I am working on a new security feature to replace the password login. Essentially it will allow someone with a Ledger Nano S hardware wallet to login using a pin from the device. That way nobody can use your Bitsquare app without that device connected. It will also work with the Nano Blue.
Good idea?
It need to be additional. The PW protection encrypts the BitcoinJ wallet so that will be important in any additions.
To use a hardware wallet has limitations because the trade process uses automated transaction creation and signing, so any hardware wallet requireing interactive signing cannot be used in the trade proecess (when an offer gets taken, when the payout gets signed).
Though for a kind of savings wallet hardware wallets would be good, but its basically that u can move btc from bitsquare to hardware wallets in a convenient way.
To use a wallet to access the app (not btc) is another good use case.
Not sure if its worth the effort atm, I think there are many other higher prio stuff. But if anyone wants to work on that, great.
I already use the Nano S as my cold storage. But the idea is not to replace the bitcoinj wallet, as you say it needs to be active even when the user is offline. The logic is something like this:
If Nano S present and BTC account same as Bitsquare, skip login page.
Firmware is already done, I’d upload a snapshot of the Nano screen but my phone’s camera is terrible.
Does this imply that the Nano S has to be physically connected via USB etc or will it just function as a 2FA code generator, similar to Google Authenticate etc? If so, it would seem prudent to implement 2FA methods with the largest coverage first. There are lot more people using Google compared to say, a Ledger device.
There are a lot more people spending money via Paypal too. Should we abandon Bitcoin? 
Nobody ever explained to me how to use 2FA while traveling when the second factor is a phone. Global roaming rates? No way.
2FA by email isn’t secure, but a physical device like the Nano S can be carried in you pocket and doesn’t need to be connected to anything else. Get used to these devices, they’ll be everywhere in a few years.
It has to be physically connected to login without a password, and if I get it right it will also provide the seed for recovering the database from anywhere you can get access to a computer.
I am not saying the Nano is a bad idea to support. I think it is a great idea to support. All I am saying is: support the most widely used 2FA methods first so that the new code is useful to the largest number of people. Common sense. I will bet you that mobile app based 2FA is 1,000 times more used than hardware authentication in the crypto world. Hardware tokens are heavily used for online banking in many countries, but even there rapidly being replaced by phone-based apps.
Still, if you go ahead and support the Nano S I might just buy one for that reason.
PS: In case the Nano S is lost/damaged will it still be possible to unlock the wallet? Is there a backup feature of some sort that allows me transfer keys etc to another Nano?
Yes, the Ledger wallets all support reconstruction from 24 seed words. These are written down on a card provided when you buy one. I’ve successfully loaded the Nano S from a seed used to create the earlier Nano, and it will also work on the Trezor wallet.
Ref: http://support.ledgerwallet.com/knowledge_base/topics/search?search=recovery%20seed
In the case of Bitsquare, there will be an option to unlock from a password if the Nano S isn’t connected.
