Karpelès is discussing the implants found in Ledger hardware wallets sold through third-party resellers. His case is that Ledger knew about the problem for months and could have told customers to open their devices and compare them with the manual, which would likely have caught the attack sooner.
…turned away at customs. So that's why there are authorized resellers in those jurisdictions. I think it's a trade-off, but purely on the physical security side, obviously buying directly from the producer is going to minimize that number of hands and decrease the risk of a supply chain compromise.
Well, I don't know if you saw Leonidas NFT tweeted that Ledger should end their authorized reseller program immediately. I'm curious. So I understand the trade-offs that you mentioned, but what do you think of that suggestion?
Well, I would say that's probably too drastic, but there are steps that Ledger can probably take to make sure that these kind of issues cannot happen or would be much more difficult to cause in the future. One thing I don't know exactly how, for example, the handoff of cryptobilis happened if Ledger was notified and if Ledger vetted the new operators of the company, there are a few things that Ledger could be doing on their side that would make the product more safe to sell, such as temporary evidence packaging, so that if you know if your ledger has been opened before or not, while a lot of those methods can be defeated in some ways, it's always a game of the cattle mouse, basically, of trying to just move faster than. The other, but for this thing, one thing I do think that Ledger could have been doing because it sounds like this is not a new issue. It's been discussed for at least six months. Ledger could have maybe what I would have seen a good idea is to tell people that when buying…
Yeah, something that was interesting is Sebastian V. Sta. I'm actually not sure who this person is, says quantum physicist on their profile, but he tweeted that he remembered reading something about, you know, Ledger advertising that there's no anti-tampering sticker in the box. And so we dug up…
Self-custody is here for a big reason is that people's computers get virus and get hacked. One thing, one term we use a lot in IT security is attack surface, which is basically what entry points there is into an IT system that would allow someone to get inside. And for computer, you are connected…
Certainly on the CONMAN side, I can say that the losses from people using hot wallets, i.e., wallets where the keys to those wallets are held on a computer that's connected to the internet or a phone or something like this, that causes significantly more loss than we see from hardware wallets. So…