Quote from: joshuad31 on September 21, 2014, 07:45:38 PM

Hello,

I can say that I myself had some difficulties but two things really impressed me:
1. Very fast response times from Nicolas on the support team
2. Greenaddress's wallet is sleek and has a good UX experience

Thank you!

Quote from: joshuad31 on September 21, 2014, 07:45:38 PM

I have three laptops and each one had its own challenge:
1. windows 7 64 bit - I needed to install drivers and reboot the machine before the greenaddress app would recognize the wallet. Wasn't clear I needed a reboot

I agree I think the page with drivers should inform the user a reboot may be necessary. I'm not even sure Windows 7 always requires a reboot for drivers but Nicolas may know more.

Quote from: joshuad31 on September 21, 2014, 07:45:38 PM

2. On my windows 8 machine it would recognize the wallet but it would also store my pin on the computer so it seemed like it didn't even need the card to access any funds until I went into settings to turn the pin remembering feature off.

People that don't have or want a hardware wallet can use a feature we call 'Quick access' which stores your mnemonic passphrase in your local storage encrypted with a random 256bit AES password. GreenAddress returns this password against the PIN.

This information was available in our FAQ:

Quote

How does the PIN work?
A random password (256 AES) is created and used to encrypt your mnemonics and store them on your device in encrypted form. The random password is sent server side and destroyed on the client. When during login the user provides the right PIN a mechanism will ask the server for the password which is used to decrypt the mnemnonic passphrase stored on your device and get you in your wallet. If the PIN is provided wrong for 3 times in a row the password is then deleted from our servers.

Quote from: joshuad31 on September 21, 2014, 07:45:38 PM

3. On my windows 7 - 32 bit machine (company laptop) with some restrictive settings running the drivers never installed correctly.

Yes I believe you need administration privileges to install drivers on some platforms. Perhaps Nicolas should mention this too on the BTChip help page.

Quote from: joshuad31 on September 21, 2014, 07:45:38 PM

My overall experience is tentatively positive but having spent many hours working with bitcoin technologies I can still say there is plenty I don't understand about this wallet:

1. The initial setup experience caused some confusion because I am not sure if I was able to get my mnemonic for backup done correctly. This is because greenaddress does not tell you its initializing with the hardware wallet BEFORE you create a new wallet and get your mnemonic.

There is no way to tell how the keys are generated. Are they generated by greenaddress and then written to the HW.1? Are they generated by the HW.1 and then the HW.1 tells greenaddress what the memonic should be? Since its unclear at what point the greenaddress wallet actually initializes with the HW.1 I can' figure this out.

There are two ways of creating your seed, either in the GreenAddress app (in which the creation happens locally using your platform secure random number generator) which gets displayed on screen and optionally written on a hardware wallet or you can create it straight on the hardware wallet (and to display it once you need to unplug the card and plug it in a separate computer to output the seed) - this mode is not well documented yet but is functional by pressing the button on the right bottom corner of the mnemonic passphrase box.

Once a seed is written on a hw1 (and output once) it can't be accessed, you can only use it to sign transactions or information.

At no time the seed is kept in the app, unless you explicitly setup the quick access mode manually.

Quote from: joshuad31 on September 21, 2014, 07:45:38 PM

2. The private keys are on the HW.1 but because the *quick login* feature can be active resulting in access to your wallet without needing to access HW.1 this must mean that greenaddress also stores these keys in some other location. How in the world was the greenaddress app able to open up the wallet with only a pin number when the *Quick login* - feature was selected? Where were the private keys stored if they were not stored on the wallet? Were they stored encrypted or unencrypted? If they were encrypted by only my pin number how strong could the encryption possibly be?

As mentioned early, it is quite secure, if you use a 4 digits PIN there are 10000 possibilities and only 3 chances. And you can use much longer PINs. Remember, even if the mnemonic passphrase is compromised that is not enough to steal your funds as long as your two factor authentication is also not compromised.

Quote from: joshuad31 on September 21, 2014, 07:45:38 PM

3. I'm still not sure that I believe this is better than 2 factor authentication using a cell phone. We already have seen that the greenaddress wallet has a habit of storing keys in some format (encrypted or unencrypted) on the computer anyways. If the keys are only encrypted using a weak pin then obviously blockchain.info's wallet is the better option.

They are not stored in a weak way and they are only local and unlike others we don't keep your private keys encrypted with a weak user password on our servers that any hacker worth their salt can bruteforce offline.

Quote from: joshuad31 on September 21, 2014, 07:45:38 PM

4. I am familiar with handing paper wallets and loading actual private keys into software wallets. I am comfortable with adding / deleting private keys from a blockchain.info wallet to gain access to funds. I am not familiar with using a memonic to recover lost keys. There should be some videos to assist the consumer to learn more about this. I assume that this memonic is a feature of a Hierarchical Deterministic wallet but I'm not sure. So one memonic recovers all possible keys that could be generated by greenaddress / HW.1? Also what is the different / benefits between writing down an encrypted seed memonic and an unencrypted one? If greenaddress removes their app from the app store and I only have the memonic could I take and enter this into another wallet software to recover my private keys?

In our FAQ there's more information on how to recover funds, there is a tool designed for this (which specifically handles the fact that GreenAddress' wallet is multisignature.
Videos and more information on this is coming and I agree they are due.

Quote from: joshuad31 on September 21, 2014, 07:45:38 PM

Also it would be really nice to have someone run a debugging program to isolate the type of communication taking place between the greenaddress wallet and the HW.1 to show us the following items:
1. Process of how private keys are generated - How is the mnemonic generated?
2. Showing how a request is inputted to the HW.1 and a signed transaction is outputted.

I think some people have verified this but I can only welcome more people to verify the code and the network.

Quote from: joshuad31 on September 21, 2014, 07:45:38 PM

I'm not yet sold on this technology, I purchased it to learn about it. To convince me (and I am a pretty tech savvy consumer) that there is a benefit to using HW.1 there needs to be way more work done to educate the consumer as to the workings of this product.

~JD

I think it is expected and right of people to be skeptical, more videos and information to come.
In the meantime, if we can answer any question we are at disposal.