How To Verify the Downloaded Version of Ledger Live

[o_e_l_e_o]

Reason I didn't download directly from ledger site is because people mention you need to make sure to verify the signature of the download and I didn't know how to do that... so I didn't download download any update since then.

An attacker who can compromise the Ledger website and make it link to a malicious download could equally compromise whichever server Ledger Live connects to when you hit the "Update" button and make that point towards a piece of malicious software too.

With any piece of software, just downloading it from the "correct" source (while good practice) is never enough to ensure your safety. You should always verify it against the developer's keys or hashes.

[HCP]

Reason I didn't download directly from ledger site is because people mention you need to make sure to verify the signature of the download and I didn't know how to do that... so I didn't download download any update since then.

It's really easy to verify the download... Ledger have all the information here: https://www.ledger.com/ledger-live/lld-signatures

The first page of this thread gives plenty of details on how to go about doing it.

An attacker who can compromise the Ledger website and make it link to a malicious download could equally compromise whichever server Ledger Live connects to when you hit the "Update" button and make that point towards a piece of malicious software too.

With any piece of software, just downloading it from the "correct" source (while good practice) is never enough to ensure your safety. You should always verify it against the developer's keys or hashes.

And then Ledger say things like this:

What about automatic updates

The update mechanism is secured once you've verified and installed Ledger Live. Ledger Live checks each upcoming update against Ledger's public key to verify that the update is legitimately from Ledger.

Seems they've set up Ledger Live to automatically authenticate any updates that it downloads... so, theoretically, once you've verified the installer once, you shouldn't need to do it again if you're using the in-app update mechanism... Would be interesting to see how robust this actually is.

[Pmalek]

<Snip>

You are asking the same questions and coming to the same conclusions like you did yesterday. If the update Ledger Live button is available on your computer and current version of LL, just click on it and update to the newest version. I wasn't joking when I said it yesterday. If you feel like verifying the authenticity of the downloaded software, just follow the step-by-step instructions in my OP. It's simple.

[jerry0]

Hey.  Well back then, I always clicked on the update on the top right corner in ledger live whenever i saw an update available.  I always did this until few month ago when there was a ledger live update and people said you had to download it directly from the ledger website... so because of that... I didn't want to do it.


So to confirm... just updating right now on the top right corner on ledger live would never be an issue right?  Again, that is how i always used to update ledger live whenever i open ledger live and there is update available, i always update.  But because of what happened last time, i just decided to wait. 



You can't verify the download when clicking on top right corner of update on ledger live right?

[Pmalek]

Hey.  Well back then, I always clicked on the update on the top right corner in ledger live whenever i saw an update available.  I always did this until few month ago when there was a ledger live update and people said you had to download it directly from the ledger website... so because of that... I didn't want to do it.

I really have to ask... Are you receiving regular and repeated blows to your head or something? Click the update button to update your version of Ledger live, what's wrong with you?

You can't verify the download when clicking on top right corner of update on ledger live right?

How would that verify anything? The update button does what its name suggests. It updates the software to the newest release. You have to do the verification yourself as explained in the OP. 

[HCP]

How would that verify anything? The update button does what its name suggests. It updates the software to the newest release. You have to do the verification yourself as explained in the OP. 

As I mentioned earlier, Ledger Live claim that it is automatically verifying the download for you when you use the update button...

What about automatic updates

The update mechanism is secured once you've verified and installed Ledger Live. Ledger Live checks each upcoming update against Ledger's public key to verify that the update is legitimately from Ledger.

So, theoretically, there is no need to verify anything if you use the "in app" update button... you only need to manually verify the installers that are downloaded manually.

[jerry0]

Okay so I clicked on update now on ledger live.


Its showing


Downloading update...



But its taking a very long time.  Is this normal?  Again I haven't did any ledger live update through ledger live in months since last time it was mentioned you had to do it through the website so I didn't do it for months.


Previously whenever I click on update in top right corner of ledger live, it was very fast and then I clicked on download now etc.

[Pmalek]

As I mentioned earlier, Ledger Live claim that it is automatically verifying the download for you when you use the update button...

What about automatic updates

The update mechanism is secured once you've verified and installed Ledger Live. Ledger Live checks each upcoming update against Ledger's public key to verify that the update is legitimately from Ledger.

I understood the bolded part as a suggestion to users to still verify one instance of Ledger Live before they install it. After that, Ledger will carry out the other checks for all future updates. But you know the saying: Don't verify, update!" It shouldn't matter what Ledger says.

But its taking a very long time.  Is this normal?

Yes, it's normal (he said hoping you would stop asking unnecessary questions). Just make sure you have a priest present in the room to provide your software with the needed blessings. He should also be able to speed up the download time.   

Again I haven't did any ledger live update through ledger live in months, etc., etc., etc.

Oh good. It's been almost a day and I was worried that you wouldn't tell us that you haven't done any Ledger Live updates in months. Thanks for that. See you tomorrow where I expect you to tell us how long and why you haven't done any Ledger Live updates.

[jerry0]

Well... can anyone here confirm if it can still be downloaded on the ledger live app or not?


It has the


Update to Ledger Live Version 2.32.2 is available



When I click download update, it does show downloading update... but it takes a very long time and nothing seem to do anything?  I had tried to download it... then I notice because i was idle on my computer, well ledger live would automatically sign you off etc.  So i go and sign back on... then download update, make sure i move my mouse frequently to make sure ledger live doesn't sign off... still downloading.



Previously any ledger live update I clicked on when using ledger live... it was pretty quick. 



I checked reddit and apparently other people seem to have the same issue.  So does one need to download it straight from ledger website or not?  Or does anyone have an estimated time of how long it takes to download this update?  As you know when you download the update straight from ledger live... it doesn't show you like how much percentage of it has been downloaded etc... so you just wait.



Also even if you are using an older version of ledger live... as long as it show synchronized.... that means your balance is correct right on ledger live?

[Maus0728]

I checked reddit and apparently other people seem to have the same issue.  So does one need to download it straight from ledger website or not?

As far as I know, if your Ledger Live is below v2.29.0, the application recommends you to download their latest version from their official website due to major changes^[1]. So I think you should be downloading it on their official site and make sure that you have verified the signature.

[1] Ledger Live 2.29.0 - Windows Users

Also even if you are using an older version of ledger live... as long as it show synchronized.... that means your balance is correct right on ledger live?

Yes. The balance you are seeing depends on the accounts added on your Ledger app.

[Pmalek]

Ledger has released version 2.33.1 of their Ledger Live software about a week ago.
This would be a good opportunity to verify the installation binaries and the SHA-512sum hashes if you have never done that before to learn something new maybe.

[jerry0]

Okay im going to finally update ledger live.


Again Im still using the old ledger live and that is 2.26.1


Right now it shows Ledger Live 2.33.1.


So anyone here had success upgrading ledger live as is when going from a much older version?


So we have to download it directly from ledger site then no matter what?


Im going to do it later so want to make sure as I will be downloading it from ledger site.  But again even though its posted how to check the legit files, i want to make sure I do it right.

[jerry0]

Has there been even one case of someone downloading ledger live from the correct ledger site and then downloading malware?


Again I want to verify the ledger live but all this hash sum and these things... are not that simple.  So you need to download a hash on a different site before you download ledger live?


I can't imagine for the average user that doing something like this is simple




Ledger site posts this to verify

https://www.ledger.com/ledger-live/lld-signatures




If you just look at that... how do you even know where to look for the hash etc.

[jerry0]

https://www.ledger.com/ledger-live/download


I am downloading ledger live from the site.


Now when i look at verifying the files... we also need to download another program?   I see its called hashbit.  How do you make sure a program like hashbit is malware free etc?


Is there a way to check the signature of ledger live without downloading another program?  Obviously you first download ledger live from the website... but can you verify it without downloading hashbit?  Im using windows ten pro if it matters.

[Pmalek]

So we have to download it directly from ledger site then no matter what?

You don't need to download anything from Ledger's site just for the sake of updating, but you need to download the installation file whose authenticity you are verifying. 

But again even though its posted how to check the legit files, i want to make sure I do it right.

The thread and the replies by other members show how to do it right. Don't ask questions for every step of the process. Everything is explained.

Has there been even one case of someone downloading ledger live from the correct ledger site and then downloading malware?

I just checked with all people on earth who use Ledger Live. The answer is negative.

Again I want to verify the ledger live but all this hash sum and these things... are not that simple.  So you need to download a hash on a different site before you download ledger live?

You do it exactly the way it was explained in the OP. That's why it was written in the first place. It wasn't written so that Jerry can ask whether or not it's the right way to do it.

I can't imagine for the average user that doing something like this is simple

My condolences.

If you just look at that... how do you even know where to look for the hash etc.

By reading what is written on the site from top to bottom. You can do that, right? Click on all of the links and download them to the same folder.

Now when i look at verifying the files... we also need to download another program?   I see its called hashbit.  How do you make sure a program like hashbit is malware free etc?

How have you made sure the other programs on your Windows computer are malware-free? Have you? Have you made sure the Ledger Live app you are using is malware-free? Use Hashbit if you want or try the open-source apps that dkbit98 recommended in one of his replies. Again, read the thread.   

[jerry0]

Well HCP tells me i could do the check with powershell in windows ten and i do not have to download hashtag... which is something i like to hear.


Well he and someone else told me he never heard of one instance of someone downloading ledger live from ledger official site and it being malware as long as its ledgers site.  I mean... does the average user who uses a hardware wallet even does the signature thing?


Checking the signature as explained in ledger live ... the way they wrote it... isn't that simple.  It isn't like... okay download the program.  Before you open it... right click it and check properties and make sure it shows exactly this... like what is shown in the picture here...

[Pmalek]

Well HCP tells me i could do the check with powershell in windows ten and i do not have to download hashtag... which is something i like to hear.

So check the authenticity with PowerShell, that's ok. That's why I told you to read the thread, all the instructions are in the OP and the replies underneath it. If there is a post saying you can do it with PowerShell and explains how to, just follow the instructions and don't ask if that is the way the rest of the world does it.

Well he and someone else told me he never heard of one instance of someone downloading ledger live from ledger official site and it being malware as long as its ledgers site.

Well there you go, what more do you want? 

I mean... does the average user who uses a hardware wallet even does the signature thing?

You are not an average user. I think everyone will agree with me that there isn't a single member on this forum like you. It shouldn't matter what other people do. Do it if you want to or don't. It's like with Electrum signatures. You verify them to be certain that the software was created and signed by the development teams it's claimed it originates from. If you don't care, don't do it. It's that simple.

Checking the signature as explained in ledger live ... the way they wrote it... isn't that simple.

What do you want me to do about it? What do you want the Bitcointalk community to do about that?
Again, my condolences. I will keep you in my prayers and ask God to simplify the authentification process for you.

[jerry0]

I just downloaded ledger live from ledger site.


One thing i noticed was when i looked at it file without opening it... i right click it and properties.  I notice in the general tab which it opens up...


The bottom shows


Security  This file came from another computer and might be blocked to help protect this computer.



Did any of you also have this message in the ledger live 2.33.1 download?  I took a look at the old ledger live desktop i downloaded which was 2.26.1 and when I right click it and properties, I don't notice that message.




I am going to do HCP method of verifying the signature and could appreciate if someone could clear everything up.



Do I just click on the start menu and type in powershell and then click on windows powershell or right click and run as admin on windows power shell?



Then once I do that


I see a blue screen that shows


Windows Powershell
Copyright (C) Microsoft Corporation.  All rights reserved.

Try the new cross-platform powershell  https://aka.ms/pscore6


PS C:Users/jerry0>


Then press spacebar once... and then type this and enter?


Get-FileHash ledger-live-desktop-2.33.1-win.exe -Algorithm SHA512 | Format-Table -AutoSize -Wrap





I just want to make sure of this before I continue as that security message file came from another computer... i never seen before.  Can you guys confirm this is the correct way to do it without downloading the hashbit etc?


Thing that has me confused is HCP says


You just need to make sure you're in the folder where the .exe is located... if you use Explorer... goto the folder where you downloaded the .exe and then hold down the SHIFT key and right click in an empty space (not on a file or folder) in the window... you should see an option that says "Open PowerShell window here":

[Pmalek]

Security  This file came from another computer and might be blocked to help protect this computer.

Don't worry about the security notification. It happens sometimes when you download something from the internet in Windows. If the file is blocked, you can unblock it yourself. Right click on the file, go to Properties > General, and at the bottom of the screen where you see the security notification there should be an option that says Unblock. Click on it to unblock it if needed and press OK.

Do I just click on the start menu and type in powershell and then click on windows powershell or right click and run as admin on windows power shell.

No, don't do it like that. If you open PowerShell like that, you will have to manually navigate to the destination folder. HCP explained what you should do. After you have downloaded every single item from https://www.ledger.com/ledger-live/lld-signatures and saved them in the same folder, open that folder on your PC. Hold down the shift button on your keyboard while your press the right button on your mouse and click on "Open PowerShell window here". After that, follow the instructions you found.

[jerry0]

Thanks.


HCP helped me with this and it confirms its legit download.