Hi,

please wait

Ok, MyTrezor.com asks a user (i don't know - i didn't get my trezor, i wait) to enter 12 (by default) words. May be it ask by random order directed by trezor device. But words are entered in computer! Trojan already know exectly 12 words, may be order is randomized but there may be 2^12 variants to get right order of words. Am i right?
It's BIP32 wallet so hacker doesn't need to use a Trezor device - this process can be automated. 2^12 computations can be run in computer for seconds or less one second.

I don't talk about to guess seed (where 2^128 combinations). I am about to guess seed if hacker knows exectly 12 words (one word - it's already hacker knows exactly 2^11 bits of seed part) of seed which he sniffed by trojan/faked mytrezor.com site and etc.

Ok, i am hacker and the right seed (for easy example) is three word, but in dictionary 2048 words for one position (as trezor has):

User entered: red green blue

Hacker got:blue green red

Ok, he run process and got only these variants (B, G, R):

B G R
G B R
R G B
B R G

Here 2^2 variants (may be because 2^(3-1))

If hacker doesn't know exactly words he should make 2048^3 variants (may be 'red', may be 'cat' and so on).

Now imagine it for 12 words and for 24 words
May be there will be 2^11 variants for 12 words, not 2^12 as i wrote above.
Ok, for 24 words we will get 2^23 = 8388608 combinations
I think this combinations can be computed for 1-10 seconds. I think user will not have a time to send him bitcoins to other.

Ok, wallet32 is an Android application as BIP32 wallet. But if you use special hardware device with private keys inside only it will be very strange to setup seed at Android device phone for sending all bitcoins If you trust to your Android phone same as Trezor, i think this topic not for you

But this hack will be made for one second if hacker will sniff 12 or 24 words.

Sorry, i don't understand your math


3! = 3x2x1 = 6 combinations
^^^^ Why? Please write other variants for my example. You say that there (in my example) should be 6 variants. Please add other two ones

Sorry, yes, you are right.
I see now

But i think if hacker knows exactly words in random order it's not fine

Ok, i will use 24 words. I think 6.2044840173323943936 × 10^23 variants of brute force will be enough for me

P.S. Only suggestion for future versions of Trezor recovery procedure. Now 12 or 24 words are written in one paper. The Armory program has 3-of-4 backup types for example. If same backup could be too in Trezor, i will happy I understand that it's more difficult procedure and there a lot programming for this. It's only suggestion.

I see it, thanks.

Definitely needs that offline recovery tool

I just discovered random words are not used on 24 word seed. Maybe random words are used just to fill up to 24 words? Would make sense.

If it is using BIP32, you should be able to just enter the seed into a programm capable of restoring a BIP32 wallet?

I have a question concerning advanced settings (use of passphrases).

As far as I see there are two exclusive options:
1) use no passphrases at all.
2) use one or more passphrases.

It would be nice to set up Trezor in a way so that you can have at the same time:
1) one 'account' with no passphrase (for small money).
    This could pop up in the web wallet immediatly without further interaction when you connect the Trezor.
2) one or more (hidden) accounts. These would be visible only if the correct passphrase is
    (optionally) given.

Is this possible ?