YHK - yet another hacker news clone

You will never be completely secure against failure, the only way to protect yourself is to be able to robustly recover from failure.

I'd rather be able to say "every single government is in my hardware and they still can't touch it."

Perhaps possible with multisig, but now you're basically back to trusting banks.

not your hardware, not your keys

not your chips, not your hardware

not manufactured in house, not your chips

not your designs, not manufactured by you

not designed by you personally, not your designs

ad infinitum. To be truly secure, you must first learn to survive alone in the wilderness and smelt tin

Grab the Bitcoin white paper and an airgapped PC with a fresh Debian install.

Implement the algorithm(s) in the white paper to generate yourself a private key and then a wallet address from that.

Send bitcoin to that wallet. Write down the private key and wallet address, store it somewhere safe, bury it in the garden, whatever.

No special hardware is required for any of this...

Or am I missing something?

Supply chain risk is real, and it has to be managed in realistic terms.

For me, this is the weak link in the chain for digital assets, and always has been, but the mitigation is simple: no one hardware wallet should have millions of dollars of assets on it. Split it up, and use different techniques, different vendors, with different supply chains.

Or the keys lost/forgotten, like Satoshi's approx 1M Bitcoin (possibly/probably). But this is a feature not a bug - according to Satoshi himself "Lost coins only make everyone else's coins worth slightly more. Think of it as a donation to everyone." (https://satoshi.nakamotoinstitute.org/posts/bitcointalk/thre...)

Maybe it increases the price quite a lot, IDK.

(https://support.ledger.com/article/4404382029329-zd)

I never did get one, though.

The hardware wallet is just a sandboxed interface between you, your seed, and the blockchain. It requires a computer to connect to you and the internet.

In other words: as long as you have your seed phrase (and your passphrase, if you set one) on a piece of paper, you can smash your hardware wallet to bits and be fine.

(This assumes a standard single-signature wallet using the BIP-39 standard)

Thus the attack surface is far greater.

Most people's computes run a lot of software, including a general-purpose OS with a huge attack surface and third-party applications, often with broad or even unconstrained access to all their files.

General purpose computers often also don't have tamper-proof secure storage; hardware wallets generally do.

The impacted resellers would have to test the devices powered on to see if they were using cellular data.

I ponder "What applications would I want this security stuff for?" Crypto wallets are a great example... and the crypto wallets in the wild aren't using them, as you point out!

This doesn't help any bit against the hardware implant we're discussing here.

> So there’s no way to guarantee that the software running on this has not been tampered with.

While true, I don't think it matters too much, other than the possibility of turning the device into something like a rubberducky.

> There is no physical tamper detection either. No tamper pads to detect case openings, no seal that gets broken when it’s opened that prevents operation. As others have mentioned, the most basic precaution would be to glue the whole thing together, which they didn’t do either.

Now that is the real meat. Unfortunately, for any given attack it's possible to bypass it. Tamper pads, if you know where they are, you can drill through the housing and, depending what it is, keep the button pressed by a jig, or solder wires if it's a sense trace to bridge it. The housing itself can easily be fully replicated, it's just a matter of coughing up some money for custom molds.

The only way to make something relatively tamper proof is to use injection molding over the full housing with something like glitter as part of the plastic, that will distribute randomly - and most importantly: not replicable! - across the housing, and then take high quality photographs and store them on your website together with the serial number.

That way the customer can photograph the device they have, and compare the random glitter specks with those on the website.

Tamper proofing hardware is among the hardest things there are, especially if you are up against nation-state actors like North Korea (that has been known to engage in cryptocurrency theft in the past).

Edit: For folks down voting me, please explain. I'm genuinely curious about your perspective.

That MCU is explicitly not assumed to be critical in their security model [1]. It handles Bluetooth and USB communication, both of which are assumed to be insecure transport layers. Securing the MCU would not have helped in this particular incident, and I can't think of a scenario in which it would be critical.

Button input and screen output, which are critical, are handled by a secure element. Unfortunately, at some point even the most hardened secure element will have to output data to be displayed on a screen; that's what was attacked here. Electronic shoulder surfing, basically.

[1] https://www.ledger.com/ledger-nano-x-bluetooth-security-mode...

Says who? I've bought single-use eSIM profiles for data while traveling without any KYC in the past; it's actually the norm, not the exception.

Some suppliers specifically advertise that, as well as accepting cryptocurrency.