Ledger’s Recover Update Lets Users Choose Third-Party Backup Option
The introduction of Ledger Recover, a feature enabling Ledger hardware wallet users to back up their recovery phrases, faced strong opposition from the cryptocurrency community. Éric Larchevêque, co-founder and former CEO of Ledger, responded to the criticism, stating that it was a significant failure in public relations rather than a technical issue. In simpler terms, when Ledger launched the Recover feature, which allows users to backup their recovery phrases, many people in the crypto community were unhappy about it. Ledger’s co-founder, Éric Larchevêque, acknowledged that the negative response was mainly due to poor communication and not because of any technical problems.
Ledger Recover is an over-the-air (OTA) firmware update that offers users the option to back up their seed phrases using third-party entities. If users decide to participate in this new service, their recovery phrase fragments are encrypted and stored by three separate parties. These stored fragments can be used to recover the seed phrase if needed in the future. However, some users who view Ledger as a trusted service for securely storing their cryptocurrencies were concerned about the concept of the seed phrase leaving the hardware wallet. In simpler terms, Ledger Recover is an update that allows users to backup their seed phrases with the help of third-party entities. If users choose to use this service, their recovery phrases are divided into fragments, encrypted, and stored by three different parties. These fragments can be used to recover the seed phrase if necessary. However, some users who rely on Ledger for secure cryptocurrency storage were uncomfortable with the idea of their seed phrases being outside of the hardware wallet.
Responding to the growing concerns of users globally, Larchevêque addressed the issue on Reddit and made it clear that Ledger was never intended to be a completely trustless solution. He explained that a certain level of trust needs to be placed in Ledger in order to use their product effectively. Larchevêque emphasized that if users consider Ledger as an adversary or do not trust the hardware manufacturer, it would be impossible to use their product. In simpler terms, Larchevêque acknowledged the concerns of users and explained on Reddit that Ledger was never designed to be completely trustless. He emphasized that users need to have a certain level of trust in Ledger as a hardware manufacturer in order to use their product effectively. If users view Ledger as an adversary or do not trust the company, it would not be possible to use their product.
He stated that the Ledger Recover update does not affect the security of the hardware wallet. Additionally, he admitted that during his time as CEO, he may have made a mistake by not explaining the security model more thoroughly. However, he pointed out that there comes a point where he had to give up as people did not show much interest in understanding it. He mentioned that now, with the current concerns, people are starting to care again. In simpler terms, he mentioned that the Ledger Recover update does not compromise the security of the hardware wallet. He also acknowledged that as the CEO, he might have made a mistake by not explaining the security model in more detail. He explained that he reached a point where he had to stop trying to explain it further because people were not interested. However, he observed that now, with the renewed concerns, people are starting to pay attention again.
Larchevêque believed that the only difference lies in how users perceive trust in the system, and he clarified that the Recover code included in the firmware is not a harmful code. In simpler terms, Larchevêque thought that the main change is how users now view trust in the system, and he assured that the Recover code integrated into the firmware is not meant to cause any harm.
“Larchevêque assured users that Ledger is still a secure platform and there is no secret access point. He clarified that Ledger Recover is not part of any conspiracy and nobody will be compelled to use it against their will. In simpler terms, Larchevêque wanted to reassure users that Ledger remains a safe and secure platform without any hidden access points. He emphasized that Ledger Recover is not part of any secret plan and no one will be forced to use it if they don’t want to”.
Larchevêque compared the act of trusting Ledger with sharding the seed phrase to trusting Ledger with signing a transaction. In response to a user’s suggestion of having two separate firmware versions to eliminate concerns about a potential “backdoor,” Larchevêque stated that such a solution would not make a difference. He also expressed personal disappointment at the idea. In simpler terms, Larchevêque explained that trusting Ledger to shard the seed phrase is similar to trusting Ledger to sign a transaction. Regarding a user’s proposal of using two different firmware versions to address backdoor concerns, Larchevêque dismissed the suggestion, stating that it would not solve the problem. He also mentioned feeling saddened by the idea personally.
The firmware update mentioned is not accessible for the Nano S, which is Ledger’s most affordable hardware wallet option. This is because the chipset used in the Nano S does not have sufficient memory capacity to accommodate the new firmware. In simpler terms, the firmware update mentioned is not compatible with Ledger’s least expensive hardware wallet, the Nano S, because the chipset used in the Nano S does not have enough memory to support the new firmware.
“During the release of Ledger’s firmware update that sparked controversy, GridPlus, a rival hardware wallet provider, made the decision to publicly share the source code of its firmware with its users. In simpler terms, while Ledger faced criticism for its firmware update, GridPlus, a competitor in the hardware wallet market, chose to make its firmware’s source code openly available to its users”.
The most trusted name in cryptography, relied upon by the world's governments for their highest security applications for decades, sold products backdoored by the CIA. How can we ensure this won't happen again? Open-source software.
GridPlus will open-source its firmware in Q3. pic.twitter.com/889OnqXd20
— GridPlus (@gridplus) May 18, 2023
Taking advantage of the controversy surrounding Ledger, GridPlus announced its intentions to make its device firmware open source in the third quarter of 2023. This move aims to provide users with more transparency regarding their hardware wallet’s operations. In simpler terms, GridPlus saw an opportunity in the Ledger controversy and decided to announce their plans of making their device firmware open source in the later part of 2023. This step is taken to offer users more clarity and openness regarding the functionality of their hardware wallets.
Important: This article is intended solely for informational purposes. It should not be considered or relied upon as legal, tax, investment, financial, or any other form of advice.
