Very nice post, and somewhat reassuring.
Grazie tante!
I guess you are manually doing what the ledger live app is doing behind the curtain.
Don't trust, verify.
Don't trust, verify.
Yes, this is exactly what I did.
The only thing that puzzles me:
Can you trust a list found on the internet? Why Ledger doesn't disclose this kind of information?
Can you trust a list found on the internet? Why Ledger doesn't disclose this kind of information?
Well, I will try to answer to this question below.
- The TargetID for Ledger Nano X -- 0x33000004 -- from that list was the same with the one mentioned on Ledger's website. Remember the command mentioned on their website:QuoteSecure Element attestation
python -m ledgerblue.checkGenuineRemote --targetId 0x33000004
So having this TargetID mentioned on their website and as well inside that list confirmed that the information was correct. So no matter if the other values for TargetIDs from that list were correct or not, that did not influence the integrity check of this Ledger, as same information was provided by Ledger too.
- Now about the other values from that list, for the other Ledger models: if we look on Ledger's website, on the page about hardware integrity check, we can see this sentence:QuoteThe source code is available here.
If we access the link provided, we can see that the GitHub repository was provided by someone named dr-chain. Now if we open the page containing the list of TargetIDs we can see at its right side a section named "Contributors". There are 27 contributors. If we click on Contributors, to see all 27 names, one of them is dr-chain, meaning the one mentioned directly on Ledger's website. Does it make sense? Seeing the name of this developer on Ledger's website and also on that page containing all Ledger TargetIDs is reassuring from my perspective.
In any case, I did not check the integrity of other Ledger models excepting the Nano X one so I can't say that all those TargetIDs from that list are 100% correct. But for our check we can know for sure that the TargetID is correct, as same value is mentioned directly on Ledger's website.
Thanks for checking integrity of wallet. After reading your post, it looks like one of these operations that you shouldn't do at home if you don't know what you're doing. Well, this thing is definitely not for my skills. Maybe it would be possible to do it following your instructions, but I doubt that my wallet would work after that.
Glad I could help
