Data Harvesting Inside Ledger Live App - Is this really part of Non-custodial?

o_e_l_e_o

legendary

Activity: 2268

Merit: 18748

Quote from: joniboini on December 27, 2023, 09:47:25 PM

Is there a case where a phone still sends data even after airplane mode is active, etc as mentioned above?

Yes. The NSA have admitted they can easily track phones, even with all connectivity disabled and airplane mode turned on:

Quote from: https://threatpost.com/nsa-warns-smartphones-leak-location-data/158040/

Even turning off a device’s cellular service, such as when it’s in Airplane Mode, does not totally protect someone from having their location pinpointed, the NSA warned.

“Inconspicuous equipment (e.g., wireless sniffers) can determine signal strength and calculate location, even when the user is not actively using the wireless services,” according to the advisory. “Even if all wireless radios are disabled, numerous sensors on the device provide sufficient data to calculate location.”

Most phones these days are quite happy to allow WiFi and Bluetooth to be activated even when airplane mode is turned on, since you are now allowed to use these things in most aircraft. Further, it is almost impossible for the average person to actually verify that their phone is not transmitting information via some method. The only way to be certain that your airgap is effective is to use a device which does not have the capabilities to transmit data in the first place. This almost always means an old computer or a SBC without a WiFi card, Bluetooth module, etc.

Lucius

legendary

Activity: 3234

Merit: 5637

Blackjack.fun-Free Raffle-Join&Win $50🎲

Quote from: Pmalek on December 28, 2023, 04:59:30 AM

~snip~

Unfortunately, nothing lasts forever, and everything depends on how the device is used and how it is stored afterwards. I managed to save an old smartphone by flashing it with new firmware, I didn't even need any special cables or software, I did everything with the help of a memory card on which I put the firmware and then managed to do everything from the phone.

You've probably tried something to fix it, and in any case, search the term "white screen smartphone" and you'll find a lot of tips on how to try to fix it.

Pmalek

legendary

Activity: 2730

Merit: 7065

Quote from: Lucius on December 27, 2023, 06:48:55 AM

@Pmalek, I can agree that smartphones are not the best choice for airgapped wallets, but people still change smartphones more than personal computers, so I believe that a lot of people have an old smartphone that is useless.

Many old smartphones do become useless to the point you can't even turn them on. They break much easier and malfunction. One of my older phones that I used in the past, now doesn't turn on any more. I wanted to give it to my parents who don't need anything state of the art. The phone was ok last time I used it. Now, there is only a white screen after which the device turns off.

joniboini

legendary

Activity: 2170

Merit: 1789

Quote from: Pmalek on December 27, 2023, 06:04:08 AM

There is no way to remove all antennas and connectivity chips and sensors like you can on a desktop system.

Do we need to go that far though? Is there a case where a phone still sends data even after airplane mode is active, etc as mentioned above? What about using those called privacy OS like Graphene before we install a wallet on it? It sounds really weird tbh, unlocking and flashing your phone likely requires unlocking your firmware to install a crypto wallet, which will likely increase the risk of getting attacked with malware. I guess you don't need to think about that if you can guarantee you never connect your phone to the internet/other devices at all. At the very least, it should be better than using Ledger Live.

Lucius

legendary

Activity: 3234

Merit: 5637

Blackjack.fun-Free Raffle-Join&Win $50🎲

@Pmalek, I can agree that smartphones are not the best choice for airgapped wallets, but people still change smartphones more than personal computers, so I believe that a lot of people have an old smartphone that is useless. For those who have no other choice for "safe" storage, an old smartphone will certainly make more sense than any hot wallet.

I assume that if Wi-Fi is disabled, and if there is no SIM card in the device, the device cannot connect to the Internet, and Bluetooth and NFC should also be disabled. Also, such a device should be reset to factory settings and always be in Airplane mode.

Pmalek

legendary

Activity: 2730

Merit: 7065

Quote from: Lucius on December 24, 2023, 10:33:08 AM

The best hardware wallet that exists is the one that we can just make from an old computer or mobile phone.

I agree with you regarding the airgapped computers for optimal security. However, I don't have much faith in mobile phones as long term storage for Bitcoin. There is no way to remove all antennas and connectivity chips and sensors like you can on a desktop system.

Lucius

legendary

Activity: 3234

Merit: 5637

Blackjack.fun-Free Raffle-Join&Win $50🎲

Quote from: tread93 on December 23, 2023, 01:04:58 PM

Lied about being the most secure hardware wallet in the world!

They (Ledger) or perhaps it is better to say lord of the rings Pascal still claim that they are the most secure HW because their Recovery is one big step forward, and they described the hacking of the user data base as some kind of trivial thing that had no effect on user security.

Quote from: tread93 on December 23, 2023, 01:04:58 PM

I remember when everyone was dead set on Ledger being the absolute best and most secure and then all of this crap came out.
~snip~

It was a good lesson for all of us not to trust anyone, no matter what the company's name is or what kind of product it has. We should always be on our guard and not advise others about something we may regret one day. The best hardware wallet that exists is the one that we can just make from an old computer or mobile phone.

tread93

hero member

Activity: 1386

Merit: 599

Quote from: o_e_l_e_o on December 20, 2023, 01:46:19 PM

Quote from: Meuserna on December 20, 2023, 06:03:39 AM

Ledger is not an honest company.

Lied about the security of your data.
Lied about the security of your coins.
Lied about how many people had their data stolen.
Lied about seeds never leaving the device.
Lied about being open source.

Did I miss any?

Lied about being the most secure hardware wallet in the world! I remember when everyone was dead set on Ledger being the absolute best and most secure and then all of this crap came out. I cound't believe it. I got off Ledger. The fact that they are tracking all of this information and broadbasting it to another seperate company and probably selling that data is infuriating! You can't trust anyone or anything these days.

o_e_l_e_o

legendary

Activity: 2268

Merit: 18748

Quote from: Meuserna on December 20, 2023, 06:03:39 AM

Ledger is not an honest company.

Lied about the security of your data.
Lied about the security of your coins.
Lied about how many people had their data stolen.
Lied about seeds never leaving the device.
Lied about being open source.

Did I miss any?

Pmalek

legendary

Activity: 2730

Merit: 7065

Quote from: Meuserna on December 20, 2023, 03:35:30 AM

But you have to use Ledger Live to add or update apps on your Ledger hardware, at which point you're at the mercy of Ledger's tracking.

I know, but like I said, that's an entirely different problem that has no affect on the custody of your coins and keys. If you had no access to your crypto outside of Ledger software and needed their permission to move your funds, then we can talk about issues with custody. That isn't the case here.

Quote from: Pmalek on December 20, 2023, 03:05:52 AM

Better yet, it's time for Ledger to prove the firmware on their hardware is safe AND HAS ABSOLUTELY NO ABILITY TO EXPORT THE USER'S KEYS.

Doing it now, retroactively, would be pointless anyway. The best you can hope for is them doing it for future firmware versions, and I doubt they will do that. And even if they do, the harm of Ledger Recover has already been done and can't be undone. Sending shards of your keys to other companies for "safe-keeping" is a custody issue in comparison to the tracing problem we discussed above.

Meuserna

full member

Activity: 128

Merit: 190

Quote from: dkbit98 on December 20, 2023, 05:38:29 AM

it's simple to open source everything, right? Right?? Wink

Oh my god, THIS.

Ledger prints "WE ARE OPEN SOURCE" on the boxes for hardware running closed source firmware.

Ledger is not an honest company.

Ledger cannot be trusted.

dkbit98

legendary

Activity: 2212

Merit: 7064

Quote from: Meuserna on December 20, 2023, 03:35:30 AM

But you have to use Ledger Live to add or update apps on your Ledger hardware, at which point you're at the mercy of Ledger's tracking. A smarter idea is to stop using Ledger hardware entirely.

You also can't even start using ledger wallet if you don't install their ledger live crapp after you purchased their hardware wallet.
Good luck to anyone trying to bypass that Cheesy

Quote from: Meuserna on December 20, 2023, 03:35:30 AM

Ledger hardware isn't safe anymore.

It was never safe in the first place, but it's not that hard to provide illusion of safety... same like governments are doing with their msm propaganda bs.

Quote from: Meuserna on December 20, 2023, 03:35:30 AM

It's time for Ledger to prove the firmware on their hardware is safe. They've been lying to their customers for a long time, so their word is no longer good enough.

it's simple to open source everything, right? Right?? Wink

Meuserna

full member

Activity: 128

Merit: 190

Quote from: Pmalek on December 20, 2023, 03:05:52 AM

As long as you have access to your keys, and you are the only one with such access, and can import them properly elsewhere, it's a non-custodial wallet.

But you have to use Ledger Live to add or update apps on your Ledger hardware, at which point you're at the mercy of Ledger's tracking. A smarter idea is to stop using Ledger hardware entirely.

Quote from: Pmalek on December 20, 2023, 03:05:52 AM

Quote from: Lucius on December 13, 2023, 06:15:29 AM

However, even if the user turns off that option, can we say with certainty that the app still does not (secretly) collect data and send it to someone for analysis?

Someone should prove it then.

Better yet, it's time for Ledger to prove the firmware on their hardware is safe AND HAS ABSOLUTELY NO ABILITY TO EXPORT THE USER'S KEYS.

Ledger hardware isn't safe anymore.

Ledger's security was breached in 2020, leading to users names and home addresses being leaked. That's ironic since Ledger's entire job is SECURITY.

Ledger's code has now been hacked. And worse, Ledger blames a previous employee getting phished! That's a double-whammy of inexcusable ineptness from a company who's entire job is SECURITY. And it's even worse since Ledger hardware now runs firmware with key extraction APIs.

It's time for Ledger to prove the firmware on their hardware is safe. They've been lying to their customers for a long time, so their word is no longer good enough.

Pmalek

legendary

Activity: 2730

Merit: 7065

Quote from: CryptoGirl_200x on December 13, 2023, 03:51:46 AM

There have been a lot of controversies surrounding the mode of operations of ledger - one of the top hardware wallet manufacturers, meant to be complete non-custodial, but recently, researchers have discovered data Harvesting Inside the ledger live app.

For whatever reason best known to ledger, and hard to comprehend for users, ledger live app is transmitting information about..
- Clicks
- Page visits
- Redirects
- Crypto transactions
- Page scrolls
- Number of accounts
- Crypto asset names
- Session duration
- Hardware device type
- Firmware version

The information you mentioned that is being tracked and collected doesn't change the non-custodial aspect of the app to a custodial one. As long as you have access to your keys, and you are the only one with such access, and can import them properly elsewhere, it's a non-custodial wallet. And you can do that with Ledger. A big problem would be if someone can prove that Ledger has and/or has always had a copy of all keys. I am not talking about the Ledger Recover feature here.

Quote from: Lucius on December 13, 2023, 06:15:29 AM

However, even if the user turns off that option, can we say with certainty that the app still does not (secretly) collect data and send it to someone for analysis?

Someone should prove it then. Unless it's the firmware that is doing nasty stuff, those who can read and comprehend code shouldn't have issues proving if and how Ledger collects data using ledger Live.

o_e_l_e_o

legendary

Activity: 2268

Merit: 18748

Quote from: ABCbits on December 19, 2023, 06:21:37 AM

Any browser based on Chromium? How about Ungoogled Chromium?

Perhaps the exception to the rule, but I would argue that no matter how hard you try it is next to impossible to remove all Google code, dependencies, spyware, and so on. Far better to start with a clean slate (i.e. Firefox) and work from there.

ABCbits

legendary

Activity: 2870

Merit: 7490

Crypto Swap Exchange

Quote from: Lucius on December 13, 2023, 06:15:29 AM

Someone already shared that news here: https://bitcointalksearch.org/topic/m.63308706

It's nothing strange to me, considering that various apps have an "analytics" option that collects data about how the user uses the app and a lot more that the company wants to know. The real problem is that this option is turned on by default, and those who are not aware that it exists at all are not aware that they can turn it off.

And usually company makes it difficult or annoying for user to opt-out from such data collection.

Quote from: Lucius on December 13, 2023, 06:15:29 AM

However, even if the user turns off that option, can we say with certainty that the app still does not (secretly) collect data and send it to someone for analysis?

No, unless you actively monitor network activity of Ledger Live application which almost doing that.

Quote from: o_e_l_e_o on December 15, 2023, 04:29:29 AM

Quote from: CryptoGirl_200x on December 13, 2023, 03:51:46 AM

For whatever reason best known to ledger, and hard to comprehend for users, ledger live app is transmitting information about..

Newsflash: So is almost every piece of software on your computer.

Do you use Windows or iOS? Then your OS is transmitting all that data and more to Microsoft/Apple and a ton of third parties. Do you use Chrome or any browser based on Chromium (i.e. anything except Tor, Firefox, or one of its forks)? Then your browser is transmitting all that data and more to Google and a ton of third parties.

Any browser based on Chromium? How about Ungoogled Chromium?

dkbit98

legendary

Activity: 2212

Merit: 7064

Quote from: bitmover on December 13, 2023, 12:38:48 PM

You can also use Metamask + Ledger for ethereum.

I think that Metamask is one of the worst ever software wallets I used in my life, and you can lose shitcoins even if you had them on ledger, if you approved access with metamask crap. Tongue

That is the way how people lost money, so I don't understand why use shit hardware wallets with shit contracts anyway..

Quote from: Meuserna on December 13, 2023, 03:29:25 PM

I seriously do not understand why anyone is trusting Ledger at this point. What ever happened to the days of Bitcoiners saying "Don't trust. Verify." Now, it seems to be "Don't trust, unless the company's CEO wears at least nine rings while defending key extraction firmware. Nine rings or more makes it okay."

Most people say, but what could go wrong if I use ledger with other wallets like electrum, etc... and I say - a lot could go wrong.
Let's see what is going to happen next after latest fiasco with ex-worker... but I am sure we are going to see more crap from ledger.
At this point I am considering all people who work for ledger to be compromised in one way or another.

o_e_l_e_o

legendary

Activity: 2268

Merit: 18748

Quote from: CryptoGirl_200x on December 13, 2023, 03:51:46 AM

For whatever reason best known to ledger, and hard to comprehend for users, ledger live app is transmitting information about..

Newsflash: So is almost every piece of software on your computer.

Do you use Windows or iOS? Then your OS is transmitting all that data and more to Microsoft/Apple and a ton of third parties. Do you use Chrome or any browser based on Chromium (i.e. anything except Tor, Firefox, or one of its forks)? Then your browser is transmitting all that data and more to Google and a ton of third parties.

Quote from: bitmover on December 13, 2023, 12:38:48 PM

You can also use Metamask + Ledger for ethereum.

Here's a great example. Let's take a look at Metamask's privacy policy:

Quote from: https://consensys.io/privacy-policy

Information we collect from you may include:

   Identity information, such as your first name, last name, username or similar identifier, title, date of birth and gender;
   Contact information, such as your postal address, email address and telephone number;
   Profile information, such as your username and password, interests, preferences, feedback and survey responses;
   Feedback and correspondence, such as information you provide in your responses to surveys, when you participate in market research activities, report a problem with Service, receive customer support or otherwise correspond with us;
   Financial information, such as your credit card or other payment card details;
   Transaction information, such details about purchases you make through the Service and billing details;
   Usage information, such as information about how you use the Service and interact with us;
   Marketing information, such as your preferences for receiving marketing communications and details about how you engage with them;
   Financial information, such as bank account number and bank routing number; financial assets holdings; and
   Technical information, such as your Ethereum wallet address, application programming interface (API)-key and network information regarding transactions.

So Metamask collects literally everything. Not exactly a good recommendation.

Since the seed extraction "feature", everyone should have abandoned their Ledger devices a long time ago. But when it comes to privacy, Ledger Live is only as bad as most other software out there. If you aren't using Linux + Firefox/Tor + your own node, then Ledger Live isn't any worse than the rest of your device.

Lucius

legendary

Activity: 3234

Merit: 5637

Blackjack.fun-Free Raffle-Join&Win $50🎲

Quote from: bitmover on December 13, 2023, 12:38:48 PM

The best option for those who have a Ledger wallet and are worried about data harvesting, is just to use another software.
~snip~

There is no doubt about that, but still from time to time you can't avoid using LL, at least when it comes to things like updating or adding a coin app, or maybe when it comes to a firmware upgrade. I turned off that questionable option a long time ago because I have a habit of checking such things, but this is a good warning for all those who haven't done it yet or are about to install LL.

Quote from: Meuserna on December 13, 2023, 03:29:25 PM

Uhm... what about the key extraction code that's not built into the firmware?

Maybe that code has always existed, only recently they decided to tell us about it because they want to charge us for a service that has a direct connection with that code.

Quote from: Meuserna on December 13, 2023, 03:29:25 PM

I seriously do not understand why anyone is trusting Ledger at this point. What ever happened to the days of Bitcoiners saying "Don't trust. Verify." Now, it seems to be "Don't trust, unless the company's CEO wears at least nine rings while defending key extraction firmware. Nine rings or more makes it okay."

Some actually have no idea what it's all about, some others simply can't afford another HW, others think that the recovery option is actually something that gives them greater security. Besides, how many people actually understand Bitcoin as more than a get-rich-quick scheme? If so many believe in CEX as a crypto bank, it's no wonder that they still trust the company that allowed it to be hacked (data leak) and then came up with the idea of enabling seed extraction and sharing the same with third parties.

Quote from: Meuserna on December 13, 2023, 03:29:25 PM

There are only three safe uses for a Ledger:

Door stop.
Target practice.
Decoy wallet.

I agree, and maybe someone could think of another way to use it - I know that some have managed to install a simple game on Ledger in the past🐍

Fivestar4everMVP

legendary

Activity: 2422

Merit: 1083

Leading Crypto Sports Betting & Casino Platform

I have always known ledger to be the biggest and most popular manufacturers when it comes to hardware wallets and so, but recently, all this news about how they have been secretly gathering personal information of their users is really alarming and discouraging to be honest.

I am actually planning to get a new hardware wallet for myself, and that is what brought me into this board, to find out which is the best to go for, I actually was looking at buying a ledger, but based on all that I have read here, i think I've changed my mind, I will probably do my research on trezor and see if I will go for this one.

Topic: Data Harvesting Inside Ledger Live App - Is this really part of Non-custodial? (Read 313 times)