Topic: My dad got a Ledger from Best Buy.... (Read 267 times)

The issue with that and bitcoin will always stay the same: Bitcoin price constantly rises over time and therefore you will be sooner than you think left with a massive amount of USD. Then you will be totally hyped and don't think about your unsafe coins in an unsafe exchange or your unsafe wallet. Finally you will loose these coins. The best way to not have that happen is to store them safe, no matter what the value of your coins is at that time. Safe can also be a paper wallet or an offline laptop.

People who have fewer funds should not buy hardware wallets as the software wallet should be enough for them.

Finally, due to a large number of scams and everyone targeting people crypto and bitcoin, always order or buy it from an official store. Do not trust any reseller no matter how much he is trusted. Since bitcoin is getting popular, resellers are trying to scam people who order hardware wallets from them. So be careful.

I'd personally recommend something not Ledger-branded; if you want a tried-and-tested brand, get a Trezor product, otherwise I'm a big fan of the convenience and open-source nature of the Foundation Devices hardware wallets.

In terms of supply-chain attacks (the scenario described / worry about it described here); some brands rely on stickers, others give you more options.
Passport has a 'supply chain validation' process where cryptographic signatures are used to make sure the device is genuine; the device also verifies signatures of any updates you install to it (just reinstall latest firmware when you get it) and you could even easily build the firmware yourself and flash it, after uploading your own keys to it.

Open-source hardware also allows you to visually inspect PCB and internals for any hardware implants or similar supply-chain attacks on the hardware level. Although I must admit that they're not the easiest thing to open (without damage).

mmh yes I understand your disappointment, maybe it has some design problem.  But the software is robust and has an added chip to keep the operations protected (like the google pixel titan, if you know it).  Maybe we can complain to Shiftcrypto about the key issue.

Can you order and pay with Cash on Delivery?  If you can get a hold of a disposable phone number and order on a fake name at the address of a hotel or gas station, you would have nothing to worry about.

If my Privacy trip ever taught me something, it is that Privacy has a cost almost all the time.  You either pay extra time or extra money.  Or both.

-
Regards,
PrivacyG

I haven't used the bitcoin-only version, but I've used the other one and for some reason it slows down my cursor something fierce--have any of you had that experience with the Bitbox?  That's the major issue I have with it as a device, with the secondary one being that it appears to be designed for people with tiny fingers, and for me it's hard to key in the password.  The major gripe against the Ledger products is that the code is closed-source, so if the above things aren't a problem I'd recommend a Bitbox in a heartbeat.

Good to see you here, tread93.  And best of luck to your pops with his wallet selection!

Some countries only have one or two resellers at the moment, so it can be a problem if you can't make a trip. In my case, I need to travel for at least half a day to buy from them. They do support online shopping but you'll need to give some personal info at one point or another. Makes me wonder if they share the data with Ledger or not.

Another problem is the price, buying locally costs a lot in my area, probably because the reseller wants more profits. The price difference can start from 30 to 50%. It is probably not a problem if something like Nano S is your target though. I just wish it can be even cheaper.

That's all great advice.  I do use a PO box and an email address exclusively set up for these types of purchases, but I didn't use a fake name.  I don't know how risky it is to expose my real name along with a PO box, but if things go sideways having a real name makes it much easier to get compensated.


Yeah, I mean an official resellers, but even a trusted, locally owned small electronics store would be acceptable.  There's a guy in town who does cellphone repair who stocks Ledgers, but he's not into cyrpto himself.  A couple of years ago I wanted a few Trezor Ones as stocking stuffers for my kids so I asked if he would source them for me, but he wasn't interested.  I wouldn't have any issue buying a hardware wallet from a local mom-&-pop store like that.

Ledger has been good about marketing in general, which is probably why their products are available locally, but even Trezor which seems to be nearly as popular are as rare as hens teeth at local retailers.

What about the alternative of using a Post Office Box and ordering on a fake name with a one time use E-mail account?  To conceal it entirely, pay in Cryptocurrency.

By local retail store do you mean official resellers?  I think they have enough resellers to cover most parts of the world.  If planning to buy a Hardware Wallet physically with Cash, just plan the next vacation in a city where an official reseller can be visited.

-
Regards,
PrivacyG

Honestly, if I was to buy a Ledger I think it's safer to buy it from a local retail store where I can pay in cash.  Ledger has had at least a couple of data breaches that exposed their customers' email and physical addresses.  I was stung by at least one of those leaks, and my email inbox has been spammed by scam attempts and generic shitcoin related BS.

I wish more hardware wallet manufacturers made their wallets available at local retailers.  There is a risk the wallets could be tampered with throughout the supply chain, but most hardware wallets can have their firmware flashed, which would reset any malicious firmware that a hacker could introduce.

All in all, the ability to buy a hardware wallet at a local retailer for cash could go a long way to preserving your privacy and security.


Agreed.  I own both, and find them very secure and practical.  I'm also thinking of buying a Foundation Passport, which looks like the safest Bitcoin-Only hardware wallet on the market today.  Plus it's made in the USA.

Hey long time no talk    You're absolutely right, only buy directly from the maker, period.  Also, the two best hardware wallets, imo hands down, Trezor and CoinKite ColdCard.

Ledger is NOT the most secure hardware wallet, it's closed source and they had many security leaks in past.
I think that you and your father just wasted time and made you even more exposed after returning devices you already purchased in best buy, and then ordering online with your private information.
Not sure what you wanted to achieve with this exactly, and now you are asking for other hardware wallets...
There are much better open source hardware wallets , like Passport, Keystone, BitBox or Trezor.

There is no such thing as ''decentralized source'' for purchasing stuff...

A small correction: the Coldcard is based on open-source code but the final product does not come with an open-source license. That means, you are not allowed to modify or redistribute Coldcard code. You also can't use their code to create your own hardware wallet. The codebase is verifiable though, and that should be the point you should focus on if that's something that is important to you.

---

@tread93
A few things about the Ledger.

- You have ways to check and ensure that the software and hardware of a Ledger is genuine. For instructions on how to do that, you go to the official website or read this support document.
- Only a genuine Ledger HW can connect to Ledger Live (the native app for your hardware wallet) servers. The fake ones can't.
- You can also physically open the device and check the hardware inside, but you should know that by doing that, you void the warranty. This is the link with instructions if you want to do that.   
- When you first turn on your Ledger HW, it's supposed to display a welcome message of some sorts. I am not sure what exactly it says now. "Hi Ledger", "Welcome to Ledger", or the screen simply displays the ledger logo. Keep an eye on that. It only happens during the onboarding process and the first time the device is turned on. If it doesn't, you aren't the first one who has turned it on.
 
To sum up.
Never use a HW with preinstalled seed. Confirm everything with the information available on the official site. Download software only from the official site, not based on instructions given to you elsewhere. Verify if your device is genuine before using it. Stop and ask questions if you are in doubt, like you did with this thread. Ask the Ledger support or people on this forum if something is not clear.

Trezor has no recovery seed phrase when you purchase. You are the one who will generate it when you open the device for the first time so resetting it right after you purchase is still useless if the inside of the hardware wallet chip is rigged. Hacker can put a program on hardware wallet that shares your recovery seed phrase once you connect in the internet. This is the danger that you can get on buying to 3rd party because you can’t check the inside of you device.

The sticker seal of the box can be counterfeit too so buying directly on manufacturer is the best thing to do if you are using it as life savings storage.

It's better to buy a hardware wallet from an official website but even if you have bought from best buy or any third party marketplace, if you can reset the device, the passphrase can be reset too and the device will be safe to use. Isn't ?



Every penny is important so if you want your bitcoin to be safe, you should buy a hard wallet irrespective of whether you have a million dollars or a mere 1000 dollars.

Currently the best hardware wallet I think is Coldcard by coinkite, it's Airgapped and open source and this makes it the best around in my opinion.  However, I must emphasize that it is not an instrument suitable for everyone and can be difficult for beginners.  So I have in store for you the second best hardware wallet that anyone can use.  Bitbox02 bitcoin only edition, this is a fantastic piece of hardware that stores your private key offline on a micro SD that you can store wherever you see fit.

Ledger nano is also a good wallet but don't use it with ledger live that can be risky for privacy rather use it with electrum.

In my opinion hardware wallets are for those who simply want to store their keys in a safer way, regardless of the amount of money they have.
Since both Trezor and Ledger allow to interact with smart contracts, digitally sign messages, ect; one could even argue there is a reason why someone out there would buy a HW while having 0$ of holdings at the moment of the purchase. 

A Ledger Nano S Plus is just $90. If you're a long-term investor, that purchase should be a total no-brainer. Why use a hardware wallet just when you already have $100k? Heck, I purchased my first hardware wallet when I had like $2000.

I had the same worry when I was buying my Ledger, and decided to order it directly from manufacturer and guess what happened? Ledger data got leaked and my email (luckily just that, it could have been worse) ended up being spammed with bunch of scam mails. My point is, there is always a chance that you get screwed when ordering something like hardware wallet so even if ordering directly from them, try to order to one of those mailbox services so even in case of data leak hackers don't get your name.


I can't really tell you that as there are hundreds of devices on the market, but you might wanna check this topic (it is in Croatian, but you can use Google translate). Personally, if my Ledger Nano S stopped working, I would probably buy again Ledger just because I got used to it and I don't like the change.

i can to a point understand the topic creators fears.
thinking an employee of bestbuy is sneaking a look inside the packaging to reprogram a ledger to a bad random generator where it, when functioning creates a key the employee designed it to create. rather than random..

but then again so could the postman/courier sending out devices direct to customers.

so that fear can be taken with a pinch of salt (or lack of). and taken with less tinfoil hear dress fear

the best solution is to use your own chosen words. create your own unique key. and only put value onto your key. not one generated by a piece of software.

importing your own wallet into a hardware wallet is better than using a wallet the device/software chose for you

---

the biggest fear of hardware wallets is where hardware wallets use webbrowsers as the GUI where by things like web extensions and phishing sites can scam/con people into typing their seed into the scammers control