Users will decide if they can still trust Ledger with their seed phrases

Self-preservation is important in cryptocurrencies, and security is essential for self-preservation. Ledger, a prominent manufacturer of hardware wallets, has built its reputation on the secure storage of users’ private keys. Hardware wallets create a secure offline environment to store keys and use the keys to carry out transactions.

The user’s private keys are generated and stored inside the device and are never supposed to be left behind. This “cold storage” provides an unparalleled level of security compared to “hot wallets” or online wallets. The problem is that many people lose their keys.

Ledger rolled out a seed phrase backup product this week called Ledger Recover. If you give the company your identity and personal information, you can pay for a service that takes your raw phrase inside your machine, encrypts it into three “parts” and then shares it with different custodians.

Introducing a third party inherently centralizes control, creating a single point of failure that can be exploited by hackers or subject to regulatory action.

Related: Throw bored monkeys in the trash

I don’t begrudge Ledger his efforts to grow as a business to reach out to non-Organo Gold users and other cypherpunk-ethos. Millions of bases, like our skeptical baby boomer in-laws, wouldn’t be sucked into cryptocurrency by this kind of precautionary backup approach. Perhaps it was her mistake trying to use the same product to appeal to both cryptocurrency holding OGs and their broader future customer bases.

Ledger’s rollout of its backup product was met with some strong reaction among the customer community. Many were surprised to learn that Ledger always has the ability to touch your secret key with updates to his devices. Many of us view our devices as sacred. I was clearly not aware enough of this device to trust to protect my crypto assets.

Yesterday I was freaked out about the revelation @Arbitrage Your private key can be spit out with a firmware update.

However, I noticed that the smartest people were not afraid. am I missing something?

I spent the evening educating myself, and now I’m in the “nvm it’s fine” camp.

Haseeb ＞ | ＜ (hosseeb) May 17, 2023

Haseeb Qureshi believed that while he initially reacted negatively, he realized that this was always true about Ledger. We have always trusted not to include malware in firmware updates to steal our initial phrases. He’s not wrong, but I wouldn’t say this is a comfortable idea.

After all, nothing bad can happen to your device unless you sign a transaction. You retain strength. I don’t know about you, but I’m not a programmer – I can’t tell a malicious update from a legitimate one, so I trust Ledger on that too. I don’t exactly have a choice no To agree to the latest firmware update includes the Ledger Recover capability, as Ledger warns that failure to update your firmware is a security risk.

They are doing a crap job of providing trust in the software package. A better design might include functionality like Certificate Transparency or Key Transparency, so you don’t have to hope they don’t send you a buggy firmware without accounting

– Andrew Miller (@socrates1024) May 17, 2023

I trust Ledger – it’s a great company. It’s been a backbone in the cryptocurrency self-guarding tech stack, at least in my crypto journey.

But the goal of a cryptocurrency self-guarding tool should be to reduce trust requirements. Ledger can improve on this by unlocking more software and hardware. Ledger’s chief technology officer was asked about this on May 17 Unbanked The podcast reported that Ledger had signed non-disclosure agreements preventing him from doing so, and argued that people were unlikely to crowdsource security audits anyway.

I’d bet security researchers like Andrew Miller, who discovered the vulnerabilities in the secret network, would take on the job.

1/ Ledger “retrieving” a string

Last night, Ledger accidentally leaked some information about their new payback subscription service, and today they revealed the details.

Let’s find out what the proposed “solution” for cryptocurrency custody is and how dangerous it is. pic.twitter.com/8GnCKv7hTH

– Seth for Privacy (@sethforprivacy) May 16, 2023

While Ledger’s startup communications were a disaster, his crisis communications were helpful. I certainly realized that I don’t have enough understanding of how hardware wallets work. But “Sorry, we can’t open source anything due to NDAs” is an inadequate answer for those in the community who have concerns that Ledger Recovery could be used by a malicious actor to trick users with a fake update and steal their seed phrase.

Ledger can also give me the option to continue to update my firmware without adding a Ledger Recover token to my device. But just in case its open-source firmware isn’t available, it won’t do much, since we’ll have no way of verifying its claims.

This could be a win for the brand if Ledger pivots to rolling out a branded “cypherpunk” dimension to its hardware and software that appeals to the OG crypto community that they might be willing to subscribe to, and allows existing hardware owners to subscribe to their previously purchased devices such that new updates bear The cypherpunk brand and approval, as open source as possible, with mass security audits – the whole package. He will forgive everything.

For now, it doesn’t look like Ledger plans to do that. So, the options are to use open source hardware wallets, but those wallets don’t have Ledger’s widespread interoperability with emerging blockchains. Or you can create your own, or just use the new revamped Gameboy open source hardware wallet.

For now, and for many coins, it’s probably the safest option to trust Ledger while remaining open to competing developers of open source hardware wallets.

This article is for general information purposes and is not intended and should not be considered legal or investment advice. The views, ideas and opinions expressed herein are those of the author alone and do not necessarily reflect or represent the views and opinions of Cointelegraph.