Then let them bypass it, too. Give them 5 obstacles to bypass. 5 is better than 1.
You want to open the device, fake the holographic sticker first. Then fake the box, too. Fake the sticker on the device as well.
There's nothing wrong with putting several layers of security measures for buyers to readily check. A holographic sticker that looked somehow different could have saved one from losing all his/her lifesavings. With Ledger's misplaced confidence, customers are left with nothing to check, either for legitimacy or integrity or whatever. Nobody checks unmarked plastic wrappers seriously. They could be perfectly faked even with a sidewalk vendor.
"Engineered to be tamper-proof" my foot! A can of sardines or a jar of sandwich spread seems more protected.
I've bought 3 hardware wallets so far. It's Ledger that overconfidently offers almost zero packaging protection.
Don't get me wrong, I fully agree with you. I was merely thinking that there is no way that this can be fully prevented at all, at least not that I know of from a hardware perspective. They can only make it harder by including different things, from the hardware validation which seem to have failed in this case, to the stickers that were mentioned, to some supply chain validation and that. The more things are added the better, and I don't think these things add that much cost on a scale. Definitely those stickers are pretty cheap, so that part of the weak protection can be blamed on Ledger.
As a person who works in the field of printing design, it is easy for me to make anti-tampering stickers like this because it can be Custom or made like the original stickers made.
But some Original VOID stickers with Holograms and special codes may be a marker, but some other supporting methods are needed for higher security such as cryptographic verification of devices,
protecting devices from the Design to Distribution stage, because the device distribution chain also needs to be strictly audited.
And the Licensee as a Distributor or Reseller also needs to be strictly audited if the company is acquired by someone else,
but there is no official report from Ledger about further audit on the Cryptobilis Acquisition Process.
I would not expect a company of this scale to use basic anti-tampering stickers if they were going to add them, but they should do something more after this case.
meanwhile, Trezor is reducing the number of resellers as a preventive measure:
https://x.com/Trezor/status/2110000774314873020it seems to me that reducing the number of resellers isn't a comprehensive enough measure to secure the supply chain. ideally, there should be a single production location for hardware wallets where everything can be monitored more rigorously. Ledger, for instance, manufactures different models in several countries. this guy (
https://x.com/Cyphertux/status/2109695312050765966) managed to find information regarding place of production of Ledger devices:
Nano X - France
Nano S Plus black - Hungary
Stax - Vietnam
Flex - Vietnam
Nano Gen5 - Vietnamit is hardly surprising that there has been no clear response from Ledger so far, given the scattered production locations and the additional factor of suppliers for individual components.
It is not enough but every step helps.
