Quote from: legolouman on October 06, 2012, 11:04:36 PM

Quote from: MysteryMiner on October 06, 2012, 08:19:58 PM

Quote

OK, say you want to make a transaction. You fill out four things in the PC client: the wallet to transfer from, the amount of BTC, the destination address and the password for the wallet.
You press OK, and the transaction is sent to the device via USB for signing.

The Send-To address is changed by malware to another address before being sent to hardware wallet for signing. Hardware signs the transaction.

You cannot get any security on compromised computer! It is only a question how sophisticated is the malware.

I was going to say something about using a hashed protocol, however if malware is on the computer it doesn't matter. The idea here is golden, as it does not involve a computer. This is for receiving only if I understand correctly.

For receiving not even electronic device is needed to generate private key and address. Or the wallet can be generated on offline computer never connected to network. You can get a old used Pentium3 class computer for as little as 8 USD just for this purpose. And it is much harder to accidentally lose an ATX-size tower and for thief also it is much more physical work to do to steal a system block instead of small dongle.