Skip to content

SlowMist Cosine: Ledger Clear Signing by default collects signature-related information such as chain ID and destination address.

Nov 11, 09:12

November 11 - SlowMist founder Yu Xian posted that Ledger's Clear Signing mechanism collects user signing-related information by default, including network or chain ID, target address (contract or recipient), device model, firmware version, app version, and whether blind signing is used and the reasons for it.

Yu Xian stated that this data collection mechanism is located in Ledger SDK's `context-module` version 1.16 and above, rather than within the Ledger device firmware. The relevant toggle needs to be provided by wallet applications that support connecting to Ledger.

Source