Wallet Logo

JAN7007IT (ebay seller) NFC Hardware Wallet

🔍 Last analysed 29th April 2022 . Bad Interface

Jump to verdict 

Do your own research!

Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.

If you find something we should include, you can create an issue or edit this analysis yourself and create a merge request for your changes.

What is a bearer token?

Bearer tokens are meant to be passed on from one user to another similar to cash or a banking check. Unlike hardware wallets, this comes with an enormous "supply chain" risk if the token gets handed from user to user anonymously - all bearer past and present have plausible deniability if the funds move. We used to categorize bearer tokens as hardware wallets, but decided that they deserved an altogether different category. Generally, bearer tokens require these attributes:

  • Secure initial setup
  • Tamper evidence
  • Balance check without revealing private keys
  • Small size
  • Low unit price
and either of these applies:
  • Somebody has a backup and needs to be trusted.
  • Nobody has a backup and funds are destroyed if the token is lost or damaged.

The Analysis 

Background

This generic looking Bank EMV Smartcard does not come with a brand. The eBay seller’s user name is Jan7007it (“it” may stand for Italy)

How it works

This Smartcard Hardware Wallet, can contain 16 Wallets (Private+Public Keys). The smartcards comes with no keys for best security and when you will receive it, you will request it to generate the private/public Key(s).

The Secure Algo of the Wallet is the SECP256k1 + SHA3-256 (KECCAK)

Technology

  • Secure Cryptoprocessor Hardware
  • The Secure Algos supported are SECP256k1 + SHA3-256 (KECCAK)
  • Half a Mb of Memory in the smartcard

Smartcard ISO format

Contact (PC/SC) AND Contactless technology (NFC Reader) or NFC in your Mobile Phone / Smartphone

NO battery is required

Features

PIN/PUK Features to prevent loss or misuse.

(Once received you need to email us and we will provide you with your unique PIN/PUK for your card. You can then modify your PIN Code for best security).

If you fail to enter the PIN code, you can always recover the card with the PUK like with your mobile.

16 Wallets available (every Wallet can be used for multiple cryptos).

Each of the 16 Wallets can be created and deleted, each position can be then reused after deletion.

If you dont use a Wallet and want to reuse the slot you can delete it and create a new one.

You create your own Wallet, so only you and the smartcard know the Private keys.

The Private Key is sealed securely in the smartcard once generated. You can export/unseal/backup it.

You can transfer your Private key into the smartcard if you want to transfer it from another device (PC Software, USB Ledger, Web Wallet Platform, etc).

The Smartcard is a ISO card, you can store it in your physical wallet like any other Card (TV/ID/Bank/Credit).

You can access the Cold Wallet with a Contact or a NFC Contactless card reader (eg. Smartphone).

Analysis

A product actively being sold on eBay by an unidentified seller gives us pause.

More so the fact that the user has to email the provider in order to get the PIN/PUK for the card upon receipt of the card.

Notwithstanding the claimed security features, the device does not appear to have any display or button interface. This brings the user back to the provider to give him the link to the smartphone app or software. Although the wallet smart card may be “secure” as the provider claims, a lot is unknown about the smartphone app specifically used by the provider.

(dg)

Verdict Explained

The design of the device does not allow to verify what is being signed!

As part of our Methodology, we ask:

Bad Interface!

Can the user verify and approve transactions on the device?

If the answer is "no", we mark it as "Bad Interface".

These are devices that might generate secure private key material, outside the reach of the provider but that do not have the means to let the user verify transactions on the device itself. This verdict includes screen-less smart cards or USB-dongles.

The wallet lacks either an output device such as a screen, an input device such as touch or physical buttons or both. In consequence, crucial elements of approving transactions is being delegated to other hardware such as a general purpose PC or phone which defeats the purpose of a hardware wallet.

Another consquence of a missing screen is that the user is faced with the dilemma of either not making a backup or having to pass the backup through an insecure device for display or storage.

The software of the device might be perfect but this device cannot be recommended due to this fundamental flaw.

The product cannot be independently verified. If the provider puts your funds at risk on purpose or by accident, you will probably not know about the issue before people start losing money. If the provider is more criminally inclined he might have collected all the backups of all the wallets, ready to be emptied at the press of a button. The product might have a formidable track record but out of distress or change in management turns out to be evil from some point on, with nobody outside ever knowing before it is too late.