Couriers have data of every hardware wallet purchased and delivered successfully

[Catenaccio]

Your concerns are quite reasonable because all that data is sensitive, and we don't know what might happen to us if it falls into the wrong hands, especially with wrench attack cases becoming more common, it only adds to the worry. However, there should be tips that can be used to reduce data sharing with hardware wallet parties. For example, using a P.O. Box and paying via crypto, as explained by Trezor in their article. However, a solution that is no less important is "Anonymous Delivery" from hardware wallet providers, because this includes various things, such as dedicated checkout, locker pickup, etc., which can protect customers.

It's bad for privacy, anonymity and possibly causes physical attacks in the future but people who bought Trezor wallets can use those wallets well or bad. It's their responsibility to learn and practice with Trezor hardware wallets properly.

Another risk is online phishing attacks but if people are well aware about phishing attacks and careful with their practice, they will not be scammed with this method.

Buying hardware wallets and pay them with cash is recommended. More advice is here
[GUIDE] How to buy a Hardware Wallet the right way.

More advice for privacy
Bitcoin privacy resources.
Wallet finger printing detectors.
Bitcoin privacy guide.

[Patikno]

Call me crazy but I am just thinking ahead.

Wouldn't it be better for hardware wallet companies to handle shipping themselves and they will be able to erase data after delivery becomes a success? People who bought hardware wallet shouldn't be known by anybody.

There is nothing wrong with your critical thinking, or skepticism. I think the issue you are concerned about could become a serious problem down the line, especially for hardware wallet buyers. In my opinion, the shipping process needs to be confidential, with no risk of sensitive buyer information being exposed. Well, this might create some logistical hurdles, such as; meeting specific requirements or coordinating with shipping partners, but I think it is a necessary step to ensure user security.

As far as I know, a buyer can ask the seller not to list the package contents in detail on the box, but the shipping company and courier can still identify what is being delivered. So, I strongly agree with you: hardware wallet companies should handle the shipping to their customers themselves, to prevent any dangerous data leaks.

[Nathrixxx]

The best to do is in choosing to buy the hardware wallet that will not make use of such courier service that will demand for our kyc, it does not make sense when you later advanced to use a hardware wallet and discover that your privacy has been at ransom just to secure one, upon every purchase, it was expected to see that they ensure is seamless transactions taking place between the customer and the courier service they are using, while user information will not be at risk or be provided during the process.

[Lida93]

Lately I've been thinking, is it really safe that couriers are the ones shipping hardware wallet that we purchased from official hardware My worries is couriers or what are they called have your address and they know what you are buying since the receipt sometimes comes with the item glued to the case or package.

just change address by relocating then.

Call me crazy but I am just thinking ahead.

No, this ain't crazy.

Wouldn't it be better for hardware wallet companies to handle shipping themselves and they will be able to erase data after delivery becomes a success? People who bought hardware wallet shouldn't be known by anybody.

Hardware wallet companies can't  be doing both design and manufacturing of wallets and at same time be taking on the logistics of it to their bought addresses in any part of the world. There are things that we as consumers/users of a product just can't have it in the way we want it just be we think it should have being better it was so.

If we want to think much to trace about how exposed our data has gone and how risky it has become for us, we might be sleeping with our one eye open. I think we should be worried more about doing our best in trying to reduce how much of our information that we allow out there to central platforms.

[Ashawowo(OS)]

My worries is couriers or what are they called have your address and they know what you are buying since the receipt sometimes comes with the item glued to the case or package.

I think people should stop giving a courier their exact address when buying such sensitive materials, or even a real name. I feel it is better to give the courier service a far off post office address where they will drop it off and notify you via the email tracking when they've dropped it and you can go pick it up by yourself. Google now allows us to register emails without verifying it with your phone number, so you can create proxy names to match, you can also pay for the hardware wallet with bitcoin from your non-custodial wallet.

[snowpega]

...

So you are only concerned about courier services, right? Why are you not thinking about those services/companies from where you are buying your wallets? They can also have all the information that you are stressing about courier services. Anything can be compromised because the term you used, "bad actors", is everywhere. They can be in the courier companies and in the product-provider environment also.

So our data can be compromised at any time, even without hinting to us about this. So, as crypto space users, we should always give priority to the privacy factor and never compromise on it. Because our one single mistake can lead us to bad consequences. This world is getting scary day by day due to advancements in technology and the way data is stored, so for now we have very few verges left to stay away from these hunters.

[YellowSwap]

It didn't bother me a bit, because hardware wallet company aren't close to where I am from, if bad actors somehpw get their hands on my information they will have to pass too many security checks to get to me.

Starting from the airport among other security checks, it's going  to be very hard unless the attackers are in my country, and they know their way around.

There is no way to fix this problem unless the hardware company start to run it's own shipping business which will cost them even more tons of money.

[PrivacyG]

No matter how creative one can become while trying to maintain privacy when buying and receiving their hardware wallet, the worst case scenario isn't even the fear of the courier knowing your address or the company knowing your personal details. What I fear the most is having to buy a hardware wallet that comes pre installed with a bug or malicious software system that could compromise the safety of the wallet like what happened with coldcard incident.

Then if that is your biggest fear, make your own Airgapped Computer and install Electrum on it, make your own Seed using dice, add a strong Pass phrase to it and you are good to go.

[moneystery]

Wouldn't it be better for hardware wallet companies to handle shipping themselves and they will be able to erase data after delivery becomes a success? People who bought hardware wallet shouldn't be known by anybody.

I don't think hardware wallet companies will handle shipping themselves, but to minimize data misuse, they might still work with a third party. They might just obscure the package name and advise buyers to use a PO Box. After delivery, all shipping data would likely be deleted.
This method might minimize the risk of customer data being exposed. However, hackers can still obtain user data through other sources. For example, there was a recent tax data leak in France, and that data contained sensitive information from many individuals, including wealthy crypto holders.
That's just one; there could be many other databases that hackers could hack to obtain crypto user data. So, the bottom line is just being smart about your safety, especially if you hold a large amount of crypto assets.

[Cleanshit]

It's bad for privacy, anonymity and possibly causes physical attacks in the future but people who bought Trezor wallets can use those wallets well or bad. It's their responsibility to learn and practice with Trezor hardware wallets properly.

Another risk is online phishing attacks but if people are well aware about phishing attacks and careful with their practice, they will not be scammed with this method.

You are right, responsibility does not end with choosing just a good hardware wallet, during buying and delivery process privacy should be considered. Using an option like that of a P O Box or any delivery method which don’t exposes one’s home address this can help to reduce risk. But also hardware wallet companies should make anonymous delivery easy than leaving everything for users to figure out themselves. With this at the end we can’t eliminate data exposure completely, but amount of sensitive information given put will be reduced.

[shinratensei_]

It didn't bother me a bit, because hardware wallet company aren't close to where I am from, if bad actors somehpw get their hands on my information they will have to pass too many security checks to get to me.

Starting from the airport among other security checks, it's going  to be very hard unless the attackers are in my country, and they know their way around.

There is no way to fix this problem unless the hardware company start to run it's own shipping business which will cost them even more tons of money.

Shipping is actually not the problem, the courier won't know since the hardware wallet is packaged with discreet packaging, the problem is customs and data leak. You may be a target for a phishing email or scam calls if your data got leaked, or the customs could become a supply chain risk. It's not as simple as the company is pretty far away from you, and you're safe from the risk. Even if the company made their own shipping business, they will have a right for data retention policy regardless which is susceptible to leak.

[Free Market Capitalist]

What’s clear from this is that self-custody is coming under increasing scrutiny. I don’t know if it’s intentional or what, but it’s fueling conspiracy theories. A leak like this probably wouldn’t have caused much of a stir if it hadn’t come so soon after the ColdCard hack. Now that seemingly simple process of “buy a hardware wallet and write down the seeds it generates on a piece of paper” is being called into question. You can't trust the generated seeds, you can't trust the courier, it's quite a bit of FUD on self-custody.

[Catenaccio]

What’s clear from this is that self-custody is coming under increasing scrutiny. I don’t know if it’s intentional or what, but it’s fueling conspiracy theories. A leak like this probably wouldn’t have caused much of a stir if it hadn’t come so soon after the ColdCard hack. Now that seemingly simple process of “buy a hardware wallet and write down the seeds it generates on a piece of paper” is being called into question. You can't trust the generated seeds, you can't trust the courier, it's quite a bit of FUD on self-custody.

FUDs can be about anything and people need to prepare their knowledge from learning in order to be not affected by non sense FUDs.

Going to store bitcoin self-custodial will require knowledge, practice with test net first before practice with main net and actual bitcoin on main net. Checking wallet scrutiny is very important step, to choose good wallets for using.

https://walletscrutiny.com/
Wallet scrutiny check list https://snout0x.com/crypto-wallet-security-checklist/

Then choose wallets with feature filter https://bitcoin.org/en/choose-your-wallet?step=5

[Ucy]

The fact that hardware wallets are dedicated devices make them vulnerable to attacks during transportation.. The better Op sec would be to create airgapped devices with multiple uses. Other uses except bitcoin wallet may be trivial but conspicuous, so the hardware original purpose (Bitcoin wallet and fund access) doesn't attract too much attention on transit especially from thieves. Optionally if you are transporting a device that is  used for fund access make sure this purpose is well hidden and difficult to identify  on transit unless to those that need to know the content. This should narrow potential security issue the device may have down to those with access to the information

[Hamza2424]

My worries is couriers or what are they called have your address and they know what you are buying since the receipt sometimes comes with the item glued to the case or package.

Call me crazy but I am just thinking ahead.

Wouldn't it be better for hardware wallet companies to handle shipping themselves and they will be able to erase data after delivery becomes a success? People who bought hardware wallet shouldn't be known by anybody.

The Trezor is working with ShipMonk I think and they delete user's data after 90 days so the user's data that was breached was also from 90 days. So you can say the Trezor is already taking precaution for the safety of their customers but still 13k lost their data and now they are vulnerable. The emails, and home addresses make them the direct target but they must need more data to confirm if any of those have how many coins and of which kind.

Because I can also buy Trezor for fun purposes, or to hold my $100 in it. People usually buy it not just for holding but for testing purposes as well.

So the hackers need other data like on chain analysis, or other connections from sites where they logged in with those emails or numbers or shared online somewhere about their total holdings etc. So they will narrow down their targets but your concern is real bro.

[Lontor]

This is why it's not good to drop your home.address when you want to receive a package from a courier, robberies have happened in my country where people who delivers items were responsible for the attacks.

It happened successfully for a longer period of time because one was caught and he confessed about his other co-workers too, I always go down to a courier station nearby to pick my items up instead of the doing me the favour.

Normally home delivery is dangerous, it's just too much information exposed to the public, the color of your house is known, the specific apartment is also exposed, security wise it's not a good practice.

[stompix]

PO BOX  as there are many hardware wallets that supports shipping to hardware wallets: hardware wallets that supports shipping to PO Box

If you're in Europe, just redirect it to a parcel locker!
The address of the delivery will not be on the parcel destined for a locker so the employee has no idea who is going to pick this up or if he is even from the said town where the delivery is going.

In the last year we have installed like 100 of those just in my region I'm assigned to and usage is going through the roof, no deliveryman who has a quota on how fast he needs to put them in the locker will have the time to go through all of them to check this and that, he would double his shift with ease.
Funny thing you can even give a fake name on that delivery since nobody cares, it's a paid parcel that goes into locker x on street z for w and y.

Who should be doing that then? obivously couriers are the one who handle the shippings. that's literally their purpose. lol
do you have a better alternative?

The one above!