Large-scale Coldcard compromise (1596 BTC stolen so far)

[Lucius]

~snip~
Most hardware wallets make entering a strong passphrase cumbersome. Even if the thing has a decent keyboard (which none do, not even LOL'DCARD), do you really want to type a long passphrase every time you use it? Most hardware wallets encourage the use of weak passphrases. That weakens security through bad design.
~snip~

Have you ever held a Foundation Passport in your hands and tried to type in passphrases? I've already written that it's the same as typing a message on an old model mobile phone and it takes me less than 1 minute to type 20+ characters, noting that I have no need to rush. I don't know why you need a 50-character passphrase, but if you think you're safer that way...

Besides, I don't know why the same nonsense is constantly repeated that someone needs to do it every day, considering that such setups are used for long-term storage - and that for everyday use we have other less complicated solutions.

[mabji1]

~snip~
Most hardware wallets make entering a strong passphrase cumbersome. Even if the thing has a decent keyboard (which none do, not even LOL'DCARD), do you really want to type a long passphrase every time you use it? Most hardware wallets encourage the use of weak passphrases. That weakens security through bad design.
~snip~

Have you ever held a Foundation Passport in your hands and tried to type in passphrases? I've already written that it's the same as typing a message on an old model mobile phone and it takes me less than 1 minute to type 20+ characters, noting that I have no need to rush. I don't know why you need a 50-character passphrase, but if you think you're safer that way...

Besides, I don't know why the same nonsense is constantly repeated that someone needs to do it every day, considering that such setups are used for long-term storage - and that for everyday use we have other less complicated solutions.

Users who view the hardware wallet as a frequently accessed tool are rightly frustrated by poor input interfaces.
Users who view the hardware wallet as a high-security vault accept the "1-minute penalty" as a necessary cost of protecting their assets.

[Meuserna]

~snip~
Most hardware wallets make entering a strong passphrase cumbersome. Even if the thing has a decent keyboard (which none do, not even LOL'DCARD), do you really want to type a long passphrase every time you use it? Most hardware wallets encourage the use of weak passphrases. That weakens security through bad design.
~snip~

Have you ever held a Foundation Passport in your hands and tried to type in passphrases? I've already written that it's the same as typing a message on an old model mobile phone and it takes me less than 1 minute to type 20+ characters, noting that I have no need to rush.

Less than a minute to type a somewhat strong passphrase vs instantly scanning a QR code with a very strong passphrase.

If you really sit down to time it, since the Passport doesn't have an alphabetical keyboard, I bet it actually does take longer than you think. That method is fine for a weak passphrase, but not a strong one.

I don't know why you need a 50-character passphrase, but if you think you're safer that way...

Ask the people who used ColdCard and got robbed if they wish they'd used a strong passphrase.

Hackers began cracking weak passphrases for ColdCard seeds, most likely for seeds with wallets they suspected were just decoys.

Here's a video that explains passphrases and how to pick a strong one.

Passphrase QR makes it really easy to instantly load a very strong passphrase.

Pro-Tip! Want to use a decoy wallet? Don't use it as the seed-only wallet. That gives anyone who finds it a clue that the seed has been used. Instead, hide the decoy behind somewhat weak passphrase. That way, if the decoy wallet gets found, you know for a fact that somebody is trying to crack your passphrase. And by using a strong passphrase, you know you have time to move the wallet.

[PrivacyG]

How does that work? Say you have a Trezor: do you enter that complex seed extension each time you use the device, using those 2 small keys scrolling through characters?

I have some experience with both kinds of Hardware Wallets.  The button kind and the touch screen kind.  Both are absolute horror to use for complex keys, but I believe buttons do have a some what advantage considering the touch screen ones are easier to mistype on.