ledger-live VS trezor-firmware

get Ledger's public key from their git repo. (Assume that hackers cannot modify it.)

Ledger Live is Open Source - you can always see the latest details on github https://github.com/LedgerHQ/ledger-live/blob/develop/apps/ledger-live-desktop/RELEASE_NOTES.md

Ledger Live is Open Source https://github.com/ledgerhq/ledger-live

There is no Ledger device API that Casa could call to export your seed phrase into our possession. You can verify this for yourself by checking Ledger's documentation here: https://github.com/LedgerHQ/ledger-live/tree/develop/libs/ledgerjs/packages/hw-app-btc

I just wasted a few hours of my life scanning the Ledger Live code base. And sure yeah it's open source and clonable as you can see here https://github.com/LedgerHQ/ledger-live it's also pretty much updated as the last merge to develop is 19 hours ago. So first off the firmware is proprietary meaning not open source and normal people won't have access to it. So there's no freaking way to confirm nor debunk what the comment OP see IN A TREZOR SUB unless you can hack into the Ledger device memory one way or another but that requires hardware and firmware knowledge that I don't have nor a majority of software developer.

https://trezor.io/ - Easy to use, no matter how new in Bitcoin you're.

Added (November 2021): https://github.com/trezor/trezor-firmware/pull/1903

Next thing to have is a hard wallet if you haven’t already like a Ledger or a Trezor and let it sit there. That’s the safest thing to do! Also, there’s always been a risk of KYC (Know Your Customer) on CEXes as mentioned several times. This was all meant to be decentralized and keep our identity under wraps and retain that anonymity that crypto was originally designed for… and you get a hold of your keys.

https://trezor.io/ - Easy to use, no matter how new in Bitcoin you're.

where "x.y.z" is the VERSION of trezor (aka TrezorCTL) you are trying to install. See the version history when picking a version. "Oldest" is not necessarily "best". You'll want to pick a version that was released around the same time your Trezor-1 was last updated.

I've purchased a Trezor model T from what I believe is the official Trezor website (https://trezor.io/). Is it rational for me to have a slight fear that it isn't a legit trezor and maybe the chip is compromised, possibly being able to send off my seed to an unknown party?