If your wallet of choice isn’t @ambire and it runs Ledger’s latest signing kit, chances are every signature you make gets reported back to Ledger. I noticed it early while bumping Ledger packages to debug an issue! No affected version ever reached Аmbire production, and we’re shipping it disabled by default, with an opt-in toggle in the privacy settings 🛡️ However, the devil was that it was sneakily enabled by default in the Ledger SDK since their ledgerhq/context-module v1.16... So right after the lib update - every transaction you sign with a Ledger device started sending to the network, the contract or recipient address, device model and firmware, app versions and whether you signed blind. I'd argue that privacy should be the default, @Ledger 💪 Happy to see more and more people becoming aware of the privacy implications and picking Ambire for our ongoing privacy focus. Catching things like this 👀 is part of the job for us!

After speaking at @EthCC[9] about EIP-7702 and hardware wallets, my next stop is @ethbelgrade 🇷🇸 - this time, to talk about browser extension security. I’ll share some of the work we’ve done at @ambire with the @goodmorningdevs crew to stay a little safer while relying on third-party packages. Prevention is better than cure. Come say hi, grab a pljeskavica, and let’s talk tech 🤝