How-to: Ledger Hardware Wallet in Kicksecure ™
Ledger wallets are a special type of commercial bitcoin wallet whereby a user's private keys are stored in a secure hardware device. Other commercial alternatives include Pi Wallet, TREZOR, BWALLET, KeepKey, Opendime, CoolWallet and others.
The major advantages of hardware wallets over software wallets include: 
- Usually private keys are stored in a protected area of a microcontroller, and cannot be transferred out of the device in plaintext.
- Resistance to computer viruses that target theft from software wallets.
- More secure and interactive than paper wallets that require importation to software.
- Usually software on the device is open source.
The main principle is that cryptographic secrets (private keys) are fully isolated from easy-to-hack computers or smartphones. Ledger wallets use secure chips that are similar to the technology used in chip and PIN payment cards or SIM cards. 
Learn from Ledger and/or other authoritative sources:
- What is a seed phrase?
- Ledger Phishing Scam Targets Crypto Hardware Wallet Users
Potential risks of hardware wallets include: 
- Compromised production process: Hardware backdoors could be introduced via intentional or unintentional actions that leaves security holes in the final product.
- Device interdiction: No hardware wallet solution can deal with the threat of government programs that intercept hardware and modify them in transit to introduce backdoors.
- Imperfect implementation: If bugs are present in the software, firmware or hardware, then attackers may be able to gain unauthorized access to the hardware wallet.
- Insecure Random Number Generator (RNG): Security is reliant upon true randomness being generated by the source of entropy for the RNG, since it generates the wallet's private keys. This is hard to verify, and attackers may be able to recreate wallet keys if the RNG is insecure. 
- Malware swapping recipient Bitcoin addresses: Malware on a PC could potentially trick the user into sending Bitcoin to the wrong address. Multi-factor confirmation of a recipient's Bitcoin address mitigates this risk.
Despite these risks, hardware wallets are considered a higher security solution than software wallets, since the latter must make private keys available in plain text in the computer's memory when transactions are signed -- any compromise by Bitcoin-targeting malware would enable theft of Bitcoins. 
Seed Backup Security
It is definitely safer to have at least two Ledger hardware wallets. During initial setup the Ledger does not verify all words of the seed; it only verifies two words of the 24-word seed. This means if one word is mistyped, it will be difficult later on to regain access to personal coins. On the other hand, two Ledgers using the same seed should generate the same addresses, which proves the seed was correctly backed up.
Seed testing applications are available like BOLOS Seed Utility App.   It is probably safer to avoid these tools since they are maintained by a third party and this adds complexity to the procedure.
Another alternative is to:
- note some generated addresses
- reset the Ledger
- re-setup with the seed and see if it still uses the same addresses
Wallet Testing Security
Before storing any significant funds in a wallet, it is recommended to first test sending a small amount there and then trying to send it back. The reason is software bugs could potentially lead to the presentation of an address where the user does not own the corresponding private key.
Virtualizer Specific Settings
Kicksecure ™ VirtualBox users only:
Add the Ledger hardware wallet to the virtual machine (VM).
- Power off the VM.
Enable USB Controller→ press
- Power on the VM.
- Repeat the above after you open an app on Ledger device, ie: Bitcoin, Ethereum, Litecoin etc. It turns out that Ledger device has distinct hardware ID for each app you open on the hardware wallet.
VirtualBox Oracle VM VirtualBox Extension Pack not required.
Kicksecure ™ KVM users only:
Add the Ledger hardware wallet to the virtual machine (VM).
Kicksecure ™ for Qubes users note:
For better usability, it is discouraged to start with a Ledger hardware wallet. First learn how to pass any other, "simpler"; USB device to an AppVM and attempt that procedure in order to iron out any eventual Qubes USBVM issues. Any eventual Qubes USBVM issues are Qubes support issues. Not Kicksecure ™ support issues.
This step is optional and only necessary if you intend to use Electrum.
Ledger Live Application Installation
Make the Ledger Live AppImage executable.
Ledger Live Start Menu Entry
1. Create folder
2. Open file
~/.local/share/applications/ledger.desktop in a text editor of your choice as a regular, non-root user.
3. Paste the following contents.
5. Kicksecure ™ for Qubes only: perform platform-specific steps.
- Refresh Qubes
- Add desktop shortcut.
- Physically connect the Ledger hardware wallet to a USB port.
- Enter the PIN on the Ledger.
- Start the
Start Ledger Live.
For further actions, refer to upstream Ledger usage instructions.
Same basic steps as for Ledger Live but then start Electrum, not Ledger Live.
Do not attempt to run Electrum and Ledger Live at the same time. This is a Ledger limitation, unrelated to Kicksecure ™.
An Electrum wallet will only show legacy bitcoin addresses and their balances or segwit wallet bitcoin addresses and their balances, not both. It is possible to have multiple Electrum wallets and switch between them.
Electrum will ask for
- The default is
m/44'/0'/0'for legacy bitcoin addresses.
- You should use
m/49'/0'/0'for segwit bitcoin addresses.
The USB device might be passed to the
Ledger VM, but Ledger applications may not recognize the Ledger hardware wallet. If that occurs, try the following in BIOS settings:
Legacy USB Support
XHCI Pre-Boot Mode
- attempt flipping other USB-related BIOS options
It is unnecessary to reinstall Qubes.
To troubleshoot Ledger problems, try the following:
- Use the
Manangertab in Ledger Live first.
- Qubers users note: Update the firmware of the Ledger hardware wallet by connecting it to a non-Qubes Linux computer (where connections are possible using Ledger Live).
Try with Debian First
Issues which are not caused by Kicksecure ™:
- Using Ledger on (Debian) Linux can be challenging.
- Using USB devices with VirtualBox can be challenging.
- Using Ledger with a virtualizer such as VirtualBox can be challenging.
Therefore, as per Free Support Principle:
- Learn how to use Ledger on a Debian host.
- Learn how to use USB devices with your choice of virtualizer.
- Learn how to use Ledger with Debian inside VirtualBox.
Only after completing these steps, try to use Ledger in a Kicksecure ™ VM.
The Qubes R4 USB widget formerly had bugs such as showing the USB device was connected to a VM while
qvm-usb -- the command line authority whose judgment should be trusted more -- disagreed or showed the same USB device more than once in the menu. 
If similar issues re-emerge, follow these steps.
See also: Dev/Ledger Hardware Wallet.
- general: https://forums.whonix.org/t/ledger-nano-s-support/8521/2
- KVM-specific: https://forums.whonix.org/t/ledger-nano-s-no-device-found/10934
After setting up a hardware wallet, please consider making a donation to Kicksecure ™ to keep it running for many years to come.
- The attacker generates psuedo-randomness that is indistinguishable from true randomness, but is still predictable.
This repository contains an application for the Ledger Nano S that allows the user to verify the backup of their BIP 39 mnemonic by comparing it to the master seed stored on the device.
- Web citation.
- This is probably because Ledger does not announce itself before that.
- See: Problem with adding USB device to a VM.
- Broken link: https://ledger.groovehq.com/knowledge_base/topics/how-to-setup-electrum-nano-slash-nano-s
This is probably outdated:
python3 -m pip install btchip-python
- Was not required.
ln -s /lib/x86_64-linux-gnu/libudev.so.1 /lib/x86_64-linux-gnu/libudev.so
btchip-python?). Unfortunately it is not available from Debian's repository. Therefore we have to install it using python-pip.
- Was not required.
- Further research is required to confirm if this step is still necessary. The issue appears to have been fixed, see: Ledger Nano S not detected on Linux.
- USB devices shown multiple times in devices popup menu #3266