Quote from: Gachapin on Today at 01:06:54 PM

Quote from: JayJuanGee on December 22, 2024, 04:48:15 AM

Quote from: OutOfMemory on December 21, 2024, 08:54:57 PM

Still can't decide on that hardware wallet... Roll Eyes

I want to dodge the ledger(s), originally wanted to choose a follow-up hw wallet as cold storage.
Now, when coming to feature sets, security design and even price, the choices are almost no-brainers, but going through the FUD and spam with the ledger's, i started to question the need of a hw wallet at all.
I could live with seedword lists and computers, but there will be less convenience in some usecases and security of storing the words would become even more crucial.

On the other hand, i like Passport's and Coldcard's stuff and have the required bucks to spend...

Many of us have said fuck Ledger.. they have shitty products and it has a lot of issues.

Trezor is very good and very user-friendly.

I heard that Passport is easier than Coldcard, and I found Passport to be way more difficult to use as compared with Trezor, and surely they have some air gapped security measures, but it can be a bit complicated to have standard wallets and passphrase wallets on the Passport.. .. but I am still practicing with it.. since I wanted to experiment a bit more. Of course, anything you get should be open-source, and surely Ledger is not quite open source and they even admitted to having some abilities to access coins under certain circumstances, which should cause any of us to pause...even though they are a very popular shitcoin wallet, yet Trezor has a lot of shitcoins, too, even though you could get a bitcoin only version of Trezor.. which is just choosing which firmware to run, so any of the Trezor models can be bitcoin only or allow shitcoins depending on choice of firmware. .and even you could switch at a later date, too..

It depends if you consider the usage of secure elements open source. If not, the Trezor Model T is the last Trezor wallet that was designed open source.

Most makers use secure elements to be safe against physical attacks. Call me a fanatic, but I would only trust smaller amounts to wallets with secure elements. If you choose a long enough PIN you don't need secure elements.

I am no technical expert, and even though in several ways we are on the same page in regards to several benefits to having open source and not running some the risk of closed source that comes from having a secure element and the extent to which, so far, no secure element has been able to be made completely open source, so if there are any flaws (or back-doors) in the close source-ness then that can you leave you vulnerable in ways that you had not realized to be feasible or possible.....

At the same time, I would suggest that you are wrong in regards to your description of the vulnerability being ameliorated by having a stronger pin number, which I believe hardly does shit if someone has physical access to the device with a non-secure element. Folks with a non-secure element mostly have the protection of not giving up physical access to the device or by creating passphrase wallets, since if some hacker gets physical access to your non-secure element device then they can get your private key (or your seedwords the 12/24 words), but they cannot get your passphrase, so they would be able to take money off of your non-passphrase portion of your wallet, but no wallets that have been created with passphrases, until they brute force into such passphrase, and there is an infinite number of passphrase wallets that you could create that would still be under the same seedwords, but each passphrase creates a new wallet (if you were going to have multiple passphrases under the same seedwords)

I see the trade off being different in terms of who your attack vector would be, since it seems that the attack vector for open source is the physical access to the device, yet your attack vector for closed source could be the company itself or governmental actors or anyone who could attack the vulnerabilities of the closed sourced systems that are not necessarily getting reviewed as much as open sourced systems. I am also no guru in security practices or assessment of vulnerabilities... I am merely considering that we cannot just presume that a device is more secure because it has a secure element, even though the attack vectors become different.. and part of the reason that bitcoin is open source, is to attempt to show the value of incentivizing the crowd-sourcing of the review of its code, and sure maybe we can trust (and need to trust) some various centralized entities with some things, but maybe not a lot of things, such as all of our bitcoin... which is another reason that people choose multi-signature and multi-device security - which brings another level of complications to potentially lock us out of our coins, too..

Quote from: Gachapin on Today at 01:43:45 PM

Quote from: vapourminer on December 22, 2024, 01:37:08 PM

just to pile on, these are ones ive owned
used Trezor One since they came out - no probs (but hardware itself can be compromised if someone has physical access to it and the equipment)
use Trezor T since they came out - no probs
used Ledger - FUCK NO nothing but risk here. stay away

afaik, that's not true anymore. It depends all on the lengths of your PIN

If a bad person (who knows something or knows someone who knows something), they can get you private keys (or your seedwords) in a matter of 15 minutes (or something like that), so they can get anything on your non-passphrase wallet, and your pin doesn't do anything. But they cannot get you passphrase wallets unless they are able to guess them or brute-force them.

Quote from: bitserve on Today at 07:08:18 PM

Quote from: JayJuanGee on Today at 06:25:35 PM

Quote from: philipma1957 on Today at 04:49:39 PM

Phil is pushing the pushups hard. very hard to crack 100k today
[im width=1500]image deleted[/img]

Your OpSec sucks.

Now that's the Christmas spirit!!
You are right though... unless that's not him and/or the tatoo is fake/photoshopped... which is also a possibility... and, IIRC, he has previously claimed to NOT even being a "fullcoiner" (or barely), even if he is a Legendary Miner since... ever. All in all... probably he just doesnt give a shit Tongue

Whenever other members are posting sensitive OpSec information, it likely does not hurt to mention it, even if that particular member does not give too many shits. Some OpSec materials are more exposing than other materials, too.

We have had some members who have scaled back on some of their revelations over the years too.., deleted old posts and even changed their user names. There are needs for public personas in the bitcoin space too.

Quote from: philipma1957 on Today at 07:09:04 PM

Quote from: JayJuanGee on Today at 06:25:35 PM

Quote from: philipma1957 on Today at 04:49:39 PM

Phil is pushing the pushups hard. very hard to crack 100k today
[im width=1500]image deleted[/img]

Your OpSec sucks.

yeah since I am already fully doxxed and splattered all over the net It does not matter very much.

besides my coins don’t amount to that much.

We are still in a public thread, and of course you can do what you want and of course, i can respond how i want in terms of mentioning the issue.