No honest engineer (to be clear I am not one!) should claim that any programmable device is 100% immune to undiscovered vulnerabilities.

KeyOS does not treat installing an app as blanket trust. Each app declares the capabilities it needs. Some basic capabilities are automatically available, while additional access must be approved by the user directly on Passport Prime, either during installation or when first used. Other highly sensitive capabilities are reserved for trusted system components and cannot be granted to third-party apps at all.

This includes the Master Key. Third-party apps cannot request or export it. An app may request access to a hardened, app-specific seed, but that is separately derived for that app and requires the appropriate on-device permission.

Apps also run as separate, memory-isolated processes. A malicious app would therefore need to exploit a vulnerability in KeyOS, the kernel or a privileged service to cross these boundaries. Simply installing and running it is not enough.

Users wanting the smallest possible attack surface can install no third-party apps and leave Developer Mode disabled.

Gonna dive in tomorrow. Looks so good. Our clankers have great taste

Wait what? That looks so on brand. Is it new?

Fair criticism if you judge Passport Prime purely as a Bitcoin signer, but that is the wrong product lens.

First, Prime is $349, not $500. It is also not simply a hardware wallet. It combines a Bitcoin signing device, hardware security key, dedicated 2FA authenticator, secure storage for additional seeds, and 50GB of encrypted file storage in one device, with more functionality coming through KeyOS apps. Buying comparable dedicated devices separately would cost considerably more than $349.

Passport Prime is a personal security platform that also secures Bitcoin. It can stay at home or be carried, depending on the user’s threat model and which functions they want available.

If someone only wants a basic stateless Bitcoin signer, SeedSigner may suit them perfectly. But describing Prime as an overpriced signer misses both its purpose and most of what the price includes.

I’m talking about the stamping part, but I think you knew that.

Yeah I’m not a huge fan of creating those backups. Terrible UX

Migrating devices and populating wallets with child seeds

Max is just doing a backup. Should be restored soon