5 ms·
> The obvious one is that the security domains in the device are idiotic. There's a "secure" processor with almost no processing power or IO, and a "insecure" o
by lima 8y ago
> The obvious one is that the security domains in the device are idiotic. There's a "secure" processor with almost no processing power or IO, and a "insecure" one which handles the screen, buttons and IO. Both of them handle secrets (for example, the seed shown on the screen), which leaves you with essentially no gain whatsoever.
I think the idea is that the secure processor will verify the insecure processor's firmware (the "MCU check"), making such attacks impractical.
Of course, the design is broken and it can be bypassed by emulation, but security isn't all or nothing - "no gain whatsoever" is not true.
- 32032141 8y agoEven if the firmware on both firmwares are completely virgin, this doesn't say much about the safety of the device. I agree that security is not all or nothing, protection in layers is always the goal of secure products. I do however caution that it can cause complacency if things are presented as bulletproof, you need to be up front about what tools such as attestation afford you. In this case it can not tell you that the device is safe or not tamptered with.