Crypto hardware wallet provider Ledger recently found itself at the center of controversy after an ambiguous and now-deleted tweet suggested the possibility of the company writing firmware capable of extracting users’ private keys. Critics were quick to point out the seemingly contradictory position from Ledger since previous alleged statements claimed that a firmware update could not extract the private keys.
To dispel misunderstandings and restore confidence, Ledger Chief Technology Officer (CTO) Charles Guillemet clarified that the wallet’s operating system (OS) requires user consent before accessing a private key. He acknowledged a certain degree of trust to be necessary for using a Ledger wallet, but stated that the OS does not allow third-party endorsed apps to use a private key for a network they’re not created for, such as a Bitcoin app trying to access Ethereum private keys and vice versa. Consent from the user must be acquired before using a private key, significantly reducing the chances of unauthorized access.
The core of the turbulence originated when Ledger introduced the “Ledger Recover” service, a feature allowing users to back up their secret recovery phrase by splitting it into three parts and securing it with different data custody services. Combining this development with the controversial tweet led to speculations and concerns over Ledger’s security features and commitments. However, Guillemet’s clarification is a reassuring reminder that tampering with the systems would require dishonest conduct from wallet providers or, in unfortunate scenarios, an attacker gaining control of the company’s computers.
GridPlus, a rival of Ledger, has offered to open-source its firmware, hoping to attract Ledger users dissatisfied by the recent issue. Ledger’s CTO, on the other hand, believes that open-sourcing firmware wouldn’t protect against dishonest developers or companies since users could not guarantee that the publicly available code is the same version running on their devices. Ultimately, a minimal amount of trust is required between users and wallet providers, as it’s nearly impossible for individual users to secure complete protection without creating all the components themselves.
This recent controversy highlights the delicate balance of trust needed between wallet providers and users, emphasizing the importance of transparency and clear communication. While the issue appears to have been resolved, ongoing vigilance and skepticism are crucial in discussions surrounding technology, security, and the advancement of blockchain systems.
Source: Cointelegraph
