4 ms·
I feel like there's more to this story but I'm just shocked that trezor transactions can be authorized from the app. I know that with ledger your keys/password
by neither_color 6y ago
I feel like there's more to this story but I'm just shocked that trezor transactions can be authorized from the app. I know that with ledger your keys/password are not exposed to the device and you need to enter a pin for every transaction, he'd know he was authorizing a transaction at the moment of entering his PIN!
I've never used a trezor before so I had to look it up:
When considering the security in entering our passwords, in Trezor wallets, the password is entered via the keyboard of the connected device, making it vulnerable for attackers to read it.
However, in Ledger wallets, the password is linked to another PIN which is entered using the normal keys.
- gruez 6y agoThat's misleading information coming from a competing hardware wallet maker. While it's true that the pin is entered on the computer, it's scrambled[1], so it's non-trivial to keylog it. [1] https://wiki.trezor.io/User_manual:Entering_PIN https://wiki.trezor.io/User_manual:Entering_PIN
- csomar 6y agoIndeed, there is something missing. My guess is that he entered his private key into the wallet. A part from requiring a PIN, you need to make a few clicks to authorize a transaction and the trezor screen will show the amount/receiver.
- thinkmassive 6y agoThere is more to the story: "The app was a fake, designed to trick people into thinking it was a legitimate app." Same app, different user: "He wanted to make sure his investment was secure, so he purchased a Trezor Model T hardware wallet and downloaded an app on his iPhone called Trezor, which asked for his seed phrase. The app didn’t connect to his Trezor wallet, and he figured it didn’t work." NEVER TYPE A SEED PHRASE INTO AN ONLINE DEVICE. That is never required during normal operation of any hardware wallet, that's the whole point of using one.