5 ms·

I picked up a Ledger in a raffle at a meetup a few months ago, and it's just been sitting around ever since because I was concerned about this kind of risk. It'

I picked up a Ledger in a raffle at a meetup a few months ago, and it's just been sitting around ever since because I was concerned about this kind of risk. It's a bit of a shame... Can't ethically sell it for the same reason. Fortunately, I was recently able to use it to introduce a curious friend of mine to Ethereum, using small amounts, so there's been at least some benefit.

StavrosK 9y ago
Keep in mind that, even with these vulnerabilities, the Ledger is still the safest you can get for cryptocurrency storage.
- yarrel 9y ago
  Trezor is better.
  - StavrosK 9y ago
    How so? Trezor had a vulnerability where you could extract the private keys by measuring power draw.
  - charlesdm 9y ago
    Trezor seems much worse, in nearly every security write-up I have read.
- lawn 9y ago
  Except an encrypted seed in cold storage. If you want to spend it you'll have different problems though.
  - StavrosK 9y ago
    Yeah, the problem with offline/paper seeds is that, if you want to spend them, you're going to become more vulnerable than with a hardware wallet, and they're single-use. Not to mention that they're hard to generate securely.
rebuilder 9y ago
If you're worried about using a secondhand Ledger, then shouldn't you be worried about using a brand new one you fetched from the assembly line yourself?
- AlexCoventry 9y ago
  A device with unknown provenance is much more likely to be compromised than one from an organization making good money from a legitimate business model.
  - rebuilder 9y ago
    Sure, but this is the type of product where trust is not what you want to rely on at all. Edit: I mean: if it's possible for the manufacturer to compromise their customers, then in the case of crypto wallets, you have to assume that they will screw their customers over. The potential profits for a company like Ledger, running a long scam, waiting for the moment their take hits a high enough sum to be worth doing a runner and relocating to some island paradise under a fake name, are just too great to allow for trust. Until now, I assumed the whole point of HW wallets was a 100% assurance of trustlessness. Now, it seems maybe that isn't the case.
    - AlexCoventry 9y ago
      That sounds like extremist individualism. You have to trust someone. The potentially nice thing about cryptocurrency in this regard is that you have more control and transparency about who you're trusting and what they're doing with that trust. But there's still trust involved.
      - dragonwriter 9y ago
        > The potentially nice thing about cryptocurrency in this regard is that you have more control and transparency about who you're trusting No, you don't. That's, like, the exact opposite of the whole model of cryptocurrency, which is trusting an anonymous collection of people.

StavrosK 9y ago

Keep in mind that, even with these vulnerabilities, the Ledger is still the safest you can get for cryptocurrency storage.

yarrel 9y ago
Trezor is better.
- StavrosK 9y ago
  How so? Trezor had a vulnerability where you could extract the private keys by measuring power draw.
- charlesdm 9y ago
  Trezor seems much worse, in nearly every security write-up I have read.
lawn 9y ago
Except an encrypted seed in cold storage. If you want to spend it you'll have different problems though.
- StavrosK 9y ago
  Yeah, the problem with offline/paper seeds is that, if you want to spend them, you're going to become more vulnerable than with a hardware wallet, and they're single-use. Not to mention that they're hard to generate securely.

rebuilder 9y ago

If you're worried about using a secondhand Ledger, then shouldn't you be worried about using a brand new one you fetched from the assembly line yourself?

AlexCoventry 9y ago
A device with unknown provenance is much more likely to be compromised than one from an organization making good money from a legitimate business model.
- rebuilder 9y ago
  Sure, but this is the type of product where trust is not what you want to rely on at all. Edit: I mean: if it's possible for the manufacturer to compromise their customers, then in the case of crypto wallets, you have to assume that they will screw their customers over. The potential profits for a company like Ledger, running a long scam, waiting for the moment their take hits a high enough sum to be worth doing a runner and relocating to some island paradise under a fake name, are just too great to allow for trust. Until now, I assumed the whole point of HW wallets was a 100% assurance of trustlessness. Now, it seems maybe that isn't the case.
  - AlexCoventry 9y ago
    That sounds like extremist individualism. You have to trust someone. The potentially nice thing about cryptocurrency in this regard is that you have more control and transparency about who you're trusting and what they're doing with that trust. But there's still trust involved.
    - dragonwriter 9y ago
      > The potentially nice thing about cryptocurrency in this regard is that you have more control and transparency about who you're trusting No, you don't. That's, like, the exact opposite of the whole model of cryptocurrency, which is trusting an anonymous collection of people.