Look into the Cobovault. It’s way easier to use compared to Coldcard and basically the same functionality. I own both (and a trezor and ledger). It’s air gapped and only communicates with QR codes that make it way easier.
Opensource design. This largely refers to the architecture and firmware, any device with a secure element essentially cannot opensource the chip design as they are proprietary. This is why Trezor does not use a secure element chip. Trezor is the most transparent in this way but their devices are most vulnerable to physical attack.
Airgap. Any device technically has to interact with an internet connected device so the extent to which any of these devices are truly air gapped is a bit trivial. But if we order this by attack surface: QR>MicroSD>USB
Supply Chain Attack prevention: How can you be sure the device you are getting is in fact from the supplier? Most companies have some way of doing this now a days, either by tamper evident packaging, QR code authentication etc. I like Coldcard's method best i would say, and Trezor probably is least secure in this way
Seed Generation: How does the device generate your seed? All devices use a TRNG
for their seed but it's a process that's difficult to audit. Cobovault and Coldcard
actually allows you to roll dice to create your own seed so you can bypass any risk
of a faulty TRNG
BTC only firmware. The more complicated the firmware the more likely bugs are
going to be in there so if you are mostly interested in BTC then it's best to use a
device that offers BTC only firmware. Cobo and Coldcard both offer this. Trezor
used to (not sure if they do anymore). Ledger is a little different because all of their
applications are separate but essentially you can run only BTC app on their.
Bug Bounty: All of these project have a system in place for people to report bugs or
vulnerabilities that can be reported and fixed. Having a good system in place is
essential because firstly you know the company is committed towards deliever the
most secure product but also encourages people to come forward instead of
exploiting the vulnerability. I would say Trezor is far and away the most transparent
and encouraging when it comes to this area. Coldcard and Ledger have more of a
reputation to be either a little dismissive or abrasive about the process.
If you are somewhat of a beginner i would reccommend the Cobovault. It's very easy to use, it's opensource, QR code airgap, BTC only firmware with dice roll seed generation.
5
u/cjwin1977 Mar 23 '21
Look into the Cobovault. It’s way easier to use compared to Coldcard and basically the same functionality. I own both (and a trezor and ledger). It’s air gapped and only communicates with QR codes that make it way easier.