When you buy a hardware wallet, your private keys are super safe, but it doesn't mean you can relax and be displicent, so here are some simple to follow procedures that would enhance security.
Security of the recovery phrase (24 words)
When initializing for the first time a hardware wallet, you will be prompted to write down 24 words on a paper. The 24 words are a human readable version of your seed (from which all your private keys are derived), and can be used to restore access to your crypto assets on another hardware wallet.
Anyone getting access to these 24 words would get immediate access to your assets (the PIN code is a protection related only to your device, and has nothing to do with your recovery phrase).
Therefore, it is of the upmost importance that you secure correctly these 24 words.
-Never take a picture of your recovery sheet (as it would go in the cloud and could be accessible to hackers)
-Never enter your 24 words on any computer or smartphone
-Keep your recovery sheet in a safe place, protected from light, humidity and fire
-Security steps to verify your receiving address
Your hardware wallet requires a software interface on your computer to interract with you and access the internet (so it can computer your balance, get your transactions history, etc). It is very difficult to verify the integrity of the software or your computer, and therefore you must act on the principles that what you see on your screen could be compromised.
When you need to see your receiving address (so you can be the recipient of a payment), you must take extra steps to ensure you are not victim of a man of the middle attack. An attacker could be in control of your computer screen and show you a wrong address which would make him the beneficiairy of any transaction sent to it.
You must verify the receive address by displaying it on your device.
Using a Ledger Nano S, on the bottom right of the receive window, you have a "monitor button" which will show the recipient address on your hardware wallet. You must make sure it is the same than displayed, and also make sure this is the address you will ultimately send/paste/scan on the target application/service. MEW also propose this function.
If you are using a software wallet which doesn't propose this feature, we recommend to send a small amount first, and make sure that you have properly received it (verify that your balance has been credited). This test should ideally be done on another computer. It is ok to reuse the address that you have just verified (you will see a new address on the receive windows, this is the normal way HW wallets are working).
Security steps to verify the beneficiary address
When you wish to send a payment to a third party, you will usually get the recipient address on a web page or through an email/messenger service. A trivial attack for a malware would be to replace the address by one of its own. Some malwares are simply monitoring the clipboard to replace an address you have just copied by a compromised one.
Always verify the beneficiary address on the device (this is enforced by pressing a confirmation button), but also always double check it using a second channel. For instance, request the address to be sent by SMS, or another messenging app. If you are depositing on an exchange, send first a small amount and check that it arrived properly.
Final thoughts
A harware wallet ensure the protection of your private keys by providing with a full isolation against the internet (the keys are never "hot", i.e. online, that's why it's often refered as "cold storage"). However, this is not a silver bullet against all possible attacks and you must always verify and double check everything as explained above.
You might already heard that with great powers come great responsabilities. Being your own bank is not trivial and requires discipline. Using a hardware wallet doesn't make you invicible. Use comon sense. Don't trust, verify.