how can you guaranty that you receive an original product and not some fake to steel your coins?
That's why you should only buy new products from the official stores(trezor,ledger etc.) and avoid buying hardware wallets from untrusted sellers,it is highly unlikely one of these big companies will scam you and steal your coins.
the company producing the hardware wallets will surly not try to scam me, but they still have to send the package and this is a possible way to swap the original device with a tempered one. i know that this is a fare fetched situation, but people tend not to mind it, but have some similar scenarios when they speak about the dangers of making your own wallet.
You do have a point, but if you're this paranoid, you should also read the full sourcecode of any wallet software you run, and compile it yourself just to be sure nobody tampered with your wallet software.
As soon as you trust the signature of the maintainer, you already assume the signer of the binary didn't go rogue and inserted malicious code to steal your coins.
Don't get me wrong, i think you have a valid point, but in order to be 100% safe, you should review the sourcecode of your OS and your wallet, compile everything yourself,... For me, it's just not practical to live that way. I'd rather trust some experienced companies and maintainers than do everything myself
see that is exactly my point. i hear this a lot from hardware wallets enthusiast. why is a hardware wallet better then a simple wallet? to be fair you have to look at it this way:
either we trust the programmer or we check the source code. both this goes for both. the simple wallet and also the hardware wallet. then you have the transfer period. i can download it and check the checksum. you would have to trust the shipping company and in addition you also have to use some kind of software (as far as i know) to run the hardware wallet.
and from this point the safety is in the users hand anyway. so i do not see why a hardware wallet should be better. at least when just looking at those points.
the only reason why people choose hardware wallets is that they are looking for an easy way to reach a high level of security. not everyone has programming knowledge to secure his wallet himself or even go through the code, compile it, ...
using any other wallet like electrum means going through these steps:
- make a raw transaction online
- transfer that raw unsigned tx to the offline computer that has the private keys
- sign transactions offline
- transfer it back to an online system and
- finally broadcast it
and in all these steps you have to be careful not to contaminate the offline system with a malware while transferring. this which may be simple for many of us, is still scary and not acceptable for many other people.