Ledger’s Developer Kit Reports Every Signature to Ledger Unless Wallets Opt Out, Ambire Developer Says

A developer at rival wallet maker Ambire said on Nov. 10 that Ledger’s signing kit, the software development kit (SDK) that wallet apps use to talk to Ledger hardware devices, sends details of every signature back to Ledger by default. The developer, Kaloyan Kosev, wrote that each signature pings a Ledger server. The report names the network and the destination address, identifies the device and its firmware, lists the app versions in use and flags if the user approved the transaction blind. Blind signing means approving a transaction the device can’t show in readable form. He said the reporting has been on by default since version 1.16 of Ledger’s context-module package. “I’d argue that privacy should be the default,” he wrote.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Unchained.