Eingabe der Passphrase in der UI

> Isn’t there malicious malware out there that can memory scrape, keylog, or sniff on a hacker’s command?

Well, yes, but actually no.

The thing to understand is that to a malware author, your passphrase is completely and utterly useless. They can write it on their mirror in lipstick and stare at it lovingly every morning for all you care …. because to make any use of it at all, they _also need the seed phrase_…

…which they’re never going to have, because it’s on Trezor and you’re never storing it digitally.

So yes, sure, a keylogger can grab your passphrase in theory. In practice, nobody is going to bother because there’s nothing they can do with the captured data.

The one situation where having a keylogger would be useful is a targeted attack: if your roommate already broke into your desk drawer and copied the seed (or if they’re gearing up to stealing the Trezor itself), they could use a keylogger to grab the passphrase too.

Even in such situation, it’s still orders of magnitude safer to use a passphrase than not, because it is yet another obstacle in the attacker’s path.

—

And of course you can get a Model T and enter the passphrase on device.

The „hacker“ can’t do shit with the passphrase without the private keys inside the device (which never leaves your device) , your seed (that you never type anywhere) or physical Trezor in hand (which he needs your PIN)

Cheers

On the right side panel of this page are Best Security Practices… one of which is „use a passphrase“. Some other hww manufacturers warn against using a passphrase since a novice can easily lose their coins if they mess it up. But Trezor does this, I think, because their devices are vulnerable to physical attack. i.e. if someone gets possession of your device, and has the know-how, they can extract the seed-phrase. If this same person had somehow managed to install a keylogger on your computer, then they would have your passphrase(s) if you typed them in Trezor Suite. Then coins are all gone.
This scenario is not likely to happen; but I prefer to be paranoid. So I enter passphrases on my Trezor T only. This is tedious because I use long passphrases; but that’s something I’m willing to put up with.

Following

I just got a trezor a couple of days ago. I entered my pass on the app but had to look on the device to know where each digit were on the number pad..

So you don’t actually enter anything on the app, or am I missing something?