foobar

@0xfoobar

Stop using Ledger hardware wallets. Migrate away from them immediately. They’ve shown nothing but gross incompetence and wild misunderstanding of their own purpose. And now they’ve publicly admitted to intentionally backdooring their own proprietary hardware. Stop using Ledger

4,556

21:13 • 16 May 2023

Honestly, my initial reaction towards this feature was not negative. Having worked with a previous company that was focused on solving wallet management issues for everyday users, I comprehend the potential of a secure key recovery service. It could present a significant advantage to numerous users and could address one of the key obstacles preventing the widespread adoption of cryptocurrency by average users. The fact that this new feature is opt-in further reassured me that it would not pose a significant threat to other existing users.

However, on a second thought, I started seeing things from a different perspective. While I still believe that the recovery service has the potential to greatly benefit users, I have a few reservations about its current implementation in Ledger. There are a few serious issues that concern me and warrant further discussion and examination.

A common misconception

Before going into my specific concerns, I would like to dispel a common misconception. Many people who reacted with alarm have a misconception about how Ledger uses the Secure Element. They wrongly assume that the code run by the Secure Element is immutable, which is not the case. Ledger runs a custom operating system known as BOLOS, which is executed within the the Secure Element of the SoC. BOLOS, being part of the firmware, can be updated to accommodate new features, such as supporting new cryptography primitives and additional blockchains. The updatable BOLOS invariably has access secret key materials to enable it to derive new keys using different algorithms. Essentially, the entirely of BOLOS forms the trusted computing base (TCB) of the Ledger system. Without the ability to update BOLOS, Ledger would be unable to support new signing algorithms or additional blockchains without rolling out new hardware models.

However, the firmware update of BOLOS is not unregulated. The code that operates within the Secure Element must be signed by the Ledger company. Furthermore, it can reasonably be assumed that a user passcode is necessary to authorize a firmware update. Therefore, even in a hypothetical scenario where Ledger is coerced by a governmental authority to release firmware incorporating a backdoor, this modified firmware couldn't be installed without the user's explicit consent.

This reddit post provides a comprehensive explanation of the interplay between the Secure Element, OS, and apps in a Ledger device.

Ledger Support

@Ledger_Support

(1/2) Technically speaking it is and always has been possible to write firmware that facilitates key extraction. You have always trusted Ledger not to deploy such firmware whether you knew it or not.

426

1:49 • 18 May 2023

Security involves trade-offs

Information security always involves balancing trade-offs. Methods exist to mitigate risks during firmware updates; one approach is to design hardware to generate key encryption keys based on firmware measurements. Thus, any firmware modification would erase the device. While this enhances security, it complicates the update process for users. Given that most users' threat models don't require protection against state actors, it's understandable that leading hardware wallet manufacturers allow firmware updates without necessitating a full factory reset.

My reservations about the Ledger Recover service center around two key areas: the potential risks inherent in its implementation and the broader human organizational issues. While these problems may not actually arise in Ledger's implementation, the Ledger team's rather poor job at communicating their implementation details to the technical community leaves me with no choice but to assume the worst-case scenario.

The following FAQ contains the most comprehensive description that I could find from Ledger regarding the design of their new service:

In short, only you can access your wallet. When you subscribe to Ledger Recover, a pre-BIP39 version of your private key is encrypted, duplicated and divided into three fragments, with each fragment secured by a separate company—Coincover, Ledger and an independent backup service provider. Each of these encrypted fragments is useless on its own. When you want to get access to your wallet, 2 of the 3 parties will send fragments back to your Ledger device, reassembling them to build your private key.

And on recovery procedure:

The steps are as follows: - Get a new Ledger Nano X. - Open the Ledger Live mobile app and navigate to My Ledger -> Ledger Recover. - Go through reasonable checks to verify your identity. - Follow the onscreen instructions.

Ledger Recover undeniably expands the attack surface

In my opinion, the FAQ published by Ledger not only failed to answer many crucial questions, it, in fact, exacerbates my concerns.

The FAQ describes that the private key is encrypted and subsequently divided into three fragments. This, however, leads to several questions: if the key is encrypted prior to its division, whose encryption key is used? Are these fragments encrypted within the Secure Element before distribution to individual operators, thereby averting interception at the software level?

If the key that wraps the users' key materials is under the control of a singular entity and if that entity can access the fragments (perhaps during initial setup), the “layers of protection” in their recovery service become moot.

Further, there's another aspect that needs clarification: are the encryption public keys embedded in the firmware, or are they obtained from software? If it's the latter, there exists a potential threat where an attacker could substitute the encryption key with a different one, enabling the interception of the key in transit, and consequently, access to the private key material.

Even without these potential vulnerabilities, the Ledger Recover service still breaks a crucial assurance many users rely on: that there is no possible way to extract or clone a secret key from a hardware wallet. Many wallet management procedures employed by large enterprises hinge on this assumption and the physical security of the hardware itself. An attacker who knows the passcode could use a fake identity to sign up for the recovery service and clone the private key to a new Ledger device. The new recovery service, at the very least, weakens - if not entirely disrupts - this assumption.

Human organizational threats

The Ledger Recover service relies on government-issued ID for verification. This implies that at least part of the recovery process involves human judgment. Whenever humans are involved, the organizational design always becomes a crucial point of discussion.

Firstly, how do Coincover and Ledger verify your identity? Is the verification process performed independently by both? Or does one party conduct the verification and the other merely a rubber stamp?

From their FAQ, a third party who retains one of the three shares of the key is termed an "independent backup service provider". This title suggests that this provider only offers a "backup service”. It is reasonable to expect that this provider would not be involved in the verification process. If this is the case, who has the authority to instruct the backup service to return a fragment?

These questions essentially revolve around the degree of independence of the three supposedly separate parties. If at least one of them is not practically independent, the entire 2-of-3 threshold secret sharing scheme may offer no protection to the majority party.

Furthermore, where are Coincover and the "independent backup service provider" based? If they are both situated in the same country, or in friendly nations, a single court order could potentially force two of the parties to surrender their key fragment. This could potentially lead to the seizure of assets, which represents a serious threat to some users’ security.

Transparency is the key to trust

In conclusion, while Ledger's new recovery service has the potential to significantly benefit users, there are pressing concerns regarding its implementation and organizational structure. The increased attack surface, questionable independence of parties involved in key recovery, and the potential impact of governmental intervention raise legitimate doubts about the security of the system. Ledger needs to address these issues transparently and communicate their solutions effectively to the technical community to ensure user confidence and maintain the high security standards users have come to expect from hardware wallets.

When I first use the internet in 2000, people believed in a free and open internet: a place where anyone can say anything, and anyone who wants to hear it can listen. We were optimistic about an internet that would allow anyone to express their beliefs “without fear of being coerced into silence or conformity”. The free flow of information and hyper-connectedness of internet were supposed to promote mutual understanding of mankind and positive change.

However, two decades later, the egalitarian vision of free speech heaven has failed to materialized. Instead, we have widespread online harassment, misinformation that causes real harm, and violent and hateful content that no one should have to witness. Rather than enhancing mutual understanding, free speech has led to increasing political polarization.

Content moderation has often been an afterthought in today’s internet. Every major internet platforms today started with very few rules. As these platforms grow bigger and people began to do crazy, unpredictable and hateful things, rules and moderation are gradually implemented. There are still online spaces that adhere to the anything-goes mentality, such as 4chan, but they often turned ugly where majority of people choose not to participate. In some sense, content moderation helped make the internet more attractive and functional for most people. It’s already part of the internet.

Moderators are human, and as such, they bring their own perspectives, biases, and beliefs to the job. Without question, content that is blatantly illegal, such as child pornography, should be removed. However, in cases where the line between free speech and harm is less clear, content moderation becomes intricate. For some, certain political viewpoints are harmful and therefore should be censored. For others, all opinions, even controversial ones, should be allowed to circulate freely.

The real question, then, is not whether content moderation is censorship, but rather how it can be done in a way that serves us and the society. What speech should be restricted as harmful? By whom? In what way?

The Moderator’s Trilemma

The difficulties in content moderation is captured by the Moderators’ Trilemma. The trilemma goes:

• Running a platform with a large and diverse user base

• Attempting to use a centralized, top-down content moderation policies

• Avoid angering their users

The past decade of content moderation controversies suggests that these three goals can’t all be met.

Large walled gardens like Facebook, Twitter, and others are certainly unwilling to shrink their user growth and give up control over content moderation. The thesis is that dissatisfaction with moderation decisions on these centralized platforms is inevitable.

Fediverse, including Mastodon, is presented as a solution to the Moderator’s Trilemma. Here is the idea: de-siloing social media, giving up on centralized moderation, devolves content moderation decisions to the individual instances that make up the overall network. Under this model, if users are dissatisfied with a instance’s policy, they can freely switch instances and migrate their account data, including their followers and post history. Unlike the traditional platforms that rely on high switching costs to keep users locked within their walled garden, Fediverse gives it users the freedom of exit. And this freedom in turn enhances users’ power to influencing instances’ policy. This concept is also referred to as content-moderation subsidiarity.

The growing pains of content moderation in Mastodon

The idea of devolving content moderation is seemingly compelling, but its implementation in Fediverse, especially Mastodon, is far from ideal.

Fediverse instances are typically run by volunteers, leading to a lack of dedicated resources for determining and enforcing uniform content moderation standards. As a result, moderation decisions within the Fediverse can be arbitrary and ad-hoc, a problem that is amplified as instances grow in size.

An illustrative example is the controversy at journa.host. Journa.host is a Mastodon instance founded by Adam Davidson, a journalist who worked at The New York Times and The New Yorker. Users are required to prove that they are professional journalists to join the instance. Mike Pesca was a member of the instance, who hosts the popular news podcast “The Gist.” He posted a link to a New York Times story about health concerns associated with the puberty-blocking drugs sometimes prescribed to transgender youths, wrote, “This seemed like careful, thorough reporting.” Parker Molloy, another journa.host user and herself a transgender woman, responded strongly and calling Pesca anti-trans bigotry. Pesca defended his original post and criticized Molloy's actions, wrote, "you as a member of the activist community attack the article of bad bedfellows, insult me and mischaracterize the story as Republicans Versus Doctors.” 

Journa.host suspended Pesca for referring to Molloy as an “activist,” which was dismissive. The site also suspended Molloy for "attacking the integrity of another, who is a moderator on the server.” Despite that, journa.host’s decisions has been criticized from all sides. Some believe that journa.host should not have suspended Pesca for his comparatively restrained response to Molloy's attack. Others criticized journa.host for suspending Molloy and for not doing more to fight transphobia.

Journa.host gained a reputation for transphobia to the extent that several large instances have either restricted or banned access for their users to journa.host, a practice in Fediverse called defederation.

The controversy exhibits a dominant culture of Mastodon is supportive of heavy moderation, especially of users and content that is viewed as conservative.

If users were given the freedom to exit, overzealously censorious instances should not be a problem. Empowering user choice of moderation policy is the premise of content-moderation subsidiarity after all. In reality, however, moving an account in Mastodon is not as easy as some proponents suggested. User handles in Fediverse are like email addresses (such as @kcchu@mastodon.social). The hostname of the server is part of the handle, which means that migrating to another Mastodon instance requires changing the user handle and renders links to old profile and posts obsolete. While Mastodon allows users to setup redirection from their old profile to new profile, relocating data of old posts is not currently possible. Also, redirection may not be an option if the old instance no longer exists (such as the owner shutting it down) or the old account is suspended. This can result in users having to start over, losing their previous content and followers.

Defederation results in balkanization

The practice of defederation in the Fediverse is also problematic. Any Mastodon server admins can decide to cut ties with another instance entirely, rendering posts from the blocked instance unavailable for its users and preventing users of the blocked instance from commenting, replying or direct messaging their users.

Defederation is common among Mastodon instances. While the idea of content-moderation subsidiarity advocates for individual instances to make their own content moderation decisions, in practice, it is not feasible for volunteering moderators of an instance to oversee content on all federated instances. It follows that when another connected instance has lenient content moderation standards, many admins choose to defederate the entire instance. It treats all users of the defederated instances as violators, even if only a few users are causing controversy, like what occurred with journa.host. Even largest Mastodon instances are not immune to this. mastodon.social, run by Mastodon’s creator Eugen Rochko, is also facing defederation by many smaller instances.

Defederation as a last-ditch nuclear option to block instances because of spam or abuse is fine. But when the blocklist becomes a protest to other instances’ moderation policy or capacity, endless infighting is warranted. Instances are tempted to change the blocklist into an allow-list system because it is easier to manage. This situation turned Mastodon into balkanized networks of polarizing echo chambers, forcing instance admins to either adopt the strictest content moderation policy or risk being isolated from most of the Mastodon users. The outcome is a spiral of censorship, silencing even slight deviations from the dominating opinion. It makes it impossible to honestly discuss controversial topics from different perspectives without causing a controversy.

While some may prefer to interact only with like-minded people, others are discouraged by this culture. Due to the significant power that instance admins hold over their users, selecting which instance to join can be a major hurdle for first-time users. These problems diminish the platform's potential as a social internet that replaces Twitter.

Freedom to speech, and freedom to filter

Some may say that silencing misinformation, racist, sexist, homophobic, and transphobic speech in the network is a feature, not a bug. They argue that these bad speech has no social value and seriously harmful to the people who are its targets as well as to society at large, and thus should be removed from the entire network (or even society as a whole).

While this essay is not intended to be a philosophical discussion on freedom of speech, I invite readers to read the classic argument from Chapter 2 of John Stuart Mill’s essay On Liberty. Mill argued that when we engage others in defending our opinions it deepens our understanding of our beliefs and prevents them from slipping into dogmas. (Further reading: Jason Stanley's criticism of Mill, and the critic's critics)

We are dealing here with bad speech, not incitement of immediate violence, which is already prohibited under law. The limitation of freedom of speech to prevent direct and immediate harm to others, such as the spread of false claims about COVID-19 vaccines during a global emergency of pandemic, can well be justified under Mill's principle of harm. However, such restrictions should be exceptional and must be necessary and proportionate to achieve legitimate objectives.

More importantly, “free speech is not the same as free reach,” as Reneé DiResta suggested. (No, it is not originated from Elon Musk.) Exercising the freedom of speech does not mean that everyone has to listen. 

Today’s internet is mediated by algorithms. The job of the algorithm is to surface relevant content and predict what we want to see next. Algorithms are an important tool to help us make sense of the overwhelming amount of information online. It also shapes our attention by controlling our news feeds and recommendations. Unlike free speech, there is no right to algorithmic amplification.

Perhaps we cannot prevent jerks from using the social internet, but we surely can build a system where we don’t have to hear them.

But then the question is who can and should have the power to select what a user hears. There are rightly concerns about bias in these algorithms and their lack of transparency. And I argue that the key to this problem is user choice, or the “freedom to filter.”

The social internet should empower users to choose which method or algorithms for filtering. Users could delegate control of their feed to one or a mix of recommendation services run by communities, commercial providers, or other institutions. We should establish a marketplace of algorithm that offers diversity, transparency and accountability.

A step forward

The foundation of a true open social internet rely on several key technological capabilities:

• Account portability: Maintains stable identifiers for users, regardless of the service provider

• Authenticated and content-addressable storage: Enables the seamless migration of user data to a new location

• Algorithmic control: User choice over what to hear, assisted by technology

Two projects are currently in the race of this category: AT Protocol (Bluesky) and Farcaster. A comparison of these two protocol could be found here.

One notable feature of AT Protocol is its integration the idea of “Freedom of speech, but not freedom of reach” within its protocol architecture. The network is separated into the “speech" and "reach" layers. The "speech" layer is intended to remain neutral, distributing authority and ensuring everyone has a voice, while the "reach" layer is built for flexibility and scalability. The base layer of AT Protocol, consisting of Personal Data Repositories and Federated Networking, creates a common space for speech where everyone is free to participate, similar to the Web where anyone can put up a website. Indexing services then aggregate content from the network, allowing for reach and searchability, similar to a search engine.

On top of the separation of layers, AT Protocol, particularly the Bluesky client, plans to support an ecosystem of third-party providers for recommendation algorithm and content moderation. They are developing a composable labeling system, enabling anyone to define and apply "labels" to content or accounts (such as "spam" or "nsfw"). Any service or person in the network can then choose how these labels are used to determine the final user experience.

The issue of free speech versus safety is a false dichotomy. Both are essential components of a healthy and inclusive social internet. While it is crucial to ensure a safe online environment, it must not come at the expense of limiting free expression. By devolving content moderation decisions to individual instances and providing users with the freedom to choose, we can achieve a balance between free speech and safety. At its core, respecting the right of user choice is an essential step toward building a social internet that works for everyone in this world. 

Account portability

Identity is a crucial element of social networks. Both protocols aim to provide account portability, enabling users to migrate their identities to a new service provider without existing server’s cooperation, unlike Fediverse (e.g. Mastodon). This is accomplished by creating user handles that resolve into public keys for message signing, enabling authentication of user data, regardless of server location.

Both protocols employ a 2-tier identifier design, consisting of a permanent stable identifier that is not easily readable (FID in Farcaster and DID in Bluesky), as well as a readable and changeable user handle (FNAME and DNS name, respectively).

ATP’s design incorporates generic standards such as Decentralized Identifiers (DID) and DNS, promoting extensibility and interoperability. However, the current implementation uses a unique DID method, DID Placeholder (PLC), as they aren’t satisfied with existing DID methods. The PLC method relies on a centralized "PLC server" to store the signed DID document (comparable to the FID smart contract of FC), and is named "Placeholder" because it is intended to be replaced by a decentralized alternative in the future.

In ATP, user handles are DNS names that resolves into DIDs. Contrary to popular belief, DNS is a viable option for decentralized identities if one accepts the ICANN’s multistakeholder governance model as sufficiently neutral. However, the primary issue with DNS lies in its user experience.

DNS registries are legacy systems that lacks a unified API, making it difficult to fully automate registration and management without introducing additional middlemen such as Cloudflare. As a result, most users opt for free subdomain names provided by service providers (e.g. *.bsky.social) instead of registering a new domain name, as setting up DNS is often too complex. However, this approach may undermine the goal of account portability.

FC has developed a specialized identity system using Ethereum smart contracts, offering several benefits. Interactions with smart contracts can be abstracted away from users, and FID, a simple number, is marginally usable on its own. Furthermore, FNAME registration fee can directly fund protocol development, unlike DNS registration fees which do not benefit ATP. Finally, FNAME are usually shorter than DNS names because it is free from the problem of domain squatting. However, FC needs to establish its own governance structure for true decentralization, as it lacks a neutral entity like ICANN that govern DNS.

Censorship resistance

Censorship and moderation may seem like opposite sides of the same coin. Censorship is often frowned upon, but moderation is necessary for healthy conversations. Without moderation, spam and unwanted messages can overwhelm the platform, making it unusable. Therefore, a balance must be struck between allowing free speech and maintaining a productive and engaging platform. Both protocols aim to offer some level of censorship resistance, but their network architectures differ significantly.

ATP distinguishes between "small-world" and "big-world”. The small-world network encompasses inter-personal activity and is owned by users, while the big-world network aggregates activities in the larger network and provides useful functions such as content discovery (algorithms) and user search.

In ATP, Personal Data Servers (PDS) are responsible for the small-world, and apps use indexing services to access the big-world network. PDS is user-owned, giving users the freedom to change service providers or even host the PDS server themselves. PDSs synchronize data with other PDSs using a HTTP-based protocol according to follow graphs, similar to the federation model in Fediverse and Mastodon. However, ATP's guarantee of account portability sets it apart as a better model. In contrast, big-world is expected to be provided by larger service providers and may be subject to censorship or moderation.

In FC, the Hub is conceptually a combination of the small-world and big-world, with Hubs being responsible for storing and disseminating every user's data. The Hub disseminates messages using a gossip-based peer-to-peer protocol. The P2P design ensures messages to be propagated through the network even if some Hubs may try to censor them. 

Scalability and data permanence

Both ATP and FC use Merkle trees for synchronization, but they differ in how the trees are implemented, resulting in unique tradeoffs for each protocol.

ATP uses a Merkle Search Tree where each user has an individual tree and signs the tree's root. This design allows for easier moderation and spam filtering as PDS and indexers can choose to ignore certain users when syncing. Additionally, the self-balancing nature of the MST provides some efficiency benefits over FC's approach. 

In ATP, users specify a single PDS as their primary data store. Since the PDS only needs to store the data of specific users, it is reasonable to assume that it can permanently store the entire history of the user. However, since PDS and client apps are considered as two separate tiers, users need to choose a reliable PDS hosting service, which can be a hurdle for some users.

FC uses a Merkle Patricia Trie that represents the world's state, and users sign their own messages. This approach makes it efficient to sync the world's state, but it may also lead to spam issues as there is no apparent way for Hubs to selectively ignore some users. Users are not required to have a specific "Home Hub," and the Hubs are expected to be integrated into the apps that users use. However, to manage each Hub's storage and bandwidth usage, there are restrictions on the size and number of messages each user can store in the network.

Conclusion

At this moment, there is no clear winner between ATP and FC as both have their own strengths and weaknesses. Farcaster's best feature is its decentralized identity system with a clear path for sustainability, while ATP's identity system is less developed, due in part to its tendency to avoid blockchain technology, especially Ethereum. However, FC's current architecture is constrained by scalability issues and lacks an in-protocol method to store user data permanently. Nevertheless, the emergence of new social networks is a positive development, as competition can promote the exchange of innovative ideas between protocols, benefiting both.