Hardware Wallets - How to Update Your Firmware

Hardware Wallet - CONTENTS

1. What is a Hardware Wallet?
2. Cryptocurrencies Are Not a Fairy Tale but the Wild West
3. Who is Saleem Rashid and What Did He Come Up With?
4. Saleem Found What He Was Looking For
5. How to Avoid Rigged Hardware Wallets
6. Firmware Update 1.4.1 at Ledger Nano S?
7. Trezor has Firmware Updates (Tested For You)
8. Passphrase or Trezor in Trezor
9. And What About Ledger in Ledger?
10. Trezor (T) vs. Ledger Nano S
11. How to Handle Your Hardware Wallet and Tips for More Safety
12. Cryptocurrencies are Immortal, but You are Not

What is a Hardware Wallet?

Whether I mention Trezor T or Ledger Nano S, I'm talking about a sophisticated hardware and software device that has been designed and is constantly being refined for the sole purposes of cryptocurrencies and to protect your private keys. You might ask - against whom and against what? The answer has two sides of the same coin. In front of you, there are those who want to steal your cryptocurrencies. While hardware wallets may resemble an ordinary flashdrive or pager, I mean it when I say that that contents underneath the plastic cover are the result of the gems and skills from professionals in the fields of high level mathemathics (cryptography), hardware, software, and social engineering, as well as many with experience in the world of hacking.

Cryptocurrencies Are Not a Fairy Tale but the Wild West

The first thing you need to realise about crytocurrencies is that you are entering a world of technically gifted and capable people. If you lack self-awareness, I recommend slowing down and realising that whatever your skills and experience are, there are likely to be people out there who are better at it than you and a lot of them belong to the "dark side". My intention, however, is not to scare you or dissuade you from the cryptosphere; on the contrary, I want to ask you to be careful, vigilant, and devote some energy to improve on this aspect. Always think about the worst possible scenario that can happen. And what if I told you that one of the most popular hardware wallets, the Ledger Nano S, was hacked by the extremely gifted, 15-year-old boy, Saleem Rashid?

Hardware wallets, by nature, should generally solve one critical issue. This is done using one-way communication with the computer you are connecting to. This means that even if you attach a hardware wallet to a computer in an Internet café, its overall production in terms of hardware, software, design, and use, should protect you from any attack with the intention of stealing your cryptocurrencies. So far, it sounds pretty safe, but surely, someone will find a way to challenge that.

Who is Saleem Rashid and What Did He Come Up With?

Saleem, a 15-year-old independent hacker, whose hobby and profession is mainly to look for security mistakes, is unique in his way of thinking. Saleem also independently cooperates with the Czech company SatoshiLabs, who is the creator of the legendary (and I even think the best) hardware wallets, the Trezor and Trezor T. Saleem is a person that you hire when you think you're invincible, and he will show you that you are probably miserably mistaken. When you ask an average cryptocurrency user about what a hardware wallet is and where to buy one, he/she will probably have some insight and tell you that it is a completely safe way of storing your cryptocurrencies and that it can simply be purchased in an authorised store. But do you think he/she has the wallet's distribution chain in mind?

Saleem Found What He Was Looking For

An entire half of the wallet's security rests on what happens when someone gets access to your hardware wallet. Let's say someone gets to your Ledger Nano S (via theft, loss, etc.) and wants to take your bitcoins. However, they encounter a problem because they do not know your PIN. Without a PIN, this wallet is useless and your bitcoins are still safe. You can then get another (NEW!) Ledger Nano S and using the recovery seed, which is a 12-24 character series of random English words, you can restore all the private keys you had on the wallet, which the bad guy wanted to get. If the hacker does not get to your recovery seed (which they should NEVER be able to), then your cryptocurrencies will remain safe.

Well, what if someone owned your hardware wallet before you, and then you bought it in sweet ignorance as a new one? Saleem Rashid figured out that the Ledger Nano S could be altered by a hacker to find the recovery seed himself/herself, and he/she can even set it up (by choosing the 24 "random" words) before the new owner receives it. This would result in the purchase of a "new" Ledger Nano S, but then when you purchase cryptocurrencies to put into the wallet, the hacker already has access to them. All he/she has to do is wait for you to have a good fortune on your wallet, and then one day, suck up all of your investments.

How to Avoid Rigged Hardware Wallets

First of all, you need to know where it is safest to buy hardware wallets. First, right from the manufacturer. This way, you have the shortest distribution chain and the slightest chance that something like what I've described will happen. Secondly, ONLY with manufacturer-verified vendors. NEVER, and I REALLY MEAN NEVER, buy a hardware wallet from auction portals, bazaars, second hand sellers, and other sellers that are not mentioned by the manufacturer on their website.

My recommendations above may sound like too much, but I repeat, you are not in a fairy tale. You are in the digital Wild West, where careless people underestimate security and end up losing everything.

Firmware Update 1.4.1 for Ledger Nano S?

If you have firmware older than 1.4.1, upgrade immediately. If the device is up and running without firmware, you can be assured that no one has ever manipulated your device; at the same time, a successful upgrade protects you against a similar type of attack. Take the case again, for example, when you leave your Ledger at home, someone can rob you, but not in the traditional way. When you get home, everything is found in its place, but your hardware wallet could be tampered with by the attacker.

Here's How to Update Your Firmware (Tested)

Before we start, make sure that you have your recovery seed, the most critical 24 words in the cryptosphere are Alpha through Omega. Here, we assume that you already have some experience with Ledger Nano S and you can use it. That's why you have an application named Ledger Manager installed in Google Chrome.

Trezor Has Firmware Updates (Tested)

SatoshiLabs, creators of the first and safest hardware wallet in the world, leave nothing to chance and regularly issue updates for their Trezor and Trezor T. Unlike the competing Ledger Nano S, an update on the web interface of the Trezor will "pop" up. Do not wait - update immediately!

Passphrase in Trezor

However, the biggest and most undisputed advantage of the Trezor is the Passphrase that doubly ensures your Trezor. The Passphrase creates a safe inside the Trezor based on your chosen words or phrase. In the event of an immediate attack, someone can force you to unlock your Safeguard with a PIN, but if you have a Passphrase set-up for your cryptocurrencies, the attacker will see only a small balance amount of your choice, and there is a good chance he/she will assume that it is all you have.

In the web interface on wallet.trezor.io, click on your Trezor or Trezor T hardware wallet, and under the Advanced tab, you will see the firmware version and the Passphrase option. The Passphrase is basically a unique 25th word to your 24-word series from which the seed is composed. As soon as you activate the Passphrase, the Trezor generates a new, complete set of unique private keys that can only be reached by combining the recovery seed and the Passphrase, for a total of 25 words. Check the "Ok, I understand" checkbox and click on "Turn on Encryption with Passphrase". Your hardware wallet prompts you to confirm with a button and then asks you to disconnect and connect the USB cable.

Now choose your Passphrase, which you are sure you will never forget. If you forget your 25 word (Passphrase) recovery seed, nobody and nothing in the world can help you get to the private keys that give you access to your cryptocurrencies. As soon as you enter the Passphrase, you will find yourself in the new private key set. At first, the balance will be zero at all addresses until you send something to them. If you want to send cryptocurrencies to an address (wallet), simply copy the current address, disconnect the USB cable from the Trezor, reconnect it, enter the PIN, do not type in your Passphrase, and press Enter.

Press Enter to get the wallet's private keys that are not hidden behind any Passphrase. From there, you can send cryptocurrencies to hidden addresses. Once you have done so, you can disconnect the Trezor from the USB cable, reconnect it, enter the PIN, enter your Passphrase again, and if the transaction occurred through the blockchain, you will see it on your wallet. If this seems complicated, just imagine that you have moved your coins from one cup to another, except no one knows that the second cup exists, and no one ever gets to unless they know the secret code (the Passphrase). In my opinion, this puts the Trezor and Trezor T over all other security solutions that you can encounter in the world.

It is essentially a solution to Plausible deniability, which is a condition where in the case of insufficient evidence and in our case, insufficient suspicion, we can be "guilty of acquittal" and basically suspicion alone that we have a larger amount of cryptocurrency. In other words, because of the Passphrase feature, you can not unambiguously prove or even suspect that a Passphrase exists. Of course, it's always a good idea to have one fake Passphrase with a smaller balance, as the Passphrase is publicly known and you can assume that a potential attacker will not only be content with a PIN code and an unprotected wallet. It is therefore not a matter of just having a Passphrase, but also a wallet with a sufficient balance that will satisfy a burglar's desire, but deter them from your real holdings.

And What About in Ledger?

Thankfully, the creators of the Ledger Nano S hardware wallet also thought of offering a Passphrase, so your Ledger can be a little safer than before. The difference between Passphrase for the Trezor and the Ledger, however, is that with your SatoshiLabs Safari hardware or a newer Trezor T, you can actually use Passphrase and you can make it anything you want. With the Ledger, you can only have a second PIN. The first PIN is without a Passphrase, and the second PIN code leads to the wallet that is hidden behind "Passphrase".

This solution honestly doesn't make much sense for re-use, as there are only two situations where you really work with a Passphrase. And when you set the second PIN, then you will be restoring your wallet using the provided recovery seed. Unfortunately, you can not set up a third PIN, and thereby, it defeats the whole purpose of the Passphrase as it works with the Trezor.

Trezor (T) vs. Ledger Nano S

One of the most common questions I get is how to choose a hardware wallet. This can not be clearly answered because both Ledger Nano S, Trezor, and Trezor T currently offer slightly different functions. The Trezor offers fewer altcoin wallets than the Ledger, but with the Trezor T, there is hope for adding more cryptocurrencies in the future, which is just a matter of time. For example, Vertcoin and ZenCash developers, which we have written articles about, are working to add more cryptocurrencies to both hardware wallets. There is also a great anticipation of Monero's integration into Ledger, while SatoshiLabs (creators of the Trezor) has announced a bold reward for anyone who manages to integrate Monero with the Trezor. The aforementioned Saleem Rashid did a great job when he got into the Trezor NEM.

Personally, I prefer the Trezor hardware wallets. They work better for me, their user-friendly environment is more enjoyable, and the Password Manager is a great feature, which will help you move your overall level of security in the digital world to a different and improved level. But if you are more interested in cryptocurrencies and your invested capital is larger than the purchase price of these two wallets, I advise you to get both. In addition, Trezors come with a security hologram, so you can see if someone has tampered with the equipment and/or the packaging. The Ledger Nano S has nothing like this, and Ledger's creators claim there's no need for it.

How to Handle Your Hardware Wallet and Tips for More Safety

• Save the recovery seed in a safe (physical) form in a safe place that only you or a trusted person knows. It is very convenient to use Cryptosteel, a fire-resistant table that ensures your word combination is safe from any catastrophe. Think of the recovery seed as such.
• Do the same with your Passphrase, but NEVER, and in no case have your recovery seed and Passphrase together - you NEVER get to recover your seed.
• Do not leave your hardware wallet unattended, and not at all in public. If you lose it or you forget it somewhere and you happen to get back to it, you'd better get new equipment and never use old ones anymore.
• Never tell anyone where you have the recovery seed.
• Do not tell people how much cryptocurrencies you have and where they are, even in the abstract, for example, in the context that you have had bitcoins since 2012. Be aware that when someone knows that you have cryptocurrencies, and in the worst case, how many of them you have, you're exposing yourself and you can be in immediate danger. In the most extreme cases, this can be a threat to your property and life.
• Use the Passphrase feature.
• Be cautious, use your head, and always have a bit of healthy paranoia, it will not hurt you.

Cryptocurrencies are Immortal, but You Are Not

The mystery of cryptocurrency is, among other things, that they are tamper-proof and indestructible. However, you may not be here tomorrow. While you have hardware wallets, dozens of passwords for the stock exchange, your recovery seed, hidden backup, and you use several Passphrases, those who stay here may sooner or later learn that have been pumping money into some stupid bitcoin. Remember when you controlled the price of Litecoin on your mobile phone, but when you shared the next coin you were interested in with others, all they heard from you was strange gibberish? In short and simple words, if you're involved in cryptocurrencies, you have to leave behind instructions on how to do it and how to get to them for your heir.

Create a Treasure Hunt

• Write down your list of cryptocurrencies and let them know where they are (in case of exchanges of web addresses).
• Put together everything your heir needs to access your cryptocurrencies (recovery seed, password, 2FA keys, Passphrases), but never add all of these factors together. Divide them, in other words, decentralise your treasure trove.
• Carefully think about and choose which currencies, to whom and where each guide will be stored and entrusted. Although it is not entirely cryptoanarchist, notaries, lawyers, or a bank can be a good choice. If you and your heir are real adventurers, you can take the treasure hunt game literally.
• If you have more heirs, create each separate Passphrase (only for the Trezor or Trezor T). Thus, each heir can have his/her own Passphrase, making sure that for example, your uncle does not recruit other family members and so on.
• Do not put it off - do it now!

The safety of cryptocurrencies should not be underestimated. A little bit of inattention and you can lose it all. The basis is to buy hardware wallets only from trusted sources. Just remember, however, that you are not immortal. So leave behind instructions on how to get access to your crypto treasure.