‘There Is No Backdoor,’ Ledger Says in Response to Recover Reactions
Ledger’s newest Nano X update allows users to subscribe to a recovery tool that encrypts the users’ seed phrase and sends it to different custodians to reconstruct the seed after going through ID verification.
However, Ledger customers are less than pleased by the news.
Mudit Gupta, Polygon Labs’ chief information security officer, warned users not to enable the feature, calling it a “horrendous idea.”
Though Gupta did not take issue with the breakup of the key — he praised it, stating that “I may or may not be doing that personally as well.”
Gupta’s concern stems from the ID verification and the key access given to the contacts who are chosen by a user to store key parts, as it could open a door for identity theft.
Ledger just released a new update for Nano X that allows social recovery of your seed phrase.
— Mudit Gupta (@Mudit__Gupta) May 16, 2023
It encrypts your seed in 3 shards and sends it to different entities that can then reconstruct the seed for you post ID verification.
It's a horrendous idea, DON'T enable this feature.
Gupta wasn’t the only person concerned about the update.
So the seed can leave the device now?
— CZ 🔶 Binance (@cz_binance) May 16, 2023
Sounds like a different direction than "your keys never leave the device". 🤷♂️
Stop using Ledger hardware wallets. Migrate away from them immediately. They’ve shown nothing but gross incompetence and wild misunderstanding of their own purpose. And now they’ve publicly admitted to intentionally backdooring their own proprietary hardware. Stop using Ledger pic.twitter.com/LLFFUsOW4y
— foobar (@0xfoobar) May 16, 2023
In a video on Twitter, Ledger Chief Technology Officer Charles Guillemet said that “there is no backdoor for anyone, neither us, a provider or even a very gifted hacker to access it.”
“Back door would mean that we control all ledger devices and could run automated updates for example…That’s not the case. Will never be the case. Only you can use functions on your Ledger. No one else can enter your pin code and press those buttons,” CEO Paul Gauthier also said.
The Recover feature is an opt-in feature.
“Ledger Recover is an optional subscription for users who want a backup of their Secret Recovery Phrase. You don’t have to use it, and can continue managing your recovery phrase yourself if that’s why you bought a Ledger,” Ledger tweeted.
Ledger Recover is an optional subscription for users who want a backup of their Secret Recovery Phrase. You don’t have to use it, and can continue managing your recovery phrase yourself if that’s why you bought a Ledger.
— Ledger (@Ledger) May 16, 2023
“The device sends encrypted shards of your seed to different companies if you decide to use the service. You can of course still choose to [back it up] yourself,” Ledger’s co-founder said on Reddit.
Ledger claims that “self-custody remains and will always be at the core principle of Ledger.”
Self-custody remains and will always be the core principle of Ledger. The ethos of self-custody is that it’s your choice – you can choose to manage all your assets yourself, or you can have a backup with Ledger Recover.
— Ledger (@Ledger) May 16, 2023
It’s up to you – and that won’t change.
Wired, in February, clarified that the three recovery custodians would be Ledger, Coincover – a crypto custody firm – and EscrowTech – a code escrow company.
The concern around Ledger’s update comes a few years after the company was targeted by a cyberattack in the summer of 2020 which led to personal information of 270,000 customers being leaked.
In response to the announcement, some Twitter users suggested that Ledger make Ledger Recover a totally separate product.
Ledger did not immediately respond to a request for comment.
Comments
Post a Comment