Kann jemand das ganze Recover-Fiasko in Laiensprache erklären?

[root_s2yse8vt]

Up

0

Down

::

Ich versuche, sicherheitsbewusst zu sein, und kam zu dem Schluss, dass Ledger eine gute Option ist, als ich anfangs einige Kryptowährungen als Investition nach einem Glücksfall kaufte. Abgesehen davon weiß ich *wirklich* nichts von den technischen Details, die dahinter stecken, ich lese nur Dinge online und treffe mein Urteil auf der Grundlage des Konsenses von Leuten, die klüger sind als ich. Ich habe einige der alten Threads von vor 5\~ Monaten gelesen, als Recover angekündigt wurde, sowie einige der neueren, und ich *denke*, dass ich es irgendwie verstehe, aber ich hatte gehofft, dass es jemand für einen Sicherheitseinsteiger erklären könnte, damit ich das Thema besser beurteilen kann.

[kuzkokronk]

Up

0

Down

::

The main issue is that, for years, Ledger said the 24 word seed phrase COULD NOT LEAVE YOUR WALLET. But then they introduced Ledger Recover which is an optional service to extract the 24 word seed phrase from your wallet for safe keeping, in case you lose your copy.

This has proven that Ledger has had the ability to take your seed phrase with a single firmware update the whole time.

EDIT: Spelling

[Wu-Tang-Chan]

Up

0

Down

::

ledger say “its impossible for seed to leave u device”

ledger say “we can take u seed from u device to keep it safe for 50$/month”

ledger say “don’t worry, we only take sharded seed, it doesnt count”

…but it did count, it very counted.

[essjay2009]

Up

0

Down

::

So there are two main issues. One is that people incorrectly (although partially because of Ledger’s marketing) thought it was impossible for your private keys to leave your ledger device. The other is that Ledger started offering a service to “back up” your private keys online.

The first issue. There were a couple of statements on the Ledger site that heavily implied your recovery phrase could not leave the ledger device. This wasn’t correct, and anyone who understood the architecture of the ledger devices understood this. You’ll see comments back when it was released from people who are deep in to the technical side basically saying “yeah, of course they can do that, how do you think these things work?” The crux of it is that ledgers have to be able to run software, and that software can be changed. Every time you add a new type of coin to your ledger you are adding a small bit of software that runs. The software takes your root keyset and runs it through a derivation path unique to that coin to general additional keys. It is these additional keys that are used to interact with whatever chain(s) the coin runs on. It is possible for a bit of software to have the derivation path 0*0*0*0 which will basically pass through the root key as-is. Ledger should not have marketed the Ledger in a way that even suggested your keys could not leave the device (I guess the argument was that at the time, they couldn’t as no software had been written that would allow it – but that’s pretty weak).

The second part is the online backup. A few issues with this. Ledger are sharding your keys in such a way that no single party can reconstruct them to steal your keys. There is still a risk though, as storing your private keyset online anywhere is risky and you leave yourself open to all sorts of attacks including social engineering – it was not at all clear how Ledger was going to adequately protect against these sorts of attacks whilst also enabling people to access their keys. But to make matters worse, there were unclear relationships between the parties they chose to store the keys where it appeared that one was Ledger themselves and one was using equipment built, installed, and maintained by … Ledger. So the independence of these parties was questionable to say the least.

So generally a bit of a shit show.

[Bruno_Alejandro]

Up

0

Down

::

Ledger’s Shady Scheme

In the town of Coinville, everyone loved to keep their coins safe in a magical hard wallet made by a company called Ledger. People loved these hard wallets because they were super secure, and you could keep your secret seed phrase all to yourself.

🌟 Chapter 1: The Trustworthy Ledger 🌟

Ledger used to be a trusted company. Their hard wallets were known for their ironclad security. People could sleep soundly, knowing their coins were safe inside.

🌟 Chapter 2: The Devious Plan 🌟

But one day, Ledger had a devious plan. They decided to add a new feature that allowed them to recover your secret seed phrase. At first, people didn’t notice, but Ledger’s real intentions were far from good.

🌟 Chapter 3: The Hidden Vulnerability 🌟

The recovery feature made the hard wallets vulnerable, splitting your secrets into 3 encrypted parts, keeping one and giving the other 2 to other companies. If two out of three untrustworthy companies conspired together, they could steal all your precious coins. Even the government could order Ledger to spill the beans on your secrets, putting your coins at risk.

🌟 Chapter 4: The Shattered Trust 🌟

When people discovered Ledger’s evil scheme, they were furious! They realized their coins were no longer safe. Ledger had become the bad guy in Coinville. People felt betrayed, and they knew they couldn’t trust their hard wallets anymore.

🌟 Chapter 5: The Quest for a Real Hero 🌟

Coinville needed a hero to protect their coins. They searched for a new company that truly cared about their security. Soon, they found a better hard wallet that didn’t have any secret backdoors and kept their coins safe.

The end.

[shoomanfoo]

Up

0

Down

::

My elder was liquidated last year, seed phrase NEVER on anything digital. You can check my post history. These ppl are criminals

[syrozzz]

Up

0

Down

::

My turn my turn!
Ledger made a new feature to recover your super duper private key (if keeping it on a piece of paper stress you out). It is encrypted in 3 shards on your hardware, then each shard is entrusted to a different company.

If you don’t opt-in nothing will happen but people thought it was technically impossible for Ledger to access your key. Given that their hardware is still not open source yet, that ability itself stresses people out.

[buranku506]

Up

0

Down

::

You purchased your 1st house. You got a mortgage with the bank.

The Bank was kind enough to make a copy of your house keys (without your permission). The Bank cut your key in 3 ways. The bank gave 1/3 of the key to 3 unknown companies.

Rumors has it, that the bank has been doing this since day 1, but after a few years you just find out now.

You can pay the bank an extra fee (9.99 usd a month) to have 3 companies manage your 1 key or not pay 9.99 a month and the 3 companies or bank still have access to your house key.

How would you feel? What if someone hacks the bank or 1 of the 3 companies and get access to your house key. The bank says “don’t worry about it”. How do you feel now?

Sound crazy and sell the house? Or continue like nothing happen?

This is my understanding for the situation

[JAMaiel]

Up

0

Down

::

So, envision your crypto as money in a digital vault. Ledger is the brand of this vault, and it’s meant to be super secure. For a long time, Ledger assured users that their personal “key” (the 24-word seed phrase) could never leave their wallet. This “key” is like the ultra-secret password to your vault. However, with the introduction of “Recover”, Ledger basically said, “Hey, we can help you extract that key for safekeeping in case you lose it.” This raised eyebrows because it contradicted their initial promise. The concern is, if Ledger can offer such a service, it implies they could potentially access the secret password with just a software update. It’s like learning that the manufacturer of your vault has a master key and might access it, even if their intentions are good.

[bmoreRavens1995]

Up

0

Down

::

Layman terms if you don’t trust yourself to keep your seeds opt in to the service pay $10/mo if you are responsible and think you can keep your seeds safe opt out don’t pay for the service and life goes on. ledger isn’t interested in your funds nor is the govt its that simple

[cryptowalter4572]

Up

0

Down

::

The two main ways that people lose access to their crypto. 1. Give away their seedphrase. 2. Lose their seedphrase. Ledger tried to address two. The way they did it from a pr pov was to say the least ordinary.

[Flaky-Wedding2455]

Up

0

Down

::

I am still happily using my ledger. I think the risk is still very low but I am disappointed the tech exists even if you don’t opt in. My move was I am now diversified over 4 different cold wallets. They all have their pluses and minuses. I figure if a disaster happens I lose 1/4 my holdings which would suck but not be catastrophic.

[Autor]

Beiträge