Ledger Live Update

[jerry0]

Just noticed ledger live has a new update.  I assume most people who saw this message on ledger live just clicked download update right?  Version is 2.34.3.



Thanks.

[1715086104]

1715086104

[1715086104]

1715086104

[o_e_l_e_o]

I assume most people who saw this message on ledger live just clicked download update right?

Yes.

/thread

[Pmalek]

Yes.

You want to bet that this is not the end of it?

Here is how I see his next reply:
Thanks o_e_l_e_o. Is this how everyone else has done it? Previously I could just update Ledger Live by clicking on the update button right? Suddenly, it was no longer possible to do that, am I right? Someone said that you had to update it manually by going to the Ledger website, but I didn't do that because I was afraid of downloading malware from phishing links. Does anyone know if someone has been infected in this way? What if I download a fake update, that's possible right?

Last month I didn't have access to my Nano S, now I have access to it because I came home, but I am worried if I am doing it the right way. Are you sure that I can just click the download button? What if I click the button and my coins are gone, that can happen right?

  

[HCP]

Thanks o_e_l_e_o. Is this how everyone else has done it? Previously I could just update Ledger Live by clicking on the update button right? Suddenly, it was no longer possible to do that, am I right? Someone said that you had to update it manually by going to the Ledger website, but I didn't do that because I was afraid of downloading malware from phishing links. Does anyone know if someone has been infected in this way? What if I download a fake update, that's possible right?

Last month I didn't have access to my Nano S, now I have access to it because I came home, but I am worried if I am doing it the right way. Are you sure that I can just click the download button? What if I click the button and my coins are gone, that can happen right?

Looks like jerry forgot to switch accounts. Tagging Pmalek for being a sold account.


Obviously joking

[The Sceptical Chymist]

Yes.

You want to bet that this is not the end of it?

Lol.  Give OP a little bit of a break (or not; it's your choice).  He's clearly expressed interest in crypto and hardware wallets for quite a while now, but he's just a tad more paranoid and perhaps OCDish than the rest of us--and way more paranoid than a bitcoiner needs to be about security. 

And I too downloaded at least 3 different Ledger Live updates in the last few weeks.  One of them was the update to the software itself, and the others were for specific wallets.  No problems, and this is business as usual for Ledger as far as I'm concerned.

[Pmalek]

Lol.  Give OP a little bit of a break (or not; it's your choice).  He's clearly expressed interest in crypto and hardware wallets for quite a while now...

That's OK and I appreciate that. But I assume everyone would like to see that all the suggestions and corrections that people gave him in all these years weren't a waste of time. It just seems that every full moon he becomes active for a few days and asks the same questions over and over again. The "how to download Ledger Live updates" was covered several times already. Before that it was the passphrase issues, storing your seed digitally, and stuff like that.

No one (including myself) would refuse to help him with genuine problems, but it just gets a bit tedious explaining something like a software update or why his seed shouldn't be stored on Google Drive.

[RickDeckard]

Just noticed ledger live has a new update.  I assume most people who saw this message on ledger live just clicked download update right?  Version is 2.34.3.

As other experienced members replied to you, you shouldn't worry to much about updating the Ledger Live application whether the promp appears assuming that you've installed a non-compromised version of it. If you want to verify the "authenticity" of the installation package you can just follow this[1] guide from Ledger to make sure that the app isn't compromised (and safe to install).
If you do end up installing it, all the automatic updates will be secured. According to Ledger[2]:

What about automatic updates
The update mechanism is secured once you've verified and installed Ledger Live. Ledger Live checks each upcoming update against Ledger's public key to verify that the update is legitimately from Ledger.

The question that you've made shows that you are aware of the dangers that revolve around crypto and that kind of caution is what will prevent you from failing in future scams.
[1]https://support.ledger.com/hc/en-us/articles/4404807946001-How-to-verify-the-authenticity-of-Ledger-Live-on-Windows-
[2]https://www.ledger.com/ledger-live/lld-signatures

[Pmalek]

As other experienced members replied to you, you shouldn't worry to much about updating the Ledger Live application whether the promp appears assuming that you've installed a non-compromised version of it.

I always wait a little bit when it comes to installing Ledger updates. That goes for firmware updates, app updates, or LL updates. Especially firmware upgrades shouldn't be rushed unless a serious vulnerability has been discovered and patched in the newest version. You always want to wait and see if some bugs or problems pop up that need to be fixed first, and I would rather not be on the receiving end of such issues. 

[HCP]

I always wait a little bit when it comes to installing Ledger updates. That goes for firmware updates, app updates, or LL updates. Especially firmware upgrades shouldn't be rushed unless a serious vulnerability has been discovered and patched in the newest version. You always want to wait and see if some bugs or problems pop up that need to be fixed first, and I would rather not be on the receiving end of such issues. 

Not the worse advice ever. I'm somewhat lucky that I'm generally not transacting every day... so by the time I actually notice there is an update to be had, it's generally been a decent amount of time (ie. days) between the update being released and me noticing

But yes, I certainly don't blindly click the "update now" button... I'll go find the release notes and see what has been updated/fixed/modified... and then have a quick scout of here/reddit/google to see if there are any widespread reports of issues.

[jerry0]

So they just have another ledger live update really soon.  Just came out. 


Do most of you still wait a few days or at least a week before you download it?



Now if you don't download it... but start adding new apps on your nano ledger, is there ever an issue when doing this?  Or before you install new apps, you need to always update ledger live first?

[bitmover]

Do most of you still wait a few days or at least a week before you download it?



Now if you don't download it... but start adding new apps on your nano ledger, is there ever an issue when doing this?  Or before you install new apps, you need to always update ledger live first?

Ledger Live updates are not as important as firmware updates. Ledger Live is just a wallet that is compatible with the device. But the device and its security rely mostly on the firmware.

There is no need to wait for a few weeks before updating Ledger Live. If Ledger Live breaks in an update you can simple move to another wallet (such as electrum) and use your device normally.

personally, I barely use Ledger Live, even when transferring altcoins. Ledger Live has poor control over transaction fees on Ethereum network, and offer no coin control on bitcoin network.

[jerry0]

Yes I know firmware update is much more important.  But I know ledger live update... you should still do it.  But its just should you wait a bit... like a firmware update or not.  The reason why I ask this is because I want to install a new app on my nano ledger s... so want to know if I should install the latest ledger live update before this.  Thus is it required? 


Because the ledger live update just came recently and i usually wait a bit before i update it. 

[Rath_]

The reason why I ask this is because I want to install a new app on my nano ledger s... so want to know if I should install the latest ledger live update before this.  Thus is it required?  

You should be able to install the latest version of apps even with outdated Ledger Live. You just won't be able to use new features if any are introduced in an update. The latest update added native support for NFTs for the Ethereum network, so you can safely skip it if you are not interested in them.

[Pmalek]

Because the ledger live update just came recently and i usually wait a bit before i update it.

I think the newest version is 2.38.2, released 8 days ago. Based on their GitHub page, nothing special about it. You can always check https://github.com/LedgerHQ/ledger-live-desktop/releases to see what changes are made when a new LL version comes out.

Last month, there was an update that fixed certain issues with ETH tokens. Now, if you were using ETH tokens and had problems, updating to the newer version could have solved those. So it often depends on the assets you use. If they made changes to their ETH and XRP wallet, for example, and I use neither of those, I wouldn't need to hurry to update my app. It wouldn't benefit me.   

[jerry0]

So are all people still updating their ledger live the moment they see a new ledger live update message on the top right corner?  I usually like to wait for a bit before I do it.  But is there any way a fake wallet message could pop up like how electrum did a while back?  And even if it does, it would still need you to manually copy and paste or type the website to download update if you cannot download the update straight from ledger live right?

[Pmalek]

So are all people still updating their ledger live the moment they see a new ledger live update message on the top right corner?  I usually like to wait for a bit before I do it.  But is there any way a fake wallet message could pop up like how electrum did a while back?

Are you going to ask that every time there is a new update? Electrum servers can be run by anyone, random people like you and me. When you run the software, Electrum connects to a node or you can pick the one you want from the list. Those servers and the people who operate them were able to send arbitrary messages and trick people into downloading fake software. Not anymore though. Ledger has its own centralized list of servers. You can't run a server yourself or select which one you want to connect to in LL. You have to trust the ones that Ledger has available. If you don't want to do that, don't use the software. Use Electrum, for example and trust the ones the Electrum community has on offer.     

[PrivacyG]

Remember, you are using a Hardware Wallet.  Even if the Ledger Live update was malicious, it may be able to alter what you see on the computer but not what the Ledger sees.  Worst case is the malicious software tries to make you send your money to the wrong addresses or tries to make you authorize a malicious Ledger Live Manager.  But for all of the three scenarios, while you would not suspect anything on your computer's screen, your Ledger will tell you the real address you are sending to and if the Manager is not recognized or authorized.

But anyway.  If you stay up to date with Ledger's subreddit on reddit.com/r/ledger, you will know when a new LEGITIMATE update is available.  So when there is an update, it may be a good idea to first verify their Twitter account, their subreddit and their blogs to check if a real update is out there or you are getting a fake notification.

Unless my current Live has a vulnerability, I typically wait at least 24 hours before updating my software.  That is because should there be a problem with the next version, I will hundred percent hear about it on Reddit.  I am just giving it enough time to be tested by other members and any big issues will come up mostly within a day.

-
Regards,
PrivacyG

[terrific]

So are all people still updating their ledger live the moment they see a new ledger live update message on the top right corner? 

I do.
Those updates are always coming and most of them are about integration with altcoins.

But is there any way a fake wallet message could pop up like how electrum did a while back?  And even if it does, it would still need you to manually copy and paste or type the website to download update if you cannot download the update straight from ledger live right?

IMO that's impossible. If it's a legitimate Ledger live installed on your PC or laptop or phone, there's no way an intruder that will use that notification message to mislead users. There was a time that I have to manually update it from the Ledger's website.

[PrivacyG]

IMO that's impossible. If it's a legitimate Ledger live installed on your PC or laptop or phone, there's no way an intruder that will use that notification message to mislead users. There was a time that I have to manually update it from the Ledger's website.

Seems like you have missed this important announcement: https://bitcointalk.org/index.php?topic=5090097.0.  It is indeed very possible.

-
Regards,
PrivacyG

[Pmalek]

If you stay up to date with Ledger's subreddit on reddit.com/r/ledger, you will know when a new LEGITIMATE update is available.  So when there is an update, it may be a good idea to first verify their Twitter account, their subreddit and their blogs to check if a real update is out there or you are getting a fake notification.

I always check their GitHub to see what the newest version is and what changes have been made.
Ledger Live Desktop Releases
 

Unless my current Live has a vulnerability, I typically wait at least 24 hours before updating my software.  That is because should there be a problem with the next version, I will hundred percent hear about it on Reddit.  I am just giving it enough time to be tested by other members and any big issues will come up mostly within a day.

Good man. I wait even more. Up to a week or two. The changes and fixes are usually not that important to make me hurry and install an update too early. They usually fix certain unimportant features involving altcoins or improve something I don't use anyways.

IMO that's impossible. If it's a legitimate Ledger live installed on your PC or laptop or phone, there's no way an intruder that will use that notification message to mislead users. There was a time that I have to manually update it from the Ledger's website.

Seems like you have missed this important announcement: https://bitcointalk.org/index.php?topic=5090097.0.  It is indeed very possible.

It is possible, but if it happened, it would come from Ledger directly. Ledger Live servers are not operated by a community of volunteers like in the case of Electrum. They belong exclusively to Ledger. Ledger and its team would have to go rogue for something like that to happen. In Electrum's case, all that was needed was that one or multiple server operators became malicious and started broadcasting those fake messages.