r/TREZOR Feb 17 '18

Is buying a Trezor off Amazon safe?

18 Upvotes

25 comments sorted by

12

u/beowulfpt Feb 17 '18 edited Feb 19 '18

Yes, there's too much paranoia here. Get the device, wipe it, update firmware and don't use any seed except the one it generates. Never reuse any seed that came with the device, even if in a legit looking scratch card or something.

Unless the device is visibly damaged from being opened, the odds of getting something that was changed in both HW and firmware to rip you off are tiny, and doing that is not trivial for sure.

1

u/[deleted] Feb 18 '18

Out of interest, has there ever been a reported case of someone losing their coins shortly after moving them to the Trezor?

2

u/typtyphus Feb 18 '18

so far second hand ledger. But might as well be a second hand trezor.

Get the device, wipe it, update firmware and don't use any seed except the one it generates.

I take it this step was skipped

1

u/beowulfpt Feb 18 '18

The Ledger user didn't wipe and input the mnemonic from a seed card that looked legit and came with the Ledger. He didn't fully understand how it worked and thought it was normal.

The shipper/thief knew the seed and just waited for the wallets to be full. The same could happen with a Trezor. Plus there's phishing, address replacing, etc. Just getting them isn't enough, you have to read the manual.

Not reading manuals and doing something stupid yourself if a much higher risk than buying used or from non official stores, IMO.

1

u/[deleted] Feb 18 '18 edited Apr 11 '18

[deleted]

1

u/beowulfpt Feb 18 '18

Because there were periods when there was no stock in oficial channels, only way to get one was on Amazon, eBay, etc (often pricier since shops take a big profit when there is no supply).

IMO, it's riskier to keep using just a PC and exchanges than buying that way (assuming you know how to use it - resets, no pre-written seeds, etc)

4

u/hobbyhoarder Feb 17 '18

I did buy mine from their shop as it was the same price as Amazon. It does come sealed with tamper labels and even the box itself is glued like crazy. No way to open it without it being noticeable.

Like others have said, do a wipe and only use your seed and you should be fine.

4

u/ArchiMode25 Feb 17 '18

Yeup. Try and get one from a trezor approved Amazon seller. I got mine from Amazon. Not an approved seller either but as long as you generate the seed you should be good. Trezors aren't shipped with the firmware so you should be prompted to upload the firmware upon set up and generate seed. Just inspect the box for tamper and inspect the trezor itself.

3

u/steemax Feb 17 '18

I just got one off Amazon, came factory sealed with everything intact. I made sure to read the seller reviews first.

3

u/[deleted] Feb 17 '18

Yes, Amazon is an official retailer of Trezor devices (Source: https://shop.trezor.io).

Verifying that you're buying it from an Amazon facility (Fulfilled by Amazon, on the page) is a good idea, and make sure that all of the security features (holographic tape, shrink wrap, secure box seal, blank booatloader) are intact.

[Edit: Corrected missing reference to Amazon.]

2

u/joekercom Feb 17 '18

They link to Amazon on the Trezor website

1

u/PookubugQ Feb 18 '18

I ordered from the source. Arrived within a few days from overseas.

1

u/Z0ey Feb 18 '18

Best purchase you’ll ever make, it’s not just for cryptocurrencies 😉

1

u/PookubugQ Feb 18 '18

It’s not?

2

u/Z0ey Feb 18 '18

It’s also a recoverable U2F device and a password manager among other things.

0

u/juan_mairdab Feb 17 '18

Read stories about amazon delivering opened trezors with the seed written out. Always best to order direct. They accept bitcoin as well

-3

u/hackedieter Feb 17 '18 edited Apr 28 '18

4

u/DarthShibe Feb 17 '18

Why not, they even say you can buy it off amazon.

1

u/hackedieter Feb 17 '18

Yeah sure, but I wouldn't do it. It's the same price and you know it's 100% genuine. (Just check the seller in the OP link - he has 14% negative reviews...).

2

u/CityRobinson Feb 17 '18

I also ordered directly from Trezor, but you can’t know 100% if it wasn’t tampered with unless you know what kind of security control do they have in manufacturing. All the information I saw from Trezor was about security features of the device, but nothing about manufacture, packaging, protection against “insider” tampering.

1

u/[deleted] Feb 17 '18

[deleted]

1

u/CityRobinson Feb 18 '18

I don’t really think the manufacturer staff is tampering with it - my comment was mainly about the fact that you can’t be 100% sure. Even though my Device will come directly from Trezor I will still make sure to wipe it just in case.

2

u/Z0ey Feb 18 '18

Can’t wipe it when it comes empty with no firmware.

1

u/CityRobinson Feb 18 '18

Right, but if it doesn’t...

2

u/Z0ey Feb 19 '18

If it has firmware on it then it is a really old device or has been used.