I'm a big fan of Ledger products. With the growing sophistication of attacks on crypto hodlers, I've come up with a Ledger Improvement Proposal (LIP). Allow me to share it through a story I've carefully crafted over weeks.

!! ChatGPT summary !!
This is a proposal for enhancing the security of Ledger devices involves integrating OTP codes that are displayed on the Ledger at startup and verified with a 2FA app on your phone.
This method ensures that the device in use is the genuine one, as only the legitimate Ledger device would generate an OTP that matches the one on your phone, given the shared secret key. This approach adds an additional layer of security.
It makes it much harder for someone to replicate or tamper with the device without being detected. It's a thoughtful and innovative idea, especially in the context of the increasing sophistication of cyber attacks in the cryptocurrency world.

Just arrived in Paris for EthCC 2040, buzzing with excitement! I booked a nice hotel close to the conference, bustling with fellow developers. The day was fantastic, and after enjoying some beers, I headed back to the hotel, eager to explore all the new alpha.

After a refreshing shower, I settled in front of my MacBook, connecting my Ledger Nano S Plus, discreetly stashed in a small pocket of my suitcase. I primarily use my Ledger with Rabby, seldom resorting to Ledger Live.

I keyed in my PIN as usual, but then, my Ledger screen suddenly went black. A thought flashed through my mind: "Damn! My Ledger decides to fail right here at EthCC!"

I take a closer look at my Ledger, I found nothing amiss. In a rush, I turned to Google Maps to locate a store for a new Ledger purchase first thing in the morning. But then, my phone rang.…
and you know the rest of the story.

What happened?

I didn't know it yet, but the hacker was lurking just beyond the wall, in the adjacent room. He had engineered highly accurate counterfeit Nano S Plus devices. While I was away, he swapped my Ledger with a counterfeit one with the help from an accomplice in the hotel.

The counterfeit Ledger replicates the PIN startup screen and sends the PIN to the hacker using Bluetooth. He then uses this PIN to access and sign transactions on my genuine Ledger he possesses.

So, how can we prevent such future incidents?

I believe it's essential to eventually implement a quick and effective externally verifiable authenticity check for hardware wallets.

Introducing my LIP: "ACSO" - Authenticity Check through Synchronized OTP.

Each time the device starts up, OTP codes will be displayed on the screen. These codes are generated using a shared secret key between the Ledger and a 2FA app on my phone. If the OTP codes match, it confirms that my Ledger is authentic.

If the OTP code on my Ledger doesn't match the one on my phone, it's a strong sign that my Ledger might have been compromised.

What are your thoughts on this?