It is a great product, so promising in so many ways. Here are things that break my heart about it:
1- If battery truly dies, the device resets itself. I understand this is the case for additional security so perfectly fine with looking over that. A replaceable battery would be nice but not a big deal.
2- No Duress PIN (or alternative user PIN). Since this device is not only a keystore but also a secure vault for files if the user wants that, this would be incredibly useful. Say you are being asked by someone to unlock the device, it would be incredibly valuable to have it boot an empty or alternative data store. If it supported multiple users through different PINs, this would be incredible. Or at least some hidden volumes with additional passwords.
3- No way to start without Envoy. I am (only) pretty sure this flow doesn’t send the seed to the phone but I’d rather have it get started without Envoy.
1 is partially fixed. Passport Prime now shuts down while it still holds a reserve, keeping enough charge to preserve that state for much longer. It went in from KeyOS 1.2.0, so on 1.3.0 you already have it.
On 2, agreed, and easy to add to the plan. @jack worth capturing. We have already explored a device-wide version, where a second credential opens a separate persona rather than just a separate Bitcoin account.
On 3, Zach has committed publicly to onboarding without Envoy, currently expected within a couple of months.
On your point about the seed, with Magic Backups your Master Key is split into three parts, any two of which rebuild it. Two go onto Keycards you hold. The third goes to Envoy and into your own iCloud Keychain or Android backup. So something key-derived does reach the phone, but the phone alone cannot reconstruct your key, and we never hold any part of it.
Your settings and app data are encrypted on the device with your Master Key before they leave it, and that file is what sits on our server, identified only by a hash of your Master Key. We cannot tell whose it is and cannot read it. Anything in the Files app, Airlock included, never leaves the device as part of any backup.
Choosing manual backup during onboarding opts out of all of it.
You do not have to take my word for this. KeyOS is open source, the backup code is there to read, and you can verify the firmware on your device against the published source and signatures: https://docs.foundation.xyz/firmware-updates/passport-prime/
#2 has been added to the backlog as SFT-7706 We have a pretty packed couple of upcoming releases 1.4.0 and 1.5.0, but we might be able to make it fit in 1.6.0 or 1.7.0, stay tuned. Thank you!
We have a pretty packed couple of upcoming releases 1.4.0 and 1.5.0, but we might be able to make it fit in 1.6.0 or 1.7.0, stay tuned. Thank you!