Sell me a $100 set of cards, one that's fancy like this, but makes its own bitcoin transactions, no cooperation with a service provider like Case, and one less fancy one that just holds bitcoin private keys. You put the less fancy one in a safe at your bank, and you use the fancy one for your daily business. If you ever lose the fancy one, simply buy a new one, and load it up with the backup you keep at the bank.
Case – Insanely Secure Hardware Bitcoin Wallet
11–20 of 24 posts
Re: Case – Insanely Secure Hardware Bitcoin Wallet
#12Doesn't sound particularly secure. Problems include that third key in offline storage, which sounds vulnerable to social engineering.
I get why you're concerned, but I wouldn't dismiss them so quickly until we've heard all the details. They seem like a talented team, and I assume they've anticipated the possibility of social engineering.
Here's a snippet from the FAQ on their website: "During first time setup for the device, you can choose where you want your recovery key stored. The default option is to store it in a secure vault operated by Third Key Solutions. If you wish to store your own third key, you will be prompted during the setup flow to scan the public key of your recovery private key. Please note that you will be responsible for signing a transaction with this private key if your device is lost or stolen, and we recommend this only as an advanced option for expert users." [1]
Re: Case – Insanely Secure Hardware Bitcoin Wallet
#13Earlier quoted context omitted.
Well, the third key is only useful if one has one of the other two. Though there is the possibility that an adversary could get access to the third key and the key that they store for being tied to the biometrics? But I think that that is probably sometimes a lower risk than the risk of "oops, I lost/forgot my bitcoin key" if one is using single signature? (depending on the person, and their adversaries)
I'd prefer the option to generate that third key locally and skip storing it on their servers.
Agreed, this is what some of the new startups that make something "secure" soo often overlook. They make put UX (if you can call it that), over real security. It's still possible to deliver a great user experience and backup solutions without compromising security, it's just not easy.
Companies that do succeed at this however should all receive an award for it, or at least be listed somewhere, because it's a really hard problem to solve at times.
I think in certain aspects Apple got this sort of stuff right with the iPhone, but I'm not sure about that, at least I hope iOS is as restrictive as it is for a reason.
Re: Case – Insanely Secure Hardware Bitcoin Wallet
#14>> The benefit of our device over traditional web wallets is security. Our devices are embedded. Everything that we wrote lives on the firmware. You don’t have to trust any app.
Errrr.... 'embedded' does not mean secure. While you may not have the full software stack of, say, Android or iOS, that doesn't make it secure by default. There's a network interface, some sort of processor, a variety of input devices etc.
I would hope that before making claims like "malware/virus proof" they would get both the hardware and software audited, as credit-card terminals generally have to be.
Re: Case – Insanely Secure Hardware Bitcoin Wallet
#15At least Case is open sourcing their software. I'll stick with my Tresor thank you. Cheaper, smaller.
Hopefully Case isn't vulnerable the same way: http://johoe.mooo.com/trezor-power-analysis/
Ledger isn't, and it's dirt cheap, too. I think I bought two for $20 back when they were called HW1.
Re: Case – Insanely Secure Hardware Bitcoin Wallet
#16i would be concerned about a custom ic that simply connects to the closest wifi on a given 0-day and uploads everyone's btc.
Re: Case – Insanely Secure Hardware Bitcoin Wallet
#17Since fingerprint scanners are very easily fooled I hope an additional pin-code is required to transfer non-trivial amounts.
Re: Case – Insanely Secure Hardware Bitcoin Wallet
#18"Transactions are only signed by the server if the fingerprint scan matches your biometric data."
Does this mean biometric data is stored on Case's servers?
Re: Case – Insanely Secure Hardware Bitcoin Wallet
#19i would be concerned about a custom ic that simply connects to the closest wifi on a given 0-day and uploads everyone's btc.
I think security in combination with money can only be about preventing a third party having access to your money.
The banks or any device you give your money to in the first place, you have to trust.
Otherwise keeping all money with yourself is the only alternative. A sock below the mattress or buried in the garden.
Don't forget to draw a coded (!) treasure map ;-)
Re: Case – Insanely Secure Hardware Bitcoin Wallet
#20At least Case is open sourcing their software. I'll stick with my Tresor thank you. Cheaper, smaller.
Hopefully Case isn't vulnerable the same way: http://johoe.mooo.com/trezor-power-analysis/
FYI that vulnerability was fixed already by the time he wrote that post. He brought it to Trezor's attention, helped update the firmware, and published the article after the update was pushed.