My personal view on the PR disaster, from a Ledger co-founder and ex CEO

I'm Éric Larchevêque, Ledger co-founder an CEO of the company from 2014 to 2019. My flair here says "Ledger CEO" but I'm not anymore. I'm only a shareholder of the company, not an executive, and all views are personal. My views are not representative at all of Ledger, its management or its board.

What an horrible mess.

I'm devastated to come on this subreddit, that I created nine years ago, to see images of Ledger devices burning, insults and lot and lot of anger. I'm honestly to the verge of tears.

I've given so much to this company, that it's impossible for me not to be highly emotional in this moment.

So much anger, so much hate, and also so much insanity.

My first step is to apologize as a co-founder about how this launch have been handled. I can't help but to wish this had been done differently. I don't have all details, but for sure something went wrong and the Ledger Recover service was put in your face in the worst way possible.

This is obviously a sensitive subject and would have needed a much more prepared communication.

To me, all this meltdown is a total PR failure, but absolutely not a technical one.

Please read this post which is a very good factual take on he situation : https://www.reddit.com/r/CryptoCurrency/comments/13kdusd/hardware_wallets_here_are_the_facts/

Since 2014 I have been explaining the security model of Ledger and the implications of using a Secure Element (good : very secure, bad : closed source). The security model of any Ledger device relies on the fact that you need to trust Ledger to provide with a firmware doing exactly what it is supposed to be doing.

In the early days, people just had to trust us. The more the company grew, raised money, got customers, the more the incentive to make sure the firmware is sound grew. Hence audits, governance control on the firmware release, the Donjon, etc. The more Ledger had something to lose by doing a mistake, the more things were put in place to prevent this.

Trying to explain the security model to customers with a less and less knowledgable user base became more and more difficult, and it looks like in 2022 a marketing executive tweeted "A firmware update cannot extract the seed from the Secure Element". It's not a lie, but it's missing "as long as you are trusting Ledger".

So people started to think Ledger was a trustless solution, which is not the case. Some amount of trust must be placed into Ledger to use their product. If you don't trust Ledger, meaning you treat your HW manufacturer as an adversary, that can't work at all.

When Recover was abruptly launched, this false sense of trustlessness went into pieces and people started to actually understand how a HW works. At least, that's a positive note.

My mistake as a CEO during my tenure was probably not be relentless enough about explaining the security model, but at some point you just give up as people don't care at all. Until they care again, like now.

The mistake of some of the "power user" community (reddit, twitter...) is to become batshit crazy and start writing stuff like "there is a backdoor from day one" or "the governement has taken over Ledger".

The hard truth, which has been confirmed by many experts who took the time to actually deep dive on the subject, is that nothing changed. Absolutely nothing happened. The security model is the same than before you knew Ledger Recover existed.

What changed is the perspective some of you had on the trustlessness, which appeared to be much more nuanced than you thought, and as this is a very sensible subject, many became extremely angered because they felt lied to.

I understand this point of view, but it's important also to be reasonable, take a deep breath and actually think about the facts.

If you think that Ledger did a terrible thing by not being relentless enough on the security model, and took shortcut when expressing it, if you think that at the time you bought the device, you would never have bought it if you had known this wasn't a fully trustless solution, then yes I get your point of view.

But if your only take is to jump on the hate bandwagon and yell "there is a backdoor" when you don't have any understanding of what you are saying, then it's a free country, but at the end the real victims will be the noobs who in panic will try to offload their crypto from Ledger, make stupid mistakes and lose it all.

Ledger is still safe, there is no backdoor, the Ledger Recover is not a conspiracy, no one will ever force anyone to use Recover.

The Recover code in the firmware is not a malicious code nor does it open a way to arbitrary extract the seed.

If you trust the device to sign a transaction only when you press a button, then you can trust the device to compute a SSS (a shard of the seed) only if you press a button.

I'll now answer questions to the best of my abilities.

(I have posted the same thing in the Ledger subreddit and already answered a lot of questions there

https://www.reddit.com/r/ledgerwallet/comments/13layt7/my_personal_view_on_the_pr_disaster_from_a_ledger/)

Thank you.

Éric

PS : again, this is a personal post, personal views, and I'm not representing the views of Ledger or its management.