Topic: Fuck you ledger (Read 1022 times)

Everyone uses closed-source chips in their hardware wallets. That includes open-source wallets like Trezor and Foundation Passport or the source-verifiable Coldcard. What they can do is open-source their firmware. That's the issue and biggest part of their ecosystem that is closed-source. Ledger Live, their native, and 3rd-party crypto apps are open-source. That's how they found that tracking code that is posted all over the place.

Because their employee or ex-employee and their code started the shitshow that created the problems and the exploit.

You are not wrong. That's what Ledger's Recover fiasco proved. The companies can, in theory, write code to extract your keys if they wanted to. Ledger did it. The question now is who, if, and when will do it next.

I think the second part is too simple of an explanation. Coins were drained from both Ledger hardware wallets and software/web wallets that used the vulnerable Ledger Connect Kit. For the drainer to work, the user needed to approve and sign the transaction. It should never have happened, but is still a combination of user error and Ledger failing miserably to secure their code and procedures internally. In some way, you can compare the signing of the malicious transactions to sending your coins to the wrong address or the old Electrum phishing scam that required a user mistake for it to work. Those who noticed the fake Wallet Connect pop-up and didn't sign the blind transaction weren't affected. Sadly, many still were.

Then we disagree. Funding blockchain analysis and lying about being open source are not honest and trustworthy actions in my book. And again, I'm not comparing these things to the far worse things Ledger have done, but they are more than enough to mean you shouldn't be using their devices either.

That vulnerability requires the thief to have possession of your physical device along with some very sophisticated equipment in order to hack it, and the hack doesn't affect newer Trezors.

Ledger's key extraction firmware works over the internet, which means a thief doesn't need to steal your physical device.

And Ledger's code was hacked just last week, which is how a hacker stole users coins from their Ledger hardware wallets without needing to steal their physical devices.

It's ridiculous to compare those two things.

The Trezor hack was a proof of concept by white hat hackers who alerted Trezor.

The Ledger hack was proof of incompetence which allowed thieves to steal $600,000 in users coins.

That being said, I'm not saying Trezor, ColdCard, Keystone, etc, are perfect.  I choose not to use them.  But they're not dirty companies.  Ledger has proven themselves to be dishonest and incompetent.  They lie to their users (even their packaging contains a lie right on the box), they leaked their customer database, giving customers names and home addresses to hackers!  And their code has been hacked, allowing thieves to steal $600,000 from users of Ledger hardware.



Yes, they could.  BUT LEDGER DID.

Ledger is dirty.



I do the same thing.

Airgapped.  Stateless.  Open source.  Nothing less, for me.

Ledger are obviously the bottom of the barrel when it comes to hardware wallets, but let's not pretend these other devices are all without flaw. Trezor devices have a seed extraction vulnerability and Trezor cooperates with blockchain analysis. ColdCard and Keystone lie about being open source. Nowhere near as bad as what Ledger have done, but enough to not make me want to use any of their products either.

I am by no means a Ledger fanboy, but it is a simple statement of fact that any other company could try and do the same thing. There is no inherent property in their devices (if they aren't airgapped) stopping them from doing so - only the trust you have in that company and its developers.

This is why I said above I would only ever use open source and permanently airgapped devices. Open source so you know what code is running on your device, and airgapped so that even if the developers wanted to try to extract your seed phrase as Ledger have done then they wouldn't be able to anyway. I would definitely +1 for SeedSigner (and can't wait for this fork to be fully developed: https://monerosigner.com/). Entirely open source so you know exactly what code is running on your device at all times, and even if there was malicious code on there to try and extract your seed phrase, it couldn't achieve anything anyway because it is permanently airgapped. This is what you want from a hardware wallet.

Any car can crash.  But there's a difference between that and a company building software into their cars that forces them to aim for oncoming traffic.

Surely, you understand the difference.

Ledger is the ONLY company to build key extraction into their firmware.  Ledger fanboys are desperately trying to defend Ledger by saying any company could do the same thing.  BUT THEY HAVEN'T.  Only Ledger did.  Ledger fanboys want you to blame every hardware wallet company for what Ledger did.

Have you ever been on a date with a woman whose last boyfriend cheated on her, so she chooses to treat every man like a cheater?  That's crap, right?

Don't hold Ledger's evil and ineptness against other companies who have done nothing wrong, and who go out of their way to keep their users safe.


Wrong.

I mentioned SeedSigner and Krux as two hardware wallets I like.  I use Krux with BlueWallet.

When you use an app like BlueWallet or Sparrow with a hardware wallet, you import your main PUBLIC key.  It's usually a zpub (for older wallets, it'll be an xpub).

A zpub "public key" gives the app all of your addresses, but it doesn't contain any of the keys for those addresses.  This creates what's known as a "watch only wallet," which means it can show you everything, but it can't spend or move anything since it doesn't have any of the private keys.

So, when you try to spend Bitcoin in a watch only wallet, you have to get a signature from your hardware wallet, because the hardware wallet has the private keys.  And the cool thing is, when your hardware wallet creates the signature to authorize the transaction, it does this without ever revealing the private keys to the app.  Even better: the signature is only valid for that one transaction, which means a hacker can't steal it and do anything with it.  That's how hardware wallets keep you safe.

The entire point of a hardware wallet is to provide signatures without ever exposing your keys.  Only Ledger built a backdoor into their wallets.

Not trusting any hardware wallet because Ledger is a sack of trash is like saying "Well, I got food poisoning from that Taco truck.  I guess I can't eat food anymore."  Ledger is a bad company.  Don't trust Ledger.  But don't hold Ledger's malpractice against good companies.  That's just foolish.

I try not to be foolish, but again I'm one of those who don't fully understand what goes on under the hood, if you know what I'm saying.  From what I've heard, any HW wallet with a secure element has the potential for the manufacturer to exfiltrate the private keys--if I'm wrong about that, please educate me.  And all of them have some kind of security element in them as a matter of course, too, right?

Also, given what I've said about my knowledge of the internal workings of these devices, nobody ought to follow my lead anywhere.  I've just found that for what little crypto I have I don't need a HW wallet to manage it, and I'm not comfortable with the level of uncertainty I have about them.

Never heard of Krux, but those last two are SW wallets that can be used with HW wallets--am I right about that or not?  If so, and let's say you're using Sparrow with a Ledger, they can still steal/exfiltrate/whatever your private keys regardless, right?  If I've understood everything correctly, you don't have to be using Ledger Live in order for that to happen (again, correct me if I'm wrong, please).

Don't blame all hardware wallets for one company's evils and ineptness.  That's just foolish.  The issue isn't even the companies that make the wallets.  The issue is the trustworthiness of the people at those companies.

The people at Ledger have proven again and again that they cannot be trusted.  It's the people at Ledger who lied to their customers and their users.  It's the people at Ledger who wrote and added key extraction APIs to the firmware for their devices.  It's the people at Ledger who failed to implement or follow safety procedures, a failure which led to their database getting hacked (customer names, email addresses and home addresses were leaked) and it's a failure which led to their code getting hacked (they blame a former employee for cryin' out loud!).  It's the people at Ledger who failed, lied, and proved they cannot be trusted.

The people at Trezor didn't do those things.  The people at ColdCard didn't do those things.  The people at Keystone didn't do those things.  The people at LEDGER did.

Don't blame all hardware wallets for Ledger's evils and ineptness.

That being said, I'm a big believer in fully open source projects like SeedSigner and Krux.  Krux with BlueWallet or Sparrow is a fantastic combo.

I get your concern, let me break the situation down for you.

Humans make mistakes, like really often. It applies everywhere, including software engineering and designing. If a software is exploited in an Internet connected device, the attacker can steal your keys. Being airgapped grants you this invaluable property that even if things get really fucked up, it is physically incapable of sending anything anywhere.

Trezor is not airgapped. Even if we assume they are coding with the best intentions, there's this chance of an attacker exploiting their software and taking advantage of the fact that the device can communicate with the Internet. And we know they don't have the best intentions when it comes to privacy as they're cooperating with Wasabi (references on why that's a red flag can be found on dozens of topics in this board) and had enforced a dystopian Address Ownership Proof Protocol in the past.

Nobody claimed Trezor is insecure. What is being said is that Trezor has the ability to surveil you, and is definitely less trustworthy than an airgapped device.

I have also said for a while now that I have largely moved away from all hardware wallets and back in favor of self made airgapped cold storage. I sleep easy knowing that my wallet software isn't spying on me, and that there is zero possibility of some company pushing an update to any of my airgapped devices which means my seed phrase can be extracted, or my wallets will start cooperating with blockchain analysis, or so I can start linking my KYC to my wallets' addresses, or some other such nonsense.

The only hardware wallet I would ever consider using again is one which is both open source and permanently airgapped.

The crazy thing is that I know both of you have extensive knowledge of hardware wallets, and if you're both arguing about something so fundamental, can you imagine how confused people like me--who don't have the technical knowledge to evaluate these claim on their own--are, and how jaded some of us are now that it seems like most if not all HW wallets can theoretically extract a user's private keys?

Ledger's lies turned me off of all HW wallets for the time being, even if that might be an extreme response.  I'm waiting for the dust to settle and the experts here to either confirm or disprove these suspicions/fears/whatnot.  And I really wonder what the state of Ledger's business is at the moment.

This is something new (unexpected), but considering all the bad things associated with this company, few will try to improve their reputation by playing the game "the bad ones, the good ones". I hope that there is no catch in everything, let's say some kind of KYC for all those who want a refund, or maybe a mandatory Recovery service lasting at least 1 year

Ledger announced the amount of damage from a recent hack
We are 100% focused on following up to last week’s security incident, making sure incidents like this are prevented in the future, and that the ecosystem remains safe.

We are aware of approximately $600k in assets impacted, stolen from users blind signing on EVM DApps.

Ledger will make sure victims affected will be made whole, and are committing to work with the DApp ecosystem to allow Clear Signing, and no longer allow Blind Signing with Ledger devices by June 2024.

But if you apply the same principle to politics, than there wouldn't be any governments as we know them today... so how can we survive without them and without roads  

They can if they want.
Just release new models with different secure elements, don't use same NDAs like with current models, and release code at least source viewable.
It's either that or they will stop existing soon if they continue with the same tempo... that is my prediction ^{from crypto gipsy fortune teller}.

What idiot company would publicly admit this?

If Ledger has never compensated for any user losses in any way before, then why would they do it now?

It’s time to put on the boxes with Ledger wallets the inscription “Dangerous for use, because it poses a direct threat to your cryptoassets. All your further use of this device is at your own peril and risk”.

2 strike? You seem to have lost count.

Looks like it's time to replace it to permanently.

The issue isn't clarity.  The issue is that they lie.


If they say it doesn't, how can you believe them?  They lie.  And even if their firmware doesn't extract your seed without your consent, the fact that THAT capability is now part of their firmware means Ledger hardware is now a honeypot for hackers.  And, oh by the way, Ledger's code was hacked this past week due to a screwup by a former Ledger employee.


Even if they do...  they lie, so how can you trust anything they say?


Again, once they started lying to their users, their word became worthless.


Guaranteed, the answer is no.  Ledger's lawyers protect them, not their users.


Ledger can't go fully open source due to the closed-source chips they use in their hardware.  That's why the value of their word matters so much.  And their word is worthless.

Ledger's word is worthless.

IMHO Ledger has failed terribly and their communications team should be and have been clearer and less technical in their responses to concerns of what is / was their average user.

There are ongoing concerns for many are still out there myself included.

For me a few major topics like:
1. Does the newest firmware pull your private key data without consent? We all know its now capable of this due to their backup offering non-sense.
2. Re-confirm that the end users involved in this latest hack physically had to allow /confirm the transfers on their hardware wallet. Again in plain English.
3. How did an Ex-Employee (or is it just an Ex-Employee now after the hack) retain rights to push code into their GitHub without a secondary signer?
4. Is Ledger going to make the victims of this hack whole? In my mind they need to come up with a gameplan ASAP on how to do this for every coin that was lost.
5. Why haven't they gone fully open source? I get being proprietary but at this point trust is lost as this is now strike 2...

Only time will tell how this pans out but for now I would avoid Ledger until they truly come clean.

A LETTER FROM LEDGER CHAIRMAN & CEO PASCAL GAUTHIER REGARDING LEDGER CONNECT KIT EXPLOIT
Things to know:

– December 14th, 2023, Ledger experienced an exploit on Ledger Connect Kit, a Javascript library to connect Web sites to wallets.

– The industry collaborated with Ledger to neutralize the exploit and try to freeze stolen funds very quickly – the exploit was effectively running for less than two hours.

– This exploit is currently being investigated, Ledger has filed complaints and will help affected individuals try to recover funds.

– This exploit did not and does not affect the integrity of Ledger hardware or Ledger Live.

– The exploit was limited to third party DApps which use the Ledger Connect Kit.

And how exactly does that spyware phone home from a permanently airgapped device?

I never said anything close to that, but if you think you have any privacy while syncing your device via servers owned and operated by the hardware device manufacturer then you are mistaken.

The ability exist to track you in your airgapped laptop, it has much wider attack surface, and you have confirmed spyware in your bios.
You are bringing more harm than good telling people that all hardware wallets are the same, when in reality you have no idea what you are talking about.

And there is an option of not opting in to Ledger's seed phrase extraction, which we rightly mock as being meaningless.

A yes/no button or "user opt out" means nothing. The ability exists for Trezor to surveil you just the same as Ledger do.