Hardware wallet maker Trezor has raised the maximum length of the optional passphrase from 50 to 128 characters. The change looks small, but it arrived after July's attacks on Coldcard wallets and two days after the company itself warned buyers about a suspected implant in the Safe 5.
What exactly did Trezor change?
On Sunday the company said the limit is now 128 characters instead of 50. The update is available in Trezor Suite together with new device firmware. On older firmware the limit stays the same, so without an update a long phrase cannot be entered.
The feature is optional and off by default. For those who already turned it on, the update gives more room. A 50-character limit was already generous, so in practice the winners are mostly people who build a passphrase from a few words rather than random characters. That is our own assessment, not a statement from the maker.
How does a passphrase work?
A seed phrase (a set of 12 or 24 words used to restore a wallet) gives full access to the funds on its own. A passphrase adds another layer, and opening the wallet takes both elements.
- A separate wallet: each new passphrase opens its own set of addresses, unrelated to the others.
- A typo in a single character will not trigger an error. The device simply opens an empty wallet with different addresses.
- The passphrase is not stored on the device, so nobody can recover it if you forget it.
- A long phrase takes more time to brute-force, which is why Trezor raised the limit.
It is also used for camouflage. If you keep a small sum on the wallet without a passphrase and the main funds on the wallet with one, only the first can be opened under duress. It is no cure-all, but it leaves room to maneuver.
People often mix it up with the PIN. The PIN protects the device against physical access. The passphrase protects the money even when both the device and the seed fall into the wrong hands.
For a Bitcoin holder the choice is fairly clear. A few words are easier to remember, but a random string of 20 or more characters needs a password manager or a paper note stored separately from the seed.
What does Coldcard have to do with it?
In July a flaw turned up in Coldcard firmware. Some devices generated seed phrases with insufficient randomness, and attackers managed to reconstruct them. According to Cointelegraph, total losses from these thefts come to about $100 million.
Trezor says strong, unique passphrases protected some of the affected users. The logic is clear: if the seed is compromised, the passphrase remains a second barrier that does not depend on the device's random number generator. That is Trezor's own view, by the way, not an independent audit.
There is a limit, too. A passphrase covers the scenario where the seed leaks or is reconstructed, but it will not help if the device itself or the computer used to type it is compromised. That is a separate class of threats, and it needs other measures, such as buying from the official store and checking the firmware.
What about the suspected implant in the Safe 5?
On Friday Trezor advised customers who bought wallets from former authorized reseller CryptoBilis since March to move their funds to new wallets. The trigger was a report from a customer in Indonesia about a suspected implant inside a Trezor Safe 5. By the customer's description, the device can capture on-screen information, including the seed phrase, and send it over a cellular network.
The company has not examined the device yet and has received no reports of related losses. So for now it is an unverified claim, though the maker considers it serious enough to act on.
This is not the first signal about this reseller. In October Ledger investigated the theft of $86 million from wallets bought from CryptoBilis, and we covered that separately.
What a hardware wallet owner should do
Update the firmware and Trezor Suite if you use a passphrase or plan to turn one on. Check where the device was bought, because the maker's official store removes the risk of tampering on the way to you. Keep the seed and the passphrase apart.
A word on buying. A device bought second-hand, from a marketplace or from an unauthorized seller always carries extra risk. Take a new model only from the maker's official store or from partners on the list on its site.
You can compare models and see what is known about them in the Kurslog catalog of hardware wallets. No maker guarantees protection against every scenario, so two independent barriers beat one.
Comments
Your email address will not be published. Required fields are marked *