Add hardware wallets to the "secure your wallet" page

[saivann]

Trezor has been positively received and the idea is clearly a huge step forward when it comes to wallet security. Giving more visibility to the idea on the "secure your wallet" page seems very important IMO.

[luke-jr]

Has anyone else actually even heard of Trezor, or audited its workings? Why promote this one over the various other offerings which are more widely known?

Edit: Oh, this is slush's thing. Still, should promote more than just one offering..

[saivann]

I agree, I wasn't aware of many other competitors. They can be linked later on the choose-your-wallet page IMO once they are ready ( and as long as we can have enough confidence that those devices are secure ). I removed the link.

[saivann]

I added the link back with a mention about the upcoming BFL BitSafe (they have no website yet for it). It doesn't seem like there is a lot of hardware wallets. And given that they don't represent the same third party risk than web wallet and that users keep control over their wallet, I think it is fair to give them a bit of visibility as long as they come from known businesses or individuals that have shown to be trustworthy in the past.

[luke-jr]

Hmm, this reads a bit like Trezor is available now, but it's still preorder...

[saivann]

The paragraph ends with "As of today, no hardware wallet has entered in production but they are coming soon.". Any suggestion to make this more clear?

[luke-jr]

Maybe remove the "(soon)" here then?

[saivann]

Makes sense

[luke-jr]

I'm not sure about the claims made, but mycelium's bitcoincard is a 3rd: http://bitcoincard.org

There's at least another one that's been in some kind of beta for a number of months, including having a vulnerability discovered (the keys it made were not random enough).

[saivann]

Mycelium looks awesome but still far from a final production. Was there any demonstration at Bitcoin2013?

Some features might not apply to all hardware wallets so I will probably adapt the text again.

Concerning BTChip, if my understanding is correct, this could be seen as another approach to offline wallets. But not an hardware wallet that is able to sign and issue transactions by itself.

[luke-jr]

BTChip does seem to be transaction-aware and do signing on the smartcard. Seems to me its biggest limitation is lack of the display for amount..

[saivann]

Interesting.. In fact, it seems like BTChip allows people to be charged instead of paying (pull vs push). So, just like credit cards, users don't have control over how many BTC they are being charged (though the private key remains safely stored). Users can configure the device to refuse to sign a transaction based on a set of rules (like what output address is allowed). That is more than I expected. That said, I think that it doesn't fit what is described in the text of this pull request and it cannot be used like a wallet on its own. Users are not really in control of their transactions nor can they send a transaction right from the device, which might be the case with other hardware wallets.

[mikehearn]

It might be worth waiting until Trezor is actually shipping and usable by end users. It's still an R&D project, pretty much, as are all the competitors.

[saivann]

Personally, I have no problem linking to hardware wallets on the "Secure your wallet" page at this point because I'd like users to know that "not hand-made" offline wallet security is coming. I would however only give real visibility to hardware wallets on the "Choose your wallet" page once they ship and are really usable.

[saivann]

I added a seperate small line of text to make it clear that Hardware wallets are still in development to address Mike comment. This way, we will be able to drop this line later without needing translators to re-translate the whole text.