Hardware-Wallet Noob hier. Ich kenne Ledger schon eine Weile und überlege jetzt, eine zu kaufen, aber ich weiß nicht, wie das nicht das Gegenteil von vertrauenslosem DeFi sein soll. Ich versuche nicht zu fud, ich bin ehrlich gesagt auf der Suche nach Aufklärung. Für jede Hilfe wäre ich dankbar

[root_s2yse8vt]

Up

0

Down

::

Mein Hauptvertrauensproblem liegt in der Hardware selbst. Ich weiß, wie man ein bisschen programmiert, also bin ich mit Open-Source-Software einverstanden. Ich mag, wie transparent sie ist und wie ich sie sogar direkt von GitHub aus installieren kann. Aber Hardware ist eine andere Sache für mich. Ich war noch nie der Typ Bastler, der weiß, wie man Elektronik knackt und weiß, was ich da sehe, daher bin ich ein wenig nervös, wenn es darum geht, einem Hardwarehersteller zu vertrauen.

Aber dann sehe ich die weite Verbreitung von Ledger und bin überzeugt, dass es eine Lücke in meinem Wissen geben muss. Kann mir also bitte jemand die folgende Frage beantworten? Wenn ich eine Ledger-Hardware-Wallet auf ledger.com kaufe, wie vertraue ich dann *nicht* einfach einer zentralen Einheit (Ledger SAS)?

Der Ethos dieses Raumes ist “nicht vertrauen, verifizieren”. Wie kann jemand wie ich in der Lage sein, zu *verifizieren*, dass die Hardware-Wallet, die ich von ledger.com kaufe, nicht manipuliert oder mit einer Backdoor kompromittiert wurde? Ich versuche nicht, Ledger zu betrügen, ehrlich gesagt habe ich das Gefühl, dass sie, wenn sie diesen Beitrag jemals sehen würden, ihn nicht einmal persönlich nehmen würden und verstehen würden, warum jemand in der Lage sein möchte, die Integrität von Hardware zu überprüfen, genauso wie jemand die Integrität von Software überprüfen möchte.

Also ja, wenn mir jemand helfen kann zu verstehen, warum ich dem französischen Unternehmen, das Ledger herstellt (Ledger SAS), nicht vertrauen muss, wäre ich dankbar.

[acabyeoj]

Up

0

Down

::

The way I understand it is, the functions of the physical device itself are so basic and “dumb” that it doesn’t even have the capacity to accept any form of external code, aside from the asset specific apps that it runs. You do after all, have to sign off on any outgoing transaction by physically pressing the two buttons. Less complex equals less opportunities for bad actors to take advantage.

As far as tampering, I think as long as your device generates the seed phrase in front of you, there’s no other way the device could be compromised. If it comes with a seed phrase already generated, toss that shit in the trash (it’s compromised). The phone app itself will also do an “authenticity check” to verify that the device is, er, authentic. I’m not sure how it does this but it does in fact do it.

As long as your seed phrase is generated by the device itself and is written down and secure and locked away in multiple safe locations, you are completely secure. At least that’s what crypto dad told me on YouTube.

[aFungible]

Up

0

Down

::

OP is a good OP.

[sudomatrix]

Up

0

Down

::

I brought up some of these ideas in /r/bitcoin and got trashed and downvoted for being unrealistic.

Here are some of the ways I could “cheat” if I worked at Ledger:

1. Make the random seed generator not so random, so that someone who works at Ledger could actually recreate some small percentage of seeds and steal from them.
2. Make the Ledger device wait for a long period of inactivity in the middle of the night on very rare occasions register itself as a USB HID keyboard and inject control-alt-W (open terminal) and the commands to send the user’s private key to a server.
3. Make the Ledger desktop software on very rare occasions alter the destination address of a transaction to one controlled by someone who works at Ledger,

I’m sure given more time and creativity I could think of more. Having said all this, I have weighed all the pros and cons and I use a Ledger myself. It’s the safest choice that isn’t a nightmare of unusable error-prone processes.

But please people, use a passphrase on your wallet. It’s entirely generated by you, not a random number generator written by someone else.

[AXIETwixie]

Up

0

Down

::

Hi, I’m glad that you are interested to buy a Ledger device. Your concerns are totally understandable. You can have a look at this article that explains everything that you need to know before making your informed choice – https://www.ledger.com/academy/hardwarewallet/why-you-should-choose-ledger-hardware-wallets

On the same academy page, you’ll find links to several other resources that will help you do your research. Once you make up your mind whether to buy a Ledger device then you can order directly from our official site – https://shop.ledger.com/

If you have any additional questions, I would be happy to help you🙂

[Pots454]

Up

0

Down

::

I do have ledgers. Own three, one of each. However I do think it would be simple to have software that could access the chip and read the stored private keys if it was specifically designed and built to do that.

and you would never know.

[itsnotlupus]

Up

0

Down

::

Sure. Ledger devices have some closed-source code too, and I don’t think they have reproducible builds, so yes, you end up having to trust the Ledger team to not do you dirty.

The reason why you’d do that anyway is because it’s likely to give you the smallest attack surface you can get for your crypto.

Other hardware wallets don’t rely on a [“secure element”](https://www.ledger.com/academy/security/the-secure-element-whistanding-security-attacks) to store their keys and have been shown to be vulnerable to physical access attacks because of it. The Ledger hardware has so far resisted those. That same “secure element” is why some of the code can’t be open-source, Ledger isn’t allowed to publish the firmware for it.

Going without a hardware wallet means you’re keeping your keys on a general purpose computing device and hoping for the best, exposing yourself to many more attack vectors in the process.

I probably don’t need to explain why exchanges are a poor choice for long term coin storage.

Anyway, as far as verifying things, Ledger offers a few links you may find useful:

– https://support.ledger.com/hc/en-us/articles/4404389367057-Is-my-Ledger-device-genuine
– https://support.ledger.com/hc/en-us/articles/4404382029329-Void-your-warranty-it’s-fun
– https://support.ledger.com/hc/en-us/articles/4404807946001-How-to-verify-the-authenticity-of-Ledger-Live

But ultimately all of those steps are intended to help you verify that you’re getting the goods from Ledger and not from a villainous 3rd party.
You’re still expected to be able to trust Ledger itself.

Some folks are willing to live without a secure element and the protection it brings against physical access, and if you’re one of those and you have the skills to do it, you can literally audit the entirety of the Trezor source code AND their circuit board schematics and then [build the whole thing yourself from scratch](/r/TREZOR/comments/nmoirp/i_knew_trezor_was_open_source_but_i_didnt_realize/).

[Autor]

Beiträge