[ESHOP launched] Trezor: Bitcoin hardware wallet - page 68.

rammy2k2

legendary

Activity: 1974

Merit: 1003

Quote from: cor on April 07, 2015, 09:05:23 AM

We have released firmware 1.3.3 with the TREZOR Connect for passwordless login to websites and apps.

Read more here http://satoshilabs.com/news/2015-04-07-trezor-firmware-1-3-3-connect-api/ and don't forget to update your firmware.

WOW ... really cool !
Good job Trezor team, as usual !

devthedev

legendary

Activity: 1050

Merit: 1004

Quote from: dsattler on April 07, 2015, 02:58:44 PM

Quote from: cor on April 07, 2015, 09:05:23 AM

We have released firmware 1.3.3 with the TREZOR Connect for passwordless login to websites and apps.

Read more here http://satoshilabs.com/news/2015-04-07-trezor-firmware-1-3-3-connect-api/ and don't forget to update your firmware.

Great!
Can't wait to test Trezor Connect! I hope that lots of bitcoin-related sites will support this.

This is gonna be great! How will it compare to hardware like the Yubikey?

dsattler

legendary

Activity: 924

Merit: 1000

Quote from: cor on April 07, 2015, 09:05:23 AM

We have released firmware 1.3.3 with the TREZOR Connect for passwordless login to websites and apps.

Read more here http://satoshilabs.com/news/2015-04-07-trezor-firmware-1-3-3-connect-api/ and don't forget to update your firmware.

Great!
Can't wait to test Trezor Connect! I hope that lots of bitcoin-related sites will support this.

jackbox

legendary

Activity: 1246

Merit: 1024

On Chrome suddenly the MyTrezor.com plugin fails to load. In the log it says it timed out. On Firefox it works but I prefer to use Chrome. I cannot find any way to uninstall the plugin so it loads again. There is only an option to disable it. Does anyone know why it might exhibit this behavior on Chrome. Are there other plugins that can interfere with the Trezor plugin? I am stumped. I hope some can help.

Edit: I finally got it working. Newly installed anti-virus program (WebRoot) had denied the Trezor program permission to run.

cor

full member

Activity: 121

Merit: 100

We have released firmware 1.3.3 with the TREZOR Connect for passwordless login to websites and apps.

Read more here http://satoshilabs.com/news/2015-04-07-trezor-firmware-1-3-3-connect-api/ and don't forget to update your firmware.

Carlton Banks

legendary

Activity: 3430

Merit: 3080

Quote from: fonsie on April 07, 2015, 04:30:40 AM

Quote from: Carlton Banks on April 06, 2015, 01:41:24 PM

I wouldn't take that feature especially seriously TBH. Maybe if the SELinux enforcement was enabled by default, but that's not going to happen. If you're thinking "well, I'll just turn this SELinux thing on then", good luck with that.

According to this article it's enabled by default since 5.0 in "full enforcement"...

https://source.android.com/devices/tech/security/selinux/index.html

Android 5.x isn't a full release yet, and I understand it's been problematic to get it to a usable state (although I have no idea whether that relates to SELinux enforcement). Let's just put it this way, Google will have done an exceptional job if users are not constantly making comments like: "Oh, that problem. Try turning off SELinux"

Quote from: fonsie on April 07, 2015, 04:30:40 AM

Ragarding the security aspect of the host computer knowing the seed when restoring, I would just setup the Trezor with a new seed, import the old old key in Electrum on a offline PC and transfer the funds to the newly setup Trezor seed. No risks involved regarding leaking the keys/the host knowing any of the words.

That would be fine as long as you only ever use one seed at a time, which would probably be most people? Maybe I'm wrong about that though, be interesting to hear what Trezor owners think on that

fonsie

sr. member

Activity: 434

Merit: 250

Quote from: Carlton Banks on April 06, 2015, 01:41:24 PM

I wouldn't take that feature especially seriously TBH. Maybe if the SELinux enforcement was enabled by default, but that's not going to happen. If you're thinking "well, I'll just turn this SELinux thing on then", good luck with that.

According to this article it's enabled by default since 5.0 in "full enforcement"...

https://source.android.com/devices/tech/security/selinux/index.html

Ragarding the security aspect of the host computer knowing the seed when restoring, I would just setup the Trezor with a new seed, import the old old key in Electrum on a offline PC and transfer the funds to the newly setup Trezor seed. No risks involved regarding leaking the keys/the host knowing any of the words.

cypherdoc

legendary

Activity: 1764

Merit: 1002

Quote from: BitcoinIsLiberty on April 06, 2015, 09:07:26 PM

https://www.reddit.com/r/TREZOR/comments/31mvmx/trezor_needs_a_new_simple_android_app_a_tools_app/

Slush offered a bounty for the Trezor app idea. Not sure the amount but any coders interested should PM him!

good job

BitcoinIsLiberty

newbie

Activity: 55

Merit: 0

https://www.reddit.com/r/TREZOR/comments/31mvmx/trezor_needs_a_new_simple_android_app_a_tools_app/

Slush offered a bounty for the Trezor app idea. Not sure the amount but any coders interested should PM him!

AussieHash

hero member

Activity: 692

Merit: 500

That's not going to happen as the devs are comfortable with 24! combinations. They removed +50% fake words for 24 word mnemonics some time ago

BitcoinIsLiberty

newbie

Activity: 55

Merit: 0

Quote from: Erdogan on April 06, 2015, 04:34:35 PM

Quote from: Carlton Banks on April 06, 2015, 03:59:07 PM

Quote from: Erdogan on April 06, 2015, 03:34:12 PM

Are you aware that you key in the words in a sequence requested by the Trezor via the Trezor screen? The computer can know the words, but not the order.

I was aware of that, and it's not a terrible scheme, but it would be much improved if the input device didn't even know any of the words

I suppose it could be done with the current Trezor hardware, an alphabetical list of all the words, move up and down with the buttons, and extra button press to select a word. Easier with a few more buttons though. The question is, is the extra security worth the added complexity?

It would be even easier: bring up the list of words and associated number and enter the words by entering a number using the pin pad. The computer would not know any of the words.

Erdogan

legendary

Activity: 1512

Merit: 1005

Quote from: Carlton Banks on April 06, 2015, 03:59:07 PM

Quote from: Erdogan on April 06, 2015, 03:34:12 PM

Are you aware that you key in the words in a sequence requested by the Trezor via the Trezor screen? The computer can know the words, but not the order.

I was aware of that, and it's not a terrible scheme, but it would be much improved if the input device didn't even know any of the words

I suppose it could be done with the current Trezor hardware, an alphabetical list of all the words, move up and down with the buttons, and extra button press to select a word. Easier with a few more buttons though. The question is, is the extra security worth the added complexity?

Carlton Banks

legendary

Activity: 3430

Merit: 3080

Quote from: Erdogan on April 06, 2015, 03:34:12 PM

Are you aware that you key in the words in a sequence requested by the Trezor via the Trezor screen? The computer can know the words, but not the order.

I was aware of that, and it's not a terrible scheme, but it would be much improved if the input device didn't even know any of the words

Erdogan

legendary

Activity: 1512

Merit: 1005

Quote from: BitcoinIsLiberty on April 06, 2015, 02:23:39 PM

Quote from: cypherdoc on April 06, 2015, 02:18:53 PM

Quote from: Carlton Banks on April 06, 2015, 01:41:24 PM

And that's the only other part of the Trezor system I dislike, although it's not so bad if you can use the trezor-python library commands from an offline system. Sure, it would make the seed restore operation less user friendly, but who needs that with a function you're unlikely to use all that often? (or at least not as often as other functions like signing transactions)

i think everyone is underestimating the desire to test the restore function just to be sure one doesn't load a bunch of BTC to the Trezor, lose the thing, and then find out you mis-copied a word.

I'd feel more comfortable testing mine if I could enter the words with the pin pad. I wouldn't have to worry about any knowledge of the seed being leaked.

Are you aware that you key in the words in a sequence requested by the Trezor via the Trezor screen? The computer can know the words, but not the order.

Carlton Banks

legendary

Activity: 3430

Merit: 3080

Well, it looks like the python-trezor library basically does the trick. You can definitely wipe, seed and restore from a fully offline machine. Unfortunately, it looks like you have to use the (hardware) keyboard to enter the seed for restore. It's also dangerous though, if you use the command "python trezorctl" without any arguments, it interprets that as a wipe command! Read carefully, use carefully.

BitcoinIsLiberty

newbie

Activity: 55

Merit: 0

Quote from: cypherdoc on April 06, 2015, 02:18:53 PM

Quote from: Carlton Banks on April 06, 2015, 01:41:24 PM

And that's the only other part of the Trezor system I dislike, although it's not so bad if you can use the trezor-python library commands from an offline system. Sure, it would make the seed restore operation less user friendly, but who needs that with a function you're unlikely to use all that often? (or at least not as often as other functions like signing transactions)

i think everyone is underestimating the desire to test the restore function just to be sure one doesn't load a bunch of BTC to the Trezor, lose the thing, and then find out you mis-copied a word.

I'd feel more comfortable testing mine if I could enter the words with the pin pad. I wouldn't have to worry about any knowledge of the seed being leaked.

cypherdoc

legendary

Activity: 1764

Merit: 1002

Quote from: Carlton Banks on April 06, 2015, 01:41:24 PM

And that's the only other part of the Trezor system I dislike, although it's not so bad if you can use the trezor-python library commands from an offline system. Sure, it would make the seed restore operation less user friendly, but who needs that with a function you're unlikely to use all that often? (or at least not as often as other functions like signing transactions)

i think everyone is underestimating the desire to test the restore function just to be sure one doesn't load a bunch of BTC to the Trezor, lose the thing, and then find out you mis-copied a word.

Carlton Banks

legendary

Activity: 3430

Merit: 3080

Quote from: cypherdoc on April 06, 2015, 12:45:51 PM

You don't have a choice for restore. You either use the keyboard on your PC or your phone.

I know. I still don't yet have a Trezor for this reason. Maybe the Armory plugin will be written in a way that allows offline seed restore/create

Quote from: fonsie on April 06, 2015, 01:00:23 PM

Although I have a feeling that an Android 5.1 NOT rooted might even be safer than an Online Linux PC, the other apps not being able to access the other apps it's storage space and all this, BUT I'm no security expert... Would even like an answer to this very question.

I wouldn't take that feature especially seriously TBH. Maybe if the SELinux enforcement was enabled by default, but that's not going to happen. If you're thinking "well, I'll just turn this SELinux thing on then", good luck with that.

Quote from: BitcoinIsLiberty on April 06, 2015, 01:19:07 PM

Restoring seeds always seems to be the weakest link in the whole system. If the "Trezor Tools" app implemented "advanced word entry" by inputting the seed words using the pin pad it would be impossible to steal the seed instead to too difficult to brute force the order. The user would have to look up each seed word and find the associated number and enter it using the randomized pin pad. The host computer would not be able to decipher the word being entered just like the PIN code.

And that's the only other part of the Trezor system I dislike, although it's not so bad if you can use the trezor-python library commands from an offline system. Sure, it would make the seed restore operation less user friendly, but who needs that with a function you're unlikely to use all that often? (or at least not as often as other functions like signing transactions)

BitcoinIsLiberty

newbie

Activity: 55

Merit: 0

Restoring seeds always seems to be the weakest link in the whole system. If the "Trezor Tools" app implemented "advanced word entry" by inputting the seed words using the pin pad it would be impossible to steal the seed instead to too difficult to brute force the order. The user would have to look up each seed word and find the associated number and enter it using the randomized pin pad. The host computer would not be able to decipher the word being entered just like the PIN code.

cypherdoc

legendary

Activity: 1764

Merit: 1002

Quote from: fonsie on April 06, 2015, 01:00:23 PM

Quote from: BitcoinIsLiberty on April 06, 2015, 12:45:00 PM

For the average user would you say using Android would be safer than Windows for this procedure?

My personal take on this would be

Offline Linux > Online Linux > Latest Android > Windows

Although I have a feeling that an Android 5.1 NOT rooted might even be safer than an Online Linux PC, the other apps not being able to access the other apps it's storage space and all this, BUT I'm no security expert... Would even like an answer to this very question.

Yeah, that's what I would have said but the part about android being more secure than online linux is intriguing. That's what Mycelium continually argues as a safety feature, app isolation.

Topic: [ESHOP launched] Trezor: Bitcoin hardware wallet - page 68. (Read 966254 times)