Quote from: DaveF on March 22, 2018, 02:03:31 PM

Quote from: bitmover on March 22, 2018, 10:50:18 AM

This is a problem, and was already fixed by a firmware update.

I think it's also worth mentioning that this vulnerability, although scary, occurs only if the the attacker has physical access before setup of the seed.

Not 100% true, from what he said it was vulnerable to the "Evil Maid attack"
https://saleemrashid.com/2018/03/20/breaking-ledger-security-model/

Quote from: bitmover on March 22, 2018, 10:50:18 AM

This is a problem, and was already fixed by a firmware update.

Which took them close to 4 months to put out and still is not properly alerting & forcing users to update.

Quote from: bitmover on March 22, 2018, 10:50:18 AM

And if you care at least a minimum about security, you would never buy a Ledger Wallet from third party re-sellers.

Assuming you can trust everyone who handled the package from when it left their shipping dock till when it wound up in your mailbox.

Quote from: bitmover on March 22, 2018, 10:50:18 AM

TLDR: ledger hardwallet is still pretty safe, much safer than any hot wallet. Unless you have an airgapped PC, hardwallet is still a good choice.

THAT I agree with. And pretty safe is good for most people. But it's still not REALLY REALLY REALLY safe.

Just because you are paranoid does not mean that there are not people out to get you.....

-Dave

Well, this evil maid attack is even less risky. How would a hacker access my hardwallet, inside my house?
If he can get inside your house , well, he can force you to give your btc to him even on an airgapped PC using Bitcoin core, he doesn't even need to be a hacker, he just needs a weapon.

When you buy a ledger nano they come securely closed, and if the seal was violated you should discard it, as ledger recommendation. You don't need to trust anyone who handles the package..

If the user is the problem (like using infected pendrives, using violated hardwallets), any method is unsafe

Any other wallet on desktop or smartphone is exposed to the risk of keyloggers, Trojans... Hardwallets are not. Unless you have an airgapped PC , they are the best option. Even Bitcoin core on a daily use computer is not as safe.

But this discussion is pretty worthless.. it's a selected Paranoia. Hardwallets are safe enough. Ledger nano is also open source.