search

LedgerHQ / app-bitcoin

Legacy Bitcoin wallet application for Ledger devices
Apache License 2.0
128 stars 190 forks source link

Ledger BTC app does not work via U2F on most browsers #112

Open destrys opened 5 years ago

destrys commented 5 years ago

Observed Behavior

When interacting with the bitcoin app on a Ledger Nano S via a browser with U2F:

  1. The device and application behave correctly as long as you complete the required click actions in a very short amount of time (2-3 seconds).
  2. If you take longer than that, the device appears to behave normally, but upon finishing your interaction, the web application does not respond.
  3. Eventually, (~30 seconds) the web application receives a U2F timeout error.

We observe this behavior with Chrome and Opera, but not with Firefox.

We do not observe any issues when interacting with the Ledger Ethereum App (with hw-transport-u2f)

Because of the last two reasons, this does not appear to be an issue with the browsers, @ledgerhq/hw-app-btc, or hw-transport-u2f.

Reproducible Example

We have provided a bare-bones example app at https://codesandbox.io/s/lp0j17klj9 It is only trying to call getWalletPublicKey() at BIP32 path m/45'/0'/0'

I have also seen this behavior easily reproduced using the ledger-provided wallet-webtool at https://ledgerhq.github.io/ledger-wallet-webtool/

System

OS: Mac 10.14 Browsers: Chrome 73.0.3683.103, Opera 60.0.3255.59 Ledger Live: 1.7.0 Ledger Nano S: Firmware: 1.5.5 (MCU 1.7) Ledger Bitcoin App: 1.3.8 @ledgerhq/hw-transport-u2f: 4.54.0 @ledgerhq/hw-btc-app: 4.54.0

Workarounds

We are currently instructing customers to use Firefox as that is the only browser that currently seems to work.

Fast button-clicking is not a viable workaround since you have to complete your interaction before all the necessary information has been displayed on the ledger screen, making it impossible to verify transaction details.

Using hw-transport-webusb has been suggested, but it is still labeled ‘experimental’; our production application requires high security and we are uncomfortable running code so-labeled. Furthermore, hw-transport-webusb has limited browser support (https://caniuse.com/#feat=webusb), which negatively impacts our end-users.

Communications

@btchip has mentioned this is "typically the old buggy behavior", and that recompiling the bitcoin app may be a solution (I have not tried this). Even if this works, our users cannot do this, they can only use applications distributed through Ledger Live. If this is the fix, we’d need Ledger to do it.

destrys commented 5 years ago

We noticed that the 1552-u2f-fix-2 branch was merged into the nano secure sdk master branch (https://github.com/LedgerHQ/nanos-secure-sdk/pull/21), nice work. Does this mean we'll be seeing a new version of the the BTC app built with the updated SDK soon?

nyetwurk commented 5 years ago

Is this related to https://github.com/LedgerHQ/ledgerjs/issues/306