Secret

Safety

<p>The universe of cryptocurrencies is a fascinating realm, one that interweaves technology and finance into a new dimension of possibilities. In this continuously evolving ecosystem, <a href="https://walletinvestor.com/magazinadmin/self-custody-is-more-important-than-ever/">hardware wallet</a> providers such as Ledger have played a critical role in ensuring the safety of users&#8217; digital assets. However, Ledger&#8217;s recent introduction of a seed phrase recovery service has sparked a flurry of controversy, spurring both applauds for innovation and concerns over potential security breaches.</p>
<p>&nbsp;</p>
<h2 style="text-align: center;" id="a-new-approach-to-seed-phrase-recovery">A New Approach to Seed Phrase Recovery</h2>
<p>Ledger&#8217;s latest <a href="https://twitter.com/Ledger/status/1658458714771169282?s=20">firmware update</a> unveiled the Ledger Recover service, a novel ID-based key recovery service. This feature allows users to link their seed phrase &#8211; a list of words which store all the information needed to recover a crypto wallet &#8211; to their passports or national identity cards. The intention is to simplify the recovery process should a user forget or lose their seed phrase.</p>
<p>To activate this service, users must provide an official identity document, like a passport or national identity card, to confirm their identity. The seed phrase is then divided into three encrypted fragments, which are entrusted to three separate custodians: Ledger itself, Coincover, and a yet-to-be-named third party. The fragmented seed phrase is stored on high-security hardware modules (HSMs), essentially ultra-secure versions of Ledger&#8217;s own wallets.</p>
<p>However, this system is not without its critics, with some users expressing concern over the potential for security vulnerabilities. They argue that this new system places an uncomfortable amount of trust in the security measures of the custodian companies, which must guard these encrypted fragments against potential breaches.</p>
<blockquote class="twitter-tweet" data-width="500" data-dnt="true">
<p lang="en" dir="ltr">Exciting update, Ledger has a new product, Ledger Recover, that’s launching soon: <a href="https://t.co/nT1VHnnSYz">https://t.co/nT1VHnnSYz</a> </p>
<p>🧵Here’s what Ledger Recover is and what it isn’t, explained by <a href="https://twitter.com/P3b7_?ref_src=twsrc%5Etfw">@P3b7_</a> &amp; in the thread below. <a href="https://t.co/RW1w07H6pK">pic.twitter.com/RW1w07H6pK</a></p>
<p>&mdash; Ledger (@Ledger) <a href="https://twitter.com/Ledger/status/1658458714771169282?ref_src=twsrc%5Etfw">May 16, 2023</a></p></blockquote>
<p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
<h2 style="text-align: center;" id="the-debate-safety-versus-convenience">The Debate: Safety versus Convenience</h2>
<p>Ledger, in its defense, maintains that the security of the fragmented seed phrase is not an issue. According to a spokesperson from the company, &#8220;each fragment is useless on its own, and can only be decrypted on a Ledger. They are completely safe.&#8221; Moreover, the Ledger Recover service is optional and comes with a monthly fee of $9.99.</p>
<p>Despite these reassurances, the introduction of this service has stirred controversy, particularly given Ledger&#8217;s history of security breaches. In 2020, the company suffered a significant data leak, exposing the contact details of nearly 300,000 customers and over a million email addresses. This incident left an indelible imprint on the company&#8217;s security reputation and has led to skepticism about the new recovery service.</p>
<p>One Reddit user voiced their concern, saying, &#8220;This is a disaster waiting to happen. I can&#8217;t actually believe what I&#8217;m reading, this seems absolutely crazy for a hardware wallet provider to encourage you to back up your seed phrase online AND give them your Passport/ID—especially one that has previously suffered a data breach!&#8221;</p>
<blockquote class="twitter-tweet" data-width="500" data-dnt="true">
<p lang="en" dir="ltr">So the seed can leave the device now? </p>
<p>Sounds like a different direction than &quot;your keys never leave the device&quot;. 🤷‍♂️</p>
<p>&mdash; CZ 🔶 Binance (@cz_binance) <a href="https://twitter.com/cz_binance/status/1658453341339283457?ref_src=twsrc%5Etfw">May 16, 2023</a></p></blockquote>
<p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
<h2 style="text-align: center;" id="potential-risks-and-ledger-8217-s-response">Potential Risks and Ledger&#8217;s Response</h2>
<p>The primary concern with Ledger&#8217;s new service is that, in the event of another data breach, a hacker could potentially use the Ledger Recover service to recover a user&#8217;s seed phrase. As Adrian Hetman, tech lead triager at Web3 bug bounty platform ImmuneFi, points out, &#8220;Exposing your seed phrase and then allowing anyone with your ID or Passport to regain access to the locked funds is a bad security posture. ID theft is common and that would expose crypto users to a new form of attack.&#8221;</p>
<p>In response to these concerns, Ledger has insisted that the user&#8217;s government ID is only one component of a multi-factor authentication process. To initiate the recovery process, users must pass a full liveness detection test, which involves a camera and generates randomized prompts that cannot be faked or pre-recorded. This process is reviewed both by advanced technology and human scrutiny to ensure a match before the recovery process can proceed.</p>
<blockquote class="twitter-tweet" data-width="500" data-dnt="true">
<p lang="en" dir="ltr">Ledger Recover is an optional subscription for users who want a backup of their Secret Recovery Phrase. You don’t have to use it, and can continue managing your recovery phrase yourself if that’s why you bought a Ledger.</p>
<p>&mdash; Ledger (@Ledger) <a href="https://twitter.com/Ledger/status/1658458718428700676?ref_src=twsrc%5Etfw">May 16, 2023</a></p></blockquote>
<p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
<h2 style="text-align: center;" id="in-conclusion">In Conclusion</h2>
<p>Ledger&#8217;s new seed phrase recovery service is a groundbreaking development in the crypto space. It has the potential to offer users a more streamlined and secure method of recovering their lost or forgotten seed phrases. However, it also opens up a Pandora&#8217;s box of security concerns, many of which stem from Ledger&#8217;s past security breaches.</p>
<p>While the company has attempted to assuage these fears, it remains to be seen whether the crypto community will embrace this new feature or reject it due to perceived security risks. As with any new technology or feature, Ledger&#8217;s seed phrase recovery service will likely undergo adjustments and refinements as it is tested in the real world. For now, it serves as a compelling case study of the ongoing tension between user convenience and security in the rapidly evolving crypto space.</p>

Ledger’s Crypto Wallet Recovery Service: Innovation or Security Risk?

Table of Contents

WalletInvestor

Other articles published on May 17, 2023

ARKLauncher & Nodem Are Now Open Source

EU Member States Finally Approve MiCA

Why early investors should pay attention to FART COIN: lotteries and high potential

Bitium Agency Unveils Plan to Help Businesses Grow with Blockchain

TRON 101 | Interesting Use Cases of DAO (I)

Bitcoin Cash Upgrade Enables Anyone to Issue CashTokens

Join our free newsletter for daily crypto updates!