What happens if https://connect.trezor.io is compromized? about connect HOT 6 CLOSED

We are working on a rewrite of Connect which would allow you to embed Connect into your application code. Stay tuned.

from connect.

Agreed .. I would also add: Better if the app will work even if trezor.io is not available. I realize that I can install a trezord but that makes a barrier to entry that means my tool will not be used.

A browser only implementation that works purely between the browser and the device is a requirement for any long standing app that will be assured to work. It needs to work in the future even after trezor decides to end support for something.

Also, think about cold storage. trezor.io can not be contacted in this case..

from connect.

Also there is no need to use TREZOR via anything hosted on trezor.io. There are python and Javascript libraries available and one can use these to interact with the device via low-level means.

from connect.

Thank you ;) .. FYI: The node version gives me a hard time in Node 8 and I really couldn't get it it work on a RAM only bootable USB (in several distros). I'm giving up on that. Python would probably be much better but still requires special setup. I'm putting my money on the browser. It would be good to have a full implementation running in the browser in cold storage..

from connect.

@prusnak It's actually doesn't address the issue. If I host connect.js on my site and popup asks for the pin code, I have ability to know this pin code.
What is ETA for rewrite of connect.js?

from connect.

No, you will not know the PIN, because what is transferred to TREZOR is just positions, not the actual PIN. I suggest you to try it and watch the messages.

from connect.