Topic: Is your Android Wallet secure? Most of the 37 wallets should scare you! (Read 934 times)

Thanks! Please keep in mind that WalletScrutiny so far only tests verifiability. It does not verify the source code itself. This is something for some phase two.


Currently I only add wallets that are on Google Play. If you have a link to their store listing, I add it to WalletScrutiny.


The criteria of being listed at all is that it looked a bit like a wallet. BitRefill in particular is a custodial service, so it's not a wallet but a "Bitcoin bank". This should be clear from how it's represented. If you wouldn't be able to lose "your" bitcoins with them, it would be "not a wallet".

There is a new LN wallet called Shockwallet (Alpha): https://github.com/shocknet/wallet

Also, why is Bitrefill even listed there? Just because you can deposit funds into your account doesn't make the app a wallet does not necessarily make the app a wallet.

I must really commend you for this type of project, as promising and valuable the crypto industry seems, there are some loose ends that needs to be tied just as the one you're doing
Not everyone is tech savvy, some are just bloody investors that doesnt even know how reliable their wallets are but with projects like this, then we can always be sure of what type of wallets to rely on.
I used to be a very good fan of atomic wallet until i checked up website and discovered that i am standing a risk of having my wallet security compromised at any time.
Kudos for your great efforts once again!!

Thanks for your kind words but we do not verify much. We only test if the wallets at the time of our test can be audited. An audit itself would cost tens of thousands of dollars per wallet and would be outdated with the next release. As this is not a practical thing to expect, we will go in a slightly different direction and make sure the incentives are there for finding the one issue through something like bug bounties.

It's nice that you have set up this kind of project for the community, it surely is a big help for all of us, since everybody here is using all those wallets listed in your websites, I'm glad that all the wallet that I'm currently using are all verified, I have bookmarked your site for future reference and recommendation.

Well, the answer is certainly more nuanced than that.

On your desktop you usually run Windows, Mac or Linux and the security models differ quite dramatically. And the way people use those systems varies. If you keep your system updated and don't install anything, you are more secure than if you regularly install pirated software or otherwise software from untrusted sources.

That said, Android is really good at sandboxing, so one app should not have access to another app's storage, so it's much harder to screw up on Android than on Windows.

Lastly, larus maybe wasn't talking about desktops but about hardware wallets cause with these it's even harder to lose your bitcoins.

You need to increase your knowledge about the wallets. You store the wallets on your desktop/ laptop or on your mobile phone, there is no difference in security and risk. For example you can store your coins in electrum wallet either in your PC or through Electrum app for Android. You will get the same security.

For what it's worth, the scary "code" blocks are now limited to 25 lines. Inclined users can still scroll inside those boxes but it's certainly less scary now. We will improve that further after some urgent updates.


We are aware of that. The current iteration of the project is "all manual" but if there is interest (read: money to be earned), we will automate the process and alert users of issues. We are considering the fact that Android can be rolled out in different versions to different countries and that reviewing huge changes is more time consuming than reviewing small changes. It's just that the status quo is miles away from caring about actual reviews. Reviewability is the current mission.


As stated on our page, we considered the Playstore description and the project's website, not the app itself and we will not change that, as apps can't be parsed without having the source code in the first place.


Absolutely! I still do get money. Less money for less work though.


In bitcointalk you mean? I had no idea that that was something of interest to people. For all I know it never was an official company outlet.


There is not much to address there. Syncing issues should be fixed. There is no support, right. Media-flow-opt-out should work from 3.2.0.17 on.


The walllet being verifiable is the subject of our project and having to restore your mnemonic on a different wallet is a minor detail compared with a wallet pulling an exit scam. My mission is to make exit scams harder.

This puts you in an kind of never ending loop as everything is always in flux.
You should put more detail in the testing then.
If you really want to do it then put tested Date-Month-Year. Version tested AND what was the latest version available at the time of your test. etc.

For example:
You have 3.0.0.23 as the version you used to test mycelium that is from the end of September. It's mid December and the version Google Play just put on my phone was 3.2.0.11.


It's linked from the app. You can actually click on something in the app to get to the github.
I will give you the version might be different. Did not look, just saw the link. So that's on me.


A few things in there:
1) If mycelium owes you money and you are doing work for them, that should also be stated in the review. Because sooner or later I would think you are going to have to cut your losses and that is also relevant to wallet security. That is just my opinion, you can keep working for free but I would assume it would fall lower on your priority list as time goes on.

2) Rassah is still the mod of the mycelium forum and although claims to not have any affiliation with them (don't know why he would lie) he was still a contact point. Now everyone get's to bug you about the bugs....

3) You did not address the rest of what was in my rant such as the syncing issues, the dead support links, the ads that still come on when turned off [as of 3.2.0.11 it still did it but not with any regularity]. And that is fine, you don't need to defend your project to random internet stranger. But, do not pretend they don't exist. Because saying that the code on github matches the compiled version is only part of the issue. If you have to export your keys to another wallet because the one you are using does not sync then the code is not really important is it?


-Dave

I think that in some cases it may simply be "something missing", not "bad intentions". My choice for using the word "reputed" here was because I think that people do trust some of those wallets and the teams behind them.


A hardware wallet can be bought nowadays at 65$, so although the logic is correct, the numbers are smaller (1300$ instead of 2000$ !!).


What I meant was something like the + signs in Microsoft download pages, maybe done even smarter (I don't know if it's possible to "cascade" this feature).

If you are worried about your backup being found by the wrong person, you can always buy 2 hardware wallets and put the same key on both of them and use one as backup.

Importing private keys sounds scary. The Android clipboard can be monitored by all installed apps without even an extra permission and as soon as the user copies the private key, all malicious apps race to broadcast their attempt of stealing the funds

It's the same situation if someone finds a seed from a hardware wallet, most people save their backup on paper. In the end, it comes down to how well or badly someone protects their backup. I am not sure how you think to restore private key from paper wallet on a hardware wallet, as far I know most wallet support only seed words, and that seed is created by hardware wallet, it should be entered only there.

By importing private key/s from paper wallet there is always a risk that coins can be stolen, in most cases by fake wallets, or if user for some reason tries to type private key manually and his device is infected with keylogger/RAT virus.

Actually with multisignature you can get very far in terms of security. Create a wallet involving your iphone, your android, your Windows PC, your Linux laptop and your hardware wallet and create a 5-of-5 wallet. What are the odds that this setup steals your coins?


Paper wallets are vastly inferior to hardware wallets as whoever finds them gets control of the coins. The hardware wallets are strictly superior, as you can restore your paperwallet private key on a hardware wallet and gain the protection against thieves without losing anything.


We so far are not offering consultancy. Android wallets cannot offer the same security as hardware wallets even with secure elements but that's a long topic. Android phones would need special hardware to indicate the operation of secure code for that and it would still have a much bigger attack surface than a Trezor for example.

Yeah it looks like you already have a lot of experience about the security of android wallets. And maybe you also have many clients who consult to improve the security of their wallet projects. Only one question I have? is it possible for an android wallet to have security like a hardware wallet?

Maybe it's possible, by not connecting the internet but is there another way?

Risk is always present, there is no guarantee for any type of wallet in terms of 100% security. But we can still try to minimize this risk by prioritizing a specific type of wallets. I used to consider desktop wallets pretty safe as a beginner, then I began to doubt them more and more, so I invested in a hardware wallet, but today I cannot say that I have complete confidence in such storage. Not because I think I might fall victim to an individual hack, but because of what you're talking about, and it's some kind of imaginary global hack that would do immeasurable damage.

While I'm not sure how technically feasible this is (when it comes to hardware wallets), desktop/mobile wallets are certainly vulnerable to large-scale attacks. I think that for storing larger amounts, only a properly made paper wallet guarantees an extremely high degree of security, of course with the risk of damage or theft which is always present.

Sorry, what? We are currently two developers following build instructions found on wallet projects. We are both Android Bitcoin Wallet developers, so we certainly are more up to this task than the average user who wants to compile the wallet for himself but we do not code much. Just the website.

We disclosed our findings in great detail, including the date we did our investigation. If back when you did it or now, things are different, that might explain it and we might give it another shot.


That repository has its last code update in June, while the wallet on Google Play's last update was in October. This repository was not linked from Google play or their website. Why should I assume it's relevant?


While we have a commitment with Mycelium, we also have a private life and while we do work for the company, we do not call the shots. Also Mycelium still owes me money since June and Rassah?? Do you live under a rock? He's not with Mycelium since years and said so in various occasions.


That's the problem. Those wallets have not millions of dollars under management, they have millions of users that have god knows how many dollars in their wallets. This is a huge incentive for anybody who could pull it off, to leak the private keys to then empty all wallets at once. This is also a huge incentive to provide a wallet for free that many people use and trust. To pay people to do great support and to go to conferences ...


Yes, this is an issue and why I use a "GoogleOne" phone, which comes with guaranteed updates for years. On the other hand, wallets can alert their users about security issues and I know Mycelium alerts users that try to run it on certain insecure versions of Android. In the end, Android is pretty secure though. More secure than your average Windows certainly.


Totally agree. Never put life-changing amounts in anything but a trusted hardware wallet. If you manage amounts that would change the life of many people, don't trust any single hardware wallet neither. Use multi signature with at least 3 brands of hardware wallet and pay somebody who knows how that works. Don't try that at home with that amount of money.


Thanks to the backup I trust my Android with more money than my leather wallet. Losing one is not like losing the other. For any serious money, other wallets are more suited.


To be fair, sandboxing on Android is pretty good. With your argument you could also say to not use the web cause of Java Script being insecure. Sometimes Browser makers screw up but usually it's so much more secure than to install apps on your Windows where the app can do whatever with the storage of all the other apps ...


Android is what I know as a contributor at Mycelium and I see the issue there, with more than 20 million downloads for the wallets I investigated.
If people care, we might expand to other platforms and maybe also other apps but for now, Android is already quite a lot of apps to look after.


If people care, we will expand. For now, there are only 3 wallets "green", so it's kind of pointless to be more strict and have them all red. My hope is that some 10 of the open source wallets fix their build setup so we can verify it and then we raise the bar. We would love to test new releases in real time and alert users if a verifiable app turned non-verifiable. We would also like to list bug bounties paid by the different projects, so security researchers get on board for the better paying ones.


Android is pretty good at sandboxing apps. One app should not be able to reach into another app's sandbox unless you give it root access. Keep your Android updated and it's pretty secure. More secure than Windows for sure.


There is no such thing as proven to be secure. Any wallet provider in distress might turn evil. So you trust Mycelium? I'm compiling the release versions for that wallet. How do you know you can trust it? Maybe somebody took my family hostage. Do you believe I care more about your bitcoins than their life? Maybe somebody infected my work laptop with a malware that injects a backdoor when I compile the wallet. Those are the reasons why reproducibility matters even for closed source projects. You have to check every build. At Mycelium, if there is a backdoor in our wallet, not only must I have missed it, my whole team and interested outside security researchers must have missed it as every release is compiled and verified by other team members and the public source code is pushed before we push the apk to Google Play. All this happens behind the scenes but it matters greatly and only if the app is publicly verifiable can people hope that it's actually been verified.

We certainly would hope to get the funding necessary to focus on this project and expand it to cover all wallets. For now we have to see how the community receives the project.

Which wallets should we add? Please provide a link to Google Play if you want us to review your wallet of choice. We only looked at what we know and could easily find.
Every browser should have a search feature
Check out our Methodology page.

I'm glad you care and I don't want to say you shouldn't but as you see you are not alone in trusting your money to a wallet that cannot be publicly scrutinized. I hope that many of the anyway open source wallets will come around and fix their setup so they can be easily audited. I bumped this issue and maybe you want to state your concern to them there, too.

I, as a Blockchain Wallet user, see that this worries me about the security of my assets. Blockchain Wallet Still Not Verifiable!
will it still be safe?
Didn't you give a message to Blockchain Wallet to solve this Not verifiable problem.
Blockchain Wallet has the most users and the highest rating.

Already good and really helpful for the new people who hasn't determined which wallet thay gonna use. You should add more wallet to review and make a filter for that list, or search bar would be help a lot if people want to check their wallet is secure or not. Also you need to mentioning your analysis criteria before you qualify the wallets.

Even in the experimental phase its great idea and I hope you will carry on working on it. We all assume that all wallets are being verified and checked by peers, just based on fact someone says its open source, but now I can see that is far from truth! I'd love to see initiatives like this to grow and so rest of us can have more insight into how secure and open and verifiable our wallets really are!

I hope you plan in future to involve even PC/Linux/Mac wallets in your project!
Thanks for good work

It is, and I didn't.  I hate 'listicles', and they're everywhere.

Anyway, I don't know how good op's project is in terms of accuracy, but whether it is or isn't, people need to watch what kinds of crypto apps they put on their phones anyway, not just wallets.  It's possible for someone to install a coin stealer onto your phone, tho I haven't heard of this being done yet...and it may be that I've just never heard of it happening, but it could have.

If it's bitcoin you're storing on your phone, I'd only use one of the trusted wallets like electrum or mycelium which have been around for years and haven't had security issues.  None of the newer wallets offer any real advantages over those two.  And I'm not even sure if there's a multi coin wallet that's been proven to be secure.