Quote from: blossbloss on November 20, 2014, 08:16:52 PM

Have you guys seen this?

www.ledgerwallet.com

In their FAQ section, they compare themselves to Trezor, and identify several security flaws with Trezor. Are there any merits to their claims?

Thanks

I quote the site: "The difference lies in the fact that Trezor is not built upon a secured microcontroller, leading to possible security holes such as side channel attacks, private keys leaks through code exploits and physical key extraction as soon as it is stolen."

The fact is that the Trezor is really not built on a secured microcontroller, however:
- the possibility of security holes does not mean that there are some
- and more importantly the use of secured microcontroller does not guarantee the absence of security holes

1. There is no known side channel attack on Trezor and even if there was one, it would probably require user to sign A LOT of transactions chosen by attacker which is not feasible attack vector.
2. It would be extremely difficult/impossible to exploit Trezor.
3. Physical extraction of password unprotected keys is possible (and this is known from the beginning) but it would be very expensive and it would require professional laboratory equipment and a lot of time. User would be able to move his funds using backup.

On the other hand Ledger Wallet requires secure computer to initialize and is less user friendly. I would recommend it to someone who needs product cheaper than Trezor, but I would not say that it's more secure.