I usually have “Auto-eject wallets“ option enabled, but today I got Trezor Safe 7, updated Trezor Suite, was playing with settings etc and noticed something concerning.
If I have “Auto-eject wallets“ disabled, I can access my hidden wallets without passphrase. I mean, not only see balances, but also confirm receiving addresses on Trezor and actually send cryptocurrency. I close Trezor Suite, disconnect and turn off Trezor (as a side note I would love it to turn off automatically after disconnecting USB cable), attach Trezor again, enter PIN, run Trezor Suite and can send funds from my hidden wallet without entering passphrase.
I thought it should not be possible. I believe it was not possible some time ago, it must have been some update to Trezor Suite / Trezor firmware / something else. I don’t like this as it means that my passphrase is saved on my computer (or even worse in Trezor) - I don’t want that. I could not find any information about this. I’m interested when the change happened (was it this way all the time and I just did not know because of “Auto-eject wallets“ enabled?), where the passphrase is cached and for how long, any options to control that behavior. Can somebody tell me where I can read about this?
Cheers.