[Mewtwo]

I was watching Joe Grand’s videos. Apparently he has a way to break into the Model T and Model One via hardware hacking. Also has a way to break into KeepKey devices because they copied Trezor’s product and just renamed it (same STM32 F2 Microcontroller)

Obviously this is not a good sign for security. What if someone happens to figure out the secret to downgrade the firmware and get the keys?

It sounds really great that he’s helping people recover their funds after so many years. Or for those who got drained, got their answers as to possibly why.

But i don’t think hardware wallets are secured. Who’s with me on using open source encrypted USB to store their wallet? I personally like DiskCrypt.

Here’s the video if you guys are interested:
https://youtu.be/TGmGiN5Pa48?si=AHhNgIi_7Sk97YCd

https://youtu.be/MhJoJRqJ0Wc?si=POrKNQWszpKKycS2

[InspectorGadget]

I've watched Joe for a while now, he actually inspired me to get into Hardware hacking and security.

Ultimately his method is defeating chip security, which is the same risk in any device.

From the video, the true gap in security for those wallets is that you can only select a 9 digit pin. I get it, clues in the name, it's supposed to be numbers only. But that means that once you defeat the chip security to get the hashed PIN, the bruteforce range is actually pretty small. I think Joe said it would take 48 hours to try all possible combinations on his rig. Now if they let you use letters and symbols too, the reality is more than half of the devices he cracked open would never have been cracked.

For me, everything is a risk based approach, and ultimately lots of things need to go wrong for you to actually lose money to this method. Number 1 being that you let somebody else physically take your device.

[DramaKing]

Number 1 being that you let somebody else physically take your device.

My thoughts exactly. Never assume that any device is perfectly secure.

[SUI-3183372]

It's why I've never felt the desire to use hardware wallets. I feel like I can get similar levels of security from my own approach to key management. Over the years I've received in the ballpark of a dozen diff hardware wallets for free, and other than play with functionality a little bit, I've never used one for its intended purpose.

[Mewtwo]

I've watched Joe for a while now, he actually inspired me to get into Hardware hacking and security.

Ultimately his method is defeating chip security, which is the same risk in any device.

From the video, the true gap in security for those wallets is that you can only select a 9 digit pin. I get it, clues in the name, it's supposed to be numbers only. But that means that once you defeat the chip security to get the hashed PIN, the bruteforce range is actually pretty small. I think Joe said it would take 48 hours to try all possible combinations on his rig. Now if they let you use letters and symbols too, the reality is more than half of the devices he cracked open would never have been cracked.

For me, everything is a risk based approach, and ultimately lots of things need to go wrong for you to actually lose money to this method. Number 1 being that you let somebody else physically take your device.

Well, one of the guys in the video actually won a bid from a storage unit with a few trezors and ledgers. They got over $10k from that. I don’t know if that could be considered theft though, would it? But it’s almost like finding cash inside a safe.


I wouldn’t be surprised if Trezor starts using letters as a method for login. Never understood why it’s only digits. A-z with numbers will take years, if not decades.

[NoodleBot™]

It's why I've never felt the desire to use hardware wallets. I feel like I can get similar levels of security from my own approach to key management. Over the years I've received in the ballpark of a dozen diff hardware wallets for free, and other than play with functionality a little bit, I've never used one for its intended purpose.

How you getting free hardware wallets :(

[Navos]

Yes, but Joe's method requires the physical hardware wallet.

Unless you live in an area with daily break ins or you bring it out when you travel (which I don't think people do)

Using DiskCrypt essentially turns your wallet into a hot wallet because you go online on your PC and it is vulnerable to malwares present in your system or in the future.

[Mewtwo]

Yes, but Joe's method requires the physical hardware wallet.

Unless you live in an area with daily break ins or you bring it out when you travel (which I don't think people do)

Using DiskCrypt essentially turns your wallet into a hot wallet because you go online on your PC and it is vulnerable to malwares present in your system or in the future.

There’s no true way to protect assets eh? Especially if the government really wants it. They’ll get it one way or the other.

[SUI-3183372]

How you getting free hardware wallets :(

I work in the industry. Mix of partnerships, conferences, and getting schmoozed by people.

[avielderich]

Trezor is safe as far as I know no users with complains.

[Mewtwo]

Trezor is safe as far as I know no users with complains.

Hmmm.

Data breaches. Not just once, but many times. Hardware hacking. People losing funds from IRL thefts and fraud. I don’t think it’s really safe eh?

[NoodleBot™]

I work in the industry. Mix of partnerships, conferences, and getting schmoozed by people.

What do you think about Coldcard wallets? Airgapped wallets etc.

[SUI-3183372]

What do you think about Coldcard wallets? Airgapped wallets etc.

Air gapped, no blind signing, should be a solid wallet as long as the hardware is solid as well. I haven't used ColdCard myself, but I have used Keystone which do airgapping, and it works fine.