Bitcoin Forum

Few days ago, I came across a topic on this forum discussing that ledger now gives customers to option to store their wallet seed phrase through a cloud service within the wallet, several users, not just on this forum but also outside this forum, expressed deep concern as no one is sure any longer on the true privacy of the ledger hardware wallet..

Going through a channel (https://t.me/Bitcoin_Ethereum_Trading/4779) I subscribed to on telegram this afternoon, I found this information which states that "Ledger Confirmed that the government can get access to customers funds - though I tried to do some research to ascertain the validity of this information, that is, to try and get the real source of the information (since it was not shared on the telegram post) to make sure it's authentic, but all efforts proved abortive since I am not sure about the social media the screenshot was taken from - here is the shot..


Though like I said earlier, I've not been able to verify the authenticity of this information, but then, if this information be true, then I think we all should be very careful with ledger devices - privacy wise.

Let's say we put aside the news regardless, but focus on the discussion which is about the security of users' funds and how to save it, but the things are wallet seeds storage and access to customers' wallets to the government or any other access granted be it authorized or hacked is a violation of user right and ledgers must make full refunds if the user lost any balance on the wallet.

Centralization is spreading wide and Bitcoin users are losing total control of funds and decentralized financing, at this point one needs to keep a close tap with your wallet to monitor what is happening because a lot is happening lately to both decentralized and centralized wallet storage and safety of funds.

This is likely to happen in any way. The ledger's first mistake is to even integrate an option that will allow users to backup their phrases to an online storage (where is the decentralized and privacy protection here?).

We know there is so much concern regarding how users are losing their funds on a daily basis, but those losses are most often caused by user carelessness, which should not be used to justify what the entire customer wants. There could also be a possibility that they might actually have user data, especially for those who got the new wallet after the cloud update.

It's always safer when you don't have access to something at all than having it and telling someone that their secret is safe with you. If the government finds out that users wallet access is in the hands of the ledger management, they can request immediate access to it with any fabricated excuse, and any register company will find it hard to refuse a compliance with the fed.

No, they can't freeze the funds on the user's wallet since those funds are not on a centralized platform but are under each phrase or private key that makes up the wallet. You can always import your phrase using another wallet and move out your funds, but what they can do is help you empty your wallet and send you a notification to come clean and claim your funds.

You can lose your seeds, your keys, your coins if you lose 2 or 3 shards. It can be from a subpoena or data breach or hacks any two of three shard providers. You don't know what will happen with those providers.

That is very bad as your seeds, keys will no longer be only controlled by you. After they made that announcement on the firmware upgrade on 16 May and got massively panic responses from communities, they tried to say the initial announcement is lack of details and claim that they will make their wallet open source soon.

I don't trust them so neither you. It is safest to control your keys only by yourself and hardware wallet is only one of way to achieve it. Ledger hardware wallets now are no longer provide you that security.

This is more likely a security concern than privacy. It said an "option" but you can chose to ignore it.

I don't know what kind of thoughts Ledger have when they can't held responsible of the customer data breached incident happened to them before and now they will try to have a service to "protect" their users on their very own storage cloud service, the audacity.

I do not know how true that is, but without the news, we should know that you have no privacy if you opt-in for (that kind of) third-party backup. Keep your seed phrase offline as usual and never believe in anyone. Bitcoin should be used not in a way you have to trust anyone.

There is nothing happening to bitcoin decentralization, it is still intact. Some people will only just not have the knowledge and fall for this kind of thing, just as some people prefer to store their coins on exchanges.

I did watch on youtube this issue with the ledger which seems to have a problem or issue. And the solution made by the ledger is for their users that if the seed phrase is lost, they can still recover it by accessing the fund here.

       But many people are worried about this because it appears that the users have no privacy because they will be asked for KYC, something that is not good in my opinion. Maybe just replace it with another hardware wallet that is better than the ledger, after all there are also many newly released hardware wallets that are better than the ledger and more secure.

if this is confirmed to be true then I think many people will not use this wallet anymore because the government can have access to it.
for me, the only hardware wallet I trust now only Trezor Wallet, they will stay like this and not make the same steps as Ledger did.

This is very alarming. I didn't know that the government could access customers' funds. It is important to store your seed phrase offline in a safe place. This will help to protect your funds from unauthorized access.

I’m not updated on what’s happening on Ledger but this news makes me regret on buying this piece shit instead of trezor or other hardware wallet. I thought Ledger is the best due to the wide support of the crypto community but they proven useless in the presence of regulators. I think they are being pressured by regulators to do this kind of stuff from behind since they are perfectly producing ledger hardware wallets without a problem for a long time.

Please enlighten me, Does this firmware update is mandatory or I can ignore the latest  update and still use my hardware wallet normally. This recovery feature is bullshit and now they are making it worse by allowing the government to access my keys.

And....it's not like anyone did not think that once you upload your seed to a someplace else that the government could not get to it.

Let's also be honest here, if the government shows up at your house with a court order / search warrant unless you want to spend some time in jail or have the finances to fight them it's not like you are not going to give up the same information. We would all like to say that there is no way we would give it up, but lets be hones with ourselves. There are very few people here that would spend tons of money and risk jail just not to give up some information.

* Unless you were committing other crimes and wanted to hid it.
** It's still a really crap idea to give up your private keys to ANYPLACE else
***Ledger has had so many issues in the past that it's probably worse to give them your keys then some other people.

-Dave

Haha Seems funny or What? Are they really trying to say that they are hypocrites (but they are not because we already know the reality) and they want to ruin their reputation? Are they trying to say leave us if you are using our products because now we are gonna sell up your fund's details to the government, and gonna give them access to your funds because you wanted self custody and now we are gonna remove it?

Why we choose hardware wallets because these are cold storage and feel safer and now they gonna watch out for our activity and gonna give access to our custodial funds so somehow our own funds can be used to blackmail us. Seems like a new found by the regulators to target the main feature that the community owns (Self Custody).

I agree with you on that, and I do not doubt the decentralization of Bitcoin, and what we must settle with is that self custodial wallet is the best form of Bitcoin ownership and security, and anything outside that in the form of third-party storage is targeted to take control of your asset.

Not only about Ledger in this case. Almost every entity is willing to give out your information to government if found coupable or under serious investigation. Anyone who wants to live a 100% private life should also ensure that there is no cockroach in his/her cupboard. The government is too powerful and I have learnt from others mistake so many times. The government is not isolated but connected.
If you want to be private, just go there 100% and pay any amount it will cost to be private. Once you are exposed in one way, they will get you from the loophole.

Even if Ledger doesn't disclose your funds to government, if the government come for it themselves, you will surely disclose it.

No doubt about it! This has been confirmed by multiple Ledger officials, so it is pretty solid information. Ledger has made it clear that for their "Recover" service, they will be handing over user's private data to external companies registered in the EU and US. It is not surprising, really. We all know that law enforcement agencies in those jurisdictions collaborate closely when it comes to investigations and prosecutions.

So, it is pretty obvious that if any legal issues come up, there is a chance that user's private information could be accessed and used in those investigations. It is definitely something to keep in mind when considering the risks and benefits of using such a service.

It is a bit sad, though, that many newcomers to the crypto might not be aware or concerned about these aspects. It is just like when people trusted centralized services like the FTX exchange to hold their funds, and we all know how that turned out.

I think that it was cheaper and more compact than Trezor. I'm talking about 2019 when I bought mine. At the time it was a decent option and I've got mine in person from a physical store, so I did not have to share any personal information with Ledger and avoided the leak.
As long as the cloud update isn't enforced and you can decide not to do it (unless you cannot, but you should be able to, at least for now), I see nothing wrong with this. The problem will start if they one day decide that unless you do the update you won't be able to use the device. In such case I'll probably do it and immediately move my funds, to protect them from theft.

It's still an opt-in feature but it's crazy that it might go enforced to everyone if they want to. This is crazy in all honesty.

I have been advocating to never store private keys and/or seeds to any cloud storage and services and even if it takes Ledger to make them trustworthy, I will still not keep my seeds there.

The twist is that, it's not them that will keep the seeds but by a trusted third-party of theirs and that's even make it more scarier because even it is them that shall keep it, no way and I'll never entrust it to them.

Even though there is an option to ignore, the community will be very worried about the policies they make, what will happen if they are required to store data in their cloud?

Of course it will be a lot of contra to what Ledger is doing recently, I even saw several videos of several communities having switched to other devices because they no longer believe in Ledger as secure hardware even though there is a security service that they make.

Point taken. It's peer to peer, not trust your peers in the bitcoin industry. This only solidifies that notion. Now this means you literally can't have anyone get a hold of your bitcoins otherwise you risk losing them through hackings, and now through the government issuing a subpoena and therefore accessing your funds which I must say is a massive dick move. I'll stick to cold wallets that would never see the light of the internet except for rare occasions. Can never trust anyone anymore these days. Everything starts as an opt-in feature, and then through the sheer pressure of the government or the userbase, they'll soon start implementing it as a mandatory feature. You can't make this up, this has been the staple in this industry.

Ledger is working closely with the government that's what it is. They may not even need a subpoena to access your account. They'd just go ahead and go ahead and because it's not an opensource the Ledger company could even freeze your coins if not sent to another wallet.

For users who bought a Ledger wallet and have used it before this update, there must have been paranoia already. If I did have a ledger, I must have sent my coins already the day after the announcement.

If we happen to access a centralized service and leave our information there, there is really a possibility that the government can acquire information about us.  And since Ledger is saving private keys no matter how many different online storage they use or how many part they cut our private key or seed phrases, they will be revealed once the government issued a subpoena requesting details about our Bitcoin address.  Remember being centralized service, they are bound to follow government regulation and have to answer to government inquiry especially when they have a court order asking for the users details.

I hope they won't make the same mistakes as Ledger though. I still trust Trezor but who knows what the future holds? Personally, I prefer to store my funds in an air-gapped device that I set up myself rather than relying on a company's product. There's always a risk involved when you entrust your money to any device that you can't fully control.

With an air-gapped device you ensure that you are the only person with access to your PC/phone minimizing the risk of anyone messing up with it.

In my opinion, the biggest takeaway from this case is that we should not trust closed source wallets. When it comes to hardware wallets, the safest options appear to be those that are completely air-gapped. This means the ones that do not connect your hardware wallet to any form of internet connection. For example, they use QR codes and a camera to sign transactions. What are your thoughts on this?

Their Former CEO (2014-2019) has indeed said this. To clear doubts, this is the post link:


If you go to u/murzika's (https://www.reddit.com/user/murzika/) profile, you'll see he's the one of the mods on r/ledgerwallet and has the "Former Ledger Chairman and Co-Founder" flair on his posts.

It is too late for ledger as major trust has been broken ever since they announced cloud backups. It's pretty clear they rather prioritize profits over their users security. Unfortunately for them, not everyone does not know what they're doing.

Yes, although someone doing air-gapped should be at least technically incline and knows what he/she is doing. But I think this is the best method instead of buying 3rd party hardware like Trezor or Ledger that might give access or our wallet to the government and that doesn't sound good to crypto or Bitcoin holders.

It's worth a try to learn how to set up our own air-gapped machine now with this latest admittance from Ledger itself.

There are other closed source wallets not just this two in my opinion. So if someone is looking for a hardware wallet, just be sure what and where you are going to buy the items, IMHO.

The choice of cloud storage by ledger is one development that has affected the company's trust and there is no doubt the fact that their focus is more on profits rather than customers satisfaction and guaranteeing privacy and security.

Because storing user sed phrases online is the same as exposing them to third parties and there will be a lot of hack attempts to gain acto those stored details.

the stupid part of all this is..
.. they offer a service to back up your seed incase you lose it... but.. to access the seed in a cloud you need.. yep to remember a key..

in short
"if you think you will forget your key give it to us, but you will need a key to get it from us"
kind of defeats the purpose.

if your able to successfully remember the key to get into the cloud then you know how to remember a key. and thus dont need a cloud backup.
or the flip side if you are forgetful. you will forget your cloud key. thus lose both

anyways. lesson to learn
what a hardware wallet is suppose to do, is just sign a raw tx. thats all it should do. never needing any updates never having ways to take the key out of the device to communicate with a computer. never needing to do anything special that can compromise the key.

if new signing policy or tx format came out people should buy a new device if they want to use a new feature. because if a device is firmware upgradable then hackers can abuse that exploit, not just the manufacturer.

the whole idea of hardware wallets was secure hardware store of a key which could not be moved to a computer or accessed by a computer especially not one that can then transmit the key to the internet, nor have a system where the firmware of device can be compromised, edited, updated to change the security

so to whomever is going to make the next gen hardware wallet. let it do one simple job without needing any resources of a computer bar being given a raw tx and taking back a signature. no on PC app or browser extension. no firmware update capability. no online backup, account... just be a friggen hardware wallet as described

Hack attempt may be useless, or the chance is low because the seed are encrypted, just like Shamir encryption. The seed encryption are in three, which would be enough to recover the seed phrase if the correct shared are used. The shared are given to two other companies and the first one with Ledger.

Although, hacking is possible, but the chance is low. The main problem now is the convenience that people can have that nobody knows their seed phrase. With Ledger, that convenience is no more there. People should stop using Ledger wallets.

The worst are the authorities. Ledger has used this opportunity for the government to have more control, but making their users to have no privacy like before.

Maybe no pressure from the government but it's actually part of their plan and no customer can stop them from doing so.

We can't do much with it but they don't know that this will impact their userbase if ever they've been pushing this to most of their users. AFAIK, they're already seeing the reaction of the market that they've got on it and it's not the typical feedback they want to see.

Because everybody doesn't like it, techy and non-technical people are easily understanding where they are coming from and this is no good for an individual.

The current sitting CEO has also confirmed this in a podcast - there's a short clip in the link:


Although he tried to downplay it by saying it's not a real concern, we all know how hostile the governments are/can be to cryptocurrencies hence you never know + this breaks the concept of self-custody.

Why should people pay to get additional risk on their way?

Unfortunately that is the case for the vast majority of newcomers. They are all so behind and there is so much to know, a crypto education is almost needed. All the scams, pitfalls, technical jargon, hardware, software, industry trends and all of the different coins and exchanges and so on and so forth. It'll be hard enough for them to get all this information downloaded into their brains, knowing who and what to trust to store your coins is also highly subjective and so many options out there make it very hard. A crypto education program would be highly beneficial.

With this and Ledger Recovery Service, Ledger makes more fear among their customers and I am sure many of Ledger users will consider and already chose to use other hardware wallets.

The answer from Ledger CEO is risky but see why do we need a non custodial wallet, buy a hardware wallet, Ledger. Then if government send a subpoena to Ledger company, they will get keys of our coins.

It is not how hardware wallets were created and if a hardware wallet no longer provides such products, no reason to use that hardware wallet.

And who, in your opinion, should start and run that program? It would be a little strange to expect governments to do this, because as much as it seems to some that they (governments) approve of certain things, Bitcoin is still a small thorn in their side that is causing them a little embarrassment for now, and all the chaos you describe is going to their advantage.

The more confusion, doubts, hacking and loss of funds, the greater the advantage of those who are against all that. After all, in some conspiracy theory, we could say that Ledger was bought by a government to use it as a Trojan horse to gain control over everything that these devices store.

This is a great question Lucius, IMO It would need to be a completely autonomous program and user guided, maybe kind of like the Khan Academy but specifically for crypto. It should not be free though, but charge some small nominal fee to gain access, like a Wikipedia on steroids. Maybe could even be a group effort to make this a reality where everyone contributed and the content sticks based on merits or votes from experts/devs etc. AI can help create the videos that explain and lessons that teach entry, mid, and advanced levels.

There are many free resources to learn about Bitcoin so do you think paid courses will be better and provide more comprehensive knowledge for learners?

Learnmeabitcoin.com (https://learnmeabitcoin.com/) from Beginners to Advanced levels.
Saylor Academy - Bitcoin for everybody (https://learn.saylor.org/course/PRDV151)
Saylor Academy - Bitcoin for developers (https://learn.saylor.org/course/CS120)
Jameson Lopp blog (https://www.lopp.net/bitcoin-information.html)

There are enough free resources and tech gurus in communities to help them learning. If they want to debut their learning, they can do it anytime.

Nobody truly values something that they got for free, just look at the free public school systems. Do you think those educations are highly valued and beneficial and equipping students for financial independence? If they pay for it then the people who add the most value to the lesson plans can get paid, now we have an incentive system to have a completely non biased merit based learning platform that anyone can access, for a small fee. So many times people will start free courses and stop, at least this way I feel most people would want to get their money's worth...  just a thought.