New Ledger firmware updates are coming shortly

[Pmalek]

Ledger has released new firmware updates for Nano S and Nano X hardware wallets. Like in the past, users will be able to update their wallets gradually.

These are the information for the new Nano S Firmware version 1.6.1.
This is for Ledger Nano X Firmware version 1.2.4-4.

For Nano S users this is a smaller update.

Ledger says it will

mostly be focused on additions for exciting upcoming features. For example, the BLS12-381 G1 cryptographic curve has been added.

There will also be less of a delay when installing and uninstalling apps from your Ledger Nano S after this update.

A new change in the update process for both devices is that users no longer need to connect and disconnect their device. it's now a one-click process.

The Nano X MCU chip will be upgraded to patch some small vulnerabilities.
More info about the mentioned vulnerability can be found here.

[1713557901]

1713557901

[1713557901]

1713557901

[1713557901]

1713557901

[o_e_l_e_o]

Added cryptographic support for the Stark 256 curve. This will allow the support of Starkware applications.
Added cryptographic support for the BLS12-381 curve

Am I right in saying this is all necessary for Ethereum 2.0? What are Stackware applications? A very quick internet search seems to suggest it is a second layer scaling solution for Ethereum. Why am I being forced to sacrifice some of the very limited space on my Nano S to support something I will almost certainly never use?

What happened to holidays and COVID delaying all work and updates? We can roll out support for some niche use of an altcoin, but we can't patch critical vulnerabilities that we've known about for months?

As time goes on, I am more and more leaning to wards scrapping hardware wallets altogether and just using encrypted airgapped storage for everything.

[Lucius]

Pmalek, firmware update for Nano X is already old news - it is posted here -> Ledger Nano X Firmware Update

Why am I being forced to sacrifice some of the very limited space on my Nano S to support something I will almost certainly never use?

I asked similar questions in the thread I linked, and what I read from Ledger is that they want to keep S&X model equivalent in functionality, but this must of course be to the detriment of storage in the Nano S. Size of storage for apps is now 4kb smaller, and that is one of the advantages that the Nano X has. If Ledger continues to provide firmware support for Nano S, it will probably be possible to have max 1-2 apps at the same time.

fabnormal
Ledger Product Innovation7 points ·
21 hours ago
Unfortunately, it's a difficult trade-off. On the one hand. we'd like to keep the Ledger Nano X and Ledger Nano S equivalent in functionality, on the other hand, this will come at the expense of app capacity on the Ledger Nano S. For this update, we are happy it's only 4 kb considering the changes that were made.

Important notes for anyone who does not visit the links from the OP

- you need to have firmware 1.5.5 in order to update to 1.6.1
- you need to update to the latest version of Ledger Live
- firmware is not available for all users in the same time (progressively rolled out)

[Pmalek]

Why am I being forced to sacrifice some of the very limited space on my Nano S to support something I will almost certainly never use?

I agree with you. A standalone Bitcoin firmware would be one way to go. I doubt we will see that though. Ledger is a multi currency wallet and because of that we will have to accept things like this or find other solutions.

Pmalek, firmware update for Nano X is already old news - it is posted here -> Ledger Nano X Firmware Update

Yeah, you are right about that. The way they made their announcement made me think there was another Nano X firmware as well.

New firmware updates available for both #Ledger Nano X and Nano S!

Follow the instructions on Ledger Live.

Learn more on the updates:
Ledger Nano S - https://bit.ly/2PILEnX
Ledger Nano X - https://bit.ly/3gOLasf

https://www.facebook.com/Ledger/photos/a.802170596506829/3298903483500182/

[hugeblack]

Yeah, you are right about that. The way they made their announcement made me think there was another Nano X firmware as well.

The company has lost a lot of its good reputation over the past few days, so unless they update, I expect them to lose part of their market share in the future.
Generally, there is no real competitor for the two companies so development will be very slow.

It is best to lock the topic because the scammers are looking for updates to scam people into installing malware.

[Coin-Keeper]

 A standalone Bitcoin firmware would be one way to go. I doubt we will see that though. Ledger is a multi currency wallet and because of that we will have to accept things like this or find other solutions.

I was wondering the same thing.  On a few of my Trezors I have bitcoin-only firmware, which is great for devices only running BTC.  I wish Ledger offered the same option.  Its not only space but logic would tell you that more coin "software" offers at least the opportunity for attack surface, and if you don't need alt's then why have the extra software?  I run about 75 % on btc only, but I play with alts on a few hardware wallets.

[The Sceptical Chymist]

As time goes on, I am more and more leaning to wards scrapping hardware wallets altogether and just using encrypted airgapped storage for everything.

Similarly, I'm starting to wonder whether HW wallets are really necessary for long-term storage, because as you mentioned you can do that by storing your private key(s) without using a device.  I have to say I do find it convenient to be able to store a large number of altcoins in addition to bitcoin on something like a Ledger.  No doubt there are other ways to do this that don't require you to purchase a device, but I've become a fan of the Ledger.

The company has lost a lot of its good reputation over the past few days, so unless they update, I expect them to lose part of their market share in the future.

You think?  You guys probably know I'm not a tech-savvy person, but I don't see a reason anywhere in this thread which would lead me to believe that the above statement is true.  Am I missing something, or could someone possibly dumb it down to my level?

[HCP]

The company has lost a lot of its good reputation over the past few days, so unless they update, I expect them to lose part of their market share in the future.

You think?  You guys probably know I'm not a tech-savvy person, but I don't see a reason anywhere in this thread which would lead me to believe that the above statement is true.  Am I missing something, or could someone possibly dumb it down to my level?

Maybe not so much in this thread... but have a read of some of the other threads regarding recent events around vulnerabilities and the way they were handled... like putting the testing off for 3 months during agreed "responsible disclosure" period due to resourcing issues around "covid" etc, and then magically getting it released a day after the guy went public when the period expired... While in the meantime they have added a ton of "useless" shitcoin features etc.

And then the PR shitstorm when they had the data breach on their ecommerce platform.

And of course, the fact that they keep ignoring some features like "Coin Control" while continually putting more and more altcoin support in... and now, they are arguably making the Nano S UX "worse" by taking another 4k of the already limited memory.

I get that it's a juggling act for them, and they're simply not going to please "all the people, all the time"... but, as of late, they are not really improving things for my use cases, tbh

[o_e_l_e_o]

Similarly, I'm starting to wonder whether HW wallets are really necessary for long-term storage, because as you mentioned you can do that by storing your private key(s) without using a device.  I have to say I do find it convenient to be able to store a large number of altcoins in addition to bitcoin on something like a Ledger.  No doubt there are other ways to do this that don't require you to purchase a device, but I've become a fan of the Ledger.

I've never used hardware wallets for long-term storage. My set up is the majority of funds in encrypted airgapped cold storage, funds that I am actively using/moving/trading/spending on a hardware wallet or two, and a very small amount on a mobile wallet which I carry with me. Given all the recent hacks and vulnerabilities being exposed with hardware wallets, I'm considering just moving almost everything over to my airgapped computer. For the sake of an extra minute to boot it up and scan a few QR codes, I think the extra peace of mind is worth it.

I don't see a reason anywhere in this thread which would lead me to believe that the above statement is true.

Although this bug couldn't possibly have affected me due to me not using any of the altcoins which were vulnerable, it was how they handled it which was the issue. Time and again we see bug and vulnerability fixes being delayed, bitcoin features being delayed, ease of use features being delayed, but they focus on shitcoins and privacy invading KYC trading. That's not the kind of behavior I want from my hardware wallet.

[Lucius]

Given all the recent hacks and vulnerabilities being exposed with hardware wallets, I'm considering just moving almost everything over to my airgapped computer. For the sake of an extra minute to boot it up and scan a few QR codes, I think the extra peace of mind is worth it.

I have already written somewhere that I have less and less confidence in hardware wallets, and all the recent events worry me even more because as a user I wonder what's next, and will I wake up one day and see 0 on my balance. I remember thinking the same thing a few years ago for a desktop wallet, which just means that we really need to look for some new solution that would be resistant to things like this that appear with both major players in the world of hardware wallets.

Still, I want to believe that Ledger will change his approach after all and put safety first. If some other similar nonsense happens on their part, they will definitely lose credibility, and some say it has already happened - especially those whose complete data has been hacked and are now probably sold somewhere on the dark web.

[Coin-Keeper]

  Still, I want to believe that Ledger will change his approach after all and put safety first. If some other similar nonsense happens on their part, they will definitely lose credibility, and some say it has already happened - especially those whose complete data has been hacked and are now probably sold somewhere on the dark web.

Yep, that was a sh** storm for sure.  I always buy my hardware wallets using mixed BTC and have them mailed to an address that does not come back to me.  Its worth the extra few minutes to not leave a web trail that leads anywhere meaningful against me.

[HCP]

And once again it would appear that I'm going to be waiting days to get the new firmware update. 3 days and it still isn't showing up in Ledger Live as being available:



Thankfully this isn't a "critical" update for fixing a security vulnerability etc.

[Lucius]

And once again it would appear that I'm going to be waiting days to get the new firmware update. 3 days and it still isn't showing up in Ledger Live as being available

I've been waiting more than 3 weeks for Nano X firmware, but I haven't really checked several times every day although I don't know if it would have any benefit. The question is whether the availability of firmware changes during the day and on what principle it is determined who will get the opportunity to update and when. The only thing that makes sense to me is that Ledger releases firmware based on certain countries, and uses IP users for detection.

Have you perhaps tried using a VPN with different IPs? I haven't tried to update Nano S yet, but if the update isn't available to me, I'll try different IP addresses to see if it works.

You must be exaggerating a little bit, I never heard that private keys generated by Ledger on the base of 24-words-phrase-plus -extra-password are vulnerable. Or do you think you have some proof?

There is no evidence that such a thing is possible, but this is about preventing possible damage in the future due to the fact that companies that produce hardware wallets have had very big problems lately. If something is not possible today, can you be sure that it will not be possible in a few months or years?

BTW, unless it's not a top secret, what wallet do you use for the cold storage?

I'm considering just moving almost everything over to my airgapped computer.

It can be any desktop wallet, but what matters are that it is on the airgapped computer - which means there is no internet access.

[stompix]

Why am I being forced to sacrifice some of the very limited space on my Nano S to support something I will almost certainly never use?

Hihi, reminds me of windows 10 making my old 32gb ssd obsolete.
As a user who doesn't care for any features or other altcoins and just for security indeed it's a bit frustrating seeing other things being made priority.

The company has lost a lot of its good reputation over the past few days, so unless they update, I expect them to lose part of their market share in the future.

You think?  You guys probably know I'm not a tech-savvy person, but I don't see a reason anywhere in this thread which would lead me to believe that the above statement is true.  Am I missing something, or could someone possibly dumb it down to my level?

Nope, they will not lose a huge chunk of their sales just because of the recent stories, as it happens with all companies that go public and get a lot of new users from the second and third generation those care less and less about some updates gone wrong, a security breach or any other things as long as they check and see their balance is still there and the device keeps working. To sum it up, they've gone commercial, like any other company they are looking for sales and userbase

That being said I'm still holding on to my ledger, but with every pending update, I am looking more and more anxiously for feedback about it, if anything went wrong.
Seems like this one has no troubles....yet

[Coin-Keeper]

I just wish they would make their code public so I and others could go through it and see what is being changed, and how it "ticks".  Call me old school but open source sure makes a person sleep better at night.  Bad actors attack open source but good coders resolve known bugs quickly, and then you have rock solid and OPEN SOURCE code that makes you know its good.  Hate closed source, which is why I run from devices using it.  Its also why I left Windows for Linux years ago.


Ledger is such a fine device but keeping coders in the dark is a mistake, IMO.

[dkbit98]

Hihi, reminds me of windows 10 making my old 32gb ssd obsolete.
As a user who doesn't care for any features or other altcoins and just for security indeed it's a bit frustrating seeing other things being made priority.

Ledger software sometimes reminds me on Windows Vista software. (read more about Windows Vista if you never heard about it).

[Husna QA]

My friend got the news that there is a problem stuck while updating the firmware because the update server is overloaded (whether this is true or not). But a few days ago I got a nano x firmware update notification on ledger live and managed to update the firmware and some installed applications to the latest version.

[o_e_l_e_o]

You must be exaggerating a little bit, I never heard that private keys generated by Ledger on the base of 24-words-phrase-plus -extra-password are vulnerable. Or do you think you have some proof?

Not for Ledger - at least, not yet. I used to use a Trezor device as well, but wiped it after the critical vulnerability which allowed the seed phrase to be extracted was revealed. This recent bug with Ledger was just as bad though - potentially allowing an attacker to steal all your coins - even if it didn't actually compromise the seed phrase or private keys directly.

BTW, unless it's not a top secret, what wallet do you use for the cold storage?

I use Electrum mostly, but as Lucius says, the client is less important than the fact it is on a computer which has no internet access, has no capability for internet access (WiFi and Ethernet cards physically removed), and uses full disk encryption.

Nope, they will not lose a huge chunk of their sales just because of the recent stories, as it happens with all companies that go public and get a lot of new users from the second and third generation those care less and less about some updates gone wrong, a security breach or any other things as long as they check and see their balance is still there and the device keeps working.

Yeah, agreed. If people were sensible and stopped using companies which had terrible security practices, then blockchain.com's wallet would have been obsolete years ago rather than still being one of the most commonly used wallets.

[Pmalek]

Wow, right now I have updated my nano S to 1.6.1.  

Did you notice any improvements in the speed of installing/uninstalling apps? According to the info they released, this new firmware is supposed to make the installation of apps faster. Not that it really matters, at least to me.

And once again it would appear that I'm going to be waiting days to get the new firmware update. 3 days and it still isn't showing up in Ledger Live as being available:

I noticed a link to download it the day after it was released. I have not done the update yet. Planning to do it after work today. I have no idea what factors they use when determining who gets it and at what time. I got it quick this time, but had to wait longer for the 1.6 release.

[HCP]

Well... it "only" took 5 days for the firmware update to show up in Ledger Live...



The update itself was easy and painless:



And it prompted to re-install the apps I had prior to the update:



And, having updated all the apps a day or 3 ago, I can definitely say that it installed them a lot faster this time! So, that's a nice little bonus I guess... but as we can see, we have indeed lost 4kb of storage... now down to 156kb from 160kb prior to update.