Sicherheitsproblem: Die an die PIN gebundene Passphrase ist möglicherweise nicht so sicher wie eine temporäre Passphrase

[root_s2yse8vt]

Up

0

Down

::

Das Einrichten einer **temporären** Passphrase scheint **sicherer** zu sein (auch wenn es lästiger ist), da das Gerät die Passphrase “vergisst”, wenn Sie es ausschalten, und Sie sie jedes Mal eingeben müssen, wenn Sie Zugang zu dieser speziellen Wallet haben möchten.

**Die Frage ist jedoch: …. Wenn Sie sich entscheiden, sie mit dem Pin zu verknüpfen, wird Ihre Passphrase dann im Ledger gespeichert (AKA kann zusammen mit dem 24-Wort-Seed extrahiert werden)?

​

**Von der Ledger-Website:**

An der Nadel befestigt:

“*T****die Passphrase wird auf dem Gerät gespeichert*** *bis Sie sie mit einer anderen Passphrase überschreiben oder bis das Gerät zurückgesetzt wird. “*

Temporäre Passphrase:

“*Die Verwendung einer temporären Passphrase ermöglicht den Zugriff auf eine neue Gruppe von Konten auf Ihrem Ledger-Gerät* ***für die Dauer der Sitzung****. Befolgen Sie die nachstehenden Anweisungen* ***jedes Mal***, wenn Sie auf die durch die Passphrase geschützten Konten zugreifen möchten. “*

​

Was haltet ihr von dieser Sache?

[DefectiveClown]

Up

0

Down

::

The only people who can answer you would be Ledger staff but with recent lies about the keys not being extracted, would you trust whatever answer Ledger provides now? Anyone else answering yes or no would only be answering based on information that Ledger releases.

[[deleted]]

Up

0

Down

::

[deleted]

[Squezeplay]

Up

0

Down

::

Storing it is for sure less secure because anyone win the pin can access the wallet, or if it is possible to extract data, then the passphrase is there too.

Some hardware wallets allow you to type the passphrase on the computer. While this is less secure from the prospective of leaking your passphrase, its more secure vs no passphrase.

My legder S doesn’t seem to support this, at least when using it with metamask, and its a huge time consuming pain to enter it in on the device. I wish they allowed to enter the passphrase on the computer like other wallets (correct me if I’m wrong and they do, I was just not able to with a nano S with metamask).

[LordGaraidh]

Up

0

Down

::

Not entirely accurate. If you enter a wrong pin three times it forgets the pin for the 25th word wallet. I don’t mean 3 times in a row as that will wipe the whole device. Instead of you input a wrong pin then a correct pin then wrong pin then correct pin etc it will still add up to 3 wrong inputs and the device will forget the pin to the 25 word wallet, aka the passphrase wallet. I tried it and it does work.

[loupiote2]

Up

0

Down

::

Temporary is potentially safer but much less convenient, as it needs to be re-entered every time.

That’s assuming the critical data stored in the secure element (seed phrase, passphrase, PINs) could be extracted, but if that’s the case, it would be a critical vulnerability. So personally I sleep well with my passphrase stored in the device.

[pringles_ledger]

Up

0

Down

::

Hey there, passphrases are not supported for Ledger Recover – users can only back up their recover phrase instead. The passphrase would need to be kept secured or remembered correctly by the user instead. Our FAQ addresses your question – please see the section, “What if I have a passphrase-protected wallet? Is it covered by Ledger Recover?” Let us know if you’ve any other questions.
https://support.ledger.com/hc/en-us/articles/9579368109597-Ledger-Recover-FAQs?docs=true

[Jackpoder]

Up

0

Down

::

I can’t answer how it works for Ledger but asked this question Trezor and they said that all wallets manufacturers can extract passphrases just like seeds if they wanted to…. then they of course pointed out that they are open source.

However, if there is any fear Ledger might have your keys…. then adding a passphrase won’t help…. I’m personally looking at multisig solutions. That seems to be the only safe thing now

[Autor]

Beiträge