Ist meine Trezor-Brieftasche vor Hacks sicher, wenn sie an einen mit dem Internet verbundenen Computer angeschlossen ist?

[root_s2yse8vt]

Up

0

Down

::

In einem anderen Beitrag gab es Meinungsverschiedenheiten darüber, ob eine solche Wallet sicher ist oder ob die Gefahr besteht, dass sie gehackt wird. Einige Leute sagten, dass ein Trezor nie mit dem Internet verbunden ist, während andere meinten, dass der Trezor nicht sicher ist, wenn der Computer selbst mit dem Internet verbunden ist.

[cuoyi77372222]

Up

0

Down

::

It is impossible to hack a Trezor without being able to touch the Trezor. It doesn’t matter if it is connected to your computer, and the hacker has control of your computer. They won’t be able to physically touch/press the confirm button the Trezor. (Nor would they be able to put in the pin number if it is a model T)

Now, if you have your seed phrase saved on your computer… that’s a different story.

[bluescr33n3]

Up

0

Down

::

Yes. That’s entire point of the device.

[Certain-Reach1506]

Up

0

Down

::

I feel if you did not share your seed phrase with anyone you are safe no problem if you are connected with the internet as far as you are not share your seed phrase you are good to to

[WorldSpark]

Up

0

Down

::

Yes

[kaacaSL]

Up

0

Down

::

Hi, sure you can use Trezor on a computer connected to internet. The point of Trezor is that you can use it even on an infected computer.

Check this link for more detail: https://wiki.trezor.io/Security:Threats#Running_the_recovery_process_on_an_infected_computer

[-johoe]

Up

0

Down

::

The Trezor itself is a small computer reading the input from the usb cable, checking if this is a valid request, asks for user confirmation if necessary and then sends a reply, e.g. a signed transaction to the main computer. It has no direct connection to the internet, but if you have a malicious program on your computer it could send requests from the internet directly to the Trezor and send the replies back.

The point of the software running on the Trezor is to make it secure even in that case. So it checks all incoming requests, never sends private keys, and only sends signatures out after they were confirmed by user using its physical buttons/touchscreen. But like any other software it could have bugs.

This is where code reviews, fuzzing (simulating billions of random requests and checking if something unexpected happens), and being conservative when adding new features come in. These help preventing these bugs or detecting them before they are shipped out. There is also a bug bounty program where you get paid for finding such bugs and reporting them in private to SatoshiLabs so they can fix them, before the bugs become publicly known.

[Autor]

Beiträge