So with the cold wallet hack I am thinking about using core 29 to store.

[philipma1957]

Playing with trezor 5.

There are some ways to make a passphrase via the trezor.

But if you access weeks later I am not  sure how to enter a passphrase offline.

I think I can.

To me if you want a 1 btc cold wallet trezor.

You could do

0.1 20 word seed
0.3 20 word seed with passphrase
0.3  "   "
0.3 "   "

1 btc total

[nc50lc]

Isn't there an option to prompt your Trezor to enter the passphrase on the HW's screen itself?
Most attack vectors wont work if your use that instead.
~snip~

Is it even possible for such sensitive information to be entered through a user interface?

In Trezor Suite?
It should be enabled in the settings and there should be an option to create Passphrase wallets,
then the passphrase will prompted in the UI or a button to enter it on the device when you need to create/access a wallet with passphrase.

AFAIK, only older models don't have that option to enter the passphrase on the hardware wallet's screen.

[Cricktor]

but don’t lose it or you are fucked.

It certainly sounds like a broken record: if you use one or more mnemonic passphrases, make sure to very carefully and redundantly document them! Because if you loose or can't reproduce a mnemonic passphrase, you instantly loose access to your coins, which you expressed more casually.

It may sound obvious, but some people screw up the basic documentation. Human brains will inevitably forget complex mnemonic passphrases, so proper documentation is mandatory.

also the trezor has its seed my trezor 5 uses 20 words

IIRC, I don't use modern Trezors yet, it's Trezor's SLIP-39 new standard recovery word backup which encodes additional metadata and uses Shamir Secret Sharing (embedded entropy is 128 bits equivalalent to standard 12-word BIP-39 backup).


I hope other hardware wallet companies didn't fuck up their code paths for entropy generation and properly use embedded TRNGs in contrast to Coinkite's Coldcard mess. At least some companies did code audits, but those don't guarantee you find every flaw in your code base.