I recently found out that you can have a secondary wallet within your ledger nano S that is hidden and can be unlocked with a separate pin, also you can add an extra word (passphrase) to your seed which will change it to be really your own and unique seed.
Here's how:
(Warning: Option for advanced users)
The passphrase is like a 25th word on your 24 words seed, but one that you should remember and never write down. It scrambles your seed and generates a new identity: there is no right or wrong passphrase, each one will always derive a unique seed and set of accounts.
It is mainly used for two reasons:
protection of your backup seed: if someone gets physical access to your 24 words seed, it’s game over. If your accounts are behind a passphrase then you are protected since it would be computationally extremely expensive (and not feasible) to try all possible combinations.
plausible deniability: in case of a $5 wrench attack, you would give out a passphrase unlocking accounts containing spare change. Of course, this has some limits: if the attacker is very well informed he can continue to hit you with the wrench until you give the “real” password.
As entering a passphrase on your Nano S each time you plug it would be highly impractival, Ledger’s approach is to use an alternative PIN (or “duress PIN”) which would be locked to a fixed passphrase.
Note that all your apps (Bitcoin, Ethereum, FIDO…) are affected by the passphrase identity change.
Advanced Passphrase options
These settings are useful to have 1 main account and 2 or several hidden accounts from the same wallet, with the same 24-word seed. But take care, these plausible deniability features are delicate to manage, as you are the only one to know a multitude of codes. if you ever lose them, Ledger nor anyone will be able to recover them for you. Do not activate this option if you are not absolutely sure to understand it.
WHAT IS PLAUSIBLE DENIABILITY?
In Nano S, "Plausible deniability" is a security feature to face the risk of being threatened and/or forced to give your PIN code. With this option, you will manage 2 PIN codes:
First PIN code gives access to your main wallet, like a basic account with low amounts, to check daily payments.
Second PIN code, linked to a specific passphrase you need to set up, opens an hidden account, for example to save large amounts, which will be used once in a while.
With this option, in case you are forced to recover a wallet from your 24-word backup, only the main wallet will be displayed, and the second account will remain hidden, as long as you don't reveal the attached passphrase. No one can know you have 2 PIN codes attached to your wallet, so you can reveal the first PIN code giving access to your daily wallet, to avoid having your savings stolen from your second wallet.
As each PIN is using its own independent counter and PIN comparison is constantly done, it is highly unlikely for an unsuspecting sophisticated attacker to guess that a second PIN is enabled, providing that you give the first PIN to the attacker, and not possible to brute force one PIN knowing another one.
PASSPHRASE ATTACHED TO A PIN
In your Nano S, go to SETTINGS > Security > Passphrase > Attach to a PIN
With this feature, you can create, open and manage a second (and hidden) wallet attached to a specific passphrase, wallet accessible when you connect your Nano S with another PIN code. As long as your session will be open with this PIN code, you will be able to access it. When you disconnect your Nano S or when you quit the standby mode, you will be asked a PIN code, then you can choose to reopen this one or enter the main PIN code.
Open the "Settings" of the Nano S
Select "Security"
Select "Passphrase"
Select "Attach to a PIN"
Enter a second and new PIN code
Confirm this new code
Enter and confirm a secret passphrase (100 characters max)
Enter your first main PIN code to validate
Then during the rest of your session until the Nano S is disconnected, you will run an hidden wallet. Next time you will enter your PIN code, you will choose which PIN code you want to enter, main one or second one.
You can't set a third PIN code. If you ever set a new PIN code attached to a passphrase, it would erase the first one. To manage more than 1 hidden wallet you need to use the "temporary passphrase" option.
How to best use the passphrase feature
Our recommendation is to use your current PIN for your day to day accounts, holding reasonable assets, and your alternate PIN for your savings account, holding higher value assets. This way, not only will your backup seed be protected by the passphrase, but your “duress” PIN will in fact be a real account with real transactions. This would be much more effective in a plausible deniability scenario.
TEMPORARY PASSPHRASE
In your Nano S, go to SETTINGS > Security > Passphrase > Set Temporary
With this feature, you can create, open or manage an hidden wallet, accessible only in this setting path. As long as your session will be open with this passphrase, you will be able to access it. When you disconnect your Nano S or when you quit the standby mode, this passphrase will be overwritten. You can create and manage as many temporary passphrases as you want, but only one by one - you can't open 2 or more temporary passphrases in the same session.
Open the "Settings" of the Nano S
Select "Security"
Select "Passphrase"
Select "Set temporary"
Enter and confirm your secret passphrase (100 characters max)
Enter your PIN code to validate
Then during the rest of your session until the Nano S is disconnected, you will run a new wallet attached to this passphrase. Next time you will enter your PIN code, you will open your main wallet, not this hiden account.
HOW TO RECOVER YOUR HIDDEN WALLET(S) ON A NANO S
On your Nano S, just recover your 24 words and set your previous hidden passphrase as a temporary passphrase or as a hidden wallet attached to a PIN code.
if you want to attach it to a passphrase:
- on your Nano S you must run the 24 words you previously ran when you set your passphrase. If you don't, reset your device and import the correct 24 words
- go to Settings > Security > Passphrase > Attach to a PIN
- choose a second PIN code and confirm it (you don't have to choose the same one as the previous one you set with the passphrase)
- set the exact passphrase you want to recover and confirm it
- validate by entering your first PIN code
if you want to set it as temporary:
- on your Nano S you must run the 24 words you previously ran when you set your passphrase. If you don't, reset your device and import the correct 24 words
- go to Settings > Security > Passphrase > Set temporary
- set the exact passphrase you want to recover and confirm it
- validate by entering your current PIN code
HOW TO RECOVER YOUR HIDDEN WALLET(S) ON A COMPATIBLE WALLET
If you ever lose your Ledger Nano S, you can restore your wallets and hidden wallets by importing your 24 words backup + your hidden passphrase, using any compatible wallet supporting BIP39 passphrases, on another Nano S, or on Trezor hardware wallet.
You can also manually export your private keys using an online tool for advanced users.
Lastly, if you need to completely reset and wipe out your wallet to generate new seed and start afresh, make sure it is completely empty of all contents first.
Send all your coins on another wallet you own (any)
Make sure you have the 24 words of your backup correctly copied somewhere else
go to https://www.ledgerwallet.com/wallet/keycard
click on "Random key" and copy the hexadecimal string displayed in a safe place, it is the identifier of your new security card
click on "generate a security card", to display your new security card
click on "print" to print it
Connect your Nano
Go to https://fup.hardwarewallet.com/
paste the identifier of your security card in the required field
click on start update and follow carefully the instruction
once the update done, create a new wallet, copy carefully these new 24 words and keep them in a very safe place
You are ready to send your coins into this one now.
Original Sources:
https://support.ledgerwallet.com/hc/en-us/articles/115005161725
https://support.ledgerwallet.com/hc/en-us/articles/115005214529-Advanced-Passphrase-options
If you found this helpful, please upvote ;)