How safe are the wallet apps we are using?

[FinneysTrueVision]

It is much easier for the average person to verify if they have installed an unauthorized application than it is to check the physical integrity of a device. As we have seen in recent months, it is possible for attackers to bypass a genuine hardware check. Without taking your hardware wallet apart and knowing what to look for, you can’t guarantee with 100% certainty that your device wasn’t modified.

With software, you only have to know how to verify that a signature is authentic, which can be learned easily and doesn’t risk bricking anything. It’s important to not be lazy and verify that you are installing the official apps because attackers are always creating phishing sites that show up in search results.

[Gost ms]

If we download the wallet we are using from the official website of the wallet, then we definitely don't have to worry about that APP. Because the company will never give you a bad App on its own because it is not only related to financial matters but also the reputation of the company and the trust of each person in the company. So the company will never give us a virus-infected App or a harmful App.

But yes, if there is any kind of weakness in your mobile or computer, then it is not the company's weakness but it is your weakness. Try to run the Bitcoins in your mobile or computer with as much caution as possible and not connecting them to the online is the best decision.

[Darker45]

It is much easier for the average person to verify if they have installed an unauthorized application than it is to check the physical integrity of a device. As we have seen in recent months, it is possible for attackers to bypass a genuine hardware check. Without taking your hardware wallet apart and knowing what to look for, you can’t guarantee with 100% certainty that your device wasn’t modified.

Especially since OP's hardware wallet is a Trezor, it's definitely much harder to check its physical integrity for implants. Trezor itself doesn't even encourage buyers to do it. They might only destroy the device if they try to pry it open.

On the brighter side, Trezor devices have proven to be difficult to tamper. Unlike Ledger devices, there was only one Trezor device found with an implant, but there was no confirmation of any funds lost. So, OP must have picked the right brand.

[PX-Z]

p.s. I used Trezor as an example because I have one, but I’m asking this question about all wallet apps.

The trezor device is safe. Most wallet are safe and secured. The exception is due to the recent incident of cold wallet.

Do you know what is unsafe and not secured? The device where the wallet is installed and the practice of sending or receiving funds as well as the user use the device. Most hack or scam happens is due to user's practice, that lead to phishing and getting malware.

[OcTradism]

The trezor device is safe. Most wallet are safe and secured. The exception is due to the recent incident of cold wallet.

Do you know what is unsafe and not secured? The device where the wallet is installed and the practice of sending or receiving funds as well as the user use the device. Most hack or scam happens is due to user's practice, that lead to phishing and getting malware.

With hardware wallets, you must buy hardware wallets rightly and don't buy tampered hardware wallets, or second-hand hardware wallets because there will very likely backdoors tampered set up to be ready for stealing coins from you when you fund those wallets.

After buying an official hardware wallets, you must upgrade firmwares during wallet use rightly. Buying fake and tampered wallets is first terrible step that leads to loss later but even with a good hardware wallet, if users do bad practice later, fund can still be stolen.

How to buy hardware wallet the right way.
How To Verify the Downloaded Version of Ledger Live.
Secure Element in Hardware Wallets.

[Iamgoat]

To be honest, I wouldn't completely blindly trust even the most reviewed piece of software right now, because of the rapid development on AI frontier models. No, you should consider that the wallet apps you have on your phone can be broken, and have plenty of vulnerabilities. Same goes even for software you use for "long-term funds".

It is generally scary these days how you hear about system compromises, where a system or platform expected of protecting the life saving and long term savings. People are just wicked and want to always snatch away from you what is your sweat and what becomes to you which is bad. With the coming of AI it has made things even extremely difficult. Couple of weeks or months again we heard when the CEO of Binance or thereabout was invited to have a discussion and he clearly said something about AI coming to kind off disrupt the security and data protection of many softwares it there are new apps cloning the exact interface of other apps easily with the use of AI and how such efforts do as can significantly increase phishing attacks and other deceptive practices within the ecosystem.

[Outhue]

Hey guys,

This might sound delusional, but I think a year ago we would have found it delusional to put a eSIM in Ledger devices too. My question is: how safe is the Trezor Suite app we are using? I mean is it possible for hackers to put something into the app to follow other people’s activity etc?

Please tell me the reason if my question is not a valid one.

p.s. I used Trezor as an example because I have one, but I’m asking this question about all wallet apps.

When it comes to apps that we generally use for our hardware wallets there is always a risk that something could go wrong, and this can only happen if you don't verify before trusting, if you want to use any app with your hardware wallet let the official website of that hardware wallet guide you to the correct app.

Avoid using app stores directly, either for hardware wallet apps or even the free hot wallets, do not use app stores to make a search because most apps on there aren't all verified, Google Playstore is guilty of this irresponsible habit, it was how I lost some coins in 2023 too, I am using Keystone wallet and every supported apps are on the official keystone website, they guide me to get right apps and also make sure that you update the apps regularly.

[Mr_Brilliant$]

Keep in mind that nothing is 100% secured. That way you don't cry like wolve is something happens. The recent hacks should have change your mind about security by now. Nothing is that secured. I too have that feeling that some things are not just hackable. But that thought is slowly fading. I think it is good. At the same time, it has allowed me to seek alternative routes to secure what's mine. I believe everyone should do so. You never can tell which wallet will be next. Just get ready.

[alastantiger]

If we download the wallet we are using from the official website of the wallet, then we definitely don't have to worry about that APP. Because the company will never give you a bad App on its own because it is not only related to financial matters but also the reputation of the company and the trust of each person in the company. So the company will never give us a virus-infected App or a harmful App.

What about when the main website is hacked and the apps are affected with virus that will make you to lose your Bitcoin or other cryptocurrency that the moment you download them from the website. It is very difficult to trust recently any app again because the take  apps are as similar to the original and you can download them without knowing the website are hacked, you will not be aware when a website has been compromised so do not think you can always differentiate between hacked websites. The only way of knowing if you are using the right app is to do the verification yourself so it does not look like you are using the right app when it is the fake.

[shinratensei_]

Always I update apps from the official website or from the Play Store directly. Never update apps from the apps notification; it’s not for Trezor, for all the wallets I have been using. I have Trezor as well, but I always update this way. Always you have to make sure your apps are downloaded or updated from the official source.

The only danger that I see this if the user goes directly to the play store and falls for the fake downloadable app wallet. That is because cloning is rampant there and google play store takes time to remove those fakes.

But as long as you know what you're doing and you know which one are the official source even in the play store, you should be fine.

And if this has been working for you for years, you have no problem with it. Although for the newbies, they better be careful if they'd go to play store and only source the download from the official website.

Play store is one of the most dangerous attack vector that not much people talked even in here, a cloned app shouldn't even exist in a vetted store of apps, but play store and honestly google search fail so badly at this. Even nowadays I don't really trust the result of google search and its ads. It's like walking one a minefield. These days if I want to install an app I'd straight up get the app from the github repo itself instead of using play store or even build it myself, but this is only doable on Android. IOS users are still locked on app store and need to be very meticulous in choosing the app because if they don't they could instal the fake version. I mean apple recently got literally sued over the fake sparrow wallet that incurred 1.8 million losses in Bitcoin hence why it's not an impossibilities doesn't matter what is your perception on the app store's security.

[B2Z]

If we are concerned about 100% security, then we cannot rely on any wallet. However, I have been using a simple software wallet for a long time, but so far I have not faced any problems using this wallet. I think the problem may be due to not storing the wallet information properly or due to multiple people having access to the same device. If we can store the security phases of our wallet very well and if we do not tell anyone other than me about the wallet, then maybe I think that my wallet will not be hacked or money will be lost from my wallet.

No wallet will give 100% security, but you have to use it in your own way so that you do not lose money due to your own mistakes.

[5W-KILO]

The trezor device is safe. Most wallet are safe and secured. The exception is due to the recent incident of cold wallet.

Do you know what is unsafe and not secured? The device where the wallet is installed and the practice of sending or receiving funds as well as the user use the device. Most hack or scam happens is due to user's practice, that lead to phishing and getting malware.

With hardware wallets, you must buy hardware wallets rightly and don't buy tampered hardware wallets, or second-hand hardware wallets because there will very likely backdoors tampered set up to be ready for stealing coins from you when you fund those wallets.

After buying an official hardware wallets, you must upgrade firmwares during wallet use rightly. Buying fake and tampered wallets is first terrible step that leads to loss later but even with a good hardware wallet, if users do bad practice later, fund can still be stolen.

How to buy hardware wallet the right way.
How To Verify the Downloaded Version of Ledger Live.
Secure Element in Hardware Wallets.

We've got big problem on our hands with hardware wallets, right under Ledger's nose their official resellers tampered with the devices and sold them all out to people, it shows that this problem isn't about buying them from third-parties only.

You can still end up with a tampered device if you order them from official websites, something new needs to be introduced that will reduce the possibility of hardware wallet tampering, it's in between the shipping and clearing of this devices that the problems comes from.

Even if these companies decide to cancel resellers and start selling themselves someone still have to deliver them, I think every hardware company should come up with a way for buyers to verify their devices after receiving them.

[abel1337]

The trezor device is safe. Most wallet are safe and secured. The exception is due to the recent incident of cold wallet.

Do you know what is unsafe and not secured? The device where the wallet is installed and the practice of sending or receiving funds as well as the user use the device. Most hack or scam happens is due to user's practice, that lead to phishing and getting malware.

With hardware wallets, you must buy hardware wallets rightly and don't buy tampered hardware wallets, or second-hand hardware wallets because there will very likely backdoors tampered set up to be ready for stealing coins from you when you fund those wallets.

After buying an official hardware wallets, you must upgrade firmwares during wallet use rightly. Buying fake and tampered wallets is first terrible step that leads to loss later but even with a good hardware wallet, if users do bad practice later, fund can still be stolen.

How to buy hardware wallet the right way.
How To Verify the Downloaded Version of Ledger Live.
Secure Element in Hardware Wallets.

We've got big problem on our hands with hardware wallets, right under Ledger's nose their official resellers tampered with the devices and sold them all out to people, it shows that this problem isn't about buying them from third-parties only.

You can still end up with a tampered device if you order them from official websites, something new needs to be introduced that will reduce the possibility of hardware wallet tampering, it's in between the shipping and clearing of this devices that the problems comes from.

Even if these companies decide to cancel resellers and start selling themselves someone still have to deliver them, I think every hardware company should come up with a way for buyers to verify their devices after receiving them.

I know that we want to minimize the hands touching our hardware wallet purchase but the thing is it's hard to avoid it especially if there are no physical stores near you where you can buy it there on cash. You mostly don't have a choice, you will need to buy online (which most of us do) and hope that there aren't any mischievous perpetrators targeting our purchase.

Buying a hardware wallet before isn't really an issue even if it is online, but today, it's a fact that there's a risk buying online and even from the recognized distributors given that we had a tampering incident before. Just glad that I bought few hardware wallets way back. It's outdated but it still serve its purpose.

How to buy hardware wallet the right way.

This thread is full of ideas on how to buy a hardware wallet minimizing the risks. Worth the read.

[BlackBoss_]

We've got big problem on our hands with hardware wallets, right under Ledger's nose their official resellers tampered with the devices and sold them all out to people, it shows that this problem isn't about buying them from third-parties only.

If you knew about data breaches, Ledger recover service of Ledger hardware wallet, and if you were carefully and seriously enough with your fund, you would have not used Ledger wallets since a long time ago, before latest incident with their reseller.

The fear is bigger than that, because if it can happen with Ledger hardware wallet, it can happen similarly with other hardware wallets and as customers, it's hard for you to verify everything physically in a hardware wallet after buying it.

Even if these companies decide to cancel resellers and start selling themselves someone still have to deliver them, I think every hardware company should come up with a way for buyers to verify their devices after receiving them.

The procedure is long enough, has many parties involved enough so that it's hard enough to control everything and prevent tamper attacks.

Resellers, then shippers, it's very challenging for hardware wallet manufacturers and customers to control that, because human is greedy and they can do bad things any time.

[Akaenyi]

If we download the wallet we are using from the official website of the wallet, then we definitely don't have to worry about that APP. Because the company will never give you a bad App on its own because it is not only related to financial matters but also the reputation of the company and the trust of each person in the company. So the company will never give us a virus-infected App or a harmful App.

What about when the main website is hacked and the apps are affected with virus that will make you to lose your Bitcoin or other cryptocurrency that the moment you download them from the website. It is very difficult to trust recently any app again because the take  apps are as similar to the original and you can download them without knowing the website are hacked, you will not be aware when a website has been compromised so do not think you can always differentiate between hacked websites. The only way of knowing if you are using the right app is to do the verification yourself so it does not look like you are using the right app when it is the fake.

Normally if you download your wallet from the original website you will be assured that you have done the right thing and there won't be a reason to worry about being scammed but with all these news that are flying around we cannot totally be sure of the safety of our coins even when we have done the right thing. These developments of hacks are becoming very worrisome, after doing the right thing by downloading an original wallet you will still hope that the wallet is not compromised, nothing feels quite safe anymore. One of the solutions is not to rely only on one wallet to hold all of your cryptocurrency no matter how reliable and reputable the wallet is.

[davis196]

Hey guys,

This might sound delusional, but I think a year ago we would have found it delusional to put a eSIM in Ledger devices too. My question is: how safe is the Trezor Suite app we are using? I mean is it possible for hackers to put something into the app to follow other people’s activity etc?

Please tell me the reason if my question is not a valid one.

p.s. I used Trezor as an example because I have one, but I’m asking this question about all wallet apps.

This question should be aimed at tech savvy programmers and developers, who had participated in building and maintaining such wallet apps.
The average Bitcointalk forum user cannot give you a proper answer. Anything is possible in theory, but reality hits different. No online defense is unbreakable. The hackers are capable of penetrating all kinds of systems. If you are so obsessed with online security, just put all your coins in a hardware wallet with no internet connection and bury the list containing your seed phrase in the backyard.

[Cointxz]

Normally if you download your wallet from the original website you will be assured that you have done the right thing and there won't be a reason to worry about being scammed but with all these news that are flying around we cannot totally be sure of the safety of our coins even when we have done the right thing. These developments of hacks are becoming very worrisome, after doing the right thing by downloading an original wallet you will still hope that the wallet is not compromised, nothing feels quite safe anymore. One of the solutions is not to rely only on one wallet to hold all of your cryptocurrency no matter how reliable and reputable the wallet is.

It’s a bit of paranoia already. There’s a difference between being security-conscious and thinking there’s nothing safe anymore.

You will lower the risk of being hack if you will properly download software from an official website and do proper storage of your seed phrase.

Ofc there’s no hardware wallet that offers 100% secure but the isolated cases of tampering incidents/firmware vulnerability on some provider doesn’t represent the general hardware wallet industry.

[crwth]

An open-source software can have multiple builds. I don't think it's enough to just see the code if you cannot verify whether it matches the build you can download. Inspection still wins if it's open-source. It's not automatically safe.

I have an ick towards reading some of the replies of the members that if it's from the Official Website you would have nothing to worry about. I don't really like that and it's better to verify/authenticating the file that you have downloaded or the release..

[Zaguru12]

An open-source software can have multiple builds. I don't think it's enough to just see the code if you cannot verify whether it matches the build you can download. Inspection still wins if it's open-source. It's not automatically safe.

Open source can still be trust verifiable where you can only just verify and cannot use the code. Furthermore I think most people are simply just using open source with the believe that others have verified it as they do not even know how to do it or care to do it.

I have an ick towards reading some of the replies of the members that if it's from the Official Website you would have nothing to worry about. I don't really like that and it's better to verify/authenticating the file that you have downloaded or the release..

Yes I also don’t agree that simply because it’s from the official website it’s authentic and doesn’t need authenticity or verification we have seen cases where scammers actually hack the official website first drop their fake apps there