Guide to hardened plausible deniability on Ledger nano S

This guide will explain how to set up a ledger nano S to be more resistant to the infamous $5 wrench attack.

Intended for the somewhat tech-savy paranoiac, this guide describe the creation of three different wallets on the ledger:

• One “checking” wallet is for everyday transaction
• One “saving” wallet used to replenish the checking wallet when empty
• Optional, an even more hidden “Safe wallet”

Background information on word seeds and passphrase

To understand how word seeds and passphrases works I recommend to experiment a little bit with this useful tool https://iancoleman.io/bip39/ (you can use it online or download it and use it offline).For example let’s generate a 24 word seed :

reason during shine steak field spell pool misery youth wrestle agent pepper moral sad hood motor sudden right toast retire year camera mercy art

The tool gives us the first BTC address of this wallet: 1BTjxaX4M2KJTVPJJReMnqdFRbkeoLQHtgNow let’s add a passphrase in the bip39 Passsphrase box, for example

medium12112018deniability

We can see that all BTC addresses changed as it gives a completely different wallet and the first BTC address is now: 1AaJWmw3kL1AgbnZgGojCwuP9SrJScPY8nThe lesson here is that by using passphrases, the same 24 words long word-seed can give access to an infinity of different wallets.

The actual tutorial part

First set up a regular wallet

There are already several tutorials on how to run the initial set up of a ledger nano S, the official ledger one for example:

Initialize your device
Initialize your Ledger Nano S device to get started. The device will generate new private keys that manage your crypto…support.ledger.com

I also recommend to test the recovery of your wallet. To do so, follow those steps:

• Take note of your first BTC deposit address with our earlier seed the default p2sh segwit address would have been: 3ApTNZ6rscb7fLoQA8RzpHGB6YEyGdyfgN (first address after clicking the BIP49 tab)
• Reset the ledger either with 3 wrong passphrases or in the settings
• Restart the ledger and restore your seed by entering your 24 words
• Reinstall the BTC app if it was removed
• Check that the first deposit address is still 3ApTNZ6rscb7fLoQA8RzpHGB6YEyGdyfgN

It is a little time consuming maybe 15 minutes the first time but having the peace of mind to know you can restore your wallet is priceless.Let’s say we set it up with the pin code 123456 (don’t do that), that would be the pin code to use when we access or reguler “checking” wallet

Set up a second hidden wallet with a passphrase

On your Ledger Nano S:“Settings” > “Security” > “Passphrase” > “Attach to a PIN”

• Enter a second and new PIN code like 456789 (it has to be different than the first one)
• Confirm this new code
• Enter and confirm a secret passphrase (100 characters max) for example “medium12112018deniability” this passphrase is case dependent and is needed as much as your 24 word to be able to restore your fund. If you forget it nobody will be able to help you. (you can think of it as an extra 25th word that you can choose)
• Enter your first main PIN code “123456” to validate

To access this hidden wallet, you have to disconnect the device and enter the second PIN. Otherwise, you will be in the “main” wallet.
You can’t set a third PIN code.

Optional a third wallet with a passphrase but not attached to a pin

Every passphrase (25th word) you can think of will give access to a valid different wallet. This means that you don’t have to stop to 2 passphrase even though the ledger only allows you to have 2 pins giving access to 2 different wallets.You can also open a wallet with a passphrase temporarily, this means this wallet will only be accessible with the ledger for this session until you unplug it.To do that :

• With the ledger, go to “Settings” > “Security” > “Passphrase” > “Set temporary”
• Enter and confirm your secret passphrase (100 characters max) for example “Hard31415deniability”
• Enter your PIN code “123456” to validate

How to access the different wallets

For the first “checking” wallet:

All you have to do is plug the ledger and enter your regular pin “123456”

For the second “saving” wallet:

All you have to do is plug the ledger and enter your second hidden pin “456789”

For the third “safe” wallet:

You have to reiterate the steps you did when you set it up meaning:

• With the ledger, go to “Settings” > “Security” > “Passphrase” > “Set temporary”
• Enter and confirm your secret passphrase (100 characters max) for example “Hard31415deniability”
• Enter your PIN code “123456” to validate

How to restore the different wallets

All that is needed to restore your wallets are:

• Your 24 word seed
• The passphrase you used for the saving wallet here “medium12112018deniability”
• If you used it, the passphrase for the safe wallet “Hard31415deniability”

All those respect the BIP39 standard which means that even if the ledger company disappear you are able to restore your wallet on most of the mainstreams BTC wallet out there.

Protect your plausible deniability

• Now that the chrome apps are discontinued be sure to delete your hidden accounts from ledger live after you are done using them, their mere presence on your computer invalidate every advantage of the plausible deniability feature. In a future ledger live update they might had a checkbox when you add an account to automatically delete it once you close the software.
• Never enter your 24 word seed on an electronic device (except hardware wallet )
• Never tell anyone how many BTC or crypto you have