Topic: New ledger Flex junk (Read 313 times)

That sucks, see, it's really a way to waste money and just the aesthetic feels without giving the actual need of the users. Well, I guess on their end they'll just answer this with an another "update". They seem to have that every week or two just to address these issues but still, not really worth the buck for the trouble.

Exactly... Only a few weeks have passed since they shipped it to "some of their customers" and there are already a lot of complaints on their subreddit ^{[a few Flex users have labeled it as a rushed or beta product]}:
^{- We're already in Q3 of 2024, but Ledger is still going around in circles [SMH]!}

- New Flex- 1st impressions and more questions ^{[unregistered touches, fixed auto lock and failed connections to LL]}
- Ledger Flex NFC chip is not working ....it is on. but not working
- Connect Flex

And issues with apps:

- Got a Ledger Flex - Can't add Cardano?
- Why is there no way to install the "TON" app on the Ledger Flex?
- Monero on Ledger Flex
- Why can’t i download the VeChain app on my Ledger flex?
- Ledger Flex and ICP

Purchasing it is one way to waste money. When they are no longer likable by the community that's aware of their flaw in the ledger recover, this is what they do. Well, we are not their target market anymore and I guess that instead of informing their users about the importance of securing one's funds about their feature, this is what they give to people - the aesthetic feels. 

That may be true, if we compare Ledger with other questionable hardware wallet such as BitFi[1]. Besides, why choose Ledger when there are better choice (whether we're talking price, feature or company's history)?

[1] https://www.rsaconference.com/library/presentation/usa/2020/hacking-the-unhackable-pwning-the-bitfi-crypto-wallet

Such a silly statement, especially when we know that ledger crap have integrated ''feature'' ledger-recover to extract keys and sending in to other third parties, while charging customers for that 
And all new trezor devices have transparent secure elements so key extraction is impossible.
btw Trezor One is the first ever hardware wallet in the world, and it's still in production, while we have a big graveyard of defunct ledger devices...

Some older Trezors are vulnerable to physical key extraction if the attacker steals your hardware wallet and if the attacker has the sophisticated equipment required to do it, and if the attacker doesn't fry the device in the process.  It was only done once as a proof of concept, not an actual hack where anyone's coins were stolen.

Ledgers have the ability to do key extraction over the internet by Ledger, their partner companies, or anyone who hacks their code.

Ledger's code has been hacked:


Why would you trust a company you admit isn't great to secure your Bitcoin?  Their code isn't open, so you have to trust them.  But why?

Trezors are vulnerable to physical key extraction.

Look, Ledger isn't great, but it does the job.

To be honest, that's not unusual. Let's not forget that Trezor had a limited edition Bitcoin-only version of their hardware wallet not that long ago. The difference between that model and the others were in the orange bitcoin cover. However, you can install a bitcoin-only firmware on a Trezor regardless of which model you purchase.

Even a fully assembled Jade is affordable and costs less than $60 with a discount code. But I understand the logic in purchasing the parts yourself and building everything from scratch.

I am sure that 2/10 people who are on that waiting list have an idea of what you are talking about when you say Ledger Recover debacle. Even less would be able to explain what Ledger Recover does. What they know is that it's this cool new thing that Ledger created for us and they said it's super safe.

Never buy hardware wallets on eBay, new or second-hand. Visit the official shop or use an official reseller for such devices. Trying to save a few bucks only to risk getting a faulty or manipulated HW isn't worth it.

The worst thing that could happen is hackers figure out how to add their own electronics into the device to steal your coins.  Or the seller puts your name and address on a list of people to rob.  Ledger got hacked and the hackers leaked their entire customer database a while back, including customer names, email addresses, phone numbers, and home addresses.  Here's how that went:

I meant, I'd buy a second one as a spare.  I'm big on having a backup, just in case.  It takes less than a minute to install Krux on a device, so it's not a hassle.  Plug the device into your computer, paste one line of code in Terminal, and a few seconds later it's done.


Krux and Yahboom are totally different things.  Think of it like software and a computer.  Krux is the software.  Yahboom K210 is the computer.  Kind of like how you run Adobe Photoshop on a Mac or on a PC.  You run Krux on a Yahboom K210 or on a Maix Cube.

Krux is a relatively young project.  It's a few years old, but it really started making big progress last year.  I think that's when they started winning grants from OpenSats to fund their work.  I've been mentioning Krux a lot because it's so much better than any other hardware wallet I've seen or used.  And it has some features that I think greatly increase security.  Encrypted seed QR is a game changer.  Passphrase QR is a game changer.  And the ease of switching the network from Bitcoin Mainnet to Testnet makes testing your security so easy.  Mainnet is the main Bitcoin blockchain we all know and love.  Testnet is a testing version where coins have no value, because it's just for testing.  Experimenting with Testnet is such a great way to learn.  I wish every Bitcoiner would do it!

The Yahboom K210 Visual Module is just one of the devices Krux can run on.  If you have really good vision and don't mind not having a touchscreen, Krux runs on a Maix Cube, and those things can sometimes be found for as little as $35.  But it's a tiny screen, and it has a crappy toggle button like a Blockstream Jade that's obnoxious to use.  For just a few dollars more, the Yahboom is so much better.  Sadly, the best device for Krux has been out of stock for months: the Maix Amigo.  That thing cost $50 and has a 3.5 inch touchscreen.  It's awesome.  If the Amigo ever comes back in stock, I'm buying 2 of 'em.

yeah i know its not recommended. i thought the worst thing that could happen is they fill in the seed phrase for you hoping you won't generate a new one. i heard about that scam but apparently there's other scams.


why not just buy a second yahboom for the robot thing. seems like it would be a hassle having to switch back and forth between the robot and bitcoin wallet. anyhow i had never heard about this yahboom and krux thing it must be some highly kept secret but it's exactly what i have been looking for i think 

Whoa.  Never buy a closed source hardware wallet bought from a third party.  Trying to save a few dollars could mean you buy a device that's been tampered with, even if it's sold as new.  I wouldn't even buy an open source hardware wallet from a third party.

Maybe you're thinking "Hang on!  You said to buy a Yahboom from AliExpress!"  The Yahboom K210 Visual Module is not a hardware wallet.  It's a mini computer that runs micro python & can be used for any purpose.  It's not a hardware wallet until you load hardware wallet software onto it.  At some point, I may buy myself a backup Yahboom, but next time, I'd buy it with a robot kit for the fun of it.  When I want to use it as part of a robot, I'll flash the robot code onto it.  When I want to use it as a hardware wallet, I'll flash Krux onto it.  It takes less than a minute to flash Krux onto one of these devices.  You download Krux from Github and follow the instructions.  Or, I think they have an installer too, but I just run a command in Terminal to install it.

ok wow that's really cool! thanks for the nice explanation.

i know it's not recommended but i was looking at ledgers on ebay. but they claimed they were "new". but i think i like the idea of using an opensource software and hardware like the yahboom better!

Problem is that ledger can't manufacture that much working Stax devices and they already had to delay a lot because of faulty screen design.
I think that Lixin Liu (owner of Keystone) talked about that in much more details on twitter, and he suspects that ledger Flex is just replacement for Stax.
Maybe ledger is just going to send Flex to everyone who ordered Stax and send refunds for price difference.
https://x.com/bitcoinlixin/status/1805619165518250358


https://x.com/bitcoinlixin/status/1816983045397987790

Maybe this is all connected like I mentioned in my pervious reply.
Let's see what happens in next few weeks.

I can't wait to read test reviews
Stax was another BIG fail for ledger in every way, Flex is just their attempt to save the last tiny bit of respect they have left.

Be careful.  That's not the version you want unless you want to buy the rest of the parts to assemble it.

You want the Yahboom K210 Visual Module, which is a whole device rather than just a board.  Here it is on Amazon.  You can also see it on the Krux website.  It's the device in the bottom left of the picture.

They are also available at Amazon https://www.amazon.com/Yahboom-Developer-Recognition-Programmable-Development/dp/B08MTFFH5W and on other Amazon sites so if you do not want to deal with AliExpress for some reason you do have other options.

I am really starting to think that all HW wallet makers are getting greedy to the point of stupid. Sooner or later someone is going to again release a decent quality decent functioning HW wallet for under $100.  But for now these open source products like KRUX do work.

-Dave

I assume the rest of your post was as sarcastic as the above, but when it comes to Ledger it's hard to tell.  After the Recover debacle, there were still so many people who just shrugged their shoulders and kept using their wallets.

If that waiting list is to be believed, then my point is proved.  I can't imagine people are buying this new piece of Ledger crap as a collectible, which is about the only thing it'd be good for.  And damn, that's a lot of money for a closed-source wallet produced by a company that (in the eyes of thinking people) destroyed their reputation.

We bought one immediately for testing.

https://x.com/zachherbert/status/1816864071276462174

My succinct take is that Ledger Stax's 180 degree curved eink display was extremely difficult and expensive to make at scale, without defects, and has a very high defect rate. Ledger likely spent tens of millions of dollars on screen development and has to put aside a very high percentage of screens at production due to fallout. Therefore the 1 year+ delays and price increase to $399.

Interestingly enough, the Flex has a much faster refresh rate + input response time due to a likely use of an existing eink panel (no custom tooling, etc). My guess is Ledger will cancel Stax within 12 months.

Aside from Ledger reputation and history, cheapest Ledger HW on it's official website is $79[1]. I also think the page doesn't include tax and shipping fee, although it's at normal price. On a side note, you could build DIY Jade (based on Blockstream Jade[2]) which cost less[3] if you don't mind less feature.

[1] https://shop.ledger.com/products/ledger-nano-s-plus/matte-black
[2] https://blockstream.com/jade/
[3] https://github.com/epiccurious/jade-diy/

It's fully airgapped.  No internet.  No wifi or bluetooth.

An airgapped hardware wallet communicates with apps using QR codes.

The benefit of using an airgapped device is that it has no connection to the internet, which means hackers can't reach your keys, which means hackers can't steal your coins.  And the benefit of using an airgapped hardware wallet with a large screen is that it shows you what you're signing.

In my opinion, moving Bitcoin this way is much safer.

Let's say you're using BlueWallet, which is probably the easiest to use open source wallet app (it has a great design.  Super simple.  Sparrow is great too though).  You'll create a transaction in BlueWallet ("move 0.01 BTC to this address").  BlueWallet will make a QR code with a request for your hardware wallet to scan (generated from details of your transaction).  You'll scan it with Krux.  Krux will use that data with your keys to generate a QR signature.  You'll scan that signature with BlueWallet.

Scan the BlueWallet request with Krux.
Scan the Krux signature with BlueWallet.
Done.

The great thing about Bitcoin transaction signatures is that a signature is only valid for that specific transaction.  So, if your phone or your computer is hacked, the hacker can't change the signature or change the address to send your coins to his wallet, because any change to the signature would mean the signature wouldn't be valid for the transaction anymore, which means the transaction would fail...  which means your coins would stay safe & sound at your address.

The "crypto" part of cryptocurrency stands for Cryptography.  Bitcoin signatures are a brilliant form of cryptography that proves you have the keys without revealing what your keys are.  It's math.  Brilliant, brilliant math.

Another great thing about Krux is that it makes using Testnet easy.  Testnet is literally a testing version of Bitcoin where the coins have no value, because it's just for testing.  You can go to a testnet faucet site & get free testnet coins, and then literally play with different options for setting up security however you want.

Want to try multisig?  Do it first with testnet.

Want to try using a strong passphrase?  Testnet!

Want to mess with BIP85 (which I love and highly recommend to anyone who understands how seed phrases work)?  Hooray for testnet!

Testnet is awesome.

If you can't plug it into a computer then how exactly do you think you are going to be able to do transactions? Does this thing have an internet connection or something?