I get what you mean with your posts. The thing is I learned how to use ledger a while back and I got used to it. So I prefer to stick with it. Me using something else like trezor or something else would be completely new.
Don't think about what you prefer. Think about safety.
The nano ledger s plus firmware 1.1.0 software that I am using is after the nano ledger news right with the recovery? I remember doing 1 firmware update with it I believe.
Ledger's firmware is not open.
I stopped updating my Ledger firmware while it still predated Ledger Recover, but since Ledger's firmware isn't fully open source, there was no way to PROVE the firmware didn't already have key extraction capability baked into its code.. That was in spring 2023. Here's what I did:
#1: I stopped using my Ledger immediately. Can't prove it's safe? Won't use it.
#2: I made a commitment to myself to start over with a new hardware wallet by the end of the year.
#3: I spent the next few months learning, so I could make the best decision possible. And then I switched.
Was that inconvenient? Yes. Would I have preferred to stick with the device I already knew? Of course. But I care more about the security of my coins than I care about the inconvenience of learning something new. The fact that you don't means you probably shouldn't be buying Bitcoin. If you can't handle securing it, no worries. Go with an ETF. There's no shame in admitting you're not up to the challenge that comes with securing your own coins. ETFs didn't exist when I was getting started. If they did, I might have done that instead (though I love owning my own coins).
So if I still want to continue using nano ledger s plus, would you recommend against doing the firmware update from 1.1.0 to 1.1.2?
I recommend never updating or using any Ledger code ever. It's not safe.
The thing is I don't want an issue where I have issues with it later on if the firmware is too old to do an update.
It won't matter if your coins get stolen due to the device being accessed over the internet by hackers or a rogue employee. And it's not like Ledger employees haven't already been phished.
When you do send and receive on your ledger, wouldn't you want your firmware to be up to date?
Not if the update contains code that lets Ledger and other companies extract your keys.
The other thing is if something was to happen with ledger and the backdoor, wouldn't this be the biggest news ever if they have backdoor to everyone's key?
When it happens, nobody will know until wallets start getting drained. By that point, it'll be too late.
So very few people here are still using their ledger?
People who understand how hardware wallets work stopped using Ledger. People who make brand names part of their own identity and use hardware wallets as a cool form of crypto street cred stuck with Ledger, because they're not very bright. Back in 2021, idiots on Tiktok were wearing Ledgers on a necklace, like a crypto-bro boast. They stuck with Ledger because they care more about the brand name than they care about what the thing does.
From reading online, I would have thought it was an overreaction to it
If you read Ledger's sub on reddit, Ledger deletes posts that complain about their key extraction code and they shadowban users who say anything negative about it. They probably do that on all of their social media. That creates an echo chamber of dummies cheering on dummies.
Here's the bottom line:If you're waiting to see Ledger's key extraction code get hacked before you switch to something safe, it'll be too late. That's not how a Ledger hack will go down.
When Ledger's key extraction scheme gets hacked, the hackers aren't going to empty wallets. They're going to want to steal as many keys as possible first, because if they drain wallets, they'll let Ledger know the code was hacked, which will cause Ledger to patch it, which will end the hacker's ability to keep stealing keys.
The hackers are going to want to steal as many keys as possible before they start draining wallets. And you'll never know if yours is one of them. For all we know, hackers could already be stealing keys & building a giant stockpile of wallets to hit.
But when they do start draining wallets, I'd expect them to drain a ton of them all at once. They're gonna hit 'em hard and fast, wiping them all out.
Now, think about how long it's going to take for people to figure out what happened. Their wallets will have been drained, but they won't know why, and Ledger will be quick to deny their code had anything to do with it. Ledger will start peddling FUD about other devices. And other devices will get blamed too, because people who didn't know what they were doing switched from Ledger to a new device but kept the same seed phrase, which the hackers already had.
I think it's just a matter of time before it happens - but the real question is, even if it never happens... do you REALLY want to spend years wondering if somebody accessed your device every time you turn it on? Do you REALLY want to spend years wondering if somebody already swiped your keys and is waiting for the right time to drain your wallet? Do you really want to spend years wondering about every firmware update? By the way, that firmware has tons of trackers and every update probably adds more.
I'm using a seed that has never touched a Ledger device, and my hardware wallet is 100% open source & airgapped. I have no worries. My keys are unhackable. Yours should be too.
Hey, if you don't care you don't care. But you can't say you weren't warned in explicit detail.
TL;DR: Dude. C'mon. That firmware can't be trusted.
