[ESHOP launched] Trezor: Bitcoin hardware wallet - page 174.

molecular

donator

Activity: 2772

Merit: 1019

Quote from: devthedev on August 02, 2014, 11:45:42 PM

Hey slush do you have any plans of offering the metal version in the shop?

He said above they have some left as replacements. They might throw these at the market, but it's not decided yet.

I have a feeling these first edition metal trezors could become quite valuable.

@slush, stick, cor: how many have been produced?

devthedev

legendary

Activity: 1050

Merit: 1004

Hey slush do you have any plans of offering the metal version in the shop?

halorose

sr. member

Activity: 422

Merit: 250

WOOOOOOWOOOOOOW,SO GREAT Bitcoin hardware wallet. Shocked

K1773R

legendary

Activity: 1792

Merit: 1008

/dev/null

Quote from: slush on August 02, 2014, 03:24:57 PM

Quote from: Anon136 on August 02, 2014, 03:12:03 PM

How far do you suppose one could take this thing?

In near future (except improving Trezor for bitcoin signing usage like BIP70 and multisig) we plan to turn Trezor into identity management token, something similar like failed myIDkey. In contrary to megalomaniacal vision of myIDkey, we want to start with low hanging fruit and improve stuff as time go.

There's already proof of concept for harddisk encryption protected by Trezor: https://github.com/trezor/python-trezor/blob/master/tools/encfs_aes_getpass.py This works only on Linux, but the concept can be implemented on any OS.

There's plenty possibilities how to integrate Trezor with all stuff directly, like PEM modules on Unix (ssh), Windows login, website authentication, email encryption and signatures etc.

It's really wide scope. Let's see how much interest of Trezor there'll be in Bitcoin community first :-).

It would be awesome if there would be LUKS support.

slush

legendary

Activity: 1386

Merit: 1097

Quote from: ?? on ??

EDIT : Last question, website would be mandatory or local password manager can also manage keylist?

The idea of password manager is not bounded to website in any way. We just see web UI as the best option for common users, as they're used to have everything in the browser.

Ad Android - I hope there'll be Andoid wallet with Trezor quite soon. Currently Wallet32 is the best candidate so far. Not the most beautiful UI, but works very well.

slush

legendary

Activity: 1386

Merit: 1097

Quote from: Anon136 on August 02, 2014, 03:51:22 PM

On the trezor all you have to do is press confirm right?

Yes. Plus entering PIN for first time since you connect Trezor to the computer (it remembers PIN authorization during power up cycle).

Quote

You guys have done amazing work so far. At this point i have a great deal of confidence in your team. I really think you guys have a shot at fundamentally changing the way that people think about IT security.

Thank you, we're doing our best. Maybe it's because we actually enjoy what we do as well :-). Not to say, this would not be possible without Trezor crowdfunding and I'm really glad that we did not disappoint all of those supporters :-).

molecular

donator

Activity: 2772

Merit: 1019

Quote from: slush on August 02, 2014, 03:38:26 PM

I really hope that if people will have Trezor in their hands already, they'll start using its password management capability, if it will be convenient enough...

If convenient enough, I will definitely use it.

EDIT: I love how Bitcoin (as a side-effect so to say) improves general security practices and raises awareness.

slush

legendary

Activity: 1386

Merit: 1097

Quote from: ?? on ??

If I understand well, that would mean we should use the same seed for bitcoin and password, modified by a different passphrase to separate curves to not mix things. That would be better than my actual password policy.

No need for separate curve. Thanks to BIP32, the room of possible keys from single space is really huge. Of course passwords will use different branch than private keys for bitcoin, for this reason we introduced BIP43/BIP44.

Quote

I have read that if we leak a single bip32 private key, all other keys can be disclosed. (I don't understand exactly how but it seem to be possible)

This is true, but tranversing works only on the same level of HD tree branch.

However, Trezor never leaks private keys to computer. It only uses internal private keys to actually encrypt/decrypt values provided by computer. So this attack vector is not possible in Trezor.

This is anyway real attack vector for software which uses HD wallets, but offer importing/exporting private keys. There you must be sure you don't leak master public key AND single private key.

Again, this is not a valid case with Trezor.

Quote

I assume (but maybe i'm wrong) that if a compromised computer can have my encrypted password (blob in password manager), plus the decrypted password (sent by Trezor), it's possible to compute the private key

No, this is not possible.

Anon136

legendary

Activity: 1722

Merit: 1217

Quote from: slush on August 02, 2014, 03:38:26 PM

Actually I started to worry about passwords and password management since the pool became a real business. Then I realized how weak are all those tools for managing passwords, from security perspective.

Unfortunately even today, most of users don't care about their passwords at all. I see this also on pool which has hundreds of thousands accounts; lots and lots mailboxes get hacked every day. (fortunately pool provides 2FA as well as wallet locking, but those are just workarounds for the fact that all password-based internet infrastructure is extremely weak).

I really hope that if people will have Trezor in their hands already, they'll start using its password management capability, if it will be convenient enough...

They don't care because security is hard. If you make it easy enough than they will. If you can make it even easier than actually typing in a password than they certain will. It seems possible to make it easier than typing in a password, there is a certain amount of effort required in doing this. On the trezor all you have to do is press confirm right? You guys have done amazing work so far. At this point i have a great deal of confidence in your team. I really think you guys have a shot at fundamentally changing the way that people think about IT security.

TwinWinNerD

legendary

Activity: 1680

Merit: 1001

CEO Bitpanda.com

Quote from: slush on August 02, 2014, 03:38:26 PM

Actually I started to worry about passwords and password management since the pool became a real business. Then I realized how weak are all those tools for managing passwords, from security perspective.

Unfortunately even today, most of users don't care about their passwords at all. I see this also on pool which has hundreds of thousands accounts; lots and lots mailboxes get hacked every day. (fortunately pool provides 2FA as well as wallet locking, but those are just workarounds for the fact that all password-based internet infrastructure is extremely weak).

I really hope that if people will have Trezor in their hands already, they'll start using its password management capability, if it will be convenient enough...

A bit offtopic, but wouldn't you say that Keepass 2 with all features enabled is good-enough for average private person. (Not talking about multi-million USD/BTC net-worth individuals)

slush

legendary

Activity: 1386

Merit: 1097

Actually I started to worry about passwords and password management since the pool became a real business. Then I realized how weak are all those tools for managing passwords, from security perspective.

Unfortunately even today, most of users don't care about their passwords at all. I see this also on pool which has hundreds of thousands accounts; lots and lots mailboxes get hacked every day. (fortunately pool provides 2FA as well as wallet locking, but those are just workarounds for the fact that all password-based internet infrastructure is extremely weak).

I really hope that if people will have Trezor in their hands already, they'll start using its password management capability, if it will be convenient enough...

Anon136

legendary

Activity: 1722

Merit: 1217

Quote from: slush on August 02, 2014, 03:24:57 PM

Quote from: Anon136 on August 02, 2014, 03:12:03 PM

How far do you suppose one could take this thing?

In near future (except improving Trezor for bitcoin signing usage like BIP70 and multisig) we plan to turn Trezor into identity management token, something similar like failed myIDkey. In contrary to megalomaniacal vision of myIDkey, we want to start with low hanging fruit and improve stuff as time go.

There's already proof of concept for harddisk encryption protected by Trezor: https://github.com/trezor/python-trezor/blob/master/tools/encfs_aes_getpass.py This works only on Linux, but the concept can be implemented on any OS.

There's plenty possibilities how to integrate Trezor with all stuff directly, like PEM modules on Unix (ssh), Windows login, website authentication, email encryption and signatures etc.

It's really wide scope. Let's see how much interest of Trezor there'll be in Bitcoin community first :-).

This is so much bigger than bitcoin. Its awesome though that you have bitcoin as a means to get your foot in the door. That will allow you to succeed where myIDkey failed. Technology like this could totally neutralize the surveillance state. You guys are going to change the world.

molecular

donator

Activity: 2772

Merit: 1019

Quote from: slush on August 02, 2014, 03:24:57 PM

Quote from: Anon136 on August 02, 2014, 03:12:03 PM

How far do you suppose one could take this thing?

In near future (except improving Trezor for bitcoin signing usage like BIP70 and multisig) we plan to turn Trezor into identity management token, something similar like failed myIDkey. In contrary to megalomaniacal vision of myIDkey, we want to start with low hanging fruit and improve stuff as time go.

There's already proof of concept for harddisk encryption protected by Trezor: https://github.com/trezor/python-trezor/blob/master/tools/encfs_aes_getpass.py This works only on Linux, but the concept can be implemented on any OS.

There's plenty possibilities how to integrate Trezor with all stuff directly, like PEM modules on Unix (ssh), Windows login, website authentication, email encryption and signatures etc.

It's really wide scope. Let's see how much interest of Trezor there'll be in Bitcoin community first :-).

this is so cool!

you're making the world a safer place ;-)

slush

legendary

Activity: 1386

Merit: 1097

Quote from: Anon136 on August 02, 2014, 03:12:03 PM

How far do you suppose one could take this thing?

In near future (except improving Trezor for bitcoin signing usage like BIP70 and multisig) we plan to turn Trezor into identity management token, something similar like failed myIDkey. In contrary to megalomaniacal vision of myIDkey, we want to start with low hanging fruit and improve stuff as time go.

There's already proof of concept for harddisk encryption protected by Trezor: https://github.com/trezor/python-trezor/blob/master/tools/encfs_aes_getpass.py This works only on Linux, but the concept can be implemented on any OS.

There's plenty possibilities how to integrate Trezor with all stuff directly, like PEM modules on Unix (ssh), Windows login, website authentication, email encryption and signatures etc.

It's really wide scope. Let's see how much interest of Trezor there'll be in Bitcoin community first :-).

slush

legendary

Activity: 1386

Merit: 1097

Quote from: ?? on ??

So nice, if the feature is good, I can like this even more than wallet function.
Can you give us more information on how it will work technically with some details? (His are stored password, where are they decrypted, what is transmitted to website and host computer...)

The specification is to be released, but generally Trezor has currently capability of AES and ECIES, asymetric cipher based on elliptic curves, and feature of encrypting/decrypting key-value structures. Combining this with hierarchical structure of private keys generated from Recovery seed, there's unlimited count of cipher keys (AES) or private/public keypairs for ECIES which can be used to protect user data.

Each password is basically key-value pair, where 'key' is some identity (username, site) and value is encrypted password for such login. Computer stores blob of these keypairs (it can be local file or cloud-stored file on dropbox, google drive or anything else). Password manager (website like mytrezor) just renders list of stored keys
(services and logins). If you click the key, value is sent to Trezor, it asks you if you really want to reveal such credentials to connected computer and if so, manager unmask your password just for this particular site.

The encryption will be protected in the same way as sending bitcoin transaction, so PIN and (optional) passphrase.

Anon136

legendary

Activity: 1722

Merit: 1217

Quote from: slush on August 02, 2014, 02:38:19 PM

Quote from: P_Shep on August 02, 2014, 02:03:43 PM

Love that you can plug it in any computer and use it without having to log in to anything

We're working on Trezor-backed web password manager with the same feature. You'll be able to reach all of your passwords on any computer (with Trezor connected, of course), without need of typing any "master password" as is common in standard password managers (like Keepass).

You'll just choose which password do you want to unlock at the time, so you'll be able to log into any website on friend's computer without a risk of revealing internet banking credentials or other high profile passwords...

Edit: Password manager is of course needed for sites which do not offer challenge-response authentication, but I believe that some day at least bitcoin-related sites will implement password-less login into their site like GreenAddress already did: https://twitter.com/GreenAddress/status/479939415088062464

You guys are so amazing!

How far do you suppose one could take this thing? Do you suppose it will be possible to leverage this technology up to the point of creating a completely secure computing environment? Basically so processes could only be run with a trezor signature. Maybe im just crazy but is it possible to create a situation where even a hardware backdoor on your computer system would have limited to no functionality so long as there were no back-doors in the OS or other software?

Of course this all assumes that there is no back door in the trezor, but the hardware there could be simple enough to audit while it may not be practical to do so with a modern computer.

Again maybe im crazy. I'm not a computer scientist. Just an enthusiast who is fascinated with this technology.

TwinWinNerD

legendary

Activity: 1680

Merit: 1001

CEO Bitpanda.com

Quote from: slush on August 02, 2014, 02:45:38 PM

Quote from: TwinWinNerD on August 02, 2014, 02:41:55 PM

Is there customs fee when shipping to austria?

No, Both Austria and Czech Republic are in Schengen area.

Oh, I missed that you are shipping from CZ. I somehow thought this was US/else.

Good!

slush

legendary

Activity: 1386

Merit: 1097

Quote from: TwinWinNerD on August 02, 2014, 02:41:55 PM

Is there customs fee when shipping to austria?

No, Both Austria and Czech Republic are in Schengen area.

TwinWinNerD

legendary

Activity: 1680

Merit: 1001

CEO Bitpanda.com

Is there customs fee when shipping to austria?

dillpicklechips

hero member

Activity: 994

Merit: 507

Quote from: slush on August 02, 2014, 02:38:19 PM

Quote from: P_Shep on August 02, 2014, 02:03:43 PM

Love that you can plug it in any computer and use it without having to log in to anything

We're working on Trezor-backed web password manager with the same feature. You'll be able to reach all of your passwords on any computer (with Trezor connected, of course), without need of typing any "master password" as is common in standard password managers (like Keepass).

You'll just choose which password do you want to unlock at the time, so you'll be able to log into any website on friend's computer without a risk of revealing internet banking credentials or other high profile passwords...

Very cool, I'd love details on how it would work!!!!!

Topic: [ESHOP launched] Trezor: Bitcoin hardware wallet - page 174. (Read 966173 times)