Just listened to the #Ledger Recover episode on WhatBitcoinDid and found it mildly frustrating. Both NYK and Ledger’s CEO made inaccurate claims. Here are some general notes on #Bitcoin wallets and security as it relates to the episode.
- Ledger’s CEO claimed that we would know whether a vulnerability exists and has been discovered due to responsible disclosure agreements or widespread loss of customer funds. That’s simply not true. 0-day vulnerabilities must always be presumed to exist in any system and it was scary to me that he brushed off the issue.
- Software wallets are actually not terrible when done well. They’re perfectly fine for smaller amounts imo. Open source wallets that properly store your seed backed by Android’s keystore of the Secure Enclave in iOS is still relatively secure (though nowhere near a hardware wallet)
- My biggest concern is that Ledger feels confident about verifying a large number of customer recovery claims online in a time where deepfakes and AI image video generation has recently taken leaps forward. How long until we see customer funds recovered by malicious actors if Ledger’s recovery service sees any sort of large scale adoption?
However, in the end I’m not very concerned. This will be a nische feature due to its $10 a month cost (which nobody seems to be talking about) and the target audience it’s aimed at. Ledger has one of the most respected security teams in the space but the company sucks at PR.
nordlys / Nordlys
npub1ax…m58z7
2023-05-23 07:44:44
Author Public Key
npub1axkh7zyats2ypljcqzclndswzs9rrxcz9zjsqtt0re40gmsxrz3swm58z7Published at
2023-05-23 07:44:44Event JSON
{
"id": "7b4d8165622fa41bc41c5e1e720122036e7a6a79489b68a5f2ea8837a69109da",
"pubkey": "e9ad7f089d5c1440fe5800b1f9b60e140a319b0228a5002d6f1e6af46e0618a3",
"created_at": 1684827884,
"kind": 1,
"tags": [
[
"t",
"ledger"
],
[
"t",
"bitcoin"
]
],
"content": "Just listened to the #Ledger Recover episode on WhatBitcoinDid and found it mildly frustrating. Both NYK and Ledger’s CEO made inaccurate claims. Here are some general notes on #Bitcoin wallets and security as it relates to the episode. \n\n- Ledger’s CEO claimed that we would know whether a vulnerability exists and has been discovered due to responsible disclosure agreements or widespread loss of customer funds. That’s simply not true. 0-day vulnerabilities must always be presumed to exist in any system and it was scary to me that he brushed off the issue. \n\n- Software wallets are actually not terrible when done well. They’re perfectly fine for smaller amounts imo. Open source wallets that properly store your seed backed by Android’s keystore of the Secure Enclave in iOS is still relatively secure (though nowhere near a hardware wallet)\n\n- My biggest concern is that Ledger feels confident about verifying a large number of customer recovery claims online in a time where deepfakes and AI image video generation has recently taken leaps forward. How long until we see customer funds recovered by malicious actors if Ledger’s recovery service sees any sort of large scale adoption? \n\nHowever, in the end I’m not very concerned. This will be a nische feature due to its $10 a month cost (which nobody seems to be talking about) and the target audience it’s aimed at. Ledger has one of the most respected security teams in the space but the company sucks at PR.",
"sig": "540540bf218564c8d75537e8309e392c556096dea47b6a281a380cc14690e4b02876253a09ef4b1294857c30ba95fd7f515a6320717be2b504cdc63c9e0bccff"
}