[sowbug]

You're not listening. This is the case that otoburb is describing:

1. Install bad browser extension.

2. Visit coinbase.com.

3. Copy deposit address.

4. Paste into Ledger software.

5. Initiate transfer of funds to Coinbase.

6. Scrutinize transaction details.

7. Approve.

Your funds are now gone, and you'll never see them again.

All cryptography worked as designed in this case. "That's how cryptographic signatures work, in general."

Substitute scenarios with receive addresses triple-notarized with medallion guarantees imprinted in blood if you wish for steps 1-3. It doesn't matter. The deputy is confused.

[YjSe2GMQ]

I'll reply here to the three comments: I admit that you're right guys. I have to concede my point about backdoors. If you modify user's view of Coinbase DOM then no security in the Ledger/Trezor is going to help with that.

But also it's independent of the discussion around whether NFC or Bluetooth is a better choice for host <-> device comms.

PS. I love the term "violent agreement".