Comment by lightedman
17 days ago
Ledger provides a 'Genuine Check' mechanism to determine the authenticity of the device; however, it explicitly warns that it cannot detect added implants when the device's original Secure Element remains intact.
And as this workaround leaves the original Secure Element intact, good luck detecting the supply chain attack.
I think that’s where the epoxy from earlier in this comment chain is supposed to come in.
Epoxy is useless, we have materials to dissolve cured epoxies for rework in aerospace.
Man can make it, man can break it.
But it's specifically a potting epoxy designed to cause damage to the electronics if removed. And any destruction of the epoxy has to not significantly affect the outward appearance of the device. At worst it's defense-in-depth.