Bitcoin

Nano

Polygon

<div class="textg" style="text-align: justify; font-weight: lighter; line-height: 1.3em; font-size: 15px; border-radius: 3px; color: #80909a; padding: 10px; background-color: #F4F6F9; margin-bottom: 15px;">
 Neither the author, Tim Fries, nor this website, The Tokenist, provide financial advice. Please consult our&nbsp;<a href="https://tokenist.com/terms-of-service/" style="text-decoration:underline;color:#3c7b7b" target="_blank" rel="noreferrer noopener" class="deco-link">website policy</a>&nbsp;prior to making financial decisions.
</div> 
<p class="has-drop-cap">On Tuesday, Ledger’s Chief Security Officer, <a aria-label="Charles Guillemet (opens in a new tab)" href="https://twitter.com/ledger/status/1658458714771169282" target="_blank" rel="noreferrer noopener nofollow" class="deco-link">Charles Guillemet</a>, announced a new feature for the popular lineup of hardware wallets. For users who are not confident enough to safeguard their recovery phrase, Ledger will provide an alternative.</p> 
<p>Specifically, an optional subscription called Ledger Recover. As the name suggests, it will enable users to recover their access to the blockchain network, i.e., their funds. The service is device-agnostic so that the recovery process can be accessed anytime. However, the firm came under fire from the community over the move.</p> 
<h3 id="ledger-s-new-feature-is-optional">Ledger’s New Feature is Optional</h3> 
<p>According to Guillemet, the subscription is not automatically enabled. If activated, the user would first have to go through a KYC-like procedure by verifying their identity via selfie recording. Then, the Ledger device, such as Ledger Nano X, would copy the user’s recovery phrase.&nbsp;</p> 
<p>This duplicate would be encrypted and linked to the verified identity. In addition to encryption, the recovery phrase backup would be fragmented into three shards. Ledger, Coincover, and an unnamed third party would secure each.</p> 
<p>On their own, these three fragments are purportedly useless. When the user activates the Ledger Recover procedure, two parties return the fragments to the device. They are then recombined into a functioning recovery phrase following identity verification.</p> 
<blockquote class="wp-block-quote"> 
 <p><em>“Decryption can only happen on Ledger after identity verification.”</em></p> 
</blockquote> 
<p>Third parties, Onfido and Electronic IDentifications will be in charge of verifying users’ identities. Thus made whole from fragments and multiple third parties, the backup is restored on the Ledger device.&nbsp;</p> 
<h3 id="ledger-faces-backlash-from-users">Ledger Faces Backlash from Users</h3> 
<p>A recovery phrase, typically 12 – 24 words, is the master key that unlocks blockchain access from any device. This is useful in some cases; for example, a user loses 100% of their belongings in a house fire, including the smartphone/computer with the installed wallet app.&nbsp;</p> 
<p>If those were regular digital files, such as videos, they would be permanently lost if no backup existed. But a crypto wallet is not a file container per se. The user would regenerate the wallet app (blockchain access) on a new device with a remembered recovery phrase or retrieved from another location.&nbsp;</p> 
<p>More precisely, the recovery phrase would generate the wallet’s private keys, also called a seed phrase. Therefore, private keys themselves are less important. Private keys authorize transactions while they are derived from the seed phrase.</p> 
<p>In this light, Ledger Recover is controversial in several ways:</p> 
<ul> 
 <li>By tying multiple third parties to self-custody, Ledger could erode the very concept.</li> 
 <li>User ID becomes tied to the recovery phrase, i.e., the digital assets.</li> 
 <li>If the device has this firmware capability, is there a backdoor in the cards?</li> 
</ul> 
<p>These are potential vulnerability vectors that could be exploited down the line. Preemptively, Guillemet assured Ledger customers that such potential exploits were not possible.</p> 
<blockquote class="wp-block-quote"> 
 <p><em>“Self-custody is at the core of our offering and your secret recovery phrase is created on your device. We have no access to it. This will never change.”</em></p> 
</blockquote> 
<p>However, even Binance CEO expressed some doubts about the new Ledger feature.</p> 
<div class="wp-block-image"> 
 <figure class="aligncenter size-full">
  <img decoding="async" width="743" height="251" src="https://tokenist.com/wp-content/uploads/2023/05/Screenshot-2023-05-16-185916.png" alt="" class="wp-image-153627" srcset="https://tokenist.com/wp-content/uploads/2023/05/Screenshot-2023-05-16-185916.png 743w, https://tokenist.com/wp-content/uploads/2023/05/Screenshot-2023-05-16-185916-300x101.png 300w, https://tokenist.com/wp-content/uploads/2023/05/Screenshot-2023-05-16-185916-650x220.png 650w" sizes="(max-width: 743px) 100vw, 743px">
 </figure>
</div> 
<p>Another notable cybersecurity figure, Mudit Gupta of Polygon Labs, called Ledger Recovery a “<a aria-label=" (opens in a new tab)" href="https://twitter.com/Mudit__Gupta/status/1658368265687556097" target="_blank" rel="noreferrer noopener nofollow" class="deco-link"><em>horrendous idea</em></a>,” warning users not to enable the subscription service. </p> 
<div class="cta-referral"> 
 <img src="https://tokenist.com/wp-content/themes/thetokenist/assets/img/del/cta-referral-1.png" alt="" class="cta-referral__img" loading="lazy" decoding="async"> 
 <div class="cta-referral__text"> 
  <p>Join our&nbsp;<a href="https://t.me/thetokenist" target="_blank" rel="noreferrer noopener nofollow">Telegram group</a>&nbsp;and never miss a breaking digital asset story.</p> 
 </div> 
</div> 
<h3 id="is-ledger-s-optional-convenience-worth-it">Is Ledger’s Optional Convenience Worth It?</h3> 
<p>In the first decade of Bitcoin adoption, there was no shortage of headlines on thousands of bitcoins lost. For instance, Gabriel Abed lost 800 BTC in 2011 when his colleague formatted a laptop hard drive containing the wallet’s private keys. These funds are forever locked on the Bitcoin network without a recovery phrase.</p> 
<p>It could also be said that the human brain is unreliable. What if someone suffers a concussion, and the seed phrase is scrambled? In this light, Ledger Recovery is an enticing option.</p> 
<p>However, as software engineers know, complexity breeds points of failure. In 2020, Ledger’s customers <a aria-label=" (opens in a new tab)" href="https://www.reddit.com/r/ethfinance/comments/jhqhc0/phishing_alert_to_all_ledger_customer/" target="_blank" rel="noreferrer noopener nofollow" class="deco-link">received emails</a> from fake Ledger support asking them to download the latest Ledger Live version. These classic phishing attacks exploit the erected bridges between users and third parties.</p> 
<p>In that instance, an unauthorized third party accessed Ledger’s e-commerce database via the API key. This time, Ledger will use multiple third parties and fragment the seed phrase. Yet, all this bridging and connectivity signifies a departure from what users understand as a “self-custodial hardware wallet.”</p> 
<div class="cta-sub js__cta-sub"> 
 <div class="cta-sub__start" data-step="1"> 
  <div class="cta-sub__title">
   <strong>Finance is changing.</strong>
  </div> 
  <div class="cta-sub__subtitle">
   Learn how, with Five Minute Finance.
  </div> 
  <div class="cta-sub__excerpt">
   A weekly newsletter that covers the big trends in FinTech and Decentralized Finance.
  </div> <button type="button" class="btn">Try it out (for free)</button> 
 </div> 
 <div class="cta-sub__form" data-step="2" style="display: none;"> 
  <script type="text/javascript" src="https://app.getresponse.com/view_webform_v2.js?u=QcLhh&amp;webforms_id=hpcwd"></script> 
 </div> 
 <div class="cta-sub__result" data-step="3" style="display: none;"> 
  <div class="cta-sub__title">
   Awesome
  </div> 
  <div class="cta-sub__caption">
   You’ve subscribed.
  </div> 
  <div class="cta-sub__greeting">
   You’re well on your way to being in the know.
  </div> 
 </div> 
</div> 
<p><strong><em>Do you think extra redundancy in wallet recovery is worth the risk? Let us know in the comments below.</em></strong></p> 
<p>The post <a rel="nofollow" href="https://tokenist.com/horrendous-idea-to-back-up-keys-leads-to-user-backlash-for-ledger/">“Horrendous Idea” to Back Up Keys Leads to User Backlash for Ledger</a> appeared first on <a rel="nofollow" href="https://tokenist.com">Tokenist</a>.</p>

“Horrendous Idea” to Back Up Keys Leads to User Backlash for Ledger

Table of Contents

Tokenist

Other articles published on May 16, 2023

CryptoSlate wMarket Update: Litecoin re-enters top 10 amid wider market weakness

Siam Square Mookata's NFT launch- what's in it for customers?

Ankr’s Liquid Staking Takes DeFi by Storm: Redefining Staking Accessibility and Liquidity

Avalanche price analysis: AVAX declines to $14.8 after strong bearish movement

Top 3 Wallets in Aptos

Official Partnership Announcement: Zabava X SateChainMedia

Join our free newsletter for daily crypto updates!