Topic: Bitcoin Ledger and other hardware related questions. - page 3. (Read 939 times)

Like HCP said, what if my friend wants to go online occasionally on this PC? What exactly is to be done with that root kits thing? And can't they do anything with the certificates/signatures installed for each app before and after?

And going online through a smartphone (via HotSpot) or through WiFi Modem (Broadband service) makes any difference? He wants to use PC as an offline storage for crypto, but does that mean that he cannot go online even for other curricular things he needs to do in life?

Just wanted to say that it's either offline 100% of the time... or it isn't an "offline" cold storage PC.

If it remains offline 100% of the time, it won't matter too much if there is any malware on the PC, as it isn't connected to anything so the malware can't leak any info. However, if your friend plans to "occasionally" connect it to the internet, then you would be well advised to do everything you could to ensure that it was "clean". In this case, as the others have already stated, wipe/format the drive and do a fresh OS install as a minimum.

I would not agree with you on this, although this is often a repetitive phrase and some members on this forum will tell you that you do not need to invest in hardware wallet if you have less then $500 or something like that. There is some logic in that, but hardware wallet is actually a pretty cheap investment and anyone who wants extra security should not hesitate with such an investment.

One better smartphone is cost ten times more then one Nano S, and they are sold as if they cost like hardware wallet. $100 worth of BTC today can be very easily doubled or tripled in future, so it is maybe wrong to say that you protect only $100.

I always install a fresh windows in this kind of case. It's safe for both party. As a buyer you feel secure that you have started from zero point.

About the hardware wallet - my original thought behind this is that they have enough crypto to have a hardware wallet. For example: If someone has 100$ worth of BTC then there are no point to buy a hardware wallet that will cost 55 euro.

Edit: Just noticed the response from two members above me regarding the OS. Now you can see you have 3 votes to reinstall the OS :-)

Reinstalling the OS is the absolute minimum you should do.

You'll get most malware removed with a wipe of the hard drive + reinstalling the OS.

However, the theoretical risk of rootkits still exists. Reinstalling the OS won't help you there.
But the chances aren't very high to have a computer infected with a good (in terms of professional) root kit.


But since it is going to be used as an offline storage, you shouldn't be worried too much about that.

@Stedsm
I think your friend should definitely reinstall the OS on the 2nd hand PC he bought. Like you said you never know what the previous owner did with the PC and what his online habits were like.

Black Friday is a good time to purchase a hardware wallet. If I remember correctly there was like a 50% discount during the last Black Friday on the Nano S.

I can totally understand that but those who are interested in acknowledging the technology by using it and if they don't have much to spend upon it or willingly uninterested to do so (like newbies with least information or others with some information but don't want to spend higher), while they can get it for almost 50 - 70% less (maybe the hardware could be a first copy - pirated kinda and not the original one or even a 2nd hand but original Ledger wallet) will definitely give it a shot rather than going for the official one, no?

Is anybody here aware of Black Friday deals on such hardware during that event? If yes, what's the least one can purchase them for? And are they original too or they should also be considered 2nd hand?

A question somewhat related to this topic:
My friend purchased a 2nd hand PC and the person he bought it from, used to mine alts in it which clearly means that the previous owner held crypto in it (maybe BTC too).

So, to save the current owner (my friend) from any possible malware the old owner may have had installed in this PC, what should we do to prevent ourselves? Will a complete OS change work out? Like if we install new Windows without keeping old Windows.dat file in his PC, can we consider ourselves safe in this situation? He wants to use it mostly as an offline mode of storing his crypto there in his PC. Is he safe if we do it like that here?

I have been using my Ledger Nano S from last 2016 (if I remember the year correctly) 13/6/2017 (order date)­. So far I never had any issue with it. So, I will give you positive support for it.

It was costing me  81.75 € but now it's a lot more cheaper (€59.00) in their official website.

There are not much risk (in my opinion) buying a 2nd hand Ledger but since we are going to store thousands of dollar worth of Bitcoin and other altcoins then why would we just want to save some money when we buy one. This was my original thought when I ordered it from their official website.

By the way, one thing I love about ledger is the varieties of coin they support. I can store my NEO, ADA, ETH, Wabi safely there.

Check: https://shop.ledger.com/pages/crypto-currency-assets

Side note: Seems like I gave you a paid lecture LOL but trust me this came from the satisfaction I had or have with using this product.
It's not a paid feedback/lecture or whatever you call it :-)

I uninstall the one I do not need or I am okay to use later and install the one I need for my current operation. It's not that much hassle. The security is the key that I feel with my Ledger Nano S

For sure many bad people work on fake hardware wallets, but majority of crypto users know that only safe way to buy hardware wallet is to order it directly from the manufacturer. Of course there are those who will try to save some money, and they always look for cheaper solution which makes them ideal targets for fake hardware wallets.

What worries me is the possibility of compromising the official distribution chain, in a way that fake devices get mixed with originals and that some company is not even aware that it sell fake devices. Regarding the number of resellers of hardware wallets, this is not an option that should be neglected.

---

Number of apps installed on Ledger Nano S is not mystery, everything is clearly explained. We have stand-alone apps (BTC / ETH) which are bigger in size, and we have dependent apps, which are based on them. So if you install Bitcoin app only, then it is possible to install more apps which are based on Bitcoin (up to 10), but if you use Bitcoin+ETH app you reduce size of storage significantly.

The point is that we can have more than two or three app in same time, but key is in app combinations. Some more info can be read here.

3 time entered wrong PIN (in a row) does not mean loss of coins, if user is have seed then it will just take some time to recover such wallet. But I agree it is not easy to type 24 words on Nano S, so be careful with PIN.

@The Pharmacist
I think you made a good choice with the Ledger Nano S. You don't strike me as the type of person who holds bags of different Altcoins so if you are going to use your Nano S for Bitcoin + maybe 1 or 2 additional Alts you will be satisfied with your purchase.

Some users have complained that they can't install more than 2 different Apps on Ledger Live. Others have reported that they have 10 apps installed at the same time so I am not really sure what is causing all that. I held a maximum of 4 apps at the same time but I am now back to just 2.

The initial installation of the device is a bit of a lengthy process but I wouldn't have it any other way really. You have to take note of your seed and then re-enter and confirm every single word on the device itself. But this is a good thing because if you made a mistake somewhere the device will give you an error.

Make sure you remember your PIN because you can only make 3 mistakes while entering it, after the 3rd mistake the device wipes itself clean.       

Yeah, that's sold by Ledger themselves, via their Amazon supplier. You can see the link to their Amazon page from their own site here: https://shop.ledger.com/pages/retailers. You can rest assured you've bought a legit and brand new device.

Even so, when the device arrives, you should still perform some basic checks to ensure it is genuine and to initialize it for the first time. Step by step instructions can be found here: https://support.ledger.com/hc/en-us/articles/360002481534-Check-if-device-is-genuine. Work your way down the sidebar, to "Check if device is genuine", "Set up as new device", and "Update device firmware".

There's lots of other good information on their support site which would be worth a read. The official Ledger companion software is Ledger Live which you will also need to familiarize yourself with if you want to use it. The Ledger is compatibile with many other wallets though, and Ledger + Electrum is a particularly popular combination.

Ehhh....I don't know if they're by the official team, but I'm assuming so since what I just purchased is brand new.  It's definitely not a second hand thing.  

Maybe I'll make a followup post here once I receive the item.  This is the link to it on Amazon, so maybe you or someone else can advise me on whether I made the right choice or not.  I'm a complete ignoramus about hardware wallets, but I'd heard great things about the Ledger Nano S.  

Edit:

Thank you so much for that information, it really helps.

Amazon? Are such hardware wallets sold on Amazon officially (or by the official team) or are you going to buy a 2nd hand device over there?

You can use it on compromised pc.

They already patched it and now the address is displayed in Leger nano led visor. (On the device, theoretically unhackable)

I would not use it even for free.  Not worth the risk.
As I said, it is a permanently compromised device

Non-genuine Trezor Ones have already been spotted in the wild:
https://blog.trezor.io/psa-non-genuine-trezor-devices-979b64e359a7

I'm not sure if any malicious intent (beside selling fake products) has been ascertained though. They might have just been 1:1 copies sold by a third party without any changes whatsoever.

In general Trezor firmware integrity is ensured by the wallet web interface. IIRC Ledger has a similar mechanism in place. Hardware integrity can not be ensured this way though -- I'm not sure if it would be even possible to verify hardware integrity on the software level -- which still leaves room for threats like the Evil Maid Attack: https://wiki.trezor.io/Security:Threats#Evil_maid_attack_-_replacing_Trezor_with_a_fake



- Hardware wallets such as the Ledger and Trezor will protect your private key from compromised PCs
- They will not protect you from clipboard copy-paste malware. It's still up to you to (1) compare the address on your computer with the address as displayed on the hardware wallet and to (2) if possible, verify the address over a separate channel (ie. if you received the address via email, check on your mobile device as well or make a phone call with your counterparty)

My advice is: if one has the money for a proper hardware wallet, buy one from the producer. 60 EUR for a Ledger Nano S is not that much imho.
If one doesn't have that money he can always print paper wallets or use Tails + Electrum as cold wallet.

I'm biased on my decision here as some here believe that factory-resetting it could save me even on a 2nd hand hardware too? What's your take on this?


Ok, I've got one more question about official hardware (from their official website).

What IF:
- I use official ledger hardware on a compromised PC?
- Isn't Ledger's official hardware prone to clipboard copy-paste scams where you copy a BTC address and a malware detects and changes it to another address? Is such hardware safe from it?


I got that, you actually got me wrong there.
You're mistaken here as you are taking it like $10 discount but I've asked my question based on - if some sellers sell it way cheaper for a measly $10 - $20 as that's what lures cheap buyers to fall for these deals.

Thanks for that reply--I'm seriously considering a purchase of a Ledger Nano S from Amazon, but I'd thought of buying one second hand for a while.  I've never owned a hardware wallet before and don't really know a hell of a lot about them (which is why I'm reading threads like this).

I assume the Ledger is the best....?  When I browse hardware wallets on Amazon, there are just so many to choose from.  

I wouldn't be surprised either.  Counterfeit crap is everywhere, and making a fake hardware wallet with some sort of key-stealer would be an ideal scam.  No doubt someone somewhere is working on such a thing.

I would not be surprised if sooner or later (if not already!) some sellers can give out devices that look like and behave almost like normal Ledger / Trezor / whatever, but containing a small modification allowing them find out your private key or seed. Somebody can mass produce them and sell them cheap. They'll get back the investment when they'll start stealing your money.

Maybe I'm too paranoid, but I bought my Ledger from their website and I would clearly ever avoid "re-sellers" or "second-hand" devices.

Agreed. I myself would never use a second-hand hardware wallet, simply because i don't necessarily know if the firmware hasn't been tampered with, or if the hardware is all original. I don't have the expertise, and even if i would, it still wouldn't be worth the 0.01% chance that i missed something about the device for 20$ off. Not worth it.