Quote from: Pmalek on Today at 10:21:41 AM

Quote from: dkbit98 on May 04, 2022, 03:32:16 PM

Ledger is Made in China and Assembled in France, nothing wrong with that, just be transparent about it.

Posting this here although it's not related to Ledger but to Coldcard. It can still serve the purpose of proving how companies claim one thing, lie, and/or deliberately don't show the whole picture.

So, the new Coldcard Mk4 is out and this is what the manufacturer says about it. "Made in Canada". I actually don't know if it is or isn't, but I doubt the hardware components are made in Canada. We already had that discussion when Ledger claimed something similarly. Just below that, there is a sentence that says, "Lovingly soldered in Toronto, Canada". Soldered and made in are two different concepts. The question is, where do they get their hardware components from that are then soldered onto the board in Toronto? Also from Canada or maybe China or some other country?

https://coldcard.com/

"Made in Canada" should be taken as a marketing gimmick and ignored. And in general, it is better to distrust any loud statement of hardware manufacturers. Most often, this is aimed at drawing attention to their products and increasing sales. For the sake of profit, you can say anything. Each company is trying to "stick out" the nuances of their devices. A simple example, Ledger is "proud" of their closed source code and presents it as the best protection for hardware wallets. Trezor emphasizes open source, also trying to attract buyers, with the feature that it is safer. One way or another, each of these two companies is trying to convince us that it is their device that has the best protection in order to sell exactly their products.

As I said, for a simple user, both options are the same:

Quote from: m2017 on May 12, 2022, 06:11:06 PM

Perhaps this is a big weakness, but for the average user (most of them will be) it doesn't matter if the source code is open or closed, because he will not be able to read the code or changes to it. In the case of a closed source code, you will have to trust hardware wallet developers, and if the source code is open, then you need to trust independent developers and enthusiasts who check the code and changes. In both cases, ordinary users are forced to believe completely strangers. I think it looks like a religion. There, too, "users" can't check anything themselves and they can only "believe" in one or another confession.

Another important fact. People who buy HWs want to make a minimum of gestures: they bought a device, threw crypto into it, and use this device as needed. Will most of them follow the news and technical blogs where independent developers will post their research into the open source of HW? Even if a vulnerability is found in the code, such users will be the last to know about it after a long time, if at all they become aware of what happened. Until the balance on their device is reset. Therefore, I assume that from the position of an ordinary user, it doesn't matter to him which code is open or closed.

They are more interested in HW appearance and the impact of advertising.

Even if hardware wallets in Canada are produced entirely from their own components and assembled there, does this guarantee that there are no malicious programs in the devices? Of course not. Any "Made in Any Country in the World" device can have a backdoor regardless of the place of production.

If you are worried that Coldcard says the device is "Made in Canada" but the components are from China, then this is just a marketing gimmick, nothing more. Such lies are found at every turn.