@SCBuergel: Ledger multisig sends user data to Datadog without consent

Submit
@SCBuergel
@SCBuergel

I misunderstood the @Ledger multisig announcement the other day. I understood they've decided to charge like a Swiss private bank, but I've only just realized the extent to which they're not actually private at all... I was also dismayed to see that this is still NOT a Ledger app which actually allows normal people securely sign txs, which was the entire issue in the first place. I refuse to call it "clearsigning". There's just "signing" and "yolo signing", and the ability to not yolo sign is not a premium feature - it's basically functionality without which your product is reckless and irresponsible But back to the privacy: obviously I opted out of analytics, so imagine my surprise at all the tracker calls which @brave helpfully blocked for me So what's Ledger trying to share here with the friendly data harvesting technologists at @datadoghq ? * My personal Safe addresses * My personal browser metadata * My personal device metadata (screen resolution) * My every move that I take on the app What is this for? Ledger's own privacy policy states that sharing this kind of data requires consent, yet this is happening anyway to a company (Datadog, Inc.) not even mentioned in the privacy policy! And yes, I fully expect this project will be dead on arrival because of insane pricing. But I'm more concerned that once again a major crypto player like Ledger (and EU based to boot!) doesn't care about basic privacy protection or following the most basic privacy regulations @Ledger please do better than this, a privacy policy is not just a formality if you are a security company!

Tweet image
xcancel.com

@SCBuergel: Ledger multisig sends user data to Datadog without consent

AI summary of the linked article

Crypto researcher SCBuergel says the Ledger multisig app sends user data, including Safe addresses, browser metadata, screen resolution and in-app actions, to the analytics firm Datadog, even though he opted out of analytics. He notes that Ledger's privacy policy requires consent for sharing this kind of data and does not mention Datadog, Inc. He also argues that the app still does not let users sign transactions securely, calling the lack of a non-"yolo" signing option reckless, and asks Ledger to do better on privacy.

Recommended by 1 curator
No comments yetWhat caught your eye? Start the discussion.