It is mainly used for two reasons:
As entering a passphrase on your Nano S each time you plug it would be highly impractival, Ledger’s approach is to use an alternative PIN (or “duress PIN”) which would be locked to a fixed passphrase.
Right now, setup of the passphrase requires the use of Python scripts. Full on device management will be available in the 1.3 firmware. If using Python is not a possibility for you, please bear with us while we are building a friendler solution in the Ledger Manager.
Note that all your apps (Bitcoin, Ethereum, FIDO…) are affected by the passphrase identity change.
Execute the following commands in your Linux or MacOS shell:
pip install ledgerblue
Use the following command:
python -m ledgerblue.derivePassphrase [--persistent]
It will request your passphrase on your computer, request your current PIN on your Nano S and generate the new set of accounts. If
--persistent is set then you’ll be asked to enter an alternate PIN and these accounts will be attached to it. Otherwise, these new accounts will be active on the device until it is powered off.
With an alternate PIN activated, when you power on the device, the usual PIN will give you access to your normal accounts, and the alternate PIN will activate the accounts behind the passphrase.
Our recommendation is to use your current PIN for your day to day accounts, holding reasonable assets, and your alternate PIN for your savings account, holding higher value assets. This way, not only will your backup seed be protected by the passphrase, but your “duress” PIN will in fact be a real account will real transactions. This would be much more effective in a plausible deniability scenario.
If you provide one PIN to an attacker keeping control of the device for some time, it can be leveraged to try to brute force the other PIN, as the counter is reset during a successful PIN input, and both PINs share the same retry counter in current firmware versions. The best course of action is to restore and transfer your assets to a different seed quickly if this happens.