why it's possible to both make a secure product, and simultaneously have insecurities in your customer data handling (which is terrible for privacy!).

Yeah, but now it's much harder to apologize to everyone because of silly mistake like this.
This was always the weak link for ordering anything from internet, support, shipping, handling personal data, etc.  and that is why I always recommend purchasing locally with cash whenever possible.
If something is not available in your country or city, I would take some cheap flight and go in country where I can purchase that item personally.
And very simple solutions for most email phishing attacks is using email aliases and temp emails, it's a life changer.

I think it's finally time for Trezor to seriously change some things and stop doing the same mistakes like ledger did.

So, to this extend, I think trezor may be a "better" target for scamming.

Good point, but Trezor also has bitcoin only firmware and they released bitcoin only devices before.
Maybe that is why ledger was most targeted of all hardware wallets.

[apogio]

and that is why I always recommend purchasing locally with cash whenever possible.
If something is not available in your country or city, I would take some cheap flight and go in country where I can purchase that item personally.

Wow, sounds like a radical solution to the problem. Kind of difficult though, depending on where you live. But I like that your answer is privacy-centered.

Good point, but Trezor also has bitcoin only firmware and they released bitcoin only devices before.
Maybe that is why ledger was most targeted of all hardware wallets.

Yeah I guess... I don't know if the firmware is the problem. I mean the issue here is that their customers' emails have been leaked. So the problem is on their servers and not on the devices. I suppose hackers target Trezor because they are one of the biggest players out there. To be honest, I think trezor wallets are very easy to use, so they have a broad audience. Ledger too of course, but Ledger also has some other (more severe) issues that we have already discussed extensively in the forum. I own a trezor since 2019 and I am ok with it, but I don't use it since 2021 when I moved to better cold storage options.

[cygan]

the new hardware wallet interface (hwi) 2.4.0 version now also offers support for trezor safe 3 - big thanks flying to @achow101
you can download the new version under the following link: https://github.com/bitcoin-core/HWI/releases/tag/2.4.0
and here you can find more information about hwi: https://github.com/bitcoin-core/HWI

[The Cryptovator]

Eventually, I received my new trezor Safe3 wallet. It seems using the Trezor wallet is a bit more complicated than the Ledger wallet. And not much coin support like BNB. For that, you need to use a third-party wallet like Metamask. It seems they are not allowed to use mobile devices for setting ledgers. Otherwise, ask for setup through the Web version. Though turning off the Internet works during setup trezor, I don't feel secure with the Web version. So I have to setup trezor through my computer by tomorrow. I will update you on it by tomorrow.