Secure against what? Against random hackers trying to steal your coins, they are pretty solid. Against malware that compromises your PC, they are designed to be highly resistant. Against disassembly and hardware hacking of the device, possibly not so much. Against rubber hose cryptography, not at all. They also can't prevent you from sending your coins to an address given on a spoof email or web page (although fiat bank accounts aren't immune to that either). You also need to think carefully about writing down the device seed and then keeping it secure; if someone can steal the seed they don't need the device.
(Actually the Trezor, and possibly other devices, do have a defense against rubber hose cryptography: you can have an arbitrary number of secret passwords with other wallets behind them, and the attacker has no way of knowing if you have revealed all of them. But then maybe they just keep on beating you to be sure)
(Actually the Trezor, and possibly other devices, do have a defense against rubber hose cryptography: you can have an arbitrary number of secret passwords with other wallets behind them, and the attacker has no way of knowing if you have revealed all of them. But then maybe they just keep on beating you to be sure)
To a point. I would worry about plugging that thing in 10 years from now and it doesnt work.
I run a VM on my desktop that contains my desktop wallets. The VM is backed up to multiple sources both local and in the cloud. that way if the VM or my desktop crash, I can always just get a new computer, install HyperV, and import the VM from backup.
They are more secure than any other option that you have readily available right now.
I'm skeptical. I had a Ledger HW wallet which I used to hold coin while traveling.
I initialized on my phone using mycelium, wrote down the seed excluding 5 words, and carried the seed in a notebook I always had with me (the seed was written in the middle of other normal writing).
2 months go, the entire wallet was swept. I lost most of my savings. I have no idea how this happened.
I'm moving towards multisig solutions.
Could the 5 remaining words have been found by brute-forcing? Brute-forcing 12 words isn't feasible, but 5 is way easier, considering this is exponential. (assuming phone compromission)
But that would be a targeted attack (which could be possible, you're the one that could know if this should be in your treat model)
Of course not. Nothing is 100% secure. But it's more secure than everything else at least for now.
I've got a pretty big bounty that says that they are...