Quote from: malevolent on October 26, 2019, 10:29:58 PM

Quote from: DaveF on October 26, 2019, 07:08:46 PM

This one...um....30+ character passphrase? It's hard enough getting people to use more then a 5 or 6 digit pin. You want then to use a full 30+ character saying or group of words?

I'm not saying it would be convenient, certainly not for day to day use (but then most people aren't transacting in huge amounts day to day so they might as well keep two trezors, one without a passphrase, another with a secure passphrase they'd use only occasionally), I just said that in case someone thought no funds are safe on a Trezor, and that's with several assumptions: the attacker gains physical access to the device, the attacker has a lot of resources (i.e. willing to design and produce ASICs just to get to the coins) and the user wants security comparable to a 24 word passphrase from a set of 2048 words. And yeah, it'd actually have to be 37 randomly chosen characters.

In reality 5 randomly chosen words from a 300k word dictionary (e.g. Webster's) would still be more than enough and more user friendly. It'd also be a slightly stronger passphrase than one from randomly choosing 7 words from a set of 7776 words (long diceware word list).

Quote from: o_e_l_e_o on October 27, 2019, 09:27:37 AM

Quote from: DaveF on October 26, 2019, 09:54:45 PM

I love my ColdCard more each day.

Just be careful in assuming that your ColdCard is completely safe. Just because an attack like this has only been demonstrated on a Trezor, doesn't mean a similar one (or indeed, a completely different attack) is not possible on a ColdCard, a Ledger, or any other hardware wallet.

Quote from: DaveF on October 26, 2019, 09:54:45 PM

I guess I just don't get why at this point it's even worth getting a Trezor.

I don't own a Trezor, but provided you realize that someone has physical access to it, and you have your seed backed up properly, then you should still have ample time (provided any reasonable length of passphrase) to sweep your funds to a new wallet.

Quote from: DaveF on October 26, 2019, 09:54:45 PM

The entire part of hardware wallets was that even if you lost it it was still secure.

Secure enough. With enough time and access to a lab with electron microscope (or money to rent such a thing), your seed is probably extractable from any hardware device. The hardware wallet buys you enough time to retrieve your mnemonic phrase and sweep your funds to new wallet.

So more or less it comes down to you can just as easily have a BIP38 encrypted paper wallet with your coins on it. Because either way if it's a weak passphrase you're going to loose your BTC.

Sorry to be a downer, but it just gets to me that this is out there and yet they are still selling them and people think they are safe just using an 8 digit pin.
This should be a big red alert about this.

-Dave