[flagged]
Per HN guidelines, emphasis mine:
"Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting."
Ledger's NPM account has been hacked
21–30 of 130 posts
Re: Ledger's NPM account has been hacked
#22NPM forces 2fa, so I’m curious what the scenario was here. Was a committers phone compromised?
The Github action leaked the creds, seemingly via a log. Looks like that action has been in use for ~4 months.
Automated publishing without a human involved kind of kills the whole point of 2FA anyway.
It is kind of funny that the crypto world of multi sigs relies on blind trust of unverified UI components.
Re: Ledger's NPM account has been hacked
#23Ledger has been hacked so many times now i've lost count. I remember buying one in 2019, and shortly thereafter all customer data was dumped on the internet endangering everyone who bought one. Then after deep diving the tech i threw it in the trash, it seemed like security theatre product. There's also been so many phishing attempts, fake ledgers sold, bricked ones losing funds, it's total shitshow that ecosystem if…
>I just use isolated cheap laptops and encrypted usb's now.
I figure this isn't practical for most end users. Is there an alternative hardware wallet that you think is okay for most people? How do you feel about Trezor?
Re: Ledger's NPM account has been hacked
#24> Yes, .5/.6/.7 versions are compromised So was there a threat to Ledger users? Elsewhere it's said: > production build failed
[deleted]
Re: Ledger's NPM account has been hacked
#25Ledger has been hacked so many times now i've lost count. I remember buying one in 2019, and shortly thereafter all customer data was dumped on the internet endangering everyone who bought one. Then after deep diving the tech i threw it in the trash, it seemed like security theatre product. There's also been so many phishing attempts, fake ledgers sold, bricked ones losing funds, it's total shitshow that ecosystem if…
The only reason things like Ledger exist is because regular smart cards (e.g. Yubikey) don't yet support the signature schemes used on blockchains.
Regular smart cards also don't have screens, so it would mean totally blind signing. That's the problem which hardware wallets are solving, but sometimes the screen is just too small to show all the details of complex transactions.
Re: Ledger's NPM account has been hacked
#26Earlier quoted context omitted.
The Github action leaked the creds, seemingly via a log. Looks like that action has been in use for ~4 months.
Automated publishing without a human involved kind of kills the whole point of 2FA anyway. It is kind of funny that the crypto world of multi sigs relies on blind trust of unverified UI components.
[deleted]
Re: Ledger's NPM account has been hacked
#27NPM forces 2fa, so I’m curious what the scenario was here. Was a committers phone compromised?
The Github action leaked the creds, seemingly via a log. Looks like that action has been in use for ~4 months.
This is exactly why GitHub support OpenID Connect, https://docs.github.com/en/actions/deployment/security-harde..., so that long-lived secrets don't need to be present as part of the build.
I'm not sure if NPM supports OIDC, which would be ironic given that both GitHub and NPM are owned by Microsoft.
Re: Ledger's NPM account has been hacked
#28Earlier quoted context omitted.
The Github action leaked the creds, seemingly via a log. Looks like that action has been in use for ~4 months.
This is exactly why GitHub support OpenID Connect, https://docs.github.com/en/actions/deployment/security-harde... , so that long-lived secrets don't need to be present as part of the build. I'm not sure if NPM supports OIDC, which would be ironic given that both GitHub and NPM are owned by Microsoft.
Why would that be ironic?
Re: Ledger's NPM account has been hacked
#29Ledger has been hacked so many times now i've lost count. I remember buying one in 2019, and shortly thereafter all customer data was dumped on the internet endangering everyone who bought one. Then after deep diving the tech i threw it in the trash, it seemed like security theatre product. There's also been so many phishing attempts, fake ledgers sold, bricked ones losing funds, it's total shitshow that ecosystem if…
>I just use isolated cheap laptops and encrypted usb's now. I figure this isn't practical for most end users. Is there an alternative hardware wallet that you think is okay for most people? How do you feel about Trezor?
Coldcard!
https://coldcard.com/
Re: Ledger's NPM account has been hacked
#30Ledger has been hacked so many times now i've lost count. I remember buying one in 2019, and shortly thereafter all customer data was dumped on the internet endangering everyone who bought one. Then after deep diving the tech i threw it in the trash, it seemed like security theatre product. There's also been so many phishing attempts, fake ledgers sold, bricked ones losing funds, it's total shitshow that ecosystem if…
>I just use isolated cheap laptops and encrypted usb's now. I figure this isn't practical for most end users. Is there an alternative hardware wallet that you think is okay for most people? How do you feel about Trezor?
I don't know which it more practical trusting an exchange, paying a hardware wallet or maybe encrypted file in s3