Fuck you ledger

[o_e_l_e_o]

Other than their Seed extraction vulnerability and the possibility of pushing a malicious version of firmware or Trezor Suite.  Is there any thing I might have missed?

They work with Wasabi, meaning they are pro-censorship, they fund blockchain analysis, and they support government blacklists. They were also a big supporter of AOPP, which was a protocol designed to make you KYC your own addresses to centralized exchanges before being allowed to withdraw. They only pulled their implementation of it after huge community backlash. The argument against these facts is always "Well, you don't have to use these 'features' if you don't want to", but it shows their underlying morals and ethos are very much not what they once were. I don't want my hardware wallet designed by people who are so pro-surveillance.

I also take more issues with their approach to the seed extraction vulnerability rather than the seed extraction vulnerability itself. I explain why here: https://bitcointalk.org/index.php?topic=5222188.msg53803392#msg53803392

[1714672158]

1714672158

[1714672158]

1714672158

[Findingnemo]

So whoever wants to keep their crypto now should boycott Ledger as well as Trezor.

I do get the hate for Ledger but I do not understand why there is some hate here for Trezor too.  Other than their Seed extraction vulnerability and the possibility of pushing a malicious version of firmware or Trezor Suite.  Is there any thing I might have missed?

AFAIK, there is no security threat in the Trezor models but their censorship became questionable when their coinjoin partnership with Wasabi leaked users' addresses and they tried to hide by censoring users on Reddit and other platforms showing that they can't be trusted either.

Also, their hardware malfunctions become issues like LCD screens failing on multiple devices and lack of support from the team to make them be untrustworthy with my Bitcoin.

Related Threads

Coinjoin on Trezor Suite
Trezor problem!

[m2017]

So whoever wants to keep their crypto now should boycott Ledger as well as Trezor.

I do get the hate for Ledger but I do not understand why there is some hate here for Trezor too.  Other than their Seed extraction vulnerability and the possibility of pushing a malicious version of firmware or Trezor Suite.  Is there any thing I might have missed?

AFAIK, there is no security threat in the Trezor models but their censorship became questionable when their coinjoin partnership with Wasabi leaked users' addresses and they tried to hide by censoring users on Reddit and other platforms showing that they can't be trusted either.

Also, their hardware malfunctions become issues like LCD screens failing on multiple devices and lack of support from the team to make them be untrustworthy with my Bitcoin.

Related Threads

Coinjoin on Trezor Suite
Trezor problem!

In fact, no hardware wallet manufacturer can be trusted 100%. If the partnership with Wasabi was known, then there may be partnerships unknown (secret) to the general public. For example, with the government (this is not necessarily the case). It is unlikely that any of the manufacturers will advertise this, to put it mildly. After all, every hardware wallet manufacturer has a country of jurisdiction, in other words, production workshops, warehouses, work offices, and the like. That is, leverage can always be found to persuade a HW device manufacturer to partner, which means there should always be doubts about the reliability of any of the manufacturers.

It is not necessary to boycott Ledger or Trezor. You just need to be aware of the existing risks and take this into account when storing your crypto assets on these devices. The realization that one day, your money may not be on these hardware wallets. Who even came up with the idea that they (and others) can be blindly trusted?

Maybe the hatred towards Trezor arises because it is the largest competitor (one of the industry leaders) of Ledger. That is, when a company expands very strongly, it ceases to be customer-oriented, switching to money-oriented. And when the main goal is money, then you can expect anything from the manufacturer (being their client).

[satscraper]

In fact, no hardware wallet manufacturer can be trusted 100%.

It is not necessary to boycott Ledger or Trezor. You just need to be aware of the existing risks and take this into account when storing your crypto assets on these devices. The realization that one day, your money may not be on these hardware wallets. Who even came up with the idea that they (and others) can be blindly trusted?

I don't know whether that is true or not but I came across the mention that Ledger wallets are assembled by Flextronics. This means that Ledger company doesn't have the facilities to produce hardware and rely on 3^rd party which in turn may aper   as    the other potential  "hidden" and weak section in the trust chain.

Thus, the best approach for keeping bitcoin stash safe is to use multisig wallet with HW cosigners from different manufacturers.

[m2017]

I wanted to check the Ledger Live that was preinstalled a long time ago (some version like 2.40 or so), but when synchronizing it gives an error. Refresh doesn't change anything. The Internet works stably and all other applications that require an Internet connection work as before. Now old versions of Ledger Live can't sync with Ledger servers? Has Ledger really decided to force all users to update Ledger Live? If this is not an isolated case, then congratulations on another surprise from Ledger. Now everyone will be in their complete power without the right to refuse their services, such as the recovery function and other trash.

Tell the title of this topic now or it will be too late.

[o_e_l_e_o]

Seems like it: https://support.ledger.com/hc/en-us/articles/360012207759-Solve-a-synchronization-error. The first step to solving a sync error is to "update Ledger Live".

For anyone with their coins still on a Ledger who obviously don't want to do this, then you can bypass Ledger Live entirely and simply interact with your Ledger device via either Electrum or Sparrow. Once you've got it connected up, use this set up to transfer all your coins to a better hardware wallet or cold storage solution.

[dkbit98]

I don't know whether that is true or not but I came across the mention that Ledger wallets are assembled by Flextronics. This means that Ledger company doesn't have the facilities to produce hardware and rely on 3^rd party which in turn may aper   as    the other potential  "hidden" and weak section in the trust chain.

No, from my research ledger devices are produced in China, maybe by this Flextronics, and than they are assembled in France.
I am not defending ledger in any way, but there is a difference between assembling and producing.
But there is a chance they changed something in last few months to reduce expenses.

[seek3r]

Seems like it: https://support.ledger.com/hc/en-us/articles/360012207759-Solve-a-synchronization-error. The first step to solving a sync error is to "update Ledger Live".

For anyone with their coins still on a Ledger who obviously don't want to do this, then you can bypass Ledger Live entirely and simply interact with your Ledger device via either Electrum or Sparrow. Once you've got it connected up, use this set up to transfer all your coins to a better hardware wallet or cold storage solution.

That's exactly the way I went - at least for the time being. Some of the coins were still stored there. However I also had a few altcoins, which I mainly managed or stored in Ledger Live.
Call me paranoid, but first I transferred my bitcoins via Electrum. Only after the step was completed, I updated Ledger Live and then also the firmware and various apps. This was necessary to be able to sign some transactions without running into an error. (only for certain coins/tokens)

Don't think about how you have allowed yourself to be limited by a 3rd party for years... 

[o_e_l_e_o]

-snip-

Yeah, good plan.

Another option for any altcoins which don't have their own wallet software which can interact with your Ledger device while bypassing Ledger Live would be any wallet which can run on an airgapped device. You can import your seed phrase to the aigapped wallet (having moved all your bitcoin already!) and use that to sign a transaction which moves your altcoins.

Yet another option would be to export and import individual private keys, but I suspect the vast majority of altcoins don't have wallets which would support this.

[satscraper]

I wanted to check the Ledger Live that was preinstalled a long time ago (some version like 2.40 or so), but when synchronizing it gives an error. Refresh doesn't change anything. The Internet works stably and all other applications that require an Internet connection work as before. Now old versions of Ledger Live can't sync with Ledger servers? Has Ledger really decided to force all users to update Ledger Live? If this is not an isolated case, then congratulations on another surprise from Ledger. Now everyone will be in their complete power without the right to refuse their services, such as the recovery function and other trash.

Tell the title of this topic now or it will be too late.

I also didn't use Ledger Live for a long time because to the shift in multisig (to Passport2 + Sparrow) for securing my stash. After reading your complain I have downloaded the newest version (which is 2.71) from the official site and successfully updated my old version.  Perhaps this could be a suitable option for you as well.

[m2017]

I wanted to check the Ledger Live that was preinstalled a long time ago (some version like 2.40 or so), but when synchronizing it gives an error. Refresh doesn't change anything. The Internet works stably and all other applications that require an Internet connection work as before. Now old versions of Ledger Live can't sync with Ledger servers? Has Ledger really decided to force all users to update Ledger Live? If this is not an isolated case, then congratulations on another surprise from Ledger. Now everyone will be in their complete power without the right to refuse their services, such as the recovery function and other trash.

Tell the title of this topic now or it will be too late.

I also didn't use Ledger Live for a long time because to the shift in multisig (to Passport2 + Sparrow) for securing my stash. After reading your complain I have downloaded the newest version (which is 2.71) from the official site and successfully updated my old version.  Perhaps this could be a suitable option for you as well.

I'm sure there won't be any problems with the update. As you can see in the picture, version 2.42 is available for update, I’m sure all subsequent versions are included. The problem is that in my opinion, it looks like Ledger is forcing its users to update, even if they don't want to do so. Let's imagine I am a user who is quite happy with version 2.40 and doesn't want to update to later versions due to lack of trust in this company due to their new built-in functions in Ledger Live. But the unpleasant thing is that Ledger infringes on such users by not allowing them to use older versions of LL. Look again at the picture above - it simply gives an error that doesn't even allow you to access LL and the contents inside the wallet. This is simply called discrimination.

The option to update to the latest version is suitable only for idiots very trusting clients of Ledger. Perhaps earlier versions didn't yet have unnecessary functions (which is not a fact), but in later versions this is 100% present. This could still be used as the last loophole, which Ledger seems to have completely covered by introducing a synchronization error. I assume that this was done deliberately, which once again casts a shadow on the reputation of this company.

My conclusions may seem paranoid, but I have said more than once that in the case of any finance (and not just crypto assets), no paranoia is unnecessary. Especially when you use devices from manufacturers who have been f@ck uped more than once, tarnished their reputation and introduced very dubious services.

[Lucius]

@m2017, what exact version of LL do you have? I also have a very old version and I don't have a problem with synchronization (so far), so maybe you should check that maybe your antivirus or firewall doesn't block internet access to LL. It also occurs to me that Ledger may be blocking users gradually so as not to cause panic, and considering their dirty tactics, that would not be a surprise at all.

[m2017]

@m2017, what exact version of LL do you have?

I wrote about this above. I don’t remember the exact version, some of 2.40 or close. An earlier version than 2.42. That's for sure.

(some version like 2.40 or so)

I also have a very old version and I don't have a problem with synchronization (so far), so maybe you should check that maybe your antivirus or firewall doesn't block internet access to LL.

I also wrote about this. The Internet is fine. Since the time when this version of LL was installed, practically nothing has changed in this OS. This is a backup / spare PC that I use very rarely. That is why LL remained in the form in which it was installed.

It also occurs to me that Ledger may be blocking users gradually so as not to cause panic, and considering their dirty tactics, that would not be a surprise at all.

What if this is the same gradually blocking / restriction of users that you are talking about? I assume that there are not so many users with old versions of LL left. Few people were likely to notice these changes (from a big user base).

I wouldn't bring this up for discussion unless it all seemed suspicious to me. This is somehow strange.

[Lucius]

@m2017, My version is a bit newer (above 2.50), so maybe that's why it still works, but yours is obviously too old and can't be synchronized, considering that Ledger made some significant changes on its end and that old version no longer works. However, as far as I know, it is possible to manually install older versions of LL, and that could be a way to get a functional LL even without installing the latest version.

https://www.ledger.com/ledger-live/lld-signatures

[cygan]

this tweet^[1] reports that as soon as you access the Ledger live app, this app retrieves data about assets you hold in your hardware wallet. it also sends a ton of other information about your computer and device.


[1] https://nitter.net/rektbuildr/status/1732541519284900198

Ledger Live App Allegedly Collecting Vast User Data

https://bitcoinnews.com/ledger-live-app-accused-of-collecting-user-data/

Ledger Live data collection is more than a little concerning

https://crypto.bi/forum/threads/ledger-live-data-collection-is-more-than-a-little-concerning.5/

[www.Gambler.Casino]

I think that collecting information looks like an anonymous cryptocurrency wallet is bad. Unfortunately, this is how every product works these days((

[o_e_l_e_o]

-snip-

This really shouldn't be news to anyone who owns a Ledger device. The same is true for any hardware wallet which you use through that company's centralized servers.

In order to show your balances, it must query your addresses somewhere. If it isn't using your own node, then it is using someone else's node, and that node runner (in this case Ledger) will know exactly what you are querying, and therefore will know all your addresses, balances, and transactions. The same is true for example Trezor and Trezor Suite.

This is clearly spelled out in their Privacy Policy, which everyone has read, right? Right!?

Use of Ledger Live

Device session identifier, IP address*, clicks, actions (e.g. launching the application, use of transactional functionalities, pages viewed), properties (e.g. type, version, language and region recorded for your operating system), currency, time stamp, amount and status of transactions, transaction identifier, identifier used by our partners to identify you (when you use their services)

If you want to avoid this then use a permanently airgapped hardware wallet, and use it with non-proprietary open source software such as Electrum or Sparrow pointed exclusively at your own node.

[safar1980]

Ledger software hack news in twitter :  
"We have identified and removed a malicious version of the Ledger Connect Kit.
A genuine version is being pushed to replace the malicious file now. Do not interact with any dApps for the moment. We will keep you informed as the situation evolves.

Your Ledger device and Ledger Live were not compromised."

[m2017]

This is clearly spelled out in their Privacy Policy, which everyone has read, right? Right!?

Of course, every crazy person user doesn't read this.

This really shouldn't be news to anyone who owns a Ledger device. The same is true for any hardware wallet which you use through that company's centralized servers.

Of course, this is shocking news for Ledger device owners. Firstly, no one reads the user agreement that you talk about above, and secondly, not everyone is able to read the Ledger Live software code.

In order to show your balances, it must query your addresses somewhere. If it isn't using your own node, then it is using someone else's node, and that node runner (in this case Ledger) will know exactly what you are querying, and therefore will know all your addresses, balances, and transactions. The same is true for example Trezor and Trezor Suite.

Has anyone released an article with their shocking revelation yet?
 

If you want to avoid this then use a permanently airgapped hardware wallet, and use it with non-proprietary open source software such as Electrum or Sparrow pointed exclusively at your own node.

Let it be just that way.

[safar1980]

Lets break this down for Ledger users!

Risk of Funds: There is a potential risk to the funds stored in the #Ledger if they interact with #dApps using this compromised library.

Avoid dApp Interactions: Ledger owners should avoid connecting their Ledger to any dApps until it is confirmed to be safe, as this could trigger the drainer script and lead to loss of funds.

Need for Vigilance: Owners should monitor official channels from Ledger for updates and instructions on how to proceed.

Update and Verification: It may be necessary to update the Ledger firmware or software once a fix is available, ensuring it's downloaded from the official Ledger website.

Security Measures: Users should also consider changing passwords and checking for any unauthorized transactions.