Skip to content
This repository has been archived by the owner on Jun 27, 2022. It is now read-only.

Chromium 72+ has broken Ledger U2F support #306

Closed
gre opened this issue Feb 27, 2019 · 77 comments
Closed

Chromium 72+ has broken Ledger U2F support #306

gre opened this issue Feb 27, 2019 · 77 comments

Comments

@gre
Copy link
Contributor

gre commented Feb 27, 2019

Any users that comes on a web app using @ledgerhq/hw-transport-u2f on Chromium 72+ will fall into a bug that breaks Ledger device communication. (U2F TIMEOUT error).

What happened?

Chrome 72+ has started being rolled out around February 21th, 2019. This new version has changes in the U2F protocol implementation that is breaking Ledger's.

What solutions

In the short term, Users can be advised to switch to Opera or Brave but it's probable that these browsers will upgrade Chromium as well.

In the mid term, we are working on a fix for U2F. It will only be a fix on the Ledger device side, meaning users will have to upgrade (the apps). If you are a developer of one of these applications, you can take a look at this for reference, for further questions please get in touch with @btchip or discuss on our Slack Devs.

In the long term, switching to WebUSB is probably going to be the good plan. At the moment, this API is still a draft spec but we anticipate it will be more widely supported in the future. It is much more relevant for Ledger devices (more performant, more features like being able to detect disconnection,..)

Regarding @ledgerhq/hw-transport-webusb current implementation, it works on latest firmware / apps but there are some slight different in the way it works (coming from u2f) which have some UI/UX implication. We'll try to document it better in the next weeks.

@dschuermann
Copy link

Hi @gre,
do you know if the blocking of CCID and HID classes in Chrome (https://www.yubico.com/support/security-advisories/ysa-2018-02/) affects your plans to use WebUSB?

@gre
Copy link
Contributor Author

gre commented Mar 1, 2019

it shouldn't be a problem.

@gre gre pinned this issue Mar 1, 2019
@Luganova
Copy link

Luganova commented Mar 1, 2019

Hi!I know how to get around this error when signing transactions!

@Luganova
Copy link

Luganova commented Mar 1, 2019

everything works fine for binance DEX!

@BrendanEich
Copy link

https://bugs.chromium.org/p/chromium/issues/detail?id=935131

@Luganova
Copy link

Luganova commented Mar 1, 2019

We are talking about windows or Linux?

@gre
Copy link
Contributor Author

gre commented Mar 1, 2019

@Luganova from what we have seen it affects all platform.

@Luganova
Copy link

Luganova commented Mar 1, 2019

I agree! It is necessary to confirm the transaction in a split second! I did not have time-time out!

@gre
Copy link
Contributor Author

gre commented Mar 2, 2019

It appears that a Chrome update may have solved the problem. Waiting for more confirmations.

@harshjv
Copy link
Contributor

harshjv commented Mar 5, 2019

Working on latest chromium's latest revision 637660. https://download-chromium.appspot.com/

@monokh
Copy link
Contributor

monokh commented Mar 5, 2019

On chrome 72, this also causes the error Invalid data received (0x6a80) when using btc.signMessageNew with certain sizes of message.

@brunobar79
Copy link

Still seeing this in the latest version of chrome - 73.0.3683.86 (Official Build) (64-bit)
Also tried it with the latest firmware + ledger lib and the timeout issue after ~3 seconds is still happening.

@giankotarola
Copy link

On chrome 72, this also causes the error Invalid data received (0x6a80) when using btc.signMessageNew with certain sizes of message.

I get the same error with eth.signTransaction with chrome - 73.0.3683.86

@kjarada
Copy link

kjarada commented Apr 24, 2019

I'm having the same issue, despite the fact that ledger support advised using brave and opera browser but it's still not working in all these platforms with same error U2F Timeout.

@JeanoLee
Copy link

1.1.8

@ianaz
Copy link

ianaz commented Apr 25, 2019

that ledger support advised using brave and opera browser but it's still not working in all these platforms with same error U2F Timeout.

Same here. It used to work with Brave a couple of weeks back but not it's broken there too

@dzsobacsi
Copy link

Here too. For me it used to work with Opera some weeks ago but now that does not work either.

@georgeliuyu
Copy link

It still timeout when I use the brave

@iicc1
Copy link

iicc1 commented Apr 27, 2019

Not working for me too, I have tried Opera, Brave, last Chromium...
How can I send tokens?

@poserr
Copy link

poserr commented Apr 27, 2019

@iicc1 for us the workaround was to quickly (during 1 second) confirm twice

@iicc1
Copy link

iicc1 commented Apr 27, 2019

Thanks for you reply @poserr, I didn't see it. I was finally able to do with an old Brave release that I downloaded here: https://github.com/brave/browser-laptop/releases

@dzsobacsi
Copy link

@iicc1 which one did you download from those?

@iicc1
Copy link

iicc1 commented Apr 27, 2019

@dzsobacsi v0.25.300

@CiviStation
Copy link

Version 73.0.3683.103 (Official Build) (64-bit) U2F timeout still exists

@jakestpeter
Copy link

v.0.25.300 didn't work for me ...

@claytucker
Copy link

claytucker commented Jun 18, 2019

I have this error.
Ledger Nano S
Firmware: 1.5.5
Ethereum App 1.2.7
dYdX Exchange accessed via MetaMask connected to Ledger Nano S
Tried using Chrome, Opera, and Brave
Tried using Windows 10 Home and Windows 7 Enterprise (up-to-date security patches). All six of these options create the same error. All my funds are essentially trapped on the dYdX Exchange/in the smart contract.

Update: Was able to work around. Copied the MetaMask data and sent the identical transaction via MEW in the advanced data field instead and it worked.

@dogperrokukur
Copy link

Thanks for all the suggestions. I seem to have solved the problem independently, well at least temporarily. But I’m still of the opinion this is a big issue for the community. Like the above poster, I also lost access to my tokens. More importantly I was unable to conclude several time sensitive trades on a DEX because of this “known issue”. I’m just amazed that this isn’t a bigger deal across the web. I’m also amazed that this has not been solved yet. Its been months now. I’m sorry but the first post on this thread was in Feb. Anyway enough, I’m sorry about the rant. Here is what I did.

First I uninstalled the latest version ofChrome and reverted back to an older version. I installed a version that was released just before Feb 2019, when the known issue occurred. I used Version 71.0.3578.80 (Official Build) (64-bit)
You’ll have to stop chrome from auto updating, (which it likes to do all the time). Just do a quick search on the web to see how to do that.
In my particular case I was using metamask to complete my transactions.
Initially I installed the latest version of Metamask, but that also seems to cause similar issues. So I decided to use MetaMask 5.2.1. This version was released around the same time as the Chrome version I have reverted to using.
You can also easily find this on the web. When installing the metamask extension, use developer mode within the extension settings.
Then click on "load unpacked" and install the custom extension. Not sure how to stop auto updates on metamask however. You might have to reinstall over time.
Again I am not sure how long this will work for, and if it will work for everyone. But it does prove that reverting to older web browsers does seem to be the way to go for now.

@shawnholt
Copy link

Tried everything. old version of opera will only allow install of ver Version 3.14.1 of metamask which does not support Ledger! There is NO WAY to access ERC 20 Tokens on Ledger. This is crazy!

@shawnholt
Copy link

Error message: image

@Creamers158
Copy link

I used Chrome Beta and that one works for me ;)

@dmdque
Copy link

dmdque commented Jul 17, 2019

Worked with:

Metamask: 6.7.2
Chrome: 75.0.3770.100
Ledger Nano S: Secure Element: 1.55, MCU: 1.7

@TeslaNguyen
Copy link

Still getting "Failed to sign with Ledger device: U2F TIMEOUT" on Manjaro/Brave. What can I do? It's been weeks. :/

@nyetwurk
Copy link

nyetwurk commented Aug 9, 2019

Also hangs the Ledger dead.

@TeslaNguyen
Copy link

Still getting "Failed to sign with Ledger device: U2F TIMEOUT" on Manjaro/Brave. What can I do? It's been weeks. :/

Alright, I could actually get around the aforementioned issue by following this link (granted, I probably should've look there earlier): https://support.ledger.com/hc/en-us/articles/115005165269-Fix-connection-issues

I was missing this part:

"wget -q -O - https://raw.githubusercontent.com/LedgerHQ/udev-rules/master/add_udev_rules.sh | sudo bash"

However, now I keep getting "Failed: need signature."

It's really not funny anymore.

@nyetwurk
Copy link

nyetwurk commented Aug 9, 2019

It is hilarious that they recommend searching for a driver for windows 10 that doesn't exist.

@nyetwurk
Copy link

@AdvocateOne, thank you for the information you provided.

We suspect this is related to USB driver on Windows 7. Can you try updating them ?

https://support.ledger.com/hc/en-us/articles/115005165269-Fix-connection-issues

Thanks a lot.

This simply doesn't work. There are no windows drivers that I can find. Please provide a direct download link for your drivers.

@nyetwurk
Copy link

nyetwurk commented Aug 18, 2019

For all users experiencing this issue - try to update Firmware on your device to the latest version (1.5.5) and update your Ethereum app as well (1.2.4)

This does not work. On every browser (Chrome, FF, Brave, Opera) MM times out too soon with the latest firmware (1.5.5) and Ethereum app. The topic of this bug should be changed to reflect this is a general problem with Ledger support and MetaMask. It should also include the fact that MM U2F hangs the ledger stone dead when attempting to sign an ERC20 transaction (or any transaction with contract data).

The lack of progress on this bug is dismaying in the extreme; it makes the Ledger almost completely useless when browsing web3/u2f pages.

@nyetwurk
Copy link

Will LedgerHQ/nanos-secure-sdk#21 fix this bug?

@nyetwurk
Copy link

@seanatwork
Copy link

I sent some erc-20 tokens to my ledger prior to discovering this issue (trying to be safer!). Obviously I can't move them now in metamask . Am I SOL until this is resolved or a new ledgerlive is released?

I tried @dogperrokukur 's post of rolling back chrome/mm extension from Jun19 and the page just freezes on the "connect a hardware wallet" screen of metamask. Any assistance is greatly appreciated.

@btchip
Copy link
Contributor

btchip commented Sep 1, 2019

If you're running Windows 1903 please see https://www.reddit.com/r/ledgerwallet/comments/cxf3h9/new_beta_windows_pop_up_issue/ and report in the reddit thread if this fixed your issue

@nyetwurk
Copy link

nyetwurk commented Sep 1, 2019

Why is this discussion on reddit and not here?

@btchip
Copy link
Contributor

btchip commented Sep 1, 2019

For better visibility and follow up - of course, you can also report here. We'll update the related threads once the beta is closed if the outcome is successful.

@gre
Copy link
Contributor Author

gre commented Dec 22, 2019

The situation should be back to normal (using latest firmware)

@gre gre closed this as completed Dec 22, 2019
@jafri
Copy link

jafri commented Dec 28, 2019

@gre what do we need to update for EOS?

@mitakash
Copy link

Still seeing this issue with Ledger Nano S firmware 1.6.0. Basically won't connect to Metamask. I can connect to Ledger Live 2.0.
TransportError: Failed to sign with Ledger device: U2F DEVICE_INELIGIBLE
Can someone please help? I am on Ubuntu 18.04 LTS

@youfoundron
Copy link

+1 Seeing this error as well

@liamzebedee
Copy link

Me too. 🙌 WebUSB is broken with the ledger web3-subprovider.

@gre
Copy link
Contributor Author

gre commented Apr 3, 2020

Please share a (minimal) example that reproduce the problem in a new Github issue because it's not easy to understand what exactly you are raising. this task is about U2F support issue we had a year ago and have nothing to do with WebUSB or web3-subprovider.

@LedgerHQ LedgerHQ locked as resolved and limited conversation to collaborators Apr 3, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests