[23-05-19] Is Ledgers New Bitcoin Key Recovery Feature Safe? Experts Have Doubts

[Kryptowerk]

https://www.msn.com/en-us/money/personalfinance/is-ledger-s-new-bitcoin-key-recovery-feature-safe-experts-have-doubts/ar-AA1bpgQo


"When Ledger, a Paris-based hardware wallet-maker, announced a new key-recovery feature this week, it thought the move would be popular.

Allowing users to recover their private keys – much like you can recover your password if you forget it – would help onboard customers, the company believed. Potential crypto users are known to be turned off by crypto's unforgiving self-custody ethos ("not your keys, not your coins"). But a key recovery service would offer more comfort."


[Excerpt]
"Security concerns
The news of the update provoked a storm of criticism from the crypto community, with accusations that Ledger’s new offering contradicts its past statements about keeping private keys off the internet.
In particular, Crypto Twitter piled on the tweet Ledger’s official account posted in November, assuring users of the safety of their devices."

[Kakmakr]

I think the oil on the fire was the fact that Leger were hacked before, so people do not trust them to keep anything safe. The hackers used the hacked information to target individual customers that bought hardware wallets from them. (Phishing attacks)

Any informed Bitcoin user will tell you NEVER to store any "Private key" or "Seed" online, so it is ludicrous that a hardware supplier would even try to provide a service like that.  

[Onset]

Just when I thought they couldn’t pull out anything worse than all the mistakes they’ve done before! So in order to bring those fearful people who hated Bitcoin for being decentralized we’re inserting a possible backdoor so everybody who practiced self-custody before is now at risk? Then what’s the point of a Ledger, paying a company who’s been hacked before to “safely” store the most important information of my wallet? WTF do they have a brain to think?? This sounds almost funny, it’s so bad it wouldn’t fit even as a 1st of April joke

[Woodie]

I wonder how ledger arrived at this decision, are they saying most of its current users lose total access to their coins and they are returning the favor by bringing this feature to life?

Maybe this is a ploy to try onboard new users to the ledger world ,who would have perceived digital currencies work as good as an email  address were any user forgets his/her password can easily hit the forgot password button and access restored just like that...
But giving them a benefit of doubt,  in a few months to come if this helps them sell more hardware wallets, then they might feel vindicated for this business decision as its a game of numbers at the end of the day for them..so can't blame them entirely !

[Kryptowerk]

Just when I thought they couldn’t pull out anything worse than all the mistakes they’ve done before! So in order to bring those fearful people who hated Bitcoin for being decentralized we’re inserting a possible backdoor so everybody who practiced self-custody before is now at risk? Then what’s the point of a Ledger, paying a company who’s been hacked before to “safely” store the most important information of my wallet? WTF do they have a brain to think?? This sounds almost funny, it’s so bad it wouldn’t fit even as a 1st of April joke

It does sound like a bad joke for anyone that really knows what Bitcoin is, what it stands for, what it is capable of, and why it was created in the first place.
For everyone else, this probably sounds like a great solution. "Of, finally they solved the lost-your-seed-and-you're-fucked issue."
Let's see how this plays out in the long run. I would very much hope to see this has a major impact and creates a big disruption in the hardware-wallet sector. But I kind of doubt it will change much in the mid-long. Hope I'm wrong.

[cr1776]

Trusting 3rd parties with your private keys or your coins is always a bad idea. No matter how smart or good intentioned, someone, somewhere will screw it up eventually, particularly when there is a large target (unintended bounty) like this.

[Onset]

It does sound like a bad joke for anyone that really knows what Bitcoin is, what it stands for, what it is capable of, and why it was created in the first place.
For everyone else, this probably sounds like a great solution. "Of, finally they solved the lost-your-seed-and-you're-fucked issue."

Hopefully not! I know people can sometimes seem stupid but I’m really hoping it’s not the case here and they decide to not accept this thing Ledger’s shoving up their face. This entire story proves Ledger cares just about money and would go against what Bitcoin stands for just for additional profits.

[Kryptowerk]

Tiny update on the issue: https://decrypt.co/142044/ledger-delays-plans-private-key-recovery-controversy

"We've heard your feedback on Ledger Recover," the company said from its main Twitter account yesterday, announcing plans to host a town hall over Twitter Spaces at 12:30 p.m. EST on Tuesday, May 23.
and
A graphic he shared showed that a white paper on the Recover Protocol would be made available in the coming days.

Has anyone seen such whitepaper yet?
I doubt it'll change anything regarding the fundamental flawed idea of Ledger accessing the private keys and storing them in any other place than the Ledger device itself, though.

[zasad@]

"The seed phrase must not leave the hardware wallet", it's as simple as "not your keys, not your coins"
If the ledger implements this, then this wallet should be blacklisted by the correct crypto users. Ledger is no longer a secure crypto wallet and I am not interested in reading their papers because they do not understand the principles of cryptocurrencies. There are enough custodial services in the world.he world.

[Coin-Keeper]

I had to read through this thread twice thinking it must be a joke.  But no, it isn't.  I spent my working career in marketing and sales.  Whoever submitted this as a "corporate idea" should no longer be a contender for any promotions, LOL!!

[cr1776]

I had to read through this thread twice thinking it must be a joke.  But no, it isn't.  I spent my working career in marketing and sales.  Whoever submitted this as a "corporate idea" should no longer be a contender for any promotions, LOL!!

It is the opposite of cold storage, so why not just keep the keys in plain text in a gmail account?  I'd trust google more than Ledger, of course that doesn't say much since I wouldn't trust either of them with anything like that.

[Lucius]

I had to read through this thread twice thinking it must be a joke.  But no, it isn't.  I spent my working career in marketing and sales.  Whoever submitted this as a "corporate idea" should no longer be a contender for any promotions, LOL!!

When I first read that news, I also thought that someone was just kidding, but apparently in that company they don't choose ways to earn more, even though their business moves are completely opposite to what they built their entire business around. If you still haven't, I suggest you read the next topic Ledger Recovery - Send your (encrypted) recovery phrase to 3rd parties entities in which you can also find one of the videos in which their CEO Pascal talks about the fact that everyone who criticizes their new service is just spreading FUD, as well as that he talks about the hacking of their customers' database as a trivial event that is something for them as a company normal and harmless.