Developer Alerts Ledger Live Software Could Be Tracking User IDs, Apps and Balan

[sirty143]

Developer Alerts Ledger Live Software Could Be Tracking User IDs, Apps and Balances

Rektbuilder, a developer, has stated that cryptocurrency hardware wallet company Ledger can track user identities, apps, and even cryptocurrency balances in the device through the use of Ledger Live, its wallet management software. See more for yourself here.

Your opinion is greatly appreciated.

[NikeFit_7777]

I was skeptical about this device. Now I definitely don't consider it as a way to store cryptocurrency. What kind of security can we talk about? Sid-phrase can be compromised + some kind of wallet balance tracking. Why ask 100-200 dollars for a device when there are tons of free hot wallets? In which you are still provided with a cid phrase when you create a wallet.

Where is the guarantee that tomorrow or a year from now, other campaigns (that created cold wallets), will not become the same as Leadger. That's right, no guarantees. Everything is at your own risk.

+ rep, thanks for the topic 

[joniboini]

What kind of security can we talk about? Sid-phrase can be compromised + some kind of wallet balance tracking. Why ask 100-200 dollars for a device when there are tons of free hot wallets? In which you are still provided with a cid phrase when you create a wallet.

The problem quoted in the article above is limited to its privacy-intrusive software. You should be able to avoid them if you don't use Ledger Live altogether, although that's a tough call considering you still need to use it if you want to install or remove some apps. The journalist stated that Ledger is contacting the developer in question, but I won't put too much hope on any removal of their tracking apps. It seems like they are moving away from their previous image of a privacy-friendly company since months ago. Who knows, maybe they don't really change but manage to lie and get their way out of trouble every time. So yeah, you should never use them as your main wallet. Building your own air-gapped device is probably better in this case.

[Zed0X]

Ledger's image has changed since the introduction of new features like the Ledger Recover. Since they keep adding new stuff to increase their presence and attract more mainstream users, I wouldn't be surprised if the tracking of user IDs and balances is actually true. Unfortunately for their users, the Ledger database seems to be easy to exploit. There was the email hack a few years ago, then the Connect Kit security incident.

[NikeFit_7777]

The problem quoted in the article above is limited to its privacy-intrusive software. You should be able to avoid them if you don't use Ledger Live altogether, although that's a tough call considering you still need to use it if you want to install or remove some apps. The journalist stated that Ledger is contacting the developer in question, but I won't put too much hope on any removal of their tracking apps. It seems like they are moving away from their previous image of a privacy-friendly company since months ago. Who knows, maybe they don't really change but manage to lie and get their way out of trouble every time. So yeah, you should never use them as your main wallet. Building your own air-gapped device is probably better in this case.

Exactly. The image of the company is out of the question (in my eyes) unequivocally. Excuse me, but do you know about Recovery? 6 or 9 other campaigns will have 1-2 words of your cid phrase. If you lose it, you can recover it. Wait, you have to pay $10 for this feature. Is it safety and cold storage? Guess not. And where's the guarantee that without a firmware update on Leadger Live, you won't be able to access your funds  money. I hope they realize this at some point, but it will probably be too late as the user churn has already started. Leadger and security = incompatible.
P.S. My personal opinion, I'm not forcing anyone to buy/not buy this wallet. Make your own conclusions

[hugeblack]

The privacy problem in SPV wallet is not limited to Ledger Live Software, but all SPV wallets, including Electrum, have a privacy problem, as whoever runs the servers can know your balance, all your addresses, and your IP address. You can enhance privacy by using TOR, but who wants complete privacy, It is better for him to run full node.

Ledger has seriously damaged its reputation due to user data leaks^[1] and Ledger recovery service^[2] and it is better to stop buying/using their hardware wallets.

[1]Ledger data leak: A 'simple mistake' exposed 270K crypto
[2] https://www.ledger.com/recover

[Sim_card]

It is not something anymore that ledger has back door to access users information that are using their product, which makes ledger not safe anymore to store your coins. The last time we heard how customers funds was stolen through dapp and all these should be a warning to everyone to stay away from ledger because anything can happen to your funds at anytime. It is better to use a reliable wallet than an unreliable one. If you have an old pc, you can use electrum cold storage on an airgap device, and have a watch online wallet to monitor, and broadcast your transactions.

[yhiaali3]

Where is the guarantee that tomorrow or a year from now, other campaigns (that created cold wallets), will not become the same as Leadger. That's right, no guarantees. Everything is at your own risk.

Yes, I agree with you on this point. There is no guarantee that all cold wallet companies will become like Ledger in the future. Ledger was initially the best cold wallet company, but it was later discovered that they were leaking user data, as well as the suspicious Ledger recovery service that they recently provided.

The bottom line is that since cold wallet companies are central companies, they are subject to the laws of the countries in which they are located on the ground, and therefore I do not rule out that the governments of their countries force them to leak user data, as happened with Ledger.

[hugeblack]

Where is the guarantee that tomorrow or a year from now, other campaigns (that created cold wallets), will not become the same as Leadger. That's right, no guarantees. Everything is at your own risk.

Yes, I agree with you on this point. There is no guarantee that all cold wallet companies will become like Ledger in the future. Ledger was initially the best cold wallet company, but it was later discovered that they were leaking user data, as well as the suspicious Ledger recovery service that they recently provided.

If the code is open source that has been reviewed by many developers, and code that works is the same as the code in the hardware wallet, then you will definitely not have to worry about the security of your coins. There are some DIY wallets^[1][2][3] that can be built from scratch, and the value of hardware wallets is mainly in acceptingaltcoins.
If there is no open source hardware wallet, you can create an airgapped environment and use wallets for Bitcoin, Ethereum, and the most famous tokens.


[1] https://bitcointalk.org/index.php?topic=5259912.0
[2] https://bitcointalk.org/index.php?topic=5454770
[3] https://specter.solutions/#diy

[joniboini]

The bottom line is that since cold wallet companies are central companies, they are subject to the laws of the countries in which they are located on the ground, and therefore I do not rule out that the governments of their countries force them to leak user data, as happened with Ledger.

Are you implying that the data leak happened because the government asked them to do so? I thought they just had bad security which allowed the hackers to steal their customer data. I'm not sure if the government is interested in analytics related to IP address etc if they can just run their own node. Even if they want to know who buys Ledger hardware, they can probably ask behind the door already considering how Ledger has acted in the last few months in matters related to privacy.

For other company that provides open-source software, I believe the risk is lower if you're talking about privacy stuff assuming you run your own node, use a VPN, etc. Even if a government forces them to hand over their customer data, you can safely avoid it if you just build your own HW with their software. Any analytics-related code will probably get found out whenever a new update goes live anyway.

[hugeblack]

Are you implying that the data leak happened because the government asked them to do so? I thought they just had bad security which allowed the hackers to steal their customer data.

This data will not be useful to governments as it is public and at best (if you use your wallet with the ledger app) all they will have is your Bitcoin address (which is not guaranteed).
Also, I do not think that someone who wants to use his money for money laundering or any unknown activities can buy online service and will buy using cash or from a third party agent or use Monero.
Even the IRS won't benefit much.

[NikeFit_7777]

If the code is open source that has been reviewed by many developers, and code that works is the same as the code in the hardware wallet, then you will definitely not have to worry about the security of your coins. There are some DIY wallets^[1][2][3] that can be built from scratch, and the value of hardware wallets is mainly in acceptingaltcoins.
If there is no open source hardware wallet, you can create an airgapped environment and use wallets for Bitcoin, Ethereum, and the most famous tokens.
[1] https://bitcointalk.org/index.php?topic=5259912.0
[2] https://bitcointalk.org/index.php?topic=5454770
[3] https://specter.solutions/#diy

Why would I buy a flash drive for X-amount of money, or do something myself + figure it out. If there are plenty of free hot wallets out there. If anyone thinks there is no need for diversification in wallets. You are very much mistaken. As I wrote earlier, yes - even in this case you need to be extremely careful and trust no one.

The same free hot wallets don't host your seed phrase. What did Leadger do? That's unacceptable to me. Decentralization is out of the question. It is the same as storing funds on an exchange,  + you have to buy a 50-150$ flash drive. 

P.S. Thanks for sharing the links to the articles. That's helpful, but I have a slightly different strategy in that regard.

[hugeblack]

Why would I buy a flash drive for X-amount of money, or do something myself + figure it out. If there are plenty of free hot wallets out there. If anyone thinks there is no need for diversification in wallets.

1) If you are skeptical, you will need to make sure that the hardware does not contain spyware or any backdoors that may record your data and send it to external parties. In fact, a significant portion of hacker attacks are due to the presence of backdoors placed in your devices.

2) Some people cannot buy hardware wallets as there is no shipping to all parts of the world, or you need a third party to receive the HW and then ship it to you, but you can buy DIY WALLET parts from anywhere and build it yourself.

The same free hot wallets don't host your seed phrase. What did Leadger do?

Ledger is a closed source wallet, whether it is HW or software, so it is not an option for anyone who is looking for privacy or has millions of dollars.

[NikeFit_7777]

1) If you are skeptical, you will need to make sure that the hardware does not contain spyware or any backdoors that may record your data and send it to external parties. In fact, a significant portion of hacker attacks are due to the presence of backdoors placed in your devices.

2) Some people cannot buy hardware wallets as there is no shipping to all parts of the world, or you need a third party to receive the HW and then ship it to you, but you can buy DIY WALLET parts from anywhere and build it yourself.

The same free hot wallets don't host your seed phrase. What did Leadger do?

Ledger is a closed source wallet, whether it is HW or software, so it is not an option for anyone who is looking for privacy or has millions of dollars.

Yeah, well, I'm saying don't trust just one cold wallet. You think a 1-click law enforcement leadger won't block your accounts? You doubt it. It's a completely centralized wallet.

Everyone says that about closed source code. And nobody is confused that in such a hike they suddenly decided to make a function with seed-phrase recovery? Personally, I'm very wary of that. (Good thing I don't have that wallet). What's the difference between it and a hot wallet? (In it, we also get a seed phrase).

P.S. It's up to everyone whether or not to buy this wallet. I personally see absolutely no need for it. 

[Brewmaster]

Allegations of Ledger Live software tracking user IDs, apps, and cryptocurrency balances raise concerns about user privacy and data security. If such claims are accurate, it could impact the trust users place in Ledger's hardware wallets and associated software.

For users, it's crucial to stay informed about such developments and follow any responses or clarifications from Ledger. Additionally, considering alternative wallet options and maintaining updated security practices can be a prudent approach in the evolving landscape of cryptocurrency and hardware wallet security.

Always prioritize the security and privacy of your cryptocurrency holdings and choose solutions that align with your trust and risk tolerance.