Possible Security Issue with PIN

Security
1

The Trezor is supposed to reset after 16 PIN attempts, granted, it will take about a day. However, if you attempt a PIN and it is wrong, a countdown will start the more PIN attempts you are wrong. So the more PIN tries that are wrong, the countdown timer will increase.

I am on 7 tries left and if I am wrong I get a 512 second countdown until I can theoretically try another PIN. However, if I unplug the trezor, I can try as many attempts at a PIN as I want, since it will continue to show that I have 7 tries left once I unplug it and plug it back in. So, in theory, you could try any amount of PINs if you keep unplugging the wallet and plugging it back in. Just letting everyone know.

Using Trezor model T

2

The PIN is verified only after the countdown elapses.

That means that if you enter the correct PIN now, you still have to wait 512 seconds before your Trezor unlocks.

Entering PIN and then unplugging is like not entering at all. The results are the same as if you typed the PIN and immediately deleted it and typed another.

3 Likes