Wednesday

Online

Online discussions continue to swirl around Ledger’s new firmware update for its crypto hardware wallet, which experts have claimed could put users’ private keys at risk. 
Ledger published a Twitter thread on Wednesday attempting to alleviate concerns around the safety of users’ assets, but published a self-contradictory and confusing tweet that stoked the flames of controversy even further. 
<h2 id="ledger-s-worrying-tweet">Ledger’s Worrying Tweet</h2>
In a now-deleted tweet, Ledger support verified criticisms from Wednesday exposing a troublesome reality of using their product: the manufacturer could, technically, release firmware that extracts users’ private keys from their wallets.
<blockquote>“You have always trusted Ledger not to deploy such firmware whether you knew it or not,” wrote the company.

<figure id="attachment_251289" aria-describedby="caption-attachment-251289" style="width: 1024px" class="wp-caption aligncenter"><a href="https://cryptopotato.com/wp-content/uploads/2023/05/Screenshot-35.png" data-wpel-link="internal"><img class="wp-image-251289 size-large" src="https://cryptopotato.com/wp-content/uploads/2023/05/Screenshot-35-1024x296.png" alt="" width="1024" height="296" srcset="https://cryptopotato.com/wp-content/uploads/2023/05/Screenshot-35-1024x296.png 1024w, https://cryptopotato.com/wp-content/uploads/2023/05/Screenshot-35-300x87.png 300w, https://cryptopotato.com/wp-content/uploads/2023/05/Screenshot-35-768x222.png 768w, https://cryptopotato.com/wp-content/uploads/2023/05/Screenshot-35-1536x444.png 1536w, https://cryptopotato.com/wp-content/uploads/2023/05/Screenshot-35-2048x592.png 2048w, https://cryptopotato.com/wp-content/uploads/2023/05/Screenshot-35-50x14.png 50w" sizes="(max-width: 1024px) 100vw, 1024px" /></a><figcaption id="caption-attachment-251289" class="wp-caption-text">Ledger&#8217;s Deleted Tweet. 05/17/23</figcaption></figure></blockquote>
This contradicts a claim from the company’s <a href="https://twitter.com/Ledger/status/1592551225970548736" data-wpel-link="external" target="_blank">main account</a> last November, in which Ledger claimed that user private keys cannot be extracted from a wallet’s secure element chip through a firmware update. 
At the time, Ledger and other wallet manufacturers were recording record sales in the aftermath of FTX’s collapse, as crypto investors sought the security of self-custody and cold storage for their crypto assets. 
On Thursday, Ledger <a href="https://twitter.com/Ledger_Support/status/1659218986314366976" data-wpel-link="external" target="_blank">said</a> that it decided to delete its Wednesday tweet due to its “confusing wording.” However, Ledger’s CTO Charles Guillemet published a follow-up thread explaining that wallets, in general, have “many ways” to implement a backdoor, and that some level of trust is required with any third-party wallet purchase. 
<blockquote class="twitter-tweet" data-width="500" data-dnt="true">
22/ If you want to be completely trustless, you&#39;ll have to learn electronics to build your computer, learn ASM to build your compiler, then build a wallet stack, your own node and synchronizer, you&#39;ll have to learn cryptography to build your own signature stack.
&mdash; Charles Guillemet (@P3b7_) <a href="https://twitter.com/P3b7_/status/1659187097071132673?ref_src=twsrc%5Etfw" data-wpel-link="external" target="_blank">May 18, 2023</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
<blockquote>“Open source doesn’t really solve this,” he added. “It’s impossible to have guarantees that the electronic itself is not backdoored, nor that the firmware that runs inside the wallet is the one you audited.”</blockquote>
<h2 id="ledger-recover">Ledger Recover</h2>
Criticism around Ledger swelled on Wednesday after the company announced its new hardware wallet service “<a href="https://cryptopotato.com/ledger-under-fire-for-allegedly-exposing-user-seed-phrases/" data-wpel-link="internal">Ledger Recover</a>.” With user permission, the service breaks a wallet’s private keys into three shards, encrypts them, and stores them with three separate centralized providers – one of which is Ledger. 
The subscription service requires users to provide personal identifying information before using it. In return, users are granted a method of recovering their private keys in case they lose both their hardware device and seed phrase paper backup. 
The crypto community blasted the service and its associated firmware update for adding a code path that can send private keys to third parties. Many experts including developer and auditor “foobar” recommended that followers stop using the company’s devices.
<blockquote class="twitter-tweet" data-width="500" data-dnt="true">
If you have a ledger, your keys are not compromised (yet). But if you upgrade to the latest firmware, it’ll stick in a code path that can send your private key to third parties. Given ledger doxxed their own customers in the past, it’s unlikely that they’ll keep this info safe
&mdash; foobar (@0xfoobar) <a href="https://twitter.com/0xfoobar/status/1658493892809859073?ref_src=twsrc%5Etfw" data-wpel-link="external" target="_blank">May 16, 2023</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
The post <a href="https://cryptopotato.com/ledger-responds-to-customer-fears-on-wallet-safety-but-deletes-confusing-tweet/" rel="nofollow">Ledger Responds to Customer Fears On Wallet Safety, But Deletes “Confusing” Tweet</a> appeared first on <a href="https://cryptopotato.com/" rel="nofollow">CryptoPotato</a>.

Ledger Responds to Customer Fears On Wallet Safety, But Deletes “Confusing” Tweet

Table of Contents

CryptoPotato_News

Other articles published on May 18, 2023

Twitter Boss Elon Musk’s Interest in Pepe Coin and CZ’s Unfollowing Raise Questions: Is a Histori...

Bitcoin price analysis: BTC dips to lows of $26,612.11 as selling pressure intensifies

Chainlink BUILD Partners with Whitehole Finance to Drive Adoption of Multi-Asset Lending Platform...

Dogecoin Sets New All-Time High With the DRC-20 Hype

Legal Experts Slam Florida’s CBDC Ban as Ineffective and Misguided

PepePunks: The Ultimate Deflationary Token With AI and NFT Utility

Join our free newsletter for daily crypto updates!