Ledger Atom

[Meuserna]

the company published an article on its blog about Ledger Atom security architecture: https://www.ledger.com/blog-ledger-atom-security-architecture

here are some key points:

Supply chain risks have existed for years.

That whole post by Ledger reads like one giant facepalm.

Ledger, then: "There is no anti-tampering sticker on this box. A cryptographic mechanism checks the integrity of your Ledger device's internal software each time it is powered on. The Secure Element chip prevents any interception or physical replacement attempt. Ledger devices are engineered to be tamper-proof."

Ledger, now: "Supply chain risks have existed for years."

Good luck with that, eh? What a terrible company.

[Cricktor]

OK, I'm not known to be a fan of Ledger, rather the contrary.

Isn't it a nice concession to organized supply chain crime that this new device already comes with wifi and 5G connectivity and enough battery power onboard? Cool, no trojan implant here really anymore needed. The criminal hackers only need to find flaws in the software to tamper security boundaries (could be quite a challenge, but frankly who knows, as Ledger's firmware is usually an opaque mystery box). That's the spirt, Ledger, thank you for nothing!

I haven't yet read their whitepaper on this device's security model. Android OS is complex, same applies to iOS, and has constant need for patches, built-in obsolescense due to limited support periods. I'm not confident that Ledger will provide stellar Android OS support, so there will be attack vectors via Android OS anyway, that's mostly inevitable.

Will the FPGA be still programmable in the delivered product? (If yes: a nightmare to be tripped; if not: a discovered and exploitable flaw could render the security boundary moot.)

With further development of KI driven reverse-engineering of binary blobs, security-by-obscurity with Ledger's closed-source firmware policy might become less of a problem for criminals. Consider Ledger OS flawless and error-free? Please, seek medical help if you even had the faintest thoughts or hopes of that.

There could be traces of elements of S, Ar, Ca, Sm that escaped my brain beaker. Feel free to do your own chemistry with 'em.

[Pmalek]

The dumber move is what's next: Idiots will buy this thing, and the paid shills on youtube will encourage them to do so. I'm not going to call anybody out by name, but all you have to do is watch hardware wallet reviews - even those by some of the most popular crypto-youtubers - and it becomes glaringly obvious these clowns are gadget guys who barely understand what the devices actually do.

They are just following the trend. For them, it's about being the quickest to release a review of whatever is their niche. They will sugarcoat it as much as they have to because it generates sales, sponsorships, affiliate, earnings whatever. That's the world we live in. If you are not upset by advertisers telling you to drink Coca Cola and eat at McDonalds, don't be upset with tech reviewers telling you to buy a brand-new hardware wallet.

[PrivacyG]

On Ledger Atom, when something needs your approval, the Ledger OS takes over the screen. The Secure Bar lights up, so you always know which world you are in.

Great.  After all, the one thing our Bitcoin community has never had is one vulnerability that affects who takes over the screen.

[Meuserna]

On Ledger Atom, when something needs your approval, the Ledger OS takes over the screen. The Secure Bar lights up, so you always know which world you are in.

Great.  After all, the one thing our Bitcoin community has never had is one vulnerability that affects who takes over the screen.

...if you trust closed source code, which you should not since there's no way to prove what the parts of the code that you're not allowed to even verify are doing.

"I made you lunch!"
"Awesome. What's in it?"
"The parts I'm willing to tell you about are definitely not poison."
"Uhmmmm.... And the rest...?"
"You don't need to know. Trust me, bro."

[The Sceptical Chymist]

This must be the dumbest move I ever saw, and people working in ledger are complete idiots and morons

I can buy a good airgapped Foundation Passport hardware wallet with $349 and use the remaining $500 to buy bitcoin or to gamble with a good shit coin that I think its price will increase.

Hear, hear. 

There's inflation, there's price increases due to giant upgrades in tech, and then there's what we have here with this piece of excrementitious bouillabaisse--highway fucking robbery.  And it kind of makes me wonder if Ledger is trying to squeeze suckers due to however many former customers of theirs they hoodwinked with that Recover idiocy.  They're not a public company and thus don't have to disclose their financials, but does anyone have a sense of how much business they lost when they revealed they had their hands on everyone's private keys and their enormous hydra-dick up Ledger owners' bungholes simultaneously?

I've never seen any numbers, but I'm hoping their balance sheet got set on fire.