T
Trezor Blog
blog.trezor.io · Company blog · on HN since 2016
Trezor's company blog covers hardware wallet security, firmware updates, two-factor authentication, data breaches and cryptocurrency device design.
What HN saysHN commenters cite it for explanations of authentication and secure element tradeoffs, and users praise how Trezor handles vulnerabilities and its open design.
30HN people shared it
18linked it in comments
19stories submitted
40story points
1 year agolast shared
2016people per year2026
Most-shared posts
- 1Secure Two-Factor Authentication with TREZOR: FIDO/U2F5 people · 1 points · first shared 2016 · discussion on HN
- 2OpenSSH with FIDO2 and Trezor3 people · 7 points · first shared 2020 · discussion on HN
- 3TREZOR Firmware Security Update – 1.5.22 people · 3 points · first shared 2017 · discussion on HN
- 4Why You Should Never Use Google Authenticator Again2 people · 1 points · first shared 2018 · 1 comments on HN
- 5SatoshiLabs Response to Ledger's MITBitcoinExpo Findings2 people · 1 points · first shared 2019 · discussion on HN
- 6Our Dive into Secure Element, NDA chips and how we broke them1 people · 4 points · first shared 2020 · discussion on HN
- 7Trezor's Multi-Layer Defense Against Supply Chain Attacks1 people · 3 points · first shared 2025 · discussion on HN
- 8Details of the Mailchimp Data Breach1 people · 3 points · first shared 2022 · discussion on HN
- 9Trezor Suite Launches1 people · 3 points · first shared 2021 · discussion on HN
- 10Phishing Alert: Fake Trezor Wallet Website (possibly DNS or BGP hijacking)1 people · 2 points · first shared 2018 · discussion on HN
- 11Trezor ditches controversial KYC features1 people · 2 points · first shared 2022 · discussion on HN
- 1266,000 trezor users data leaked1 people · 2 points · first shared 2024 · 1 comments on HN
- 13Trezor security alert: Stay vigilant against a potential phishing attack1 people · 2 points · first shared 2024 · discussion on HN
- 14Trezor T announced1 people · 2 points · first shared 2017 · discussion on HN
- 15Trezor – Details of the Mailchimp data breach1 people · 1 points · first shared 2022 · discussion on HN
What HN people wrote when they linked it
jaycroft · 2022-01-27
I was wondering the same thing - here's an article I found that describes both approaches. Not being in the cryptography space myself I can't comment on how accurate it is, but passes my engineering smell test.
https://blog.trezor.io/why-you-should-never-use-google-authenticator-a…
Edit - sorry that this is really an ad for the writer's products. On the other hand, there's a hell of a bounty for proving them insecure / untrustworthy, whatever your feelings on "the other crypto".
noch · 2021-10-06
> Trezor - I've been using one for years and it's great. Also you can backup/restore the seed (so you don't need to register multiple devices).
Trezor does not make use of a secure element https://blog.trezor.io/is-banking-grade-security-good-enough-for-your-…
nicpottier · 2018-03-21
That was addressed in a firmware update. All systems will have vulnerabilities, the important bit is how the companies react. Trezor has been pretty great IMO in that respect and that all their stuff is open gives me a bit more confidence that it has been well attacked and patched.
https://blog.trezor.io/trezor-firmware-security-update-1-5-2-5ef1b6f13…
grumple · 2023-05-15
From 2018: https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7
From their forum earlier this year: https://forum.trezor.io/t/protect-from-getting-a-fake-trezor-device/58…
Scoundreller · 2022-02-15
A 2012 Bitcoin hack victim was none other than a lead developer of Bitcoin. Back then, they ran a Bitcoin faucet on it that gave out a paltry 0.25 Bitcoin at a time.
I never bothered to jump through those hoops for like a dollar (now about US$10k):
http://gavintech.blogspot.com/2012/03/bitcoin-faucet-hacked.html?m=1
He only lost 5 bitcoin (like $20 then or $200k today), but another lost 3100, or around… $124 million today:
https://bitcointalk.org/index.php?topic=66916.0
They ran a Bitcoin mining pool and this hack motivated them to create a hardware wallet:
https://blog.trezor.io/how-trezor-was-born-from-a-hacking-attack-that-…
magicjosh · 2022-02-05
Wow lots to unpack there.
For those reading, the title says "Trezor Ditches a Controversial KYC Feature, Plans Features to 'Cut Off Regulatory Overreach'"
Apparently Trezor added a KYC system called AOPP. Then backlash. Then they said they would roll it back (as of the article).
Have they rolled it back yet? They said it will be rolled out in February. Edit: Trezor blog post about the rollback here: https://blog.trezor.io/a-decision-on-aopp-789540c2930b?gi=f39ad0a68391
I always wondered what Trezor's fundraising plan is. My guess is once they started to see the money come in from taking fees they started to say "we'll be the next Coinbase!!!".
Do you have any more analysis of this addition to Trezor? As a Trezor user, this reminds me of Apple's push for on-device scanning. That Trezor even added this feature temporarily has me looking for alternatives. Anyone have suggestions?
urza · 2020-05-11
You can also look into Trezor - it has much better backup system, among other advatages compared to yobikey
https://blog.trezor.io/openssh-with-fido2-and-trezor-e565c2277
Lucadg · 2019-09-26
It depends on the country but I agree.
Being programmable money I expect better solutions to come in the future.
This is a recent and interesting one https://blog.trezor.io/shamir-backup-the-revolution-of-private-keys-ba…
pentestercrab · 2018-09-26
The Trezor [1] hardware device supports backing up (at initialization) and restoring of the secret seed which is quite useful. It can also be used as a password manager [2].
[1] https://blog.trezor.io/secure-two-factor-authentication-with-trezor-u2…
[2] https://trezor.io/passwords/
stef25 · 2018-01-29
I sincerely hope you're wrong. The only way to store ETH on a Trezor through integration with myetherwallet. Unless you're just referring to seed generation?
https://blog.trezor.io/trezor-integration-with-myetherwallet-3e217a652…
stickac · 2017-08-18
trezor uses RDP level 2
also check https://blog.trezor.io/addressing-concerns-about-trezor-firmware-1-5-2…
0x4f3759df · 2017-07-19
Move it to a hardware wallet.
"What happens to your bitcoins in case of a chain-split?"
https://blog.trezor.io/trezor-advisory-uasf-chain-split-fork-2f95cf2c1…
wslh · 2017-06-12
AhtiK · 2017-03-22
Has anyone used hardware-based password manager like Trezor Password Manager? [1] [2]
Initially Trezor was created as a bitcoin wallet but is much more these days.
The issue with 1Password is that it's not accessible in Linux and no U2F (yubikey etc) support AFAIK...
[1] https://trezor.io/passwords/
[2] https://blog.trezor.io/satoshilabs-launches-trezor-password-manager-th…
rogerbinns · 2017-02-13
I haven't used it, but Trezor looks interesting, and there is a Trezor 2 coming soon. https://trezor.io/
The sweet spot is for Bitcoin wallets, but it does the other stuff (U2F, ssh, gpg, passwords). Hardware is interesting. Everything open source. You can add your own "apps".
U2F: https://blog.trezor.io/secure-two-factor-authentication-with-trezor-u2…
DINKDINK · 2017-01-26
Happy to see Facebook finally supporting U2F but haven't assessed how robust their implementation is.
Another U2F hardware key is the Trezor bitcoin hardware wallet ( https://blog.trezor.io/secure-two-factor-authentication-with-trezor-u2… ) which has the added benefit that you can backup all your U2F private keys. I'm not aware of how you could do this with a Yubico U2F key -- if someone knows, please enlighten me.
Ardren · 2020-02-01
The original response about these type of issues [1] rubs me the wrong way
In particular this statement:
> That being said, we were surprised by Ledger’s announcement of this issue, especially after being explicitly asked by Ledger not to publicize the issue, due to possible implications for the whole microchip industry, beyond hardware wallets, such as the medical and automotive industries.
As I understand they are using a standard STM32 chip for these wallets, and relying on it's basic protection. Companies make real processes designed for securely storing data, why aren't they using them? Instead they are suggesting that there is no alternative and everyone is vulnerable to this style of attack.
Edit: I missed some of the backstory. They don't mention that option as their competitor (who found the security issues) already uses a secure element, like a sane person.
[1] - https://blog.trezor.io/our-response-to-ledgers-mitbitcoinexpo-findings…
kbody · 2017-12-07
There's a very simple solution if you care about security.
Buy a hardware wallet (e.g. Trezor in my example) note down the 24 words that are basically your privatekey. But enable the passphrase (25th word/phrase) which you type yourself and could keep just in your mind.
You have the safety of multiple backups for the 24 words and the extra security from burglars and others with the 25th passphrase.
https://blog.trezor.io/hide-your-trezor-wallets-with-multiple-passphra…
It also serves as a plausible deniability because when you input your passphrase it will never say it's incorrect, it will merely open a different wallet (generate a different private key).
Helps with the $5 wrench attack. You could setup a "fake" wallet with some activity and a low amount of Bitcoins, and have a different passphrase for the real wallet with the big amount.
BYOB, freedom comes at a price.