Ledger Introduces Security Enhancements For Wallet Nano

The Nano contains a security card housed in the device. When you approve a transaction, you enter codes from this card into your computer. This creates a vulnerability. Malware running on your system can capture and record these codes as you type them. After observing enough transactions, an attacker collects sufficient codes to fabricate their own unauthorized transactions. Using these stolen codes, they can sign transfers to their own addresses and steal your bitcoin.

To fix this problem, Ledger developed a mobile application that works with the Nano. You verify transaction details on your phone through the app before the wallet processes any transfer. This adds a second authentication layer. An attacker would need malware running on both your computer and your phone to breach this protection. Compromising two devices at once puts an attacker in a much tougher position than hitting a single machine.

Ledger CTO Nicolas Bacca contends this approach beats 2-of-2 multisignature implementations. Attacking both devices creates far more challenges for criminals. But perfect security doesn't exist. Humans are the weak point. Weak passwords, phishing attacks, misplaced recovery seeds, and theft can breach any system, no matter the engineering behind it.