Topic: Keystone....Well I didn't want to post it but here it is. (Read 235 times)

The path to progress... yeah sure, you are going to ''improve'' and save earth by calling something a $100 scam without any proof.
I work for hardware wallet company called dkbit98stone and I can sell you my latest hardware wallet that is best in the whole universe, but I will give you 10 models to chose and you can change your mind 20 times  
I just don't like when people call something a scam because they want ultra fast premium royal service, and when they are changing their minds like wind blows.
It's easy for me to call ledger hardware wallet a scam, but I never did that.

Last time I had problem was when I ordered laptop battery.
Seller didn't sent me correct tracking code, I waited more than Keystone buyer, they never replied to any of my questions, I never received battery, but I received full refund in the end.

Okay new update on my situation - they have refunded me back officially. Take what you want from my experience but it took PayPal dispute and this thread in order to sort out the problem. I wouldn't say that they are totally a scam company now, but they aren't as easy going as one might think. Overall a mixed experience. I guess if you only commit to order their product and not return it - everything will go well and as expected.

This will always be an issue with things like this. At the moment I have close to $200 of RAM missing since the company receiving it says they never got it and USPS has it delivered. So, I have been going in a loop. Did USPS scan it at the wrong address? Did it fall off the loading dock? Did the box get kicked behind some other box and until someone moves the other box it's never going to be found. USPS is washing their hands of it since they say it's delivered. And the company getting it is saying that until they scan it in it does not exist in their facility. I have been dealing with them for over a decade with no issues. So I trust them not to run with my stuff.

So yeah, it's an issue, but when dealing with multiple points. Warehouse, drives, different companies it's what happens from time to time.
If you can't deal with stuff like this happening every now and then you are going to have to stop ordering stuff online.

Even now, I am online chatting with Amazon support about an order they messed up twice. It has taken so long to deal with this issue that I could have gone out and gotten a part time job and earned more then I paid for it and bought a new one locally......

-Dave

Dude, your ,,much worse experience" than mine doesn't mean that we as customers, citizens, people - should be accepting this behavior from the companies, let alone normalize it as you're trying to do! The path to a progress in society as a whole is to improve inefficiency and neglectcy and not encourage it/be okay with it. If you don't expect high standards from these companies, why should they even try to improve after reading your comment? I am at my right to change my mind and return a product and this could be due to various of reasons and neither of them being that I could be a baby. With such conclusions you don't seem like a person that holds much self-respect in himself. Don't mean to offend you as you did to me, but to make you think on which side of the fence are you. Or maybe you do work for a hardware wallet company (in secret...) ?

Dude, you changed your mind like a child, and they are based in China, so don't expect royal service as if you purchased a Lamborghini.
I gave you a simple solution for your problem but you continue to behave like a child, so I am not taking you very seriously.
You can blame Keystone or do whatever you want, but I know much worse stories with shipping problems for other hardware wallets based in Europe.
I waited for several deliveries, refunds and returns many times in my life, and for longer periods of time than you, but I never said said someone is a scammer because of that.

I still think anybody who finds himself in my situation will be as disappointed as I am. I don't think there is any excuse in using Amazon or the logistics company's issues to whitewash Keystone behavior. It is their choice to work with them - not mine. It is also their policy on their website to accept returns and follow the EU law. I as a customer can change my mind as much as I want and cannot accept excuses that somebody else is making mistakes be it Amazon, be it logistics company, be it Keystone. And as I said it's been more than a month already since I have returned the item untouched. I have waited patiently and without drama for more than a month, but from now on I feel like I am being made into a fool. Not to mention Keystone are actually expecting me (by their own words, written by email to me) to contact the logistics company and Amazon to solve the issue - is this fair? Who's job is it to solve this?

I think you are jumping to conclusions. The situation is not quite standard and most likely there really were difficulties with finding and returning the package you canceled. After all, they also can't return the money until they make sure that the package has been returned to the sender. This is standard procedure and no reason to call them a scam. I'm not trying to defend and shield them, but show a little patience and perhaps the situation will clear up. Although I agree that from the position of the buyer it is unpleasant to find yourself in a position where there is neither a package nor money.


Agree the same. $100 is no reason for a company to put its reputation on the line. There is a banal misunderstanding here. As for talking to the CEO, I think it's not his responsibility to solve problems, but support, but it's worth a try. Suddenly it will be possible with its help to solve the problem faster.

Well it's not the first time Amazon ''lost'' the package  
Keystone is certainly not a scam company, and to be honest you maybe started all this mess with choosing to change your mind, returning package and ordering Pro version.
You can say they didn't act very professionally, and they probably could respond in a better way, but they won't get rich from $100 you paid for this device.
My suggestion is to try talking directly with Keystone CEO Lixin Liu and find solution for your problem.

Keystone are a scam company. I had ordered Keystone Essential during their blackfriday promo period and then decided that I better get the Pro and contacted them in order to return the package (keeping in mind the package was still in transit). They advised me to tell the shipping company that I am "rejecting" the package and to ask them to return to seller - so I did. Do you know what happened? Exactly 1 month later and I neither have a Keystone or my money. The package was returned to them and I have provided them with the return tracking code but they claim that they cannot locate the package inside their big Amazon warehouse and they're waiting for confirmation or something. It is 1 month and they are hoping that I give up or my PayPal buyer protection expires. I am inside European Union and will take this to the end for their deliberate incompetence. Now they are claiming to PayPal that I should have used their "return label process" when in reality they have advised me to just reject it lol. Stay away from this company - marketing is good and the product seems good but the way I have been treated shows what kind of company is this in reality. If you have interest I can provide our communication with email and with PayPal.

Can't speak to the others but coldcards come in security bags that are destroyed when opened. They have been in use in various industries for years with no issues.
Still does not stop someone from printing their own bags.

All of the security devices I have used for things other then BTC have come in destroy to open packing. Not saying it can't be faked or duplicated. But, if you are going to make it destroy to open, at least make sure the glue makes you destroy it.

-Dave

Like I said, Trezor is using heavy glue for their packaging and I personally don't like this and I don't think this makes hardware wallets safer in any way.
Imagine if smartphones you buy or anything else comes with boxes like this that need to be destroyed, for me that would be very annoying.
But you can make suggestion to Keystone developers to work on improving this for their new model, and I think new model is going to come out in 2023

Maybe someone could talk more about other hardware wallets, but I think that ledger, passport, coldcard and others also don't have super strong glue used with ''safu'' packaging.

Thats why you should always by from the official store. Coldcard for example has the serial number on the secure bag, that they ship the device in. With that kind of security I feel pretty safe, even if you can fake anything with the right effort.

Seems like a big problem to me that they sell trough amazon. Amazon is by far the last platform that you should trust with a secure device like this. To me it seems that with many mainstream hardware wallet brands it is more of a marketing now to be "secure" and their main focus is to sell as much devices as possible to people that have no clue about bitcoin. In any case chances will still be pretty low to get your coins stolen in comparison to a badly set up computer wallet.

I have been thinking about that in the past as well. I sometimes order stuff online to have it delivered to my address (person to person), and the shipping company is obviously not going to check the content and verify it's what I ordered. Unless it's a trusted seller, you could end up with a brick in a box. Good luck proving that's what the other party sent and you aren't lying and faking it.

Some people have suggested making a video of yourself opening the package. That's not a bad idea. At least you can prove the brick was inside when you opened it. Couriers in some countries allow the buyer to open the package in their presence. That's also a good way to go about it, especially for expensive items. If you open it, and there is a brick inside, the courier is a witness to it.

That's like the fake Ledger HWs that were sent to people following the data leak incident. A cautious person shouldn't fall for that. You ought to know where to go and verify the authenticity of the device and the instructions provided with it. If you are buying a Ledger, that's https://www.ledger.com/, not https://www.daves.fakeledger.com/. Getting phished is a serious problem, but you overcome it with knowledge, caution, and logic.

You have to look at it this way.

1) Still does not help when scammer orders a device and takes it out of the box and ships back a sealed device. Next person, rips open a security tab, takes off 2 security holograms opens the inside pack and gets....a deck of cards or something similar to keep the feel and weight the same. Yeah, that is going to be a PR nightmare.

2) Scammer builds a bunch of their own devices that don't require any of that. People who don't know turn it on go though the scammers setup and bad things happen.

Nothing is ever going to be perfect, and I really don't expect them to. Once again as I said above a few extra pennies for better heat resistant glue and another few extra pennies for better holograms would help a lot.

This is not going to fight supply chain issues. It from warehouse to customer issues.
As I said here in the US at least they sell through Amazon AND if you order from their site they SHIP though Amazon.
And we all know Amazon takes just about everything back and puts it back in the warehouse to be shipped out again.

-Dave

I understand your concerns, but no matter the quality of the packages, most things can still be faked. Luckily you can always rely on software and/or hardware authentication to verify if you have received a genuine hardware wallet or not.

Web Authentication: A Counter to Supply Chain Attacks

The article explains that each Keystone comes with preinstalled public and private keys in the secure element chip that are only used for verifying whether or not the device is genuine. These are not the private keys that sign transactions during transactions of your coins. During the setup process of your HW, you will be asked to visit the official Keystone authentication website. It's connected to a server that also has a public and private keypair just like your wallet. A genuine Keystone HW knows the public key of the server, and the server knows the public keys of genuine hardware devices. Once you start the authentication, you need to scan a QR code on the website which is encrypted with your device's public key and signed with the private key from the Keystone server. During the verification process, your HW will check the signature to make sure it comes from the official authentication page. The hardware device will decrypt the scanned message with its own private key. The result should be an 8-digit code that needs to be entered on the website. If the verification succeeds, you are good to go. If not, there is an issue with your device.     

With the outside box yes, it pressed back down and stuck to where you needed to rip it to open, if I added any other glue to it then it would have stuck even more.

One of the holograms I would give one a 60% that it went back with no problems or evidence that it was tampered with, the other once I knew what I was dealing with after the 1st one I would give myself a 95% in re-attaching with no evidence.
Both then opened with the void look like they were supposed to when pressed back on. Now that I know I am fairly confident I can do even better.

Nothing is going to be perfect, I agree with the fact that with the cost spending a bit more on better glue and holograms is worth it.

-Dave

Is it easy to re-adhesive without showing any sign of reopening? The re-gluing should make it easier to detect that someone tried to open the box.

In general, I agree with you, it is a mistake that the sealing is so easy, and perhaps if the scammers take advantage of this trick, they may move to improve it a little.
Their prices are quite high, so there is nothing wrong with developing packaging.

I have gotten responses from him here and on Twitter before so I went with those for contact.

I fully understand that boxes & packing can be faked.

BUT, and this is just my opinion there is a difference between Dave getting in more or less on his 1st attempt while eating breakfast and a determined person getting into the box.

Cards on the table, they are sold on Amazon, as of now anyone can order one take it out of the box, reseal the box and ship it back.
Amazon does not check returns that closely and if you send it back with a did not want it goes back into stock, the next person winds up with an empty box.

Now Keystone looks bad for something that could have been handled with a better glue and a security hologram that, to be blunt, didn't suck.

I know all holograms are not secure see here: https://bitcointalksearch.org/topic/just-a-video-about-how-bad-some-security-holograms-are-5401502  but some are better then others and there are other ways of adding to security to them, even if it's just cutting them a bit so removing them at all is more difficult without damaging them.

-Dave

FYI I think that you can reach him much faster on Keystone discord or telegram channel.
Someone else is probably handling their twitter channel, but he has his own accounts for contacts.

You still need to verify on website to confirm your device is genuine, and I agree they should improve packaging, but don't expect to get better security with better package, or with void stickers.
I know you can't open Trezor wallet without destroying packaging, but scammers can easily clone this...especially in China

I reached out to BitcoinLixin here and twitter over a week ago. He has not been active on here for a while but is on twitter. https://bitcointalksearch.org/user/bitcoinlixin-3378495

I was hoping for a response but as of now....nothing.

Sealed Box:



Opened with hot air gun showing no damage to the box / rip to open:





Inside holograms:



Removed with almost no damage, now that I know I could take it off without any damage.
The stain was breakfast burrito grease on my fingers nothing else.



The box was shrink-wrapped but as far as I can tell it's generic shrink wrap.

Was waiting to test / setup the device till I heard back from them about this. I sent messages on Nov 18th and 19th, and have not heard.
So for now I am just putting this out there.

The device SEEMS secure, but if you can't be sure it's the device that is supposed to be in the box what's the point.

-Dave