[ESHOP launched] Trezor: Bitcoin hardware wallet - page 75.

chrisrico

hero member

Activity: 496

Merit: 500

Quote from: BitcoinIsLiberty on March 06, 2015, 12:31:26 PM

Is the public key protected by PIN or confirmation preventing rogue websites from stealing it? Having your public key leaked would link all your transactions for the life of the seed.

This is actually a good point in the context of Trezor Bridge. It's not an issue with the extension because you have to manually allow it to run on every website that tries to use it. With Bridge though, it's a tiny web server that is potentially always running on your computer, allowing anyone to connect. Perhaps Trezor Bridge should require the PIN to be entered before a new connection can be made?

mmortal03

legendary

Activity: 1762

Merit: 1011

Quote from: lyth0s on March 06, 2015, 11:49:13 PM

So I tried the Trezor with the Electrum 2.0 wallet today and it worked like a charm. Glad to see another wallet service that has implemented the Trezor successfully. I'd like to see if you guys could make any progress with getting Mycelium or Wallet32 to implement it next Cheesy

Yes, FYI, here's the announcement thread for everyone: https://bitcointalksearch.org/topic/electrum-20-release-973768

binford

newbie

Activity: 52

Merit: 0

Quote from: molecular on March 07, 2015, 01:56:38 PM

Quote from: binford on March 07, 2015, 09:30:53 AM

Quote from: lyth0s on March 06, 2015, 11:49:13 PM

So I tried the Trezor with the Electrum 2.0 wallet today and it worked like a charm. ...

curb your enthusiasm : ) there are a few issues if you play with electrum long enough. p.ex. it hangs when creating new wallet (like one with password, one without password), wait at least the bugfix release 2.0.1 is out. but yes, it looks very good and they did great job.

I've been using electrum development version from git for about half a year now with trezor. I only once ran into a serious issue and that has been fixed a long time ago.

on mac os it hangs when creating new wallet, passphrase with diacritic derives different keys than mytrezor.com just to mention two issues I've seen in the github issue list. both might be resolved in 2.0.1 but both of them are also kind of serious : )

molecular

donator

Activity: 2772

Merit: 1019

Quote from: binford on March 07, 2015, 09:30:53 AM

Quote from: lyth0s on March 06, 2015, 11:49:13 PM

So I tried the Trezor with the Electrum 2.0 wallet today and it worked like a charm. Glad to see another wallet service that has implemented the Trezor successfully. I'd like to see if you guys could make any progress with getting Mycelium or Wallet32 to implement it next Cheesy

curb your enthusiasm : ) there are a few issues if you play with electrum long enough. p.ex. it hangs when creating new wallet (like one with password, one without password), wait at least the bugfix release 2.0.1 is out. but yes, it looks very good and they did great job.

I've been using electrum development version from git for about half a year now with trezor. I only once ran into a serious issue and that has been fixed a long time ago.

binford

newbie

Activity: 52

Merit: 0

Quote from: lyth0s on March 06, 2015, 11:49:13 PM

So I tried the Trezor with the Electrum 2.0 wallet today and it worked like a charm. Glad to see another wallet service that has implemented the Trezor successfully. I'd like to see if you guys could make any progress with getting Mycelium or Wallet32 to implement it next Cheesy

curb your enthusiasm : ) there are a few issues if you play with electrum long enough. p.ex. it hangs when creating new wallet (like one with password, one without password), wait at least the bugfix release 2.0.1 is out. but yes, it looks very good and they did great job.

molecular

donator

Activity: 2772

Merit: 1019

Quote from: lyth0s on March 06, 2015, 11:49:13 PM

So I tried the Trezor with the Electrum 2.0 wallet today and it worked like a charm. Glad to see another wallet service that has implemented the Trezor successfully. I'd like to see if you guys could make any progress with getting Mycelium or Wallet32 to implement it next Cheesy

you should probably ask mycelium and wallet32 devs.

lyth0s

legendary

Activity: 1260

Merit: 1000

World Class Cryptonaire

So I tried the Trezor with the Electrum 2.0 wallet today and it worked like a charm. Glad to see another wallet service that has implemented the Trezor successfully. I'd like to see if you guys could make any progress with getting Mycelium or Wallet32 to implement it next Cheesy

jackbox

legendary

Activity: 1246

Merit: 1024

Quote from: World on March 06, 2015, 05:13:00 PM

Do you store device_ID and shipping info somewhere?

In TechCrunch podcast was little conversation about Trezor at 00:04:38
http://techcrunch.com/2015/03/05/this-week-on-the-techcrunch-bitcoin-podcast-do-you-even-invest/

They already answered this. If there is an device id (such as cpu serial number) they do not store it anywhere. The Trezors are shipped blind. They put them in the box and glue them like fantatics and there is nothing on the box to indicate which Trezor is inside except a sticker denoting the color of the unit's plastic case. The cannot track you by any Trezor they sent you as they do not know who got sent which device. They only now how many physical units they have shipped to you.

World

hero member

Activity: 743

Merit: 500

Do you store device_ID and shipping info somewhere?

In TechCrunch podcast was little conversation about Trezor at 00:04:38
http://techcrunch.com/2015/03/05/this-week-on-the-techcrunch-bitcoin-podcast-do-you-even-invest/

BitcoinIsLiberty

newbie

Activity: 55

Merit: 0

Quote from: cor on March 05, 2015, 01:48:21 PM

Quote from: cypherdoc on March 05, 2015, 10:23:06 AM

Does myTrezor.com identify the specific unit that connects to it thus deanonymizing the owner that it was shipped to?

Also, I've not heard of any hacking incidents to date of the Trezor. Anyone else?

No, there is nothing in the device neither the code that we could use to link a specific person with a device.

Is the public key protected by PIN or confirmation preventing rogue websites from stealing it? Having your public key leaked would link all your transactions for the life of the seed.

Italone100

hero member

Activity: 529

Merit: 500

In criptography we trust!

please process my ticket for invalid prev hash

2112

legendary

Activity: 2128

Merit: 1073

Quote from: cor on March 05, 2015, 02:24:44 PM

The devices are produced and packed in batches. Even if there was some unique code embeded on the hardware, we would need to have a unique number on the package associated with it. there is no such code on the package of Trezor.

I trust you and I'm not claiming that you are trying to track the users of Trezor. (Plural "you", meaning "your company and associates", not "you personally"). I'm more interested on the possibility of correlation attacks done by somebody else on the users of Trezors, especially those users willing to connect the Trezor to a non-trusted and not-verified computer.

I'll repeat my question:

Is there any publicly available information or speculation about the SoC chips you use that would either exclude or confirm the presence of undocumented storage? IIRC the devices you use support "USB on-the-go" which is a fairly complex protocol. Do you even heard any substantiated rumors about the undocumented features of your chips. I've worked with some much older SoC chips where it turned out that OTPROM and ROM memory was in reality just EEPROM protected against write by convoluted trickery in the software drivers (can't recall the exact manufacturer at this time, later acquired by Rainbow Technologies).

cor

full member

Activity: 121

Merit: 100

Quote from: cor on March 05, 2015, 02:24:44 PM

Quote from: 2112 on March 05, 2015, 02:07:52 PM

Quote from: cor on March 05, 2015, 01:48:21 PM

No, there is nothing in the device neither the code that we could use to link a specific person with a device.

I easily believe that there's nothing in your code that would be designed for tracking. But do I think that NXP doesn't leave something traceable in the device itself? Do they document every bit of the JTAG state? Is there any open, published source that would confirm that their SoC devices aren't traceable?

The devices are produced and packed in batches. Even if there was some unique code embeded on the hardware, we would need to have a unique number on the package associated with it. there is no such code on the package of Trezor.

just to add there is a small QR code on the internals that identifies the production batch so we know which components and processes were used to produce it. For RMA processing.

cor

full member

Activity: 121

Merit: 100

Quote from: 2112 on March 05, 2015, 02:07:52 PM

Quote from: cor on March 05, 2015, 01:48:21 PM

No, there is nothing in the device neither the code that we could use to link a specific person with a device.

I easily believe that there's nothing in your code that would be designed for tracking. But do I think that NXP doesn't leave something traceable in the device itself? Do they document every bit of the JTAG state? Is there any open, published source that would confirm that their SoC devices aren't traceable?

The devices are produced and packed in batches. Even if there was some unique code embeded on the hardware, we would need to have a unique number on the package associated with it. there is no such code on the package of Trezor.

2112

legendary

Activity: 2128

Merit: 1073

Quote from: cor on March 05, 2015, 01:48:21 PM

No, there is nothing in the device neither the code that we could use to link a specific person with a device.

I easily believe that there's nothing in your code that would be designed for tracking. But do I think that NXP doesn't leave something traceable in the device itself? Do they document every bit of the JTAG state? Is there any open, published source that would confirm that their SoC devices aren't traceable?

cor

full member

Activity: 121

Merit: 100

Quote from: cypherdoc on March 05, 2015, 10:23:06 AM

Does myTrezor.com identify the specific unit that connects to it thus deanonymizing the owner that it was shipped to?

Also, I've not heard of any hacking incidents to date of the Trezor. Anyone else?

No, there is nothing in the device neither the code that we could use to link a specific person with a device.

cypherdoc

legendary

Activity: 1764

Merit: 1002

Quote from: ?? on ??

Quote from: cypherdoc on March 05, 2015, 10:23:06 AM

Also, I've not heard of any hacking incidents to date of the Trezor. Anyone else?

Some exploits have been found and patched

even better. the power of open source.

cypherdoc

legendary

Activity: 1764

Merit: 1002

Does myTrezor.com identify the specific unit that connects to it thus deanonymizing the owner that it was shipped to?

Also, I've not heard of any hacking incidents to date of the Trezor. Anyone else?

nelisky

legendary

Activity: 1540

Merit: 1002

Quote from: Italone100 on March 02, 2015, 05:15:05 AM

Error!
Failed to send transaction: Encountered invalid prevhash.

why?

I'm trying to send a Litecoin transaction using python-trezor and I'm getting the exact same error. Looking at the trezor-mcu code I find that it is sent here: https://github.com/trezor/trezor-mcu/blob/master/firmware/signing.c#L349 but I didn't debug it to understand what is going on. Could be a byte order thing or I just didn't put the right prev_hash to start with, not sure.

For reference I'm sending the only output of this tx: https://bchain.info/LTC/tx/3635c6b4ddb52a669a5db11e1a599d9149f18e803c178653c05d9e804afa4f57

So I do a TxInputType(address_n=client.expand_path(path to LS7CBRe81UbZJLjMG5p7gLB3DbgV2rNZ5q), prev_hash=binascii.unhexlify('3635c6b4ddb52a669a5db11e1a599d9149f18e803c178653c05d9e804afa4f57'), prev_index=0) which I guess is what I'm supposed to provide, but in my obvious diagonal reading of both python-trezor and trezor-mcu, it looks like the comparison is being make with the txhash of the first input of that transaction (though I may be completely off-base here, I'll have to compile trezor-mcu myself to add some debugging if no help comes my way)

Any clues or pointers?

EDIT: I finally found the problem I was having and it goes down to a bug in python-trezor's tx_api.insight_url. Well, maybe it doesn't reflect on every OS the same way but doing Decimal(value_as_float) is very dangerous and error prone in python, so I'll be getting a pull request ready.

rammy2k2

legendary

Activity: 1974

Merit: 1003

Quote from: Italone100 on March 02, 2015, 05:15:05 AM

Error!
Failed to send transaction: Encountered invalid prevhash.

why?

keep us updated on this one, i just got my trezor too

Topic: [ESHOP launched] Trezor: Bitcoin hardware wallet - page 75. (Read 966173 times)