0
I'm a paranoid newb, I bought a hardware wallet (Ledger nanos) and have transferred funds to it. I noticed that it generates P2SH addresses, so how could I know if the script hashed is spendable by my own wallet only?
The wallet could very well generate P2SH multisig addresses that could be spendable remotely by the wallet manufacturer.
I understand I could transfer these funds to myself and check the ScriptSig, but that would be too late.
2
Keep in mind that the ledger itself, if compromised could leak the pk in other ways. These methods I outlined will only confirm to you that a given address belongs to the set of private keys you hold, not that you're the only person holding these pks
like you said: one way you can cheaply verify that is to simply take the address and send a little bit of money to it. That does not answer if your key is compromised but it does tell you if the address belongs to your seed or not.
Another way would be to manually derivate the address from the private key using the BIP39 tool here until you reach the address that ledger gave you.
This second one doesn't require you to send any money but it is more risky as you need to trust the code in the page I sent you and you're literally inserting your pk in a form in the web, which is never a good idea.
The third thing you could do is generate Private Keys with a method you trust (i.e. using Samourai wallet or something) and then use that mnemonic in the ledger as a seed. This way you know that only you have that private key.
Thank you for the answer. I believe that with everyone's comments I learned that using a ledger comes with a bit of trusting the company that manufactured it and there are a lot of different methods I could use to manage my private keys that are more trust less. Maybe that is the path my studies will take me next. Thank you again – Pitchas – 2019-02-22T14:31:08.300
it does. Trezor, on the other hand has it's firmware open sourced. If you really want to verify it, you can (I personally never tried nor do I know how to do that exactly). Here's their github: https://github.com/trezor/trezor-core
1The question title is a bit misleading because you really want to know how to know that your ledger wallet is secured, not really about the address or why it is or is not 'spendable'. – PW Kad – 2019-02-21T22:13:06.503
This is why it is better to create your own addresses using a good source of entropy. I don't know if they release the source for the key generation, but you could check here: https://github.com/LedgerHQ
– JBaczuk – 2019-02-21T22:35:27.890