EEVblog #1048 - Ledger Nano S Crypto Hardware Wallet - Page 1
Forum section: electronics / general

author: EEVblog
author_rank: Unknown
timestamp: December 22, 2017, 11:45:30 pm
content: A review and teardown of the Ledger Nano S crypto currency hardware wallet. Installation and setup.And a comparison with the Trezor.Secure chip:http://www.st.com/content/ccc/resource/technical/document/data_brief/ac/ed/36/cb/1c/04/43/a8/DM00240763.pdf/files/DM00240763.pdf/jcr:content/translations/en.DM00240763.pdf

author: WastelandTek
author_rank: Frequent Contributor
timestamp: December 23, 2017, 02:36:14 am
content: Oh, this thread will have plenty of unique new viewpoints expressed in it I'm sureNice comparison Dave, thanks. I think I will be sticking with my deterministic paper wallet until one of these outfits ups their game a bit. I agree, for the price it seems either one could offer a real metal case at least...and finished apps that work when you click on??

author: EEVblog
author_rank: Unknown
timestamp: December 23, 2017, 02:51:31 am
content: Quote from: WastelandTek on December 23, 2017, 02:36:14 amFYI, the apps seems to be working fine now, and I'm doing real transactions now. Not sure what the issue was if it will return.

author: Peabody
author_rank: Super Contributor
timestamp: December 23, 2017, 03:05:40 pm
content: Since electronics aren't absolutely immune from failure, it seems there should be a backup in case the Trezor or Ledger dies. Is there a provision for that for either of them? Paper perhaps?

author: orion242
author_rank: Unknown
timestamp: December 23, 2017, 04:41:25 pm
content: Guessing that's what the recovery words are for.i'll stick with my paper money. Its was worth X on Monday and its worth X today. System that makes it easy to put money in but not out, is just lining up cattle to the slaughter.

author: WastelandTek
author_rank: Frequent Contributor
timestamp: December 23, 2017, 04:58:22 pm
content: Quote from: Peabody on December 23, 2017, 03:05:40 pmDid you watch?Dave went on and on about the recovery seed and how that was more important to secure than the device. Jump to 4:40.Yes, the 24 word seed is paper, but those in the know etch theirs on titanium in characters so small they must be viewed under a microscope

author: Peabody
author_rank: Super Contributor
timestamp: December 23, 2017, 05:18:05 pm
content: OK, I guess I'm confused. Is there a password of some kind that's needed to get into the device in the first place, or do you just plug it in? Also, do the 24 words let you recover the private keys of all of the different currency wallets that are stored in the device? (I'm assuming they don't all use the same private key.) Well, I obviously need to go back and read up on these things. Then I can ask even more dumb questions.

author: xygor
author_rank: Regular Contributor
timestamp: December 23, 2017, 05:37:04 pm
content: Quote from: orion242 on December 23, 2017, 04:41:25 pmYou are wrong. It is worth considerably more bitcoin today than it was on Monday.

author: orion242
author_rank: Unknown
timestamp: December 23, 2017, 06:54:22 pm
content: And if you bought last thr and withdraw on fri?When its falling down in price you want to move out 100K, how does one do that? How do you do that any day? What about 1M? Its worth nothing if I can't get out when I needed it.

author: WastelandTek
author_rank: Frequent Contributor
timestamp: December 23, 2017, 07:05:45 pm
content: Quote from: orion242 on December 23, 2017, 06:54:22 pmfineit's not for you, we got that, stick to your 401k

author: xygor
author_rank: Regular Contributor
timestamp: December 23, 2017, 08:14:33 pm
content: Quote from: orion242 on December 23, 2017, 06:54:22 pmI think you misunderstood. I wasn't talking about buying or selling anything, just that the value of your paper money is fluctuating wildly.I should have said: It [your paper money] is worth considerably more bitcoin today than it was on Monday. So why would one want to exchange bitcoin for volatile paper money? I'm half joking, but it is another viewpoint.

author: orion242
author_rank: Unknown
timestamp: December 23, 2017, 08:44:04 pm
content: Quote from: xygor on December 23, 2017, 08:14:33 pmBuy my retirement home after scoring big in the crypto for example. Or, pay bills, buy food, gas in my car, or anything I use cash for today...

author: xygor
author_rank: Regular Contributor
timestamp: December 23, 2017, 09:05:14 pm
content: Check outhttp://freakonomics.com/podcast/still-using-cash/"It facilitates crime, bribery, and tax evasion – and yet some governments (including ours) are printing more cash than ever. Other countries, meanwhile, are ditching cash entirely. And if Star Trek is right, we won’t have money of any sort in the 24th century."

author: FrankBuss
author_rank: Unknown
timestamp: December 24, 2017, 11:37:53 am
content: Regarding the anti-tamper, this is hilarious. A criminal would just make a replica with own software of the whole stick, if he/she has access to the package. Sure, it is expensive, but the reward is high, so risk is high that it will be done.I didn't worry much so far, I'm using just an encrypted wallet with a long password on my PC and backup it, but now with the higher value I think about cold storage, using an easy to remember word seed, which I will generate with bitaddress.org (of course, running it offline, it is all local JavaScript, from a Linux Live CD).BTW Dave, I've just sent you a bit Bitcoin to your address. Price is nice at the moment, I sold already half of all my remaining Bitcoin. It was really cheap when I bought it 2 years agoPS: maybe I'm paranoid, but showing a few words in your video for the seed might be sufficient for someone to recreate the internal random number state, depending on how it is implemented.

author: FrankBuss
author_rank: Unknown
timestamp: December 24, 2017, 12:59:44 pm
content: Just a tip if someone has Bitcoins: If you had Bitcoins (BTC) on August 1st 2017, you have automatically the same amount in Bitcoin Cash (BCH), even if you spent your BTC later. On exchanges like poloniex.com you can change 1 BCH to about 0.2 BTC. So definitely worth the trouble to install the BCH wallet BitcoinABC and rescan all your private BTC keys.

author: Froese
author_rank: Newbie
timestamp: December 24, 2017, 01:33:51 pm
content: A browser app can install new firmware on the ledger and they talk about security?!? Come on, that's rediculous!

author: FrankBuss
author_rank: Unknown
timestamp: December 24, 2017, 01:36:24 pm
content: Quote from: Froese on December 24, 2017, 01:33:51 pmThis is no problem, if they have encrypted and signed firmware files, assuming the device itself is not compromised.

author: Froese
author_rank: Newbie
timestamp: December 24, 2017, 01:59:34 pm
content: Quote from: FrankBuss on December 24, 2017, 01:36:24 pmUntil the signing key gets public. But, seeing that you can upload your own "apps" onto the device, that's not the case anyway.

author: Peabody
author_rank: Super Contributor
timestamp: December 24, 2017, 02:52:32 pm
content: Quote from: FrankBuss on December 24, 2017, 12:59:44 pmIsn't there also a Bitcoin Gold fork that works the same way?

author: FrankBuss
author_rank: Unknown
timestamp: December 24, 2017, 05:47:36 pm
content: Quote from: Peabody on December 24, 2017, 02:52:32 pmIt is just a copycat, as with other clones after Bitcoin Cash, and Bitcoin Gold is not listed at poloniex.com. Looks like you can't pull off the same trick more than once, not even with the silly crypto worldBut it is listed at bittrex.com and currently worth 0.019 BTC, so if you had or have at least one Bitcoin, it would be worth like EUR 200, so might be worth to exchange this as well. Funnily, if you go to the Bitcoin Gold site and theFAQ, then click on the second "When was Bitcoin Gold created?" entry, it even says "Bitcoin Cash" in the last sentence, so they didn't bother to proofread it carefully when they copied Bitcoin Cash.

author: EEVblog
author_rank: Unknown
timestamp: December 27, 2017, 12:00:52 am
content: Quote from: Peabody on December 23, 2017, 03:05:40 pmWatch the video, it is explained. That's what the seed recovery is for.

author: EEVblog
author_rank: Unknown
timestamp: December 27, 2017, 12:03:13 am
content: Quote from: FrankBuss on December 24, 2017, 11:37:53 amThanksI get quite a few anonymous crypto donations, and because they are anonymous I have no way to thank them.

author: Halcyon
author_rank: Unknown
timestamp: December 27, 2017, 06:36:27 am
content: Quote from: WastelandTek on December 23, 2017, 04:58:22 pmThe problem I have with these "recovery seeds" is that I presume it relies on Trezor or Ledger existing tomorrow? If they pack up shop, sell their business, site goes down etc... etc... then what? I'm left with 24 words which are utterly useless.But then again, I suppose these sorts of devices aren't designed for long term or "archival" storage of your crypto-currencies, they are designed for those people who make regular deposits and withdrawals.On the topic of crypto, I'm not touching Bitcoin.* at all. There are far better crypto's out there which pose much less of a risk to your hard-earned dollars.

author: EEVblog
author_rank: Unknown
timestamp: December 27, 2017, 06:45:50 am
content: Quote from: Halcyon on December 27, 2017, 06:36:27 amNo, I explained this in the video.You can recover the seed (and hence your coins) to any BIP39 compatible wallet, either hardware or software.

author: Halcyon
author_rank: Unknown
timestamp: December 27, 2017, 06:54:04 am
content: Quote from: EEVblog on December 27, 2017, 06:45:50 amSure but where is it getting the "rest" of the data from?

author: WastelandTek
author_rank: Frequent Contributor
timestamp: December 27, 2017, 08:01:17 am
content: Quote from: Halcyon on December 27, 2017, 06:54:04 amYour search string is "deterministic wallet" should you choose to dig in to how this works. The code was first implemented inBIP-0032.

author: EEVblog
author_rank: Unknown
timestamp: December 27, 2017, 08:11:44 am
content: Quote from: Halcyon on December 27, 2017, 06:54:04 amQuoteQuoteThe blockchain stored on a zillion computers on the internet. That's the magic of it.

author: Halcyon
author_rank: Unknown
timestamp: December 27, 2017, 09:02:48 am
content: Ahh gotcha! Of course!Thanks Dave.

author: wbicks
author_rank: Newbie
timestamp: December 31, 2017, 09:08:03 pm
content: I ordered the Ledger after (and despite) watching your video.I'm pleased to say I'm having a much better time with it, and it sounds like you're running better now as well.1) The screen shows the whole address when confirming a transaction now. I'm guessing yours is/was running an outdated firmware.2) I, like you, thought it was absurd to download an individual app for each coin. It looks like, however, the "Bitcoin" wallet handles all the other altcoins EXCEPT xrp and eth. Does this make sense? No. Is it more convenient that having a separate app? Yes. I have successful sent and received both LTC and VTC, and it just runs through the "Bitcoin" wallet.3) The CTO of Ledger is very active on Reddit, and has been explaining that the XRP network has been wonky on ledgers, and that they are working to fix it. I don't work with XRP, but that at least answers that.That being said, with google's plan to kill off chrome apps, I'm looking forward to the standalone wallet promised by the developers. It should handle auto installing and uninstalling of apps on the device, and should centralize the control for all the coins, and hopefully make a much better product.-WB

author: Peabody
author_rank: Super Contributor
timestamp: December 31, 2017, 09:53:26 pm
content: wbicks, I've already displayed my ignorance about all this once here, but I would appreciate it if you could explain how just the 24-word seed would allow you to recover all of those different alt coins if you dropped your Ledger in the ocean. Would you even have to remember which alts you had, or is that available just from the seed? If the seed is enough, can you explain how everything can be reconstructed from that? Or if there's an explanation online that you can link me to, that would be great.

author: wbicks
author_rank: Newbie
timestamp: December 31, 2017, 11:35:44 pm
content: Peabody:Quote from: Peabody on December 31, 2017, 09:53:26 pmThe 24 word seed is a random string of text that is unique to you, it's your signature. Using that string, you can calculate your private keys for your different coins. There are sites and software to reconstruct your keys from this recovery phrase, but be very careful of who you give access to your key -- it is the master key to your wallet, and can empty it in a second.Using your private key, which is generated from that 24 word string, you can sign any crypto transaction. The ledger provides a compact, secure, and easy way to sign and broadcast these messages thereby transferring coins, but it is by no means the only way to do so.As long as you have that key, you can still sign transactions, and therefore have full access to your coins.Quote from: Peabody on December 31, 2017, 09:53:26 pmAs far as I know, you would have to check which coins you were storing. Each coin uses a different private key, by taking your 24 words and performing a different mathematical function. That being said, once again, if you have your 24 words, you can easily generate your private keys for every single coin, and then just see if any of those wallets have coins in them or not.Quote from: Peabody on December 31, 2017, 09:53:26 pmHere are some good followup resources:https://www.reddit.com/r/Bitcoin/comments/77k0ni/explain_how_the_24_word_seed_can_recover_your/-WB

author: Peabody
author_rank: Super Contributor
timestamp: January 01, 2018, 01:49:02 am
content: Software wallets can generate a whole series of addresses and private keys for a coin. if Ledger does that too, then it seems that keeping track of which ones you have used would further complicate the recovery process.Well, I'm sure it's been thought through and works fine. I just have trouble understanding it. Of course there's no requirement that I have to understand it.Thanks for the response.

author: JackM
author_rank: Regular Contributor
timestamp: January 03, 2018, 01:02:53 am
content: Bit of an off-topic question, but could someone tell me the physical size of the Trezor's OLED screen? Is it 1.3" or 0.96" diagonally? Alternatively, what is the width of the screen in millimeters?

author: EEVblog
author_rank: Unknown
timestamp: January 03, 2018, 02:12:36 am
content: Quote from: JackM on January 03, 2018, 01:02:53 amAbout 0.96" diagonal

author: JackM
author_rank: Regular Contributor
timestamp: January 03, 2018, 03:09:14 am
content: Perfect, thanks Dave. I'm looking at assembling my own Trezor and discovered that the OLED screen comes in two sizes. Every other parameter of the part is the same, just that one version has a physically larger screen with the same resolution.

author: WastelandTek
author_rank: Frequent Contributor
timestamp: January 05, 2018, 06:59:55 pm
content: Quote from: JackM on January 03, 2018, 03:09:14 am

author: JackM
author_rank: Regular Contributor
timestamp: January 05, 2018, 07:10:26 pm
content: Quote from: WastelandTek on January 05, 2018, 06:59:55 pmI don't have any reason to believe that a bare microcontroller that I order via an electronics supplier such as Digikey would be tampered with. I'd be flashing the whole thing with Trezor firmware anyways. So no, I'm not really worried at all about that.

author: orion242
author_rank: Unknown
timestamp: January 17, 2018, 03:22:42 pm
content: Is the bubble popping?https://www.coindesk.com/as-bitcoins-slide-continues-prices-look-towards-8k/Value of paper money fluctuating wildly....lol compared to this?!?

author: djnz
author_rank: Regular Contributor
timestamp: March 21, 2018, 08:56:26 pm
content: Fyi:Firmware 1.4: deep dive into three vulnerabilities which have been fixedBlog post by the 15 year old who reported the flawBrian Krebs's post about this

author: Lockon Stratos
author_rank: Regular Contributor
timestamp: March 24, 2018, 07:46:26 am
content: Quote from: orion242 on January 17, 2018, 03:22:42 pmIt doesnt seem like it it unfortunately. GPU prices still through the roof.... Our last hope is the government banning these good for nothing fake money.