Hacking Hardware Wallets 35c3

The seed words are generated randomly on the Ledger device once you are setting it up. You can choose your own pin during the set up process. If your device did not ship with a pin already specified, it probably wasn’t compromised. It is normal that you cannot choose your seed words (recovery phrase) - it is auto-generated randomly.

The source is directly from their instruction manual and them, I called them… thay and it says there should not be any phrases preloaded.

Can you post where did you find this information? I own a nano S and as far as I’m concerned, you cannot choose your own recovery phrase - its random. I found no information about this on their site or documentation either.

You should be worrying only if the device already had pin or the recovery sheet was prefilled. Otherwise, you are fine.

Simply reset the device and enter your own words. It will not “complain” if the words are generated by other sources.

It’s worth to mention that humans usually are very poor when it comes to generating randomness. I would not recommend to pick the words by yourself. But if you do not trust the ledger device you could use something else to generate the words.

Not all word combinations produce a valid key. That is why the recovery phrase is generated randomly during first initialization. Sure, you can reset the device and enter your own phrase but you need to make sure that the word combination you picked is actually valid so you will probably need to generate it somewhere else and then enter it.

When talking about the 12 words, as far as I know only the last word is a checksum. Should be doable to pick 11 and then the right last word. (I never did it, only for proof of concept, doesn’t make sense to me)

Possibly customer service needs training? I called them and that is what I was told.