Post
Topic
Board Hardware wallets
Merits 2 from 1 user
Re: Ledger Recovery - Send your (encrypted) recovery phrase to 3rd parties entities
by
o_e_l_e_o
on 14/06/2023, 08:37:11 UTC
⭐ Merited by Pmalek (2)
I am saying Ledger tries to make passphrases less secure and more user-friendly
I also disliked the "Attach to PIN" feature, and I've spoken before about why I don't think people should use it. As you say it reduces the security of your passphrase to a simple PIN, and it also means that your passphrase is stored on the device rather than wiped after use when using a temporary passphrase. However, it does serve one useful purpose in specific niche cases and that's plausible deniability. You can have your main wallet with no passphrase holding a small amount of coins, and then you can also have a wallet with a passphrase attached to a secondary PIN holding a little more funds, which you can also hand over to an attacker. Meanwhile, you can have the bulk of your funds stored behind one or more other passphrases which you don't reveal.

It's up to the user to consider whether such a feature would actually deter an attacker, though. And since I keep my funds spread out across multiple wallets on multiple different mediums, then I never used this feature even when I did use Ledger devices.

I'd say it's worse than a hot wallet: I use several different hot wallets (for small amounts), and I'd never use Ledger's "pay us to give us your seed phrase" scheme.
Agreed. Hot wallets are only as secure as the device you keep them on. Ledger Recover is only as secure as a bunch of devices that you are trusting complete strangers to keep secure. Does anyone want to sit and add up all the times that centralized exchanges or other centralized crypto services have been hacked or sold/shared/leaked data?