Wednesday

Online

Online discussions continue to swirl around Ledger’s new firmware update for its crypto hardware wallet, which experts have claimed could put users’ private keys at risk.&nbsp;Ledger published a Twitter thread on Wednesday attempting to alleviate concerns around the safety of users’ assets, but published a self-contradictory and confusing tweet that stoked the flames of controversy even further.&nbsp;<h2 id="ledger-s-worrying-tweet">Ledger’s Worrying Tweet</h2>In a now-deleted tweet, Ledger support verified criticisms from Wednesday exposing a troublesome reality of using their product: the manufacturer could, technically, release firmware that extracts users’ private keys from their wallets.<blockquote>“You have always trusted Ledger not to deploy such firmware whether you knew it or not,” wrote the company.<figure id="attachment_251289" class="wp-caption aligncenter"><a href="https://cryptopotato.com/wp-content/uploads/2023/05/Screenshot-35.png" rel="noopener noreferrer nofollow"><img class="wp-image-251289 size-large" src="https://cryptopotato.com/wp-content/uploads/2023/05/Screenshot-35-1024x296.png" alt="" width="1024" height="296"></a><figcaption id="caption-attachment-251289" class="wp-caption-text"> Ledger’s Deleted Tweet. 05/17/23 </figcaption></figure></blockquote>This contradicts a claim from the company’s <a href="https://twitter.com/Ledger/status/1592551225970548736" rel="noopener noreferrer nofollow">main account</a> last November, in which Ledger claimed that user private keys cannot be extracted from a wallet’s secure element chip through a firmware update.&nbsp;At the time, Ledger and other wallet manufacturers were recording record sales in the aftermath of FTX’s collapse, as crypto investors sought the security of self-custody and cold storage for their crypto assets.&nbsp;On Thursday, Ledger <a href="https://twitter.com/Ledger_Support/status/1659218986314366976" rel="noopener noreferrer nofollow">said</a> that it decided to delete its Wednesday tweet due to its “confusing wording.” However, Ledger’s CTO Charles Guillemet published a follow-up thread explaining that wallets, in general, have “many ways” to implement a backdoor, and that some level of trust is required with any third-party wallet purchase.&nbsp;<blockquote class="twitter-tweet">22/ If you want to be completely trustless, you'll have to learn electronics to build your computer, learn ASM to build your compiler, then build a wallet stack, your own node and synchronizer, you'll have to learn cryptography to build your own signature stack.— Charles Guillemet (@P3b7_) <a href="https://twitter.com/P3b7_/status/1659187097071132673?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 18, 2023</a></blockquote><blockquote>“Open source doesn’t really solve this,” he added. “It’s impossible to have guarantees that the electronic itself is not backdoored, nor that the firmware that runs inside the wallet is the one you audited.”</blockquote><h2 id="ledger-recover">Ledger Recover</h2>Criticism around Ledger swelled on Wednesday after the company announced its new hardware wallet service “<a href="https://cryptopotato.com/ledger-under-fire-for-allegedly-exposing-user-seed-phrases/" rel="noopener noreferrer nofollow">Ledger Recover</a>.” With user permission, the service breaks a wallet’s private keys into three shards, encrypts them, and stores them with three separate centralized providers – one of which is Ledger.&nbsp;The subscription service requires users to provide personal identifying information before using it. In return, users are granted a method of recovering their private keys in case they lose both their hardware device and seed phrase paper backup.&nbsp;The crypto community blasted the service and its associated firmware update for adding a code path that can send private keys to third parties. Many experts including developer and auditor “foobar” recommended that followers stop using the company’s devices.<blockquote class="twitter-tweet">If you have a ledger, your keys are not compromised (yet). But if you upgrade to the latest firmware, it’ll stick in a code path that can send your private key to third parties. Given ledger doxxed their own customers in the past, it’s unlikely that they’ll keep this info safe— foobar (@0xfoobar) <a href="https://twitter.com/0xfoobar/status/1658493892809859073?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 16, 2023</a></blockquote>The post <a href="https://cryptopotato.com/ledger-responds-to-customer-fears-on-wallet-safety-but-deletes-confusing-tweet/" rel="noopener noreferrer nofollow">Ledger Responds to Customer Fears On Wallet Safety, But Deletes “Confusing” Tweet</a> appeared first on <a href="https://cryptopotato.com/" rel="noopener noreferrer nofollow">CryptoPotato</a>.

Ledger Responds to Customer Fears On Wallet Safety, But Deletes “Confusing” Tweet

Table of Contents

CryptoPotato_News

Other articles published on May 18, 2023

Anchorage Digital Integrates Snapshot for Gasless Governance Voting

Countries all over the globe are slowly embracing CBDCs

Top 3 Bridges for Algorand

WEMIX.Fi Event Celebrating the Adding of 9 New Pools Takes Place!

Render token becomes the top gainer amid very bullish sentiment

Bitcoin reclaims $27k as accumulation turns to distribution

Join our free newsletter for daily crypto updates!