Ledger and hardware wallets - here are the facts

First some basics for Ledger:

Secure Element:

The secure element is not an unbreachable storage chip, it is in fact a little computer. This computer is secured in a way that it enabled confidential computing. This means that no physical outside attack can read thing like the memory on the device. The secure element is and has always been a defense against physical attacks. This is what makes Ledger a better option than let's say Trezor in that regard, where you can retrieve the seed just by having physical access to the device.

Phygital defense

Ledger uses a 2e STmicro chip that is in charge of communicating with the buttons, USB, and screen. This co-processor adds a physical and software barrier between the "outside" and the device. This small chip then sends and retrieves commands to and from the secure element.

OS and Apps

Contrary to what most people believe, the OS and apps run in the secure element. Again that chip is meant to defeat physical attacks. when Ledger updates the OS, or you update an app, the secure element gets modified. With the right permissions an app can access the seed. This has always been the case. Security of the entire system relies on software barriers that ledger controls in their closed source OS, and the level of auditing apps receive. This is also why firmware could always have theoretically turned the ledger into a device that can do anything, including exposing your seed phrase. The key is and has always been trust in ledger and it's software.

What changed

Fundamentally nothing has changed with the ledger hardware or software. The capabilities describes above have always been a fact and developers for ledger knew all this, it was not a secret. What has changed is that the ledger developers have decided to add a feature and take advantage of the flexibility their little computer provides, and people finally started to understand the product they purchased and trust factor involved.

What we learned

People do not understand hardware wallets. Even today people are buying alternatives that have the exact same flaws and possibility of rogue firmware uploads.

Open source is somewhat of a solution, but only in 2 cases 1. you can read and check the software that gets published, compile the software and use that. 2. you wait 6 months and hope someone else has checked things out before clicking on update.

The best of the shelve solutions are air-gapped as they minimize exposure. Devices like Coldcard never touch your computer or any digital device. the key on those devices can still be exported and future firmware updates, that you apply without thinking could still introduce malicious code and expose your seed theoretically.

In the end the truth is that it is all about trust. Who do you trust? How do you verify that trust? The reality is people do not verify. Buy a wallet from people that you can trust, go airgap if possible, do not update the firmware unless well checked and give it a few months.

Useful links:

Hardware Architecture | Developers (ledger.com)

Application Isolation | Developers (ledger.com)