http://e26whn2524322mkxb3cbyk27ev2ihhq2biz35hty7gzgsyrwrygq27yd.onion/posts/blog/security/471-the-curious-case-of-bitfi-and-secret-persistence.html
The way the device is supposed to work is that, in order to (say) sign a transaction, you use an onscreen keyboard to enter a salt, and a > 30 char passphrase. The device then derives a private key from those two inputs, uses it and then flushes the key, salt and passphrase out.