Cold Wallets: I'm confused - Unconfuse me

[MikeSD]

I've been dabbling in crypto for 7 years. And by dabble I mean, "almost not at all". I have tried coinbase and still have an account and wallet.  But recently I got a Ledger Nano S.  It was unused and FREE, so I tried to use it.  The install went flawlessly, albeit I bought my 2nd house much quicker.  

But I'm confused about usage and terms.

I have seen
Seeds,
Private Keys,
Passwords,
Pins,
Master keys, etc

I don't know what each does, or if they are all applicable to the Nano S.

I did try sending, receiving, buying and loading and that all went fine.
But, when I installed this, it sent me to a page that said to buy a subscription, for $9.99/mo.  Subscription for what?  It used the term "recovery" so I assume it's something to do with.. "recovery".

But then I realized that the primary purpost for the cold wallet, was to keep my keys, on my device, and not on the internet.  but this "recovery" subscription seemed to be to backup my keys on another server, and not my wallet.

Q1: Doesn't that kind of negate the value of the wallet, if keys are stored OFF the wallet?

Q2: Is this $9.99/mo subscription mandatory? It didn't leave me much option?
Q3: Can I use the nano 3, just like it's advertized, without the subscription? I can write down my own keys and manage them myself.
Q4: Is there anything I lose, that's important, if I don't buy the subscription?
Q5: Are there any important advantages, if I keep the subscription? $120/year sounds expensive to me.

So far I know I have a
* seed (writen down and saved), used for recovery and creation of backup wallets
* password (duh! to log onto my wallet
* password (for the subscription service)
* private keys ? (have no idea what that is. Is that the seed)
* other things I don't know, what I don't know

Q6: I have a coinbase wallet.  Is that a hot wallet, or some other kind of wallet.
Q7: I also have Electrum wallet.  (was just experimenting in 2017, and didn't know I had a seed to remember, and lost my password. Just the other day, I was looking at some notebooks, an found the password. It worked, so I recovered that account. Unfortunately, it only had $29 in it. )
Q8: I have been thinking about the nano X. I want to use my samsung phone and not a PC or laptop.  Can the nano S, work on an android phone. Or does that app only work on a PC.
Q9: Is the nano X better than the S? I know it uses bluetooth?
Q10: Finally, what is the most secure cold wallet?  Are they beter than the hot wallets, like codebase wallet?

Thanks in advance

[LoyceMobile]

Who have it for free? That's usually a big red flag.

Ledger recovery wants you to broadcast your seed words to them. A lot has been written in another topic, long story short: don't do it. Ledger is not cold storage.

[OmegaStarScream]

1. Ledger claim that they have no access to the seedphrase, unless you decide to share it with them. I haven't been following the latest news though, so I could be wrong.
2. It shouldn't be necessary, no. and I definitely wouldn't recommend doing it.
3. As I have said above, it shouldn't be necessary, so nothing important. Just make sure you store your seedphrase safely offline.
4. Definitely not. You're not missing on anything.
5. The private keys are derived from the seedphrase. Each one of your receiving addresses is linked to a private key. The private key is what let you spend the funds from that specific address. If you have the seed, you shouldn't worry about all of that.
6. A coinbase wallet is a hot wallet yes.
7. Electrum is also considered as a hot wallet, unless used otherwise (but the main difference compared to coinbase here is that its open source).
8. You should be able to use it. The ledger live app is available for both android and PC.
9.  It's mainly the bluetooth. Here's is a detailed comparison between the two devices: https://shop.ledger.com/pages/hardware-wallets-comparison
10. Go to the hardware wallet board, there are plenty of similar topics: https://bitcointalk.org/index.php?board=261.0

[Charles-Tim]

So Ledgers nano seed phrase backup with those companies is now subscription service. Ledger Nano wallets are the worst hardware wallet that someone can go for.

Q1: Doesn't that kind of negate the value of the wallet, if keys are stored OFF the wallet?

It makes the wallet to be worthless to me. But your seed phrase backup should be stored someone offline in two or three different locations.

Q2: Is this $9.99/mo subscription mandatory? It didn't leave me much option?

I know the third party backup is not mandatory. But why would they include such thing.

Q3: Can I use the nano 3, just like it's advertized, without the subscription? I can write down my own keys and manage them myself.

The third party backup is not mandatory.

Q4: Is there anything I lose, that's important, if I don't buy the subscription?

You lose nothing but you gain something because nobody will know your seed phrase but only you if you protect it very well. You can even add passphrase to make it more secure offline.

Q5: Are there any important advantages, if I keep the subscription? $120/year sounds expensive to me.

They are just looking for more money. It has no importance to me.

Q6: I have a coinbase wallet.  Is that a hot wallet, or some other kind of wallet.

Coinbase.com is a custodial wallet but they have a wallet which is noncustodial. If the wallet has seed phrase, it is noncustodial. But it is close source and not recommended.

Q7: I also have Electrum wallet.  (was just experimenting in 2017, and didn't know I had a seed to remember, and lost my password. Just the other day, I was looking at some notebooks, an found the password. It worked, so I recovered that account. Unfortunately, it only had $29 in it. Cheesy

This is not a question. But it is worth knowing that only the seed phrase is enough to access your wallet. If you forget the password, create a new wallet and import the seed phrase and set a new password.

Q9: Is the nano X better than the S? I know it uses bluetooth?

Nano X is supporting more coins.

Q10: Finally, what is the most secure cold wallet?  Are they beter than the hot wallets, like codebase wallet?

Those airgapped and open source ones like Foundation Passport.

[MikeSD]

Who have it for free? That's usually a big red flag.

Ledger recovery wants you to broadcast your seed words to them. A lot has been written in another topic, long story short: don't do it. Ledger is not cold storage.

Not a red flag at all.  I got it from my brother, who recently passed away.  He was going to use it on his account.  Since he didn't use it, I will use it. 

It was NOT offered to me by any company. Just my brother's personal posession, that he never got around to using.

About the subscription.  That seemed to me to defeat the purpose of having the hardware device. But are you saying that the nano 3 (itself) is not a cold wallet? or only not so, if you get the recovery subscription?

I'm going to try and cancel that subscription, if it's not needed.

[MikeSD]

8. You should be able to use it. The ledger live app is available for both android and PC.

Everything you answered is pretty much what I got from my research. Just needed confirmation.

I did try downloading the android version of the wallet. However, when I tried to install it, it asked if it was a new install or if I had an existing account.  I said existing, then it asked for the login. I input the login email, and it came back with "no account under that email".

But it is the right email.  I went back to the PC version and verified I didn't use a different email.  Why wouldn't it be able to find my account? Or maybe I didn't do the install correctly.

Update: Duh. I better check the apps closer. I searched for Ledger App and the first that came up was crypto. wrong app. That's why it didn't know my email.  I then found the right app, and it let me log in and I was able to import my info to the android app. Now I'll just buy a short USB-C to USB-C and I can use the Nano 3.

Now I need to figure out how to delete my subscription.  Their website says to logon, then delete the account and I will be unscribed.

Update Again:Unregistering was easy.  So now, I'm on my own. All I had to do was follow the Recovery link, navigate to Manage my account[/b], and delete my login.  Then confirm through a link sent to my email.  According to the responsie it says "unregistered".  Easy Peasy.

Thanks

[LoyceV]

About the subscription.  That seemed to me to defeat the purpose of having the hardware device.

Correct. Read Ledger Recovery - Send your (encrypted) recovery phrase to 3rd parties entities for all the reasons why this is a very, very bad idea.

But are you saying that the nano 3 (itself) is not a cold wallet?

A cold wallet is by definition a wallet that's never been connected to the internet. A hardware wallet that has the ability to broadcast it's seed phrase is a flaming hot wallet.

or only not so, if you get the recovery subscription?

That's the thing with Ledger: you don't know! With a cold wallet, you're certain your private keys have never touched an online device.

Update Again:Unregistering was easy.  So now, I'm on my own. All I had to do was follow the Recovery link, navigate to Manage my account[/b], and delete my login.  Then confirm through a link sent to my email.  According to the responsie it says "unregistered".  Easy Peasy.

Is it? Are you sure? Can you be sure? If you told me your seed phrase, and I told you I deleted it, would you trust me?
You should assume your seed phrase is now compromised. Don't fund it. You could reset the Ledger and create a new seed, but are you willing to trust Ledger now that you know the hardware wallet can "call home" to share your seed phrase? Note that Ledger literally lied about the security of their devices: for years, they said it's impossible for the seed phrase to leave the secure element. Then they created a "subscription service" that literally extracts the seed phrase from your device. Are you willing to risk your money with a company that lies about it's core business?

So Ledger set up it's "recovery" subscription in such a way that they trick new users into subscribing and sharing their seed phrase? Damn!

[Lucius]

~snip~
So Ledger set up it's "recovery" subscription in such a way that they trick new users into subscribing and sharing their seed phrase? Damn!

How else could they get users to use something that is so pointless and risky that no one who understands the basics would ever think of using it even if it was completely free? At the end of the day, the "geniuses" who designed it together with the "Lord of the Rings" must somehow justify their innovation so that one day they can say that it is used by more than a million users of their devices.

[The Sceptical Chymist]

I'm going to try and cancel that subscription, if it's not needed.

The conclusion from the massive drama that happened when Ledger announced the Recover option was--and someone please correct me if I'm mistaken--that regardless of whether you have a subscription to the Recover, the secure element in the device allows the company to gain access to your private keys, and that was never ever disclosed before.  If you're dabbling with small amounts of crypto, you're probably going to be OK even if something catastrophic happened with Ledger, but I would not trust them at all.

The device itself might hold more sentimental value to you, as it was your brother's, and for that reason alone I'd hold onto it regardless of whether you're going to use it as a wallet.  I don't know you, but I'm sorry for your loss.

[SFR10]

Can the nano S, work on an android phone.

Yes, it can, but the only way to get its full functionality is by using an OTG cable.

Q9: Is the nano X better than the S? I know it uses Bluetooth?

On paper, Nano X is better but in reality, it's one of the worst hardware wallets ^{[especially if it was made in the past few years]}: Ledger Nano X Circus (Battery, Recover and more)
^{Note: Make sure to read all of the comments on that thread!}

[Cricktor]

Wait, you had a bad feeling that this paid recovery subscription is wrong and you still subscribed and paid for it? Why?

It sounds a bit as if Ledger follows some dark patterns to offer his customers victims their stupid recovery subscription in a way that their victims think it's mandatory. Why am I not surprised...

I would simply stay away from Ledger. Their firmware is closed source, they lied in the past about their claim that your seed can't ever leave the device. Well, their stupid recovery subscription does exactly that and you have to pay for it, monthly. How bonkers is that!?

I also believe you have a Ledger Nano S plus as to my knowledge the Nano S can't have the recovery subscription firmware. (I might be wrong though as I wouldn't touch any Ledger even if I got one for free and couldn't care less about their crap, except to warn people to stay away from it).

[Pmalek]

Update: Duh. I better check the apps closer. I searched for Ledger App and the first that came up was crypto. wrong app. That's why it didn't know my email.  I then found the right app, and it let me log in and I was able to import my info to the android app. Now I'll just buy a short USB-C to USB-C and I can use the Nano 3.

Don't get me wrong, but you will have to be much more careful in the future if you want to be the custodian of your bitcoin. If not, you might go down a path where you download a fake phishing app, share your seed with someone, or fall for some other social engineering trick. You already fell for Ledger's Recover vulnerability.

Nano X is supporting more coins.

Nano X doesn't support more coins than Nano S. Nano X has more internal memory, allowing you to install more crypto apps than on the Nano S. Thus, you can manage multiple coins and tokens at the same time, something that is very limited with the S model. But in terms of coin support, they are both the same.

The conclusion from the massive drama that happened when Ledger announced the Recover option was--and someone please correct me if I'm mistaken--that regardless of whether you have a subscription to the Recover, the secure element in the device allows the company to gain access to your private keys, and that was never ever disclosed before.

We don't know. We can only guess and speculate. Ledger being closed-source makes it impossible to check. This is what we know: Ledger's secure element allows the extraction of private keys if the firmware code requires it. Ledger has always claimed that your keys can never leave your device. They have proven that it's not correct. They can if they write the code that extracts those keys.

I also believe you have a Ledger Nano S plus as to my knowledge the Nano S can't have the recovery subscription firmware.

That's exactly what I wanted to say after I saw OP's topic. They never released a new firmware with the needed code for Ledger Recover to work on the Nano S. That's what they said at least. I guess they still offer it through Ledger Live regardless of what device you have .

[PrivacyG]

Set up an Airgapped Wallet and live your life with no care.  I would 100 percent recommend this even to a Newbie nowadays.  Hardware Wallets are only becoming more troublesome by the years.  Ledger had many problems in their past and Recovery is only the cherry on top so far.  Who knows, maybe there are more cherries awaiting us.  Knowing Ledger, I would not be surprised at all.

I would hate knowing most of my Coins are sitting on a Hardware Wallet that is only partially Open Source and whose producers are providing updates that significantly lower the Security of my Coins.  I know there is no proof the Security is lower after the Recovery update, but I would not want to be a test subject either.

To me, Airgapped is the way to go.

[LoyceV]

Set up an Airgapped Wallet and live your life with no care.  I would 100 percent recommend this even to a Newbie nowadays.

Considering there are still people who enter their hardware wallet seed phrase into a phishing site, I'm afraid this is far above the capabilities of many people.

[dkbit98]

Considering there are still people who enter their hardware wallet seed phrase into a phishing site, I'm afraid this is far above the capabilities of many people.

Using additional passphrases and decoy wallets would solve this problems most of the times.
But than again, anyone silly enough to enter seed words in some random website would probably never thought about using passphrases  
And same people probably use 0ne-passw0rd-f0r-everything... 1234, qwert, etc.

[Pmalek]

Using additional passphrases and decoy wallets would solve this problems most of the times.

Anyone who falls for a social engineering scam that asks them to enter their seed into a fake website will surely also enter a passphrase if asked for it. Scammers know about the possibility of a passphrase and will ask their victims to add the passphrase as well. No amount of security can protect against gullibility.