Quote from: Pmalek on May 15, 2022, 07:19:04 AM

Quote from: n0nce on May 14, 2022, 01:12:16 PM

It's only assembled in the US, so it's the honest and right thing to do to write 'assembled' and not 'made'.

I agree with you, but does it solve the underlying problem?

Let us assume that China is manufacturing backdoored components that are part of hardware wallets, and 99% of all hardware parts are delivered from China. You now have hardware wallet vendors who claim two different things. One group says made in <insert country> and the other says assembled in <insert country>. The way they explain the manufacturing process doesn't change the fact they are using backdoored Chinese hardware (let's still assume they are backdoored). If the end-users loss their money to a backdoor, it makes no difference what the website and the wallets' official documentation claimed.

Maybe I'm just a person who takes special care about words, but to me it's clear that 'assembled' doesn't imply security benefits. I do like to see less overseas production (even if it's just assembly) since in theory it could help with supply chain issues / allow to be more independent and it preserves local jobs. If however someone claims the whole device is made in the US or EU, someone might actually think there's less risk of getting hacked on hardware level.

There's also the aspect that the devices need to be flashed with a secret key to later be able to verify the authenticity of flashed firmwares and such.

It's also a bit a matter of principle for me. As I said before, if someone claims 'made in EU', but it's just assembled there; how much trust can I have in their other claims? How can I trust they treat my customer data safely? How can I trust the source code is secure (especially if it's a wallet with closed source code)?