4 ms·

I have a significant amount of crypto and use a ledger wallet. Recently I noticed that the ledger app on my phone requires precise location access to function.

I have a significant amount of crypto and use a ledger wallet. Recently I noticed that the ledger app on my phone requires precise location access to function. It just hit me that ledger has precise locations and wallet balances of all its customers. It's just a matter of time when this information falls in the hands of organized crime. I have since then moved to another wallet and am thinking of selling my house and moving. I have taken steps to ensure that none of the apps that have my crypto balance do not access my location (graphene os with location disabled and always on VPN etc.) This news bothers me. Maybe the criminals asked for data access as well?

FreeTrade 2y ago
I believe Ledger already leaked customers' addresses. https://www.bitdefender.com/en-au/blog/hotforsecurity/hacker-publishes-stolen-email-and-mailing-addresses-of-270000-ledger-cryptocurrency-wallet-users https://www.bitdefender.com/en-au/blog/hotforsecurity/hacker... Probably the most dangerous and costly data leak ever. Can't believe Ledger was able to stay in business after that.
- whatsupdog 2y ago
  I don't live at the house where I ordered my wallet anymore. So that's a relief.
  - zitsarethecure 2y ago
    Have you warned the people who DO live there?
  - ZeroTalent 2y ago
    We literally had to move, out of fear, and I am going to ridiculous measures right now because I work in the field. Luckily, we were renting.
    - grajaganDev 2y ago
      Is it worth the impact to your lifestyle to work in crypto?
      - s1artibartfast 2y ago
        Sounds like it if they have enough assets to worry about organized kidnapping, and the inconvenience is moving apartments.
        ZeroTalent 2y ago
        I literally got very thinly veiled threats from my competition to stop developing my product further, or else... Because, apparently, my product was "f*cking it up for other businesses." My usernames like here are random words.
      - ZeroTalent 2y ago
        Well, it's not just crypto. Most of my work is in general finance, which puts my family at high risk. If you know what you're doing, it's worth it. I plan to sell my company within 12-18 months and retire. And, yes, I'm certain that I will do it. I can't imagine being a celebrity. Fame must be a nightmare.
  - deleted 2y ago
    [deleted]
- sedatk 2y ago
  The article is dated 2020 for those who are curious.
- ZeroTalent 2y ago
  Ledger’s e-commerce and marketing database got popped around June 2020, and the hackers walked away with a bunch of customer emails and some subset of physical addresses/phone numbers. Ledger acknowledged the breach in July, but the data ended up getting shared and reposted multiple times afterward—most famously in December 2020, sparking a wave of phishing attacks. I know the details cause I work in the field. It's quite crazy that they are still in business.
throw101010 2y ago
There are multiples alternatives to Ledger, they are the laughing stock of hardware crypto wallets since they've started their online seed backup solution... at least among power users. Coldcard if you aren't into shitcoins, and Keepkey if you partake in them would be my choices. I would have recommended Trezor at some point but their customer data leak tainted their image for me, they've made a lot of their customers targets just because they chose to use a third party to handle customer data for marketing purpose, if you run a business this sensitive, do this in-house and apply banking standards for this data handling, seems like a no-brainer.
- xvector 2y ago
  This isn't true at all. Ledger has not been a laughingstock of the cryptocurrency community. Their hardware wallet has survived multiple attacks that Trezor has not. It has the strongest security model and easiest to use interface of any cryptocurrency wallet intended for regular use.
  - kylebenzle 2y ago
    You are correct of course! Ledger has long been a pillar of the community but villainized by the Bitcoin core maximalists when ledger started supporting Bitcoin Cash (BCH), the original bitcoin. Like so much in this space people think with their wallet and will villainize anyone who doesn't help sell their bags.
    - whatsupdog 2y ago
      I stopped using Trezor when they started labeling Bitcoin Cash as Bcash.
  - lxgr 2y ago
    I can only second that. I don't have a need for their crypto products personally, but everything I've seen from them (both their open source software and their security research) seems to be a level above the competition.
  - 2y ago
lxgr 2y ago
> the ledger app on my phone requires precise location access to functio Are you sure that's not just for Bluetooth access (which shows the same message, since it can indeed be used to derive somebody's location)? What business reason do they have to send users' location to their servers? > graphene os with location disabled and always on VPN etc. If you don't trust Ledger – how much do you trust your VPN provider? They know both your original IP and what you're doing on the Internet (or at least to which services you're connecting).
- Gigachad 2y ago
  You need location access to scan for Bluetooth devices in app. Pretty sure you don’t need it to use already paired devices. It’s because companies were using Bluetooth scanning in apps combined with known location beacons to work out users locations.
- whatsupdog 2y ago
  As I said, I'm not using ledger anymore. The new wallet's app does not have location permission and my location is turned off anyways. VPN is just an extra layer. I'm sure VPN can see I'm connecting to the wallet's servers, but they can't see my crypto balance (I hope the communication is encrypted by the app).
- ziddoap 2y ago
  >If you don't trust Ledger – how much do you trust your VPN provider? They know both your original IP and what you're doing on the Internet (or at least to which services you're connecting). Well, the big difference (for what OP is worried about) is that two distinct companies would need to be compromised instead of just the one.
  - whatsupdog 2y ago
    Exactly, and ip address does not give precise location (unless a third company, the ISP, is also compromised).
    - 2y ago
m3kw9 2y ago
Your bank is your home

FreeTrade 2y ago

I believe Ledger already leaked customers' addresses. https://www.bitdefender.com/en-au/blog/hotforsecurity/hacker-publishes-stolen-email-and-mailing-addresses-of-270000-ledger-cryptocurrency-wallet-users https://www.bitdefender.com/en-au/blog/hotforsecurity/hacker... Probably the most dangerous and costly data leak ever. Can't believe Ledger was able to stay in business after that.

whatsupdog 2y ago
I don't live at the house where I ordered my wallet anymore. So that's a relief.
- zitsarethecure 2y ago
  Have you warned the people who DO live there?
- ZeroTalent 2y ago
  We literally had to move, out of fear, and I am going to ridiculous measures right now because I work in the field. Luckily, we were renting.
  - grajaganDev 2y ago
    Is it worth the impact to your lifestyle to work in crypto?
    - s1artibartfast 2y ago
      Sounds like it if they have enough assets to worry about organized kidnapping, and the inconvenience is moving apartments.
      - ZeroTalent 2y ago
        I literally got very thinly veiled threats from my competition to stop developing my product further, or else... Because, apparently, my product was "f*cking it up for other businesses." My usernames like here are random words.
    - ZeroTalent 2y ago
      Well, it's not just crypto. Most of my work is in general finance, which puts my family at high risk. If you know what you're doing, it's worth it. I plan to sell my company within 12-18 months and retire. And, yes, I'm certain that I will do it. I can't imagine being a celebrity. Fame must be a nightmare.
- deleted 2y ago
  [deleted]
sedatk 2y ago
The article is dated 2020 for those who are curious.
ZeroTalent 2y ago
Ledger’s e-commerce and marketing database got popped around June 2020, and the hackers walked away with a bunch of customer emails and some subset of physical addresses/phone numbers. Ledger acknowledged the breach in July, but the data ended up getting shared and reposted multiple times afterward—most famously in December 2020, sparking a wave of phishing attacks. I know the details cause I work in the field. It's quite crazy that they are still in business.

throw101010 2y ago

There are multiples alternatives to Ledger, they are the laughing stock of hardware crypto wallets since they've started their online seed backup solution... at least among power users. Coldcard if you aren't into shitcoins, and Keepkey if you partake in them would be my choices. I would have recommended Trezor at some point but their customer data leak tainted their image for me, they've made a lot of their customers targets just because they chose to use a third party to handle customer data for marketing purpose, if you run a business this sensitive, do this in-house and apply banking standards for this data handling, seems like a no-brainer.

xvector 2y ago
This isn't true at all. Ledger has not been a laughingstock of the cryptocurrency community. Their hardware wallet has survived multiple attacks that Trezor has not. It has the strongest security model and easiest to use interface of any cryptocurrency wallet intended for regular use.
- kylebenzle 2y ago
  You are correct of course! Ledger has long been a pillar of the community but villainized by the Bitcoin core maximalists when ledger started supporting Bitcoin Cash (BCH), the original bitcoin. Like so much in this space people think with their wallet and will villainize anyone who doesn't help sell their bags.
  - whatsupdog 2y ago
    I stopped using Trezor when they started labeling Bitcoin Cash as Bcash.
- lxgr 2y ago
  I can only second that. I don't have a need for their crypto products personally, but everything I've seen from them (both their open source software and their security research) seems to be a level above the competition.
- 2y ago

lxgr 2y ago

> the ledger app on my phone requires precise location access to functio Are you sure that's not just for Bluetooth access (which shows the same message, since it can indeed be used to derive somebody's location)? What business reason do they have to send users' location to their servers? > graphene os with location disabled and always on VPN etc. If you don't trust Ledger – how much do you trust your VPN provider? They know both your original IP and what you're doing on the Internet (or at least to which services you're connecting).

Gigachad 2y ago
You need location access to scan for Bluetooth devices in app. Pretty sure you don’t need it to use already paired devices. It’s because companies were using Bluetooth scanning in apps combined with known location beacons to work out users locations.
whatsupdog 2y ago
As I said, I'm not using ledger anymore. The new wallet's app does not have location permission and my location is turned off anyways. VPN is just an extra layer. I'm sure VPN can see I'm connecting to the wallet's servers, but they can't see my crypto balance (I hope the communication is encrypted by the app).
ziddoap 2y ago
>If you don't trust Ledger – how much do you trust your VPN provider? They know both your original IP and what you're doing on the Internet (or at least to which services you're connecting). Well, the big difference (for what OP is worried about) is that two distinct companies would need to be compromised instead of just the one.
- whatsupdog 2y ago
  Exactly, and ip address does not give precise location (unless a third company, the ISP, is also compromised).
  - 2y ago

m3kw9 2y ago

Your bank is your home