Will Hardware Wallet Manufacturers Leak Customer’s Email Data?

[Pmalek]

AFAIK, some providers allow you to label, auto-filter, and make a folder for e-mails coming from a specific domain.

That doesn't help me when it comes to spam emails. It could be useful for labelling the domains that send the official newsletters, but I can't possibly know where the spam could originate from and make a label for that. 

Have you considered doing this experiment with another member? So, using a shared e-mail for example.

No, not really. What difference would it make to the results if two or three people were involved in the experiment and shared the email addresses? Or maybe it's a thing of trust? If two people said there were no spam messages or there were spam messages, it's more believable than if just one person claims it.

[1715244558]

1715244558

[1715244558]

1715244558

[1715244558]

1715244558

[1715244558]

1715244558

[Pmalek]

Can you check the headers of the emails and see where newsletters are coming in from.

I just checked this and wanted to reply back.

These hardware wallet manufacturers send the emails themselves:

- BitBox (Shift Crypto)
- Blockstream
- Coldcard (Coinkite)
- Foundation Devices
- KeepKey (ShapeShift)*
- Keystone*
- Ledger*
- Satochip*
- Trezor

These hardware wallet manufacturers send the emails through a 3rd-party service:

- OneKey (Zendesk)*
- SafePal (Zendesk)*

* No newsletters, only emails received from support.

On a different note. @n0nce I think you will be pleased to know that the last email I received from Foundation a few days ago also contains a link to your Bitcointalk review of the device.

[Lillominato89]

hi pmalek, I'll try to give you some feedback, I've had a Safepal for more than two years now, and so far never received an email from safepal for promotions or even from third-party services that could lead to a data leak, the only notifications i get from safepal come from their discord server. I hope it can help you in your experiment, and I will continue to follow this topic as I find it very interesting

[n0nce]

On a different note. @n0nce I think you will be pleased to know that the last email I received from Foundation a few days ago also contains a link to your Bitcointalk review of the device.

Wow, that's amazing! So they did read it. I guess there was no reply like last time; probably 'nothing to add'.

Just checked my dedicated BTC newsletter email address (maybe general recommendation for this thread: separation of concerns can be applied to email, as well).

[Pmalek]

I've had a Safepal for more than two years now, and so far never received an email from safepal for promotions or even from third-party services that could lead to a data leak, the only notifications i get from safepal come from their discord server.

That's probably because Safepal doesn't send a weekly/monthly newsletter like some other hardware wallet companies. If you take a look at my previous reply just above your post, you will see a list I made that also mentions which brands have newsletters and which don't. Safepal is among those that doesn't. At least I didn't find a link to subscribe to a newsletter back when the experiment started.   

[Lillominato89]

That's probably because Safepal doesn't send a weekly/monthly newsletter like some other hardware wallet companies. If you take a look at my previous reply just above your post, you will see a list I made that also mentions which brands have newsletters and which don't. Safepal is among those that doesn't. At least I didn't find a link to subscribe to a newsletter back when the experiment started.   

sorry for the reply after a long time, i didn't see that you replied to my comment, i never got to see if safepal also offers a newsletter service. actually i refuse all newsletters regardless and therefore i ignore the subscription step to newsletters 99.9% of the time. Anyway, do you have any news about your experiment? You haven't updated this thread in a while

[Pmalek]

Anyway, do you have any news about your experiment? You haven't updated this thread in a while.

I mentioned in the OP I would post updates after 1, 3, and 6 months. The 1-month update was posted on 16 December 2022. So, we are now about 2 months into the testing. Everything is calm and nothing out of the ordinary is happening thus far. I will perform another check today or tomorrow in search of spam and unwanted content.

[Pmalek]

Update #2:

It's now been more than 3 months since the experiment with hardware wallet manufacturers began. I checked all emails just now and there is nothing negative to report. Besides the updates from the companies and the usual notifications that some email providers send, there is no spam anywhere.

[Welsh]

Honestly, you don't need to give them any legitimate email. However, depending on how you pay for it they could have more sensitive details about you. Although, I'd like to think if you trust them in manufacturing a hardware wallet, you'd trust them with your data. Obviously, open source wallets are definitely better in that regard as it limits the trust element somewhat.

Having said that, just because a company doesn't sell your data today, doesn't mean they won't start in the future. Especially, if they plan on not manufacturing the hardware wallets anymore, and decide to move along. Although, I appreciate the effort. I've done similar experiments for companies in the past, and it's actually quite surprising to learn that a lot of companies sell your data, and its easy to prove with a unique email address.

[Pmalek]

Having said that, just because a company doesn't sell your data today, doesn't mean they won't start in the future. Especially, if they plan on not manufacturing the hardware wallets anymore, and decide to move along. Although, I appreciate the effort. I've done similar experiments for companies in the past, and it's actually quite surprising to learn that a lot of companies sell your data, and its easy to prove with a unique email address.

I am certain that selling or sharing sensitive data for whatever reason is a common thing among big companies. But a leak like the ones we saw from Ledger or some third-party services that deal with hardware wallet manufacturers can also cause problems. I remain positive that nothing bad will happen though.

[Pmalek]

I started this thread back in November 2022 by creating new email addresses and contacting hardware wallet manufacturers to see if any of them would leak any of my fake data. Sadly, Trezor has become the infamous winner in this category. I received a phishing email yesterday following the hack of their email provider.