Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ledger Live: A mobile companion app for Ledger hardware wallets

github.com

Post reply on HN
Print view View original

51–58 of 58 posts

Re: Ledger Live: A mobile companion app for Ledger hardware wallets

#51

Post by DennisP »

YjSe2GMQ wrote: post #44
DennisP wrote: post #41

Earlier quoted context omitted.

Yes but the Ledger has its own screen that shows what you're actually signing. If you verify that, you're good. There are a couple caveats. First, the Ledger Nano's screen is too small to display the entire address at once, so an attacker who knows where you might send money could generate an address that appears that same on the characters that display. (The Ledger Blue shows the full address but is getting disconti…

It is already implemented for ERC20 token transfers which are probably >90% of smart contract invocations.

Not for multisig contracts though, which people tend to use for extra security on large amounts of funds.

Re: Ledger Live: A mobile companion app for Ledger hardware wallets

#52

Post by DennisP »

jki275 wrote: post #50
DennisP wrote: post #41

Earlier quoted context omitted.

Yes but the Ledger has its own screen that shows what you're actually signing. If you verify that, you're good. There are a couple caveats. First, the Ledger Nano's screen is too small to display the entire address at once, so an attacker who knows where you might send money could generate an address that appears that same on the characters that display. (The Ledger Blue shows the full address but is getting disconti…

Just for the record, the entire address for the transaction is displayed on the screen, it just scrolls side to side. Generating another address that's similar enough to be confused easily would be prohibitively difficult at best.

Yes but the middle scrolls by pretty quickly. I once saw an article that did the math on the difficulty of making an address that matched on the easy-to-read parts of the address at beginning and end, and it amounted to less than a day's work on a modern PC. That's likely to work against most users.

Re: Ledger Live: A mobile companion app for Ledger hardware wallets

#53

Post by jki275 »

DennisP wrote: post #52
jki275 wrote: post #50

Earlier quoted context omitted.

Just for the record, the entire address for the transaction is displayed on the screen, it just scrolls side to side. Generating another address that's similar enough to be confused easily would be prohibitively difficult at best.

Yes but the middle scrolls by pretty quickly. I once saw an article that did the math on the difficulty of making an address that matched on the easy-to-read parts of the address at beginning and end, and it amounted to less than a day's work on a modern PC. That's likely to work against most users.

It doesn't scroll quickly, it's very easy to read and verify, even for my beat up eyes.

I'd be very interested to see that math, because it's unlikely that's accurate. You can get a few characters at the beginning of the address relatively easily -- the rest is in heat death of the universe territory.

Re: Ledger Live: A mobile companion app for Ledger hardware wallets

#54

Post by AgentME »

188201 wrote: post #23
jobbagy wrote: post #6

I'm not able to find the md5 signature for Ledger Live: would you please help me?

A mobile app managing cryptocurrency, but does not sign all their release, and don't even react the situation quickly. Apparently they have no clue what they are doing in terms of security. Since they also use react native, and npm is notorious for being exploit to distribute malware. I have a brief look at the package.json. Seems to be a typical javascript project where developers tend to put one more dependency for…

The repo has a yarn.lock file, which contains the hashes of all of the dependencies, so yarn verifies the dependencies match that at least.

Re: Ledger Live: A mobile companion app for Ledger hardware wallets

#56

Post by jillesvangurp »

doomslice wrote: post #29
jillesvangurp wrote: post #16

Earlier quoted context omitted.

I sort of agree with this. One caveat is that laptops are commonly compromised and your security would depend on nobody stealing keys/passwords needed to access your database/password manager/whatever. Having hardware token with paper backup, makes this harder. Having a lot of tokens creates a huge incentive for getting hacked. If you have non trivial amounts of tokens under your control, you need to consider all the…

Founder of StellarGuard here, so sort of in the same realm. Just wondering what additional features you'd want out of such a hardware token. Would it need to do the actual signing of transactions on the device for you to feel secure with it, or would generic U2F (Yubikey) + signing on the software be sufficient, assuming we could do it securely?

Yes, that is the point. Basically you have to work under the assumption that your laptop may be compromised. So anything that exposes private keys to it is going to end up leaking those keys. With the ledger you approve transactions on the token. You configure it from a paper backup or by letting it generate a private key for you and you use it to sign transactions.

Re: Ledger Live: A mobile companion app for Ledger hardware wallets

#57

Post by jillesvangurp »

kybernetikos wrote: post #47
jillesvangurp wrote: post #16

Earlier quoted context omitted.

I sort of agree with this. One caveat is that laptops are commonly compromised and your security would depend on nobody stealing keys/passwords needed to access your database/password manager/whatever. Having hardware token with paper backup, makes this harder. Having a lot of tokens creates a huge incentive for getting hacked. If you have non trivial amounts of tokens under your control, you need to consider all the…

My Ledger Nano supports fido u2f and manages blockchain wallets, so I presume you're just asking for an open version of that? Maybe the ease of use isn't quite where it could be.

Yes, I'd feel more comfortable with something that is end to end auditable without any secret/proprietary stuff.

Also the Nano does some of that but doesn't work with e.g. Firefox. I have to use Chrome to be able to do anything with it.

Re: Ledger Live: A mobile companion app for Ledger hardware wallets

#58

Post by kybernetikos »

jillesvangurp wrote: post #57
kybernetikos wrote: post #47

Earlier quoted context omitted.

My Ledger Nano supports fido u2f and manages blockchain wallets, so I presume you're just asking for an open version of that? Maybe the ease of use isn't quite where it could be.

Yes, I'd feel more comfortable with something that is end to end auditable without any secret/proprietary stuff. Also the Nano does some of that but doesn't work with e.g. Firefox. I have to use Chrome to be able to do anything with it.

I use Firefox nightly, and flick the security.webauth.u2f configuration setting.
Post reply on HN