Hey guys, I'm one of the founders and I can see there's quite a few questions; some of them have been left unanswered. I'll do my best to answer them all. For simplicity I will just quote insert the different comments. First off, before I get into it; I understand that the website and/or the initial post was a bit "salesy" and I apologise for that. Regarding both, they were made by the marketing team.. so yeah. It's good feedback though and I'll have a closer look at this; I was honestly mostly focused on the product and fundraising.
Tangem ring wallet?
Is the EAL6+ secure element chip open source?
Someone can wear it like a ring. It looks like a ring but I think it would be very dangerous for someone to wear a wallet to everywhere he is going to. I will prefer to keep my wallet secure somewhere at home for privacy reasons.
I prefer mostly the wallet that make use of QR code and camera but I think it is making use of NFC.
1. Yes, Tangem is releasing a ring as well. The main differences being theirs is more expensive (announced retail price on their blog of $200+) and they don't have a Shamir implementation like we do with Ace cards. Other than that, it should mostly be the same, though I'm just guessing here since it's not released.
2. The chip we use is NXP P71; it's a bank-level chip and has EAL6+ securit as tested by NXP. I believe none of the NXP chips are open source. I also don't think there's many, if any open-source chips at all right now. Satoshi Labs recently funded a company working on an open-source chip for hardware wallets but I haven't seen anything clear on it for a while now. If they do release and it supports our needs we'd be more than happy to switch over. We're also exploring other chip alternatives but for now we stuck with NXP.
3. That's a fair point, I'll address a few of those, however:
- The ring has absolutely no markings on the outside, just a very simple logo on the inside of the ring
- You have to understand, the purpose of this product is not necessarily for you to store 100BTC on it. The purpose is much simpler in nature; a) we want people to be able to have some crypto with them and use it easily in case they want to; i.e. small amounts and b) we want to onboard existing users who don't use a hardware wallet due to their complexity. There's around ±500M crypto users worldwide and yet lifetime wallet sales are less than 20M units across all wallet companies combined; less than 4%. Which is crazy, but it makes sense, because the process is too complicated for casual users.
- Stealing the ring alone does nothing. There's 2 viable ways to steal the money: a) someone steals the ring, the phone it was paired with, the phone password as well as the app password and b) someone steals either your seed-phrase or your ace cards depending on how you set it up initially.
- There's actually quite a lot of security into it even when you compare it to a traditional hardware wallet for 3 main reasons: a) the chip actually has a self-destruct in case something malicious actually ends up being transmitted to it, in addition to its base security (feel free to check this out on NXP website yourself as this isn't as a result of our work but their work since this is a bank-grade chip) b) there's fewer attack vectors; no battery, no ports, no internet, no bluetooth etc. There's only one mode of communication; NFC. and c) if you set up your ace-cards, since they use Shamir, they are realistically safer than a simple seed phrase
Someone can wear it like a ring. It looks like a ring but I think it would be very dangerous for someone to wear a wallet to everywhere he is going to. I will prefer to keep my wallet secure somewhere at home for privacy reasons.
This is my main grip (amongst others) with "wearable" cold wallet devices - once it gets mass marketed and known to the general audience, the user will have a mark on his/her back from ill intended individuals. I easily see users of the device being victims of the famous $5 wrench attack.
We're not just revolutionising the form factor - we've completely redesigned the way you backup your wallet. Ace Cards use Shamir's Secret to allow you to safely recover your wallet, without ever writing down your seed phrase. Each ring comes with 4 Ace Cards, but you can order more if you want in packs of 4,8 or 12. If you lose a card, you're still safe, as each individual card does not contain enough information for recovery.
Since the devices comes already wtih 4 Ace Cards, it is my understanding that the user doesn't generate a new wallet (as opposed to hardware wallets) and instead the ring comes already "configured" with the seed phase that comes within the 4 Ace Cards using Shamir's Secret correct? If so, how can the user be sure that the whole process of generating the keys was safe?
1. IF the product does become as popular as in this theoretical example, a wannabe wrench attacker would probably know the ring is useless even if he gets it. Furthermore, it's not much different than somebody knowing you have crypto because of your instagram posts or etc and then attacking you with a wrench, so I get your point, but there's a lot of what ifs involved.
2. Nothing comes pre-configured. The user gets a choice; write down a seed phrase or use Ace Cards, which in essence means using Shamir's Secret Sharing we generate multiple sets of seeds based on how many cards you want to set up (with the default being 4, and 2/4 for restoring the wallet) and then you simply store the multiple seed on these cards instead of writing them down. We will be using the Trezor implementation of Shamir for this since it's the current industry standard. The only difference being, Trezor asks you to write it down on a piece of paper and we store it on the cards. Lastly, you have to understand that the mechanism is specifically built to help onboard either existing crypto users who mostly use software wallets into using something hardware and/or new crypto users; which is why we've built it to be as easy to setup and use as possible.
Someone can wear it like a ring. It looks like a ring but I think it would be very dangerous for someone to wear a wallet to everywhere he is going to. I will prefer to keep my wallet secure somewhere at home for privacy reasons.
Well I just checked their site and they claim that even if your ring gets misplaced or lost, you do not need to worry as it is bind with your biometric information and no one can steal the crypto.
If your ring ever gets misplaced, you can rest assured that your crypto is safe. You can order a new ring and restore your wallet. Your old ring is useless without your biometric verification.
I don't know how this works and how secure it is but since the ring can be misplaced more often as it is with you all the time, even if you are sure that losing the ring will not lose your crypto, still buying a new ring again and again for 84$ is still expensive
(assuming that ring is more likely to get misplaced more often as compared to a hardware wallet stored in a safe location).
1. Yes, I've explained above the two possible ways of stealing the actual contents.
2. I understand your point on price but you have to understand we are still an early stage startup. First off, that price includes both shipping and VAT, second of all as more time passes and we ramp up production to a larger scale my wish is for us to eventually be able to reduce the cost, but currently, that is the best we can do. Lastly, Tangem has an announced retail price of $200+ so we honestly already did our best in reducing the cost as much as possible, especially since every order also comes with 4 Ace Cards included. Hopefully though, people won't lose their ring that often. At the end of the day, everyone wears engagement rings and wedding bands all day and no one loses them on a monthly basis.
Well I just checked their site and they claim that even if your ring gets misplaced or lost, you do not need to worry as it is bind with your biometric information and no one can steal the crypto.
What of physical attack? Someone to physically attack the owner of the ring wallet and tell him to send all his coins to the his (attackers) addresses.
I don't know how this works and how secure it is but since the ring can be misplaced more often as it is with you all the time, even if you are sure that losing the ring will not lose your crypto, still buying a new ring again and again for 84$ is still expensive
(assuming that ring is more likely to get misplaced more often as compared to a hardware wallet stored in a safe location).
If truly it is supporting BIP39 seed phrase, you can use any other wallet that is supporting BIP39 seed phrase for the recovery.
1. Sure, you can get attacked on the street but again: a) this is a far-fetched theoretical and b) you can get attacked for dozens of reasons, including much more mundane things that require much less effort. For your example to be a success, you would have to be physically coerced for a minimum of several minutes if not a quarter of an hour. Someone threatens you, you have to pull up your phone, put in the phone password, then the app password, then you have to actually *send* the money to the attacker. I mean this is not a walk in the park and quite unlikely to happen. Lastly, again, our main wish is for this to be an on-the-go wallet (1) and mostly serve the large population of crypto users who only use software wallets (2), in which case they would be safer either way
2. That is correct, if you set it up with a seed phrase you can naturally restore it on any other wallet.
Nice website! Really pushes the product over the features.
Looks like you are looking to grab irreversible currency for vapourware. :/ Negative trust left to avoid impulse buyers. I will remove it if you provide one of:
a) answers to
any of the questions asked
b) provide corporation KYC as required by law
c) provide a list of partners, instead of a signup form
You could try an angel investor.Hey Vod, that feels a bit personal, but I'll answer your questions.
1. You can't even buy anything on the website right now, so not sure I see how we can grab *any* currency at all. Second, it's a bit disingenuous to call this vapourware, or at least it feels like it for someone that spent the last year working on it. Anyway, moving on.
2. I will provide you answer to the questions we asked but just so we're clear a) you could've found the company by just googling the name and b) again, it feels a bit personal for you to threaten to remove the post if we don't provide KYC.
Whatever, the company is Ringwallet SRL, registered in Bucharest, Romania (
https://www.romanian-companies.eu/ringwallet-srl-49560507/). I'm also more than happy to actually do KYC, but I'm more curious about how you'll be storing my ID/Passport in case I do the KYC with you? We're also incorporating a US entity, I'll share the info of that as well when it's finished.
3. We don't have a list of public partners yet; we made the project public for the first time less than a month ago. I also don't understand how that subtracts from the work we've done on this? Just fyi, I'm actually happy for you to even visit our phyisical office in Bucharest. Or whoever you want to send in your place. Any time Monday - Friday 9am-9pm. I can share the office address in dm; I genuinely don't want to post that on a public forum because then everyone can just show up doing all sorts of crazy things.
4. I am already working on doing both some fundraising and getting a more official list of partners to build legitimacy, I'm just a bit disheartened because at the end of the day, bitcointalk was and still is a forum where all sorts of crazy ideas were tried and the reason why I specifically wanted this posted here. Sure, I'll admit the post was way too "salesy" and I apologise for that; we're honestly a relatively small team and I don't have time to individually check every post the team makes. Still, it's a legit project, and we're not even asking for anything. You cannot buy anything, you cannot invest or anything like that. We mostly just wanted feedback and to hear people's thoughts.
I would like to wear it, this is likely to be a new way of storing assets in the ring and I'm excited to see its price range, should be affordable, although I prefer an easily accessible Decentralized software wallet and I'm using the former Bitkeep currently known as Bitget Wallet.
Yeah. Hopefully, this is just the first of multiple wearables to come; in different shapes and forms. For now the base MSRP is going to be 99$ with VAT and shipping included, and for the pre-orders (which are not open) it will be 84$. In terms of software wallets the one I like the most is Rabby.
One of the nice security features of the Tangem ring is that fact that it will not work while on your finger. So you don't have to worry about people communicating with it while it's on your hand. Or just grabbing your phone while you sleep and and putting it to your hand, you actually have to take the ring off.
IMO having it work while on your hand is not a good idea.
-Dave
I haven't seen more about this to be honest, I'll do some more research and find out what you mean exactly but I find it a bit hard to understand how the ring can "know" if it's on your hand? Unless there's a specific lock you can turn on from within the app. I don't think it's a good feature for it not to work while on your hand though; it kind of defeats the purpose? Just to be clear, neither of what you said can happen.
a) for the ring to communicate in any meaningful way, the counterpart has to pass authentication; these chips are bank-grade so that means whenever you want to interact with it you have to pass a cryptogram to it, for eg a VISA POS would be able to pass the cryptogram and communicate with it, your paired phone would as well, but some random third party would just get locked behind the cryptogram. Now let's assume this is a bad actor with good technical knowledge and it somehow tries to fool the program by either bruteforcing or injecting x thing into it => the chip gets burned.
b) for someone to grab your phone while you sleep, they also have to take your ring, know your phone password and your app password. Now, considering they do this while you sleep and know all of the above, they have to be someone close, i.e. wife, kids, family etc. If you're on a plane, I doubt anyone would know your passwords, and that's not even discussing the fact that probably no one would let that fly, starting with the flight attendants.
c) it's not enough to just I don't know, put somebody's phone next to your ring; it's like a normal hardware wallet, you have to confirm the transaction inside the app. And sure the way you do that is by putting the ring next to *your* phone, but that's after all the passwords.
Lastly, even IF the ring doesn't work while on your finger, like Tangem; how does that prevent someone from doing the things you've mentioned if they can grab your phone and know your passwords?
I can assure you none of it is vapourware.
Please do. What are your corporation details in Romania?
Shared above. Again, happy for you or somebody else to come visit our actual physical office. Also, again, happy to actually do a real KYC with you, but I genuinely want to know how you'll be storing my actual ID/Passport and if you'll be KYCing in return or will you be asking me to share my ID with you while you remain anon; because that doesn't sound fair. Happy to do it either way just so we can end this discussion about vapourware but I genuinely don't want my ID to end up on some online marketplace so I want to have some safety in that sense if I have to share it with you.
One of the nice security features of the Tangem ring is that fact that it will not work while on your finger. So you don't have to worry about people communicating with it while it's on your hand. Or just grabbing your phone while you sleep and and putting it to your hand, you actually have to take the ring off.
IMO having it work while on your hand is not a good idea.
-Dave
Does that not defeat the purpose of having a wearable hardware wallet if you have to take it off? RingWallet will also support card payments at some point in the future, making it easy to pay with it at any POS in the world - directly from your finger, and directly using self-custody crypto.
Once again IMO, it's a security thing. You have to preform the deliberate action of taking the ring off to use it. People can't say grab your phone while you are sleeping and then use a fingerprint to unlock it and do something with the ring. You could probably get my phone and finger while I sleep but there is no way you are getting a ring off without waking me up. That is obviously a worst case scenario.
Or how about you are doing a TX but since the ring is on the finger of the hand that you are using to hold the phone a TX is sent before you are 100% ready. Having to take the ring off is just a security thing.
Kind of like Tangem cards. Mine never leave their rfid shields until I am ready to do something.
Everyone has a different view. This is just mine.
-Dave
I can understand your point of view. For now the ring is not built to work like that; it works on the finger. But you bring an interesting conundrum and I think that we can add this as an optional for people to decide whether they want to left their rings unlocked or lock them. I still don't understand how the tangem ring would *know* it's not on your finger unless you have an actual information being transmitted, i.e. locking the ring, but we can probably implement a locking mechanism that you can activate from within the app. I'm not 100% sure if we will be able to include this in the absolute first release but I'll have a deeper look at it.
People have been robbing others of expensive jewelry for decades simply by cutting off their wrist if they hang it out the window.
If you are sleeping somewhere that you worry about theft, I would say don't use this imaginary product.
Again, I really don't get it. Why are you so against this and calling it imaginary? I'm happy to do a video call with you, invite you to the office, meet the rest of the team, or even personally do KYC with you, I also shared the company details (even though it was 1 word on google away) so can you please just stop with this rhetoric?
As for people getting their wrist cut off, I genuinely don't know where you live, but this is something that probably only happens in some of the worst regions in some of the worst countries on earth. That's not a casual thing like wtf.
