Hacker News Reader

The legit wallets have an online way to verify they are genuine by cryptographic means. A totally new fake couldn't do that.

View on HN

Thanks. I believe you’re right a totally fake copy couldn’t verify. So that idea was wrong.

(The MITM supply chain attack which has happened succeeds because it preserves the original secure hardware but intercepts the secret data at the display interface. But a low-effort mimic of the entire device like I suggested? That wouldn’t work).

Ledger provides a 'Genuine Check' mechanism to determine the authenticity of the device; however, it explicitly warns that it cannot detect added implants when the device's original Secure Element remains intact.

And as this workaround leaves the original Secure Element intact, good luck detecting the supply chain attack.

I think that’s where the epoxy from earlier in this comment chain is supposed to come in.

Epoxy is useless, we have materials to dissolve cured epoxies for rework in aerospace.

Man can make it, man can break it.

But it's specifically a potting epoxy designed to cause damage to the electronics if removed. And any destruction of the epoxy has to not significantly affect the outward appearance of the device. At worst it's defense-in-depth.

Reply on news.ycombinator.com