That would help, but may not remove the risk entirely.  The malicious reseller may order a batch of real Trezors and send fake malicious Trezors to the clients, with the same serial numbers.

Perhaps one can devise some secure hanshake that that the Trezor could do with the SatoshiLabs server to prove that it is legit.  It would have to be something hard to emulate by a fake Trezor, even one that used parts from a real Trezor.

seriously? If they forebode reselling im sure craigslist would still have some.

the trezor is well-built. A knockoff requires some serious dedication and isnt even a remote concern if you just buy directly from buytrezor.com

far more likely:
1) printers with custom firmware to recognise bitcoin addresses/QR codes when printing, and push that data to a server
2) casascius or any other coins being opened up with precision and solvents, private key copied, then sealed shut again for resales. Or even the creator keeping a copy of all private keys
3) an android/windows/ios/ANY wallet software that was downloaded from the wrong site or updated to a malicious version
4) a webwallet that is hacked or otherwise steals privkey data.
5) virus or malware that seeks and steals any wallet info, or even QR codes from your print/documents history, and pulls the funds out.

someone creating an exact replica of the trezor and its (quality) box that its shipped in, plus valid serial numbers, plus making it match the MD5 hash..... you are pulling at straws. IMO the trezor is 100% the safest option right now outside of operating an isolated offline system with an offline printer, using it to sign txs, copying the signed tx to a USB, then sending the signed transactions from an online system

If you buy fake merchandise, your loss is usually limited to the article.  Someone who buys a fake malicious Trezor may lose millions.  The victims will be much more motivated to get their money back, and SatoshiLabs will be the only target they can sue.  The victims will argue that SL is responsible because they did not warn people about the risk of buying Trezors from resellers.

For the same reason, I hope that SL is taking adequate measures to physically secure their storage and shipping operations.  How much would it take to convince an employee to switch some Trezors before shipping?


Exactly.


Yes, all of that too, and more....


You have heard of fake ATMs, right?


The Trezor may be even safer than an off-line computer (if malware gets installed in that computer, it may be able to do a weak-key attack, or leak the private key in the signed transaction.)  Basically, the Trezor is an offline computer that is dedicated to a few bitcoin-related tasks and therefore is more difficult to compromise.  Trezor is certainly much safer than that competition hardware wallet without display.  But owners must be aware that it is still far from 100% safe.

To summarize: The Trezor is the safest and easiest to operate bitcoin wallet of today.

Good advice... as long as you don't buy all your Trezors from the same guy on eBay, or the same Walmart store. 

For the time being I will be "enjoying" the spectacle of BlockChain.info going down the tubes.  Let's resume this conversation when fake malicious Trezors appear and steal some significant piles of coins, shall we?

By the way, the BCI debacle happened because someone decided to "improve" the random number generator in their javascript code, and posted the new version for download by clients, late at night, without thorough validation by a security specialist.  Result: (ahem) hundreds of users received weak keys, some smart hackers noticed, and (ahem) emptied the addresses of those users.  The extent of damage is still unknown.

That bug was noticeed and fixed after a few hours; what if it had been there for days?

Cannot ever happen to the Trezor firmware, of course.


There is no "if": fake ATMs have been around since the very first real ones were deployed (in the 1970s, IIRC).  I read a story of a customer who complaining to a Wells Fargo cashier about their ATM, that had been aborting transactions for days.  "What ATM? We do not have an ATM!" The crooks had installed a fake ATM on the rear wall of the bank, facing the parking lot.

Fake ATMs were endemic here in Brazil when credit cards were of the magstripe kind (as they still are in the US).  Most commonly the thieves placed a false front cover over the real one, with a malicious card reader and key logger.  They seem to be less common now that all credit cards use chips instead of magstripes.

But banks do warn clients to watch out for such false covers, and they inspect their ATMs for that and other tricks.  Who will inspect the Trezors on sale at Walmart, ot those bargain ones sold through eBay?

Hey, I just noticed Some Trezors are offered at Amazon.de for 119 EUR.
Finally they understand that some people want to buy a Trezor for EUR and install it before they start touching bitcoin.

I sold a lot of Trezors for cash to people who were new to Bitcoin and not tech savvy. There is a business in reselling Trezors for fiat
(also some paranoid people who want to buy a Trezor for cash, because they don't want to be in some sort of database of customers kept by SatoshiLabs)

wow, it is a high overprice

I read in the AmA that they were going to release a new pack or something like that
any details?

Thanks for share whit us that fantastic article  , it is interesting. Thanks again .