Ledger co-founder clarifies “there is no backdoor” in recovering firmware updates

The launch of Ledger Recovery, a service that allows users of Ledger hardware wallets to back up their secret recovery phrases, was met with heavy resistance from the crypto community. Ledger co-founder and ex-CEO Éric Larchevêque took the criticism against Ledger as “a total PR failure, but not technical at all”.

Ledger Recover is an OTA firmware update that will allow users to back up their seed phrases via third-party entities. If a user chooses to opt-in to the new service, pieces of the recovery phrase are encrypted and stored by 3 different parties, which can be used to recover the phrase in the future. However, the idea of ​​the seed phrase abandoning the hardware wallet didn’t resonate with users who consider Ledger a trustless service for storing cryptocurrencies.

Addressing the growing concerns of users worldwide, Larchevic Posted Making it clear on Reddit that Ledger was never a reliable solution:

“Some amount of trust must be placed in Ledger in order to use their product. If you don’t trust Ledger, meaning you consider your HW manufacturer an adversary, it may not work at all.” “

He argued that the Ledger recovery update has had no impact on the security model of hardware wallets. He added:

“My mistake during my tenure as a CEO was probably not being clear enough about explaining the security model, but at some point you just give up because people just don’t care at all. Until they don’t care again.” Like now.

Larchevêque believed that the only thing that has changed is the general user’s attitude about trust and that the retrieved code in firmware is not a malicious code:

“Ledger is still secure, there is no backdoor, Ledger Recover is not a conspiracy, no one will ever force anyone to use Recover.”

He added that trusting the ledger with hashing the seed phrase is like trusting the ledger with signing transactions. Addressing a user’s recommendation about having two different firmware to eradicate ‘backdoor’ concerns, Larchevic said that “it won’t change anything” and would be hurtful to him personally.

The firmware update in question is not available for the Nano S – Ledger’s cheapest hardware wallet offering – because the chipset doesn’t have enough memory to store the new firmware.

Connected: Crypto community reacts to Ledger Wallet’s secret recovery phrase service

Amidst the rollout of a controversial firmware update to Ledger, competing hardware wallet provider GridPlus decided to open-source its firmware to its users.

The most trusted name in cryptography, trusted by the world’s governments for decades for their highest security applications, products sold through the backdoor by the CIA. How can we be sure this will not happen again? open source software.

GridPlus will open-source its firmware in the third quarter. pic.twitter.com/889OnqXd20

— GridPlus (@gridplus) May 18, 2023

Turning the Ledger controversy into a marketing opportunity, GridPlus announced plans to open source its device firmware in the third quarter of 2023 to provide greater transparency.