Critical Electrum vulnerability

[sweetbet]

If you are using the Electrum wallet, then you might want to visit the following thread.
https://bitcointalk.org/index.php?topic=2702103.0

[Sherlock]

It does not affect users who have set password.

[DaftDog]

It does not affect users who have set password.

Apparently that is not true. See update one in OP's link.

[wonderpunter]

Anyone with a significant amount of btc should be using a hardware wallet anyhow, but also a password.. people still leave financial tools open without pass?

[Cash Bonus]

people still leave financial tools open without pass?

Yes, you're absolutely correct, and all very much too often, unfortunately

[Sherlock]

Anyone with a significant amount of btc should be using a hardware wallet anyhow, but also a password.. people still leave financial tools open without pass?

I do not trust HW wallets for anything else than hot or tepid wallets. Have you seen the HW keyloggers in keyboards, cable extensions and so on? IMO just a matter of time until someone adds something like that into the plastic box between the HW wallet and microUSB jack for example. The attacker then does not collect some random data. He knows that all data and keystrokes on HW wallet are significant.

With open source wallets there is just one attack vector - just the software; with HW walets there are two.

[wonderpunter]

I do not trust HW wallets for anything else than hot or tepid wallets. Have you seen the HW keyloggers in keyboards, cable extensions and so on? IMO just a matter of time until someone adds something like that into the plastic box between the HW wallet and microUSB jack for example. The attacker then does not collect some random data. He knows that all data and keystrokes on HW wallet are significant.

With open source wallets there is just one attack vector - just the software; with HW walets there are two.

But trezor smart pin is immune to keyloggers it changes every time, the logger would alo need a spy camera to catch the screen realtime which would change on the next use anyhow

[Sherlock]

What I am trying to tell is that you just trust to some people that it really is as they say it is. I am not telling the hw wallet can be spied by keylogger. I am saying (for example) the wallet itself can have keylogger inside of it. How do you know what exactly is inside of your HW wallet? The software wallets is under constant reviews. The software of opensource HW wallets is as well, but who is checking the hardware of every piece?<br><br>The guy who is doing my IT security confirmed me that security of HW wallets is overhyped and that he does not trust the HW wallets for the reason above. HW wallets are significant improvement of security, but it is not a perfect solution for storing big money.