Website eines Drittanbieters, um den öffentlichen OpenSSL-Schlüssel von Ledger zu erhalten? Wie kann man Ledger Live mit GPG verifizieren?

[root_s2yse8vt]

Up

0

Down

::

Ich weiß, Ledger hat alle Anweisungen zu überprüfen, dass die Ledger Live-Download auf ihrer Website echt ist, aber korrigieren Sie mich, wenn ich falsch bin, wenn Sie eine gefälschte Ledger Live von einem gefälschten herunterladen [ledger.com](https://ledger.com) herunterlädt, dann sind sicherlich alle Schlüssel auf [https://www.ledger.com/ledger-live/lld-signatures](https://www.ledger.com/ledger-live/lld-signatures) ebenfalls gefälscht sein, um dem gefälschten Download zu entsprechen und dem Benutzer vorzugaukeln, dass der Download echt ist.

Um dieses Risiko abzuschwächen, möchte ich den öffentlichen Schlüssel von Ledger von einer Website eines Drittanbieters wie [keybase.io](https://keybase.io) beziehen und den Download damit verifizieren. Allerdings konnte ich den öffentlichen pgp-Schlüssel von Nicolas Bacca nur auf folgender Website finden [keybase.io](https://keybase.io) finden und versuche nun herauszufinden, wie ich den Live-Download des Ledgers damit verifizieren kann.

Gibt es eine Möglichkeit, einen pgp-Schlüssel zu verwenden, um eine openSSL-Signatur zu verifizieren? Gibt es eine andere Website, von der ich den öffentlichen openSSL-Schlüssel von Ledger herunterladen kann?

​

Nebenbei bemerkt: Angenommen, ich lade eine bösartige Ledger-Live-Anwendung herunter – welche Risiken bestehen dann genau? Sie wäre nicht in der Lage, meinen privaten Schlüssel zu extrahieren, oder? Was ist mit dem Senden falscher Adressen an das Gerät beim Empfang?

[sublym0nal]

Up

0

Down

::

To clarify, the same verification page you linked to contained a link to [a JavaScript file in Ledger Live’s source code on GitHub](https://github.com/LedgerHQ/ledger-live-desktop/blob/master/src/main/updater/ledger-pubkey.js), which contains an embedded copy of the OpenSSL key. The download link you mentioned is actually a canonical URL that redirects to the relevant asset as hosted on the repository’s official Releases page.

Are you saying GitHub does not qualify as a „3rd party website“ source?

[VariousJackfruit]

Up

0

Down

::

The device checks the displayed receiving address against the stored seed phrase, to ensure that it is really derived from your wallet. So even a fake Ledger Live couldn’t have the device show a receiving address that isn’t part of your wallet.

Thus a fake Ledger Live couldn’t do much as long as you verify the details on your device screen.

[FederalOil6911]

Up

0

Down

::

good question, I would like to know as well

[VoltaicShock]

Up

0

Down

::

> What about sending false addresses to the device when receiving?

This is why you always verify the address on the device from what is shown. I don’t think it’s possible to read the address on the device and force it to show in a fake ledger (I could be wrong about this though).

[papercut_666]

Up

0

Down

::

My 2 satoshis….

„but correct me if I am wrong, if you are downloading a fake ledger live from a fake [ledger.com](https://ledger.com),“ ….

If you go to a fake site of ledger.com , that means either you clicked on a link provided in an email to you, you had a type-o and you came across a scammer site or your system has been compromised that is showing you another site then ledger.com .

„On a side note, say I did download a malicious ledger live application – what are the risks exactly? It wouldn’t be able to extract my private key would it? What about sending false addresses to the device when receiving?“

They could extract your private keys if you’ve typed in your mnemonic seed phrase *in the fake app* (edited). And they also could show you, on your ledger, a different receiving address if you want to send coins to your ledger.

The main point here is that you’re responsible to keep your system clean and check what kind of software you have on your computer. Is the source of some kind of software malicious, there is no one that can help you with that. If there’s an information saying that this is a „new ledger live“ version that is still not available for the major public and you’ll get additional rewards or something along those lines, it’s a trap. Have you infected your computer with something because you wanted free in-game credits where you should’ve paid for them, I just can say congratulation you’ve played yourself.

You have the ultimate responsibility to keep your devices clean of viruses, rootkits, malware, keyloggers and other harmful stuff if you are working with values on that devices.

IMHO no one and no company has to setup 3rd, 4th or even 10th party verification if the user can’t uphold his responsibility of not installing shady software.

[Autor]

Beiträge