New ledger Flex junk

[Meuserna]

i know it's not recommended but i was looking at ledgers on ebay. but they claimed they were "new". but i think i like the idea of using an opensource software and hardware like the yahboom better!

Whoa.  Never buy a closed source hardware wallet bought from a third party.  Trying to save a few dollars could mean you buy a device that's been tampered with, even if it's sold as new.  I wouldn't even buy an open source hardware wallet from a third party.

Maybe you're thinking "Hang on!  You said to buy a Yahboom from AliExpress!"  The Yahboom K210 Visual Module is not a hardware wallet.  It's a mini computer that runs micro python & can be used for any purpose.  It's not a hardware wallet until you load hardware wallet software onto it.  At some point, I may buy myself a backup Yahboom, but next time, I'd buy it with a robot kit for the fun of it.  When I want to use it as part of a robot, I'll flash the robot code onto it.  When I want to use it as a hardware wallet, I'll flash Krux onto it.  It takes less than a minute to flash Krux onto one of these devices.  You download Krux from Github and follow the instructions.  Or, I think they have an installer too, but I just run a command in Terminal to install it.

[larry_vw_1955]

Whoa.  Never buy a closed source hardware wallet bought from a third party.  Trying to save a few dollars could mean you buy a device that's been tampered with, even if it's sold as new.  I wouldn't even buy an open source hardware wallet from a third party.

yeah i know its not recommended. i thought the worst thing that could happen is they fill in the seed phrase for you hoping you won't generate a new one. i heard about that scam but apparently there's other scams.

Maybe you're thinking "Hang on!  You said to buy a Yahboom from AliExpress!"  The Yahboom K210 Visual Module is not a hardware wallet.  It's a mini computer that runs micro python & can be used for any purpose.  It's not a hardware wallet until you load hardware wallet software onto it.  At some point, I may buy myself a backup Yahboom, but next time, I'd buy it with a robot kit for the fun of it.  When I want to use it as part of a robot, I'll flash the robot code onto it.  When I want to use it as a hardware wallet, I'll flash Krux onto it.  It takes less than a minute to flash Krux onto one of these devices.  You download Krux from Github and follow the instructions.  Or, I think they have an installer too, but I just run a command in Terminal to install it.

why not just buy a second yahboom for the robot thing. seems like it would be a hassle having to switch back and forth between the robot and bitcoin wallet. anyhow i had never heard about this yahboom and krux thing it must be some highly kept secret but it's exactly what i have been looking for i think 

[Meuserna]

Whoa.  Never buy a closed source hardware wallet bought from a third party.  Trying to save a few dollars could mean you buy a device that's been tampered with, even if it's sold as new.  I wouldn't even buy an open source hardware wallet from a third party.

yeah i know its not recommended. i thought the worst thing that could happen is they fill in the seed phrase for you hoping you won't generate a new one. i heard about that scam but apparently there's other scams.

The worst thing that could happen is hackers figure out how to add their own electronics into the device to steal your coins.  Or the seller puts your name and address on a list of people to rob.  Ledger got hacked and the hackers leaked their entire customer database a while back, including customer names, email addresses, phone numbers, and home addresses.  Here's how that went:

"Ledger wallet users face mounting home invasion and other scareware threats as hacker dumps private customer information online."

-- Cointelegraph

Don't take risks when setting up your Bitcoin security.  If you buy a hardware wallet, buy it directly from the company or go DIY using an off the shelf device (like a Raspberry Pi or one of these Kendryte K210 devices).

Seriously, don't take risks when setting up your Bitcoin security.

Maybe you're thinking "Hang on!  You said to buy a Yahboom from AliExpress!"  The Yahboom K210 Visual Module is not a hardware wallet.  It's a mini computer that runs micro python & can be used for any purpose.  It's not a hardware wallet until you load hardware wallet software onto it.  At some point, I may buy myself a backup Yahboom, but next time, I'd buy it with a robot kit for the fun of it.  When I want to use it as part of a robot, I'll flash the robot code onto it.  When I want to use it as a hardware wallet, I'll flash Krux onto it.  It takes less than a minute to flash Krux onto one of these devices.  You download Krux from Github and follow the instructions.  Or, I think they have an installer too, but I just run a command in Terminal to install it.

why not just buy a second yahboom for the robot thing. seems like it would be a hassle having to switch back and forth between the robot and bitcoin wallet.

I meant, I'd buy a second one as a spare.  I'm big on having a backup, just in case.  It takes less than a minute to install Krux on a device, so it's not a hassle.  Plug the device into your computer, paste one line of code in Terminal, and a few seconds later it's done.

anyhow i had never heard about this yahboom and krux thing it must be some highly kept secret but it's exactly what i have been looking for i think 

Krux and Yahboom are totally different things.  Think of it like software and a computer.  Krux is the software.  Yahboom K210 is the computer.  Kind of like how you run Adobe Photoshop on a Mac or on a PC.  You run Krux on a Yahboom K210 or on a Maix Cube.

Krux is a relatively young project.  It's a few years old, but it really started making big progress last year.  I think that's when they started winning grants from OpenSats to fund their work.  I've been mentioning Krux a lot because it's so much better than any other hardware wallet I've seen or used.  And it has some features that I think greatly increase security.  Encrypted seed QR is a game changer.  Passphrase QR is a game changer.  And the ease of switching the network from Bitcoin Mainnet to Testnet makes testing your security so easy.  Mainnet is the main Bitcoin blockchain we all know and love.  Testnet is a testing version where coins have no value, because it's just for testing.  Experimenting with Testnet is such a great way to learn.  I wish every Bitcoiner would do it!

The Yahboom K210 Visual Module is just one of the devices Krux can run on.  If you have really good vision and don't mind not having a touchscreen, Krux runs on a Maix Cube, and those things can sometimes be found for as little as $35.  But it's a tiny screen, and it has a crappy toggle button like a Blockstream Jade that's obnoxious to use.  For just a few dollars more, the Yahboom is so much better.  Sadly, the best device for Krux has been out of stock for months: the Maix Amigo.  That thing cost $50 and has a 3.5 inch touchscreen.  It's awesome.  If the Amigo ever comes back in stock, I'm buying 2 of 'em.

[Pmalek]

...it appears that there's no difference between the BTC edition of Flex and the normal one ^{[apart from its color (SMH)]}!

To be honest, that's not unusual. Let's not forget that Trezor had a limited edition Bitcoin-only version of their hardware wallet not that long ago. The difference between that model and the others were in the orange bitcoin cover. However, you can install a bitcoin-only firmware on a Trezor regardless of which model you purchase.

On a side note, you could build DIY Jade (based on Blockstream Jade[2]) which cost less[3] if you don't mind less feature.

Even a fully assembled Jade is affordable and costs less than $60 with a discount code. But I understand the logic in purchasing the parts yourself and building everything from scratch.

After the Recover debacle, there were still so many people who just shrugged their shoulders and kept using their wallets.

If that waiting list is to be believed, then my point is proved.

I am sure that 2/10 people who are on that waiting list have an idea of what you are talking about when you say Ledger Recover debacle. Even less would be able to explain what Ledger Recover does. What they know is that it's this cool new thing that Ledger created for us and they said it's super safe.

i know it's not recommended but i was looking at ledgers on ebay. but they claimed they were "new".

Never buy hardware wallets on eBay, new or second-hand. Visit the official shop or use an official reseller for such devices. Trying to save a few bucks only to risk getting a faulty or manipulated HW isn't worth it.

[Bitcoins101]

I'm in the US & I've bought a few things from AliExpress.  Keep in mind, you're not buying a hardware wallet from AliExpress.  You're buying a development board type device that can be programmed to do whatever you want.  Krux turns it into a hardware wallet, but most people buy a Yahboom K210 to do DIY robotics.  It's just a neat little gadget you can write your own code for to do whatever you want kind of like a Raspberry Pi.  The Krux installer wipes it out entirely & installs Krux.

If you don't want to buy one on AliExpress, you can pay a bit more to buy one directly from Yahboom.  If you click that link, you can also see a robot car using a Yahboom.

$56.99 even with free shipping. i can buy a ledger nano for less than that. hmm. this seems like something that would end up costing more than a real hardware wallet. does it need a TF card? then you have to buy that too.

Then buy a Ledger and risk exposing your coins to closed source code that contains key extraction firmware by a company that lies to you again and again and again.  Even if you could get a Ledger for free, we'd warn you not to use it for anything more than a doorstop or a decoy.

As I explained, you can get a Yahboom K210 on AliExpress for around $45.  Even less on sale.  I got mine for $37 shipped.  You don't need anything except the device and a USB cable to install Krux.  Once you have Krux installed on it, you'll never need to plug it into a computer again (you can plug it into a USB wall plug like you'd get with a phone).  The rest of the stuff you're seeing on that page is for using it to do robotics.  You're not making a robot.  You're wiping it out & installing hardware wallet software on it.  Or not.  If you'd rather trust Ledger, go for it.  I have a buddy going through a nasty divorce.  We told him before they even got engaged "She's lying to you and she's cheating on you."  Sadly, some people need to get screwed over before they learn hard lessons.  Ledger isn't trustworthy, but if you trust them anyway, that's your choice.

Open source is the way to secure Bitcoin.  Krux.  SeedSigner.  Trezor.  I'm of the opinion that open source and DIY, like Krux and SeedSigner, is the best option since it means you don't have to trust a company.  I don't know about SeedSigner, but Krux is funded by grants from OpenSats.  And Krux is far more advanced than a janky Ledger nano.  Even NVK from CoinKite is recommending Krux.  The Yahboom device gives Krux a large touchscreen that shows you full details.  That cheap Nano has a microscopic screen that only shows you a few characters at a time and only has 2 flimsy buttons for navigation.  Oh, and if you're using that Nano with Ledger Live, congrats!  Ledger and everybody else has a billion trackers built into that thing.  Who needs privacy, eh?

Seriously, don't trust Ledger.  If we were talking about Trezor, I'd say Trezor is trustworthy but Krux is much more advanced (except it's Bitcoin only, but that also means better security).  But Ledger?  Oof.

Trezors are vulnerable to physical key extraction.

Look, Ledger isn't great, but it does the job.

[Meuserna]

Trezors are vulnerable to physical key extraction.

Some older Trezors are vulnerable to physical key extraction if the attacker steals your hardware wallet and if the attacker has the sophisticated equipment required to do it, and if the attacker doesn't fry the device in the process.  It was only done once as a proof of concept, not an actual hack where anyone's coins were stolen.

Ledgers have the ability to do key extraction over the internet by Ledger, their partner companies, or anyone who hacks their code.

Ledger's code has been hacked:

Ledger exploit makes you spend Bitcoin instead of altcoins

"A vulnerability in Ledger’s hardware wallets enables hackers to prompt someone to spend Bitcoin instead of an altcoin."

https://decrypt.co/37651/ledger-exploit-makes-you-spend-bitcoin-instead-of-altcoins

Ledger's hardware has been hacked:

In this post, I’m going to discuss a vulnerability I discovered in Ledger hardware wallets. The vulnerability arose due to Ledger’s use of a custom architecture to work around many of the limitations of their Secure Element.

An attacker can exploit this vulnerability to compromise the device before the user receives it, or to steal private keys from the device physically or, in some scenarios, remotely.

I chose to publish this report in lieu of receiving a bounty from Ledger, mainly because Eric Larchevêque, Ledger’s CEO, made some comments on Reddit which were fraught with technical inaccuracy. As a result of this I became concerned that this vulnerability would not be properly explained to customers.

https://saleemrashid.com/2018/03/20/breaking-ledger-security-model/

Ledger's security has been hacked:

Ledger wallet users face mounting home invasion and other scareware threats as hacker dumps private customer information online.

https://cointelegraph.com/news/ledger-data-leak-a-simple-mistake-exposed-270k-crypto-wallet-buyers

Ledger's CEO said not to use Ledger Recover if you care about privacy (LOL!):

"If, for you, your privacy is of the utmost importance, please do not use that product, for sure."

https://youtu.be/M3VjQUcyZSY?t=2342

That would be fine if the code required for that key extraction feature wasn't baked into the firmware.  You can choose to not use it, but you can't choose to not have that dangerous code on your Ledger device.

Look, Ledger isn't great, but it does the job.

Why would you trust a company you admit isn't great to secure your Bitcoin?  Their code isn't open, so you have to trust them.  But why?

[dkbit98]

Trezors are vulnerable to physical key extraction.

Such a silly statement, especially when we know that ledger crap have integrated ''feature'' ledger-recover to extract keys and sending in to other third parties, while charging customers for that 
And all new trezor devices have transparent secure elements so key extraction is impossible.
btw Trezor One is the first ever hardware wallet in the world, and it's still in production, while we have a big graveyard of defunct ledger devices...

[ABCbits]

Look, Ledger isn't great, but it does the job.

That may be true, if we compare Ledger with other questionable hardware wallet such as BitFi[1]. Besides, why choose Ledger when there are better choice (whether we're talking price, feature or company's history)?

[1] https://www.rsaconference.com/library/presentation/usa/2020/hacking-the-unhackable-pwning-the-bitfi-crypto-wallet

[tabas]

Purchasing it is one way to waste money. When they are no longer likable by the community that's aware of their flaw in the ledger recover, this is what they do. Well, we are not their target market anymore and I guess that instead of informing their users about the importance of securing one's funds about their feature, this is what they give to people - the aesthetic feels. 

[SFR10]

this is what they give to people - the aesthetic feels. 

Exactly... Only a few weeks have passed since they shipped it to "some of their customers" and there are already a lot of complaints on their subreddit ^{[a few Flex users have labeled it as a rushed or beta product]}:
^{- We're already in Q3 of 2024, but Ledger is still going around in circles [SMH]!}

- New Flex- 1st impressions and more questions ^{[unregistered touches, fixed auto lock and failed connections to LL]}
- Ledger Flex NFC chip is not working ....it is on. but not working
- Connect Flex

And issues with apps:

- Got a Ledger Flex - Can't add Cardano?
- Why is there no way to install the "TON" app on the Ledger Flex?
- Monero on Ledger Flex
- Why can’t i download the VeChain app on my Ledger flex?
- Ledger Flex and ICP

[tabas]

this is what they give to people - the aesthetic feels. 

Exactly... Only a few weeks have passed since they shipped it to "some of their customers" and there are already a lot of complaints on their subreddit ^{[a few Flex users have labeled it as a rushed or beta product]}:
^{- We're already in Q3 of 2024, but Ledger is still going around in circles [SMH]!}

- New Flex- 1st impressions and more questions ^{[unregistered touches, fixed auto lock and failed connections to LL]}
- Ledger Flex NFC chip is not working ....it is on. but not working
- Connect Flex

And issues with apps:

- Got a Ledger Flex - Can't add Cardano?
- Why is there no way to install the "TON" app on the Ledger Flex?
- Monero on Ledger Flex
- Why can’t i download the VeChain app on my Ledger flex?
- Ledger Flex and ICP

That sucks, see, it's really a way to waste money and just the aesthetic feels without giving the actual need of the users. Well, I guess on their end they'll just answer this with an another "update". They seem to have that every week or two just to address these issues but still, not really worth the buck for the trouble.

[SFR10]

Some Flex users have recently started to report they've received brand-new devices with swollen batteries while others experienced such swellings after using it for a short time and that usually leads to the back panel getting pushed out of its place... From what I'm seeing, Ledger is replacing the affected devices fast, but I remember having similar issues with my Galaxy S4 or S6 and no matter how many times I replaced the batteries, it kept happening again!

- Ledger Flex Battery Issues
- PSA: check your Ledger Flex battery
- Ledger Flex swelling
- Just got my replacement Ledger Flex today ^{[refer to the second paragraph]}

I do know such batteries don't explode that often, but I wouldn't risk keeping such devices in my house!

[Pmalek]

<Snip>

Because of some work I did in the past, I often needed to have multiple batteries with older cellphones that I could quickly swap when one battery runs out. I often noticed such swelling and bloating with cheap replacement batteries. The original battery that came with the phone was not affected. The bloating was never as serious as what I can see on some of the images on the links that you shared and it didn't hinder further use of the phone. This issue with Flex batteries is much more serous. So, Ledger is cutting corners again.

[Meuserna]

This issue with Flex batteries is much more serous. So, Ledger is cutting corners again.

Ledger has been having hardware issues for years.  The batteries in the Nano X were known to fail.  Ledger Stax was announced in 2022 and missed its launch & shipping date by over a year.  And now this Flex junk...

But the crypto bros who care more about swag than security will stick with Ledger.  That's Ledger's user base now.  Noobs who don't know better and dummies who don't learn.

[satscraper]

I hold no brief for Ledger's products but have to say that the most so called "battery issues" are caused by  users' ignorance on the matter of   correct charging of Li-based batteries which have the upper limit for the charging current ^{(respectively, the circuit controller build into device is designed to accommodate this upper-current, but if the current exceeds this level some controller's element may be out  of commission which in turn may result in increased charging current and swelling or even exploded battery )} . Thus to be on the safe side charge your devices ^{(Ledger's including)} properly ^{(charging from USB port on computer is commonly safe)}.

[Pmalek]

<Snip>

That may be true for the Flex hardware wallet, but Ledger has had issues with their batteries in older models as well, like the Ledger Nano X. We have seen complaints claiming the devices arrived in faulty state where they couldn't be used without wired connection and with errors when trying to charge the batteries. Completely depleted batteries, etc.

It's hard to say how often battery issues occur. Ledger has many users. A small percentage of them make their voices heard over social media. Perhaps a much larger group is keeping quiet, but perhaps not. Also, it's not common for people to write about positive experiences, which makes it difficult to divide the userbase in those who have issues versus those who don't.   

[tenant48]

Typically, batteries in new devices of the same type can swell for the following reasons:
1. The layout is too dense. If components are located very close to each other, the battery may become pinched or subject to mechanical stress. This increases the risk of physical damage to the battery and may also cause it to overheat due to heat buildup from nearby cells.
2. Incorrect charge management. The charge controller may be configured incorrectly, allowing the battery to overcharge or deep discharge. Without correct voltage and current regulation, the battery overheats and is subjected to increased stress, which leads to swelling.
These problems often arise due to insufficient testing of the prototype device under various conditions or flaws in the design stage.
It would be better if Ledger made wallets with replaceable batteries like the Passport or Coldcard Q.