Ledger Live tracks you

[libert19]

Read here: https://twitter.com/rektbuildr/status/1739984215070888316

There is bit of technical jargon there which I don't understand, so you may comment in simple words if you do.

According to thread op, it only applies to Ledger live and not when using Ledger hw via third party wallets, i.e using ethereum with metamask, so there is that, but still to set up for the first time, you still need to use ledger live.

He also suggest to not update firmware unless really necessary.

[NotATether]

Why would hardware wallet companion apps need to track you? Besides making money of course. Because if the only purpose they serve is to bring in additional profit for the vendor, then that means the whole business will probably not be profitable, without this tracking. Or maybe they really just don't care a la Facebook.

[Charles-Tim]

This has been discussed on this thread: Fuck you ledger

Read what cygan posted which is what you are also referring to: https://bitcointalk.org/index.php?topic=5469941.msg63308706#msg63308706

Then start reading from what o_e_l_e_o posted: https://bitcointalk.org/index.php?topic=5469941.msg63322241#msg63322241

I am not a fan of Ledger hardware wallet and I do not recommend it. But in the case, all hardware wallets that are not airgapped can share your information this way.

The only hardware wallets that I prefer to recommend these days are airgapped ones which are open source, like Passport, using them with external wallet like Sparrow or Electrum. But I will prefer to use Electrum or Sparrow on airgapped device instead.

[Pmalek]

We need to stop living in this dream world where it's a huge surprise that software and companies track us. Ledger might be among the worst ones there is, but they are certainly not a unique case.

Owners of Electrum servers know your balance and all your funded and unfunded addresses. It's still a good wallet and the most-recommended one on this forum.

[m2017]

According to thread op, it only applies to Ledger live and not when using Ledger hw via third party wallets, i.e using ethereum with metamask, so there is that, but still to set up for the first time, you still need to use ledger live.

This is not news on this forum for a long time. Many people have repeatedly recommended not to use Ledger live.

He also suggest to not update firmware unless really necessary.

The only problem may be that Ledger can make the latest updates mandatory for installation, otherwise your device will simply cease to be operational.

Why would hardware wallet companion apps need to track you?

Why not? Any company is located in some jurisdiction where the relevant local authorities can put pressure on them.

They would be very interested in receiving statistical data from hardware wallet device users.

We need to stop living in this dream world where it's a huge surprise that software and companies track us.

Right. This is perfect for answering @NotATether's question above.

[o_e_l_e_o]

Owners of Electrum servers know your balance and all your funded and unfunded addresses. It's still a good wallet and the most-recommended one on this forum.

Not only that, but we know for a fact that blockchain analysis companies run servers for light wallets for the sole purpose of harvesting your data. As I said in the thread above that Charles-Tim linked to, if you aren't connecting to your own node, then you are connecting to someone else's node, and they can see all your addresses, all your balances, all your transactions, alongside plenty of unique identifiers such as your IP address, device hardware, device fingerprint, and so on.

Yes, Ledger Live is awful and yes, Ledger are awful, but this kind of data harvesting is pretty much ubiquitous among non-airgapped hardware wallets using third party servers.

The only problem may be that Ledger can make the latest updates mandatory for installation, otherwise your device will simply cease to be operational.

I don't think that's true. You can just continue to use an out of date Ledger device with Electrum or Sparrow without installing any new updates.

[Pmalek]

@m2017
Not that long ago, Ledger made a change in their Ledger Live software that affects the version you are running on your computer. When a new version became available in the past, the software would notify you and ask if you want to perform the update or not. But a few months ago, I read in their release notes that the software now performs automatic updates without asking for your approval. I haven't tested it myself to see whether or not this feature can be turned off.

[zasad@]

I use the Ledger hardware wallet with Metamask, but Metamask also collects user data. It is still possible to find secure wallets for Bitcoin, but it is difficult to do so for altcoins if you want to use hardware wallets. And I think we don’t know about surveillance on other wallets.

[Kruw]

Not only that, but we know for a fact that blockchain analysis companies run servers for light wallets for the sole purpose of harvesting your data. As I said in the thread above that Charles-Tim linked to, if you aren't connecting to your own node, then you are connecting to someone else's node, and they can see all your addresses, all your balances, all your transactions, alongside plenty of unique identifiers such as your IP address, device hardware, device fingerprint, and so on.

You do not forfeit your privacy if the light wallet uses BIP157/BIP158 compact block filters.  Wasabi Wallet, Trezor Suite's coinjoin account, Blixt Wallet, and Zeus all protect your privacy with filters.

[dkbit98]

I use the Ledger hardware wallet with Metamask, but Metamask also collects user data. It is still possible to find secure wallets for Bitcoin, but it is difficult to do so for altcoins if you want to use hardware wallets.

It's not difficult at all if you are not using ledger wallet, but you can't expect anything good coming from most altcoins and their wallets.
Instead of ledger you can use Trezor, Keystone, Bitbox, Satochip, etc. and instead of metamask I heard that Rabby wallet is not bad alternative.

[Pmalek]

You do not forfeit your privacy if the light wallet uses BIP157/BIP158 compact block filters.  Wasabi Wallet, Trezor Suite's coinjoin account, Blixt Wallet, and Zeus all protect your privacy with filters.

Thanks for not forgetting to shill your blockchain analysis-supporting partner wallet.

Instead of ledger you can use Trezor, Keystone, Bitbox, Satochip, etc. and instead of metamask I heard that Rabby wallet is not bad alternative.

Rabby wallet has developed a solution to the blind-signing problem that was recently a big issue following Ledger's Connect Kit hack. The wallet performs a smart contract security check, informing the user what will happen with the balance if they signed the transaction that is waiting for confirmation. Apparently, the wallet lent a helping hand, and the security check showed the users that their addresses would get emptied if they proceeded with the signing process.

[Kruw]

You do not forfeit your privacy if the light wallet uses BIP157/BIP158 compact block filters.  Wasabi Wallet, Trezor Suite's coinjoin account, Blixt Wallet, and Zeus all protect your privacy with filters.

Thanks for not forgetting to shill your blockchain analysis-supporting partner wallet.

You seem to be confused - the design of BIP157/BIP158 filters PREVENTS blockchain analysis.  You can read more here:

https://bips.xyz/157
https://bips.xyz/158