[ESHOP launched] Trezor: Bitcoin hardware wallet - page 95.

klondike_bar

legendary

Activity: 2128

Merit: 1005

ASIC Wannabe

Quote from: JorgeStolfi on December 08, 2014, 05:09:45 PM

Quote from: ?? on ??

But you have been bashing the same arguments since July... The first time, I can understand, but repeating the same thing over and over again...

Well, many Trezor customers and prospective customers do not seem to be aware of that risk yet. And I am not sure that the SatoshiLabs people are aware of the risk that they incur by tacitly approving the re-selling of their Trezors.

seriously? If they forebode reselling im sure craigslist would still have some.

the trezor is well-built. A knockoff requires some serious dedication and isnt even a remote concern if you just buy directly from buytrezor.com

far more likely:
1) printers with custom firmware to recognise bitcoin addresses/QR codes when printing, and push that data to a server
2) casascius or any other coins being opened up with precision and solvents, private key copied, then sealed shut again for resales. Or even the creator keeping a copy of all private keys
3) an android/windows/ios/ANY wallet software that was downloaded from the wrong site or updated to a malicious version
4) a webwallet that is hacked or otherwise steals privkey data.
5) virus or malware that seeks and steals any wallet info, or even QR codes from your print/documents history, and pulls the funds out.

someone creating an exact replica of the trezor and its (quality) box that its shipped in, plus valid serial numbers, plus making it match the MD5 hash..... you are pulling at straws. IMO the trezor is 100% the safest option right now outside of operating an isolated offline system with an offline printer, using it to sign txs, copying the signed tx to a USB, then sending the signed transactions from an online system

JorgeStolfi

hero member

Activity: 910

Merit: 1003

Quote from: ?? on ??

But you have been bashing the same arguments since July... The first time, I can understand, but repeating the same thing over and over again...

Well, many Trezor customers and prospective customers do not seem to be aware of that risk yet. And I am not sure that the SatoshiLabs people are aware of the risk that they incur by tacitly approving the re-selling of their Trezors.

JorgeStolfi

hero member

Activity: 910

Merit: 1003

Quote from: dnaleor on December 08, 2014, 02:41:15 PM

SatoshiLabs could do the following:

Put a long serial number in the sealed box. People can go to the website and register their Trezor. This tool would verify the Trezor device to be legitimate.
By doing that, they can also attach their email or (if they want to keep their anonymity) just a bitcoin address to their device. This can be used for warranty purposes so reselling the Trezor would be much more easy

That would help, but may not remove the risk entirely. The malicious reseller may order a batch of real Trezors and send fake malicious Trezors to the clients, with the same serial numbers.

Perhaps one can devise some secure hanshake that that the Trezor could do with the SatoshiLabs server to prove that it is legit. It would have to be something hard to emulate by a fake Trezor, even one that used parts from a real Trezor.

dnaleor

legendary

Activity: 1470

Merit: 1000

Want privacy? Use Monero!

Quote from: JorgeStolfi on December 08, 2014, 11:04:11 AM

Quote from: GreatBug on December 08, 2014, 10:25:46 AM

Quote from: ?? on ??

A fake Trezor can do anything.... you pulled that out of your FUD hat? Roll Eyes

Why couldn't a fake trezor impersonate a real one and do whatever it wants underneath the hood?
I'm not saying this is easy to accomplish, but certainly technically possible.

A fake Trezor can, for example imitate the real one but generate only weak keys (say, from among 2^30 possible pairs rather than 2^160). Then the thief needs only monitor the blockchain until enough coins have been stored in those addresses, which he has precomputed. Then he just moves the coins to his own addresses, all at once.

Note that the thief does not need to know who got the fake Trezors, and the user has no practical way of checking whether the keys are strong.

How many coins people may keep in those fake Trezors? That is the expected payoff of this attack. How much does it cost to make a fake Trezor with malicious bootloader?

EDIT: grammar

SatoshiLabs could do the following:

Put a long serial number in the sealed box. People can go to the website and register their Trezor. This tool would verify the Trezor device to be legitimate.
By doing that, they can also attach their email or (if they want to keep their anonymity) just a bitcoin address to their device. This can be used for warranty purposes so reselling the Trezor would be much more easy

JorgeStolfi

hero member

Activity: 910

Merit: 1003

Quote from: GreatBug on December 08, 2014, 10:25:46 AM

Quote from: ?? on ??

A fake Trezor can do anything.... you pulled that out of your FUD hat? Roll Eyes

Why couldn't a fake trezor impersonate a real one and do whatever it wants underneath the hood?
I'm not saying this is easy to accomplish, but certainly technically possible.

A fake Trezor can, for example imitate the real one but generate only weak keys (say, from among 2^30 possible pairs rather than 2^160). Then the thief needs only monitor the blockchain until enough coins have been stored in those addresses, which he has precomputed. Then he just moves the coins to his own addresses, all at once.

Note that the thief does not need to know who got the fake Trezors, and the user has no practical way of checking whether the keys are strong.

How many coins people may keep in those fake Trezors? That is the expected payoff of this attack. How much does it cost to make a fake Trezor with malicious bootloader?

EDIT: grammar

JorgeStolfi

hero member

Activity: 910

Merit: 1003

Quote from: GreatBug on December 08, 2014, 10:33:45 AM

Quote from: Erdogan on December 08, 2014, 10:28:21 AM

A trezor copy is not a fake, it is free software and free hardware except the bootloader. Someone with capital and skill could do it, but they have to build their own reputation.

Bootloader source is also available now.
Also, I don't understand the purpose of the distinction. Perhaps describing this theoretical device as a 'malicious Trezor' would be more accurate.

Yes, that is a more accurate term. If you buy a Trezor from a third party, how can you tell that it is not a malicious fake Trezor?

GreatBug

sr. member

Activity: 629

Merit: 252

Quote from: Erdogan on December 08, 2014, 10:28:21 AM

A trezor copy is not a fake, it is free software and free hardware except the bootloader. Someone with capital and skill could do it, but they have to build their own reputation.

Bootloader source is also available now.

Also, I don't understand the purpose of the distinction. Perhaps describing this theoretical device as a 'malicious Trezor' would be more accurate.

Erdogan

legendary

Activity: 1512

Merit: 1005

Quote from: GreatBug on December 08, 2014, 10:25:46 AM

Quote from: ?? on ??

A fake Trezor can do anything.... you pulled that out of your FUD hat? Roll Eyes

Why couldn't a fake trezor impersonate a real one and do whatever it wants underneath the hood?

I'm not saying this is easy to accomplish, but certainly technically possible.

A trezor copy is not a fake, it is free software and free hardware except the bootloader. Someone with capital and skill could do it, but they have to build their own reputation.

GreatBug

sr. member

Activity: 629

Merit: 252

Quote from: ?? on ??

A fake Trezor can do anything.... you pulled that out of your FUD hat? Roll Eyes

Why couldn't a fake trezor impersonate a real one and do whatever it wants underneath the hood?

I'm not saying this is easy to accomplish, but certainly technically possible.

JorgeStolfi

hero member

Activity: 910

Merit: 1003

Quote from: AussieHash on December 08, 2014, 06:25:06 AM

In general the tin foil hatters here would probably be satisfied with buying from an official reseller if there were either a page listing/linking official resellers on satoshilabs website, or if stick/slush/Alena posts here to confirm your official reseller status.

Sure, the fake ATM machines and POS terminals, that clone credit cards, are all a figment of tinfoil hatters' imagination...

EDIT: SatoshiLabs would have to make sure that an official reseller is selling only legitimate Trezors. How would they do that?

Half secure is not secure at all..

AussieHash

hero member

Activity: 692

Merit: 500

In general the tin foil hatters here would probably be satisfied with buying from an official reseller if there were either a page listing/linking official resellers on satoshilabs website, or if stick/slush/Alena posts here to confirm your official reseller status.

JorgeStolfi

hero member

Activity: 910

Merit: 1003

Quote from: ?? on ??

Quote from: JorgeStolfi on December 08, 2014, 12:51:38 AM

Quote from: ?? on ??

on initialization, the Trezor checks that the firmware is the same as the one shipped from factory.

A legitimate Trezor will do that. A fake Trezor can do anything -- including simulating the real one long enough to steal your coins.

A fake Trezor can do anything.... you pulled that out of your FUD hat? Roll Eyes

You obviously don't own one... and didn't discuss this possibility with SatoshiLabs... Please remember that Slush, the founder of SatoshiLabs, was the first to create a Bitcoin mining pool, in Dec 2010 https://en.bitcoin.it/wiki/History- he knows a thing or two about bitcoins...

PS: Disclaimer: I am currently enrolled in the first Master Degree in Digital Currency http://digitalcurrency.unic.ac.cy/about-the-program with Andreas Antonopoulos. He can't speak more highly of Trezor's security features. I agree with him.

Well, ask him what a fake Trezor can do, then.

Not to weigh on Dr Antonopoulos, who seems to be a honest guy (he left the Bitcoin Foundation, that puts him above all those who ae still there): but he did work as security consultant to the Neo & Bee scam. So he may know a lot about cryptography, but not enough about what a fake businessman can do.

JorgeStolfi

hero member

Activity: 910

Merit: 1003

Quote from: ?? on ??

Quote from: JorgeStolfi on December 07, 2014, 11:43:34 PM

Quote from: ?? on ??

If delivery is a problem in the US, I am distributing Trezor from Los Angeles. I mostly supply the people at Bitcoin and Fintech Meet-Ups here. Over a dozen units in stock at the moment. All factory sealed units.

Need I remind you all about the risk of buying a Trezor from a reseller?

Please do. Because on initialization, the Trezor checks that the firmware is the same as the one shipped from factory.

A legitimate Trezor will do that. A fake Trezor can do anything -- including simulating the real one long enough to steal your coins.

JorgeStolfi

hero member

Activity: 910

Merit: 1003

Quote from: ?? on ??

If delivery is a problem in the US, I am distributing Trezor from Los Angeles. I mostly supply the people at Bitcoin and Fintech Meet-Ups here. Over a dozen units in stock at the moment. All factory sealed units.

Need I remind you all about the risk of buying a Trezor from a reseller?

molecular

donator

Activity: 2772

Merit: 1019

Quote from: lyth0s on December 06, 2014, 05:17:16 PM

Quote from: kkurtmann on December 06, 2014, 02:24:59 PM

Quote from: lyth0s on December 06, 2014, 11:39:31 AM

I ordered my trezor on November 19......still no package in the mail... .

Mine took just about 3 weeks to arrive in Canada.

Yeah trezor support just responded to my email. Basically told me to wait 3 weeks for USA shipping. Unbelievable. China gets me products in less than 4 days, Romania 3 weeks.....

I think the bottleneck is at US airports.

There's no difference shipping from Romania or Czech Republic. Anything shipped from Europe to the US via regular postal ("letter") will take anything from 5 business days (extremely lucky) to 3, up to in extreme cases 5 weeks. When I shipped casascius coins in my experience the stuff was usually on the plane to the US on 2nd or 3rd day, but customs or US postal or whoever sits at the receiving airport takes ages to process. Similar to Canada, Italy, Australia.

Anything within Europe arrives within 2 to 5 business days (with exception of Italy), add a day or two to Korea, Thailand, Ukraine, Turkey, UK,...

I don't know how the fuck the Chinese do it... they also ship to Europe incredibly cheaply and fast. I guess it's something that got optimized heavily.

fonsie

sr. member

Activity: 434

Merit: 250

Here's my trajectory, it has seen 3 countries

Order info:
On Oct. 1, 2014, 9:31 a.m.: Order created
On Oct. 1, 2014, 10:05 a.m.: Payment received.
On Oct. 1, 2014, 11:53 a.m.: Order being processed
On Oct. 1, 2014, 1:52 p.m.: Order shipped

Shipping info:
03/10/2014   11:18   Shipment delivered
02/10/2014   23:46   Shipment sorted for delivery
02/10/2014   19:07   Received in internationl depot
02/10/2014   07:05   Leaving international depot
02/10/2014   03:19   Leaving international depot
01/10/2014   16:49   Shipment received into network

So no snailmail for me.

sandpaper

sr. member

Activity: 373

Merit: 250

Quote from: kkurtmann on December 06, 2014, 09:15:15 PM

Quote from: lyth0s on December 06, 2014, 05:17:16 PM

Quote from: kkurtmann on December 06, 2014, 02:24:59 PM

Quote from: lyth0s on December 06, 2014, 11:39:31 AM

I ordered my trezor on November 19......still no package in the mail... .

Mine took just about 3 weeks to arrive in Canada.

Yeah trezor support just responded to my email. Basically told me to wait 3 weeks for USA shipping. Unbelievable. China gets me products in less than 4 days, Romania 3 weeks.....

Not through regular snail mail aka national postal service does it take 4 days, which is what Trezor uses for deliveries.

Same situation for me. Ordered on Nov 17, shipped out Nov 18th. Was monitoring tracking info and it says its still in pre shipment... /s Awesome...

kkurtmann

sr. member

Activity: 475

Merit: 250

Quote from: lyth0s on December 06, 2014, 05:17:16 PM

Quote from: kkurtmann on December 06, 2014, 02:24:59 PM

Quote from: lyth0s on December 06, 2014, 11:39:31 AM

I ordered my trezor on November 19......still no package in the mail... .

Mine took just about 3 weeks to arrive in Canada.

Yeah trezor support just responded to my email. Basically told me to wait 3 weeks for USA shipping. Unbelievable. China gets me products in less than 4 days, Romania 3 weeks.....

Not through regular snail mail aka national postal service does it take 4 days, which is what Trezor uses for deliveries.

lyth0s

legendary

Activity: 1260

Merit: 1000

World Class Cryptonaire

Quote from: fonsie on December 06, 2014, 05:29:24 PM

Quote from: lyth0s on December 06, 2014, 05:17:16 PM

Quote from: kkurtmann on December 06, 2014, 02:24:59 PM

Quote from: lyth0s on December 06, 2014, 11:39:31 AM

I ordered my trezor on November 19......still no package in the mail... .

Mine took just about 3 weeks to arrive in Canada.

Yeah trezor support just responded to my email. Basically told me to wait 3 weeks for USA shipping. Unbelievable. China gets me products in less than 4 days, Romania 3 weeks.....

Because they ship your crap from Chinatown instead of China.

Bitmaintech is clearly in china and the packaging resembles such, but okay.

fonsie

sr. member

Activity: 434

Merit: 250

Quote from: lyth0s on December 06, 2014, 05:17:16 PM

Quote from: kkurtmann on December 06, 2014, 02:24:59 PM

Quote from: lyth0s on December 06, 2014, 11:39:31 AM

I ordered my trezor on November 19......still no package in the mail... .

Mine took just about 3 weeks to arrive in Canada.

Yeah trezor support just responded to my email. Basically told me to wait 3 weeks for USA shipping. Unbelievable. China gets me products in less than 4 days, Romania 3 weeks.....

Because they ship your crap from Chinatown instead of China.

Topic: [ESHOP launched] Trezor: Bitcoin hardware wallet - page 95. (Read 966173 times)