Topic: Wallet software security (Read 584 times)

The password is only for accessing the app. For example, when someone tries to access our mobile wallet application, it is necessary to enter a password in order to be able to tamper with the contents of the wallet.
Whereas the private key and/or seed phase is to be able to access to our address if the mobile wallet app is lost. So by storing with a good level of security will be able to save our assets.

This is a common explanation that many people already know, but I just wanted to remind you again.

Nothing, just shows the seed phrase, no backup instructions to device storage. Btw, the Gdrive backup option appears only when accessing the seed phrase in online mode.

---

Thanks for clarifying this.

Well, it is also available on trustwallet only when the seed phrase is displayed.

Just to avoid stalkers or CCTV in public places I think, but it's not really safe to check your bitcoin balance outside of your home.

I still have Coinomi installed on my phone from needing it several years ago. If you want to view your recovery phrase in Coinomi, you need to enter your password. Otherwise, you can't see it. I don't think the software has a biometric feature. I don't see it in the settings.

The wallet features two more privacy features:
- One disallows the phone to take screenshots while the Coinomi app is active. And it works.
- The second one is silly and makes little sense. It hides the balances in your wallet. The silly thing is you can enable/disable this feature with the click of a button. It doesn't ask you for your password.

The more I read about Coinomi wallet, the more I'm worried about its users. What does the manual backup do? Does it present you with the seed, and then ask you to write it down or is it trying to store a local backup, via storing it on your device? If it's the latter there's a whole lot wrong with that. The final straw is they've specifically stated they recommend both backup options "to help loss of crypto", but I honestly believe the way they're recommending to do it, puts it at even more risk.

Obviously, the fact that's closed source should be enough to deter most users from using their wallet, but I've seen it getting mentioned more, and more recently.

I'd rather input my password regularly, especially if it's a hot wallet, since that can be changed if you suspect that you've been compromised, compared to a private key that can't be changed, and therefore once compromised, will forever be compromised.

Although, if you suspect you've been compromised, I'd probably set up a new secure environment, and transfer to Bitcoin to the new securely generated wallet.

Right, if you have your physical wallet file you don't need to input the private key, same goes when you import your seed to generate a new wallet. Usually, you don't even need your password or biometrics since it's like creating a new wallet with the same private keys.

Interested to be more curious, related to the recent "hacking" issue on the coinomi wallet (which I just remembered). I gave several possible causes, one of them:

Since I don't use coinomi wallet, I tried my trustwallet and... bingo!!!, it really needs biometric authentication to access the seed phrase. Also, the crazy method that trustwallet offers: Gdrive backup 


Anyone who uses coinomi, does that also have the same way as trustwallet to access seed phrases?

If you use a new device, essentially you're creating a new wallet, unless you export your old one and open it on your new device. Even if the latter is the case, you don't need to re-input your private key again afaik, just need your password/fingerprint/etc to unlock it. Of course, this assumes you use the same wallet again. That being said, most wallets use seeds nowadays, so that might be the better choice to back up.

I think you might be confusing something with private keys. Some wallets probably introduce another PIN-like feature that you need to input in addition to your password to make a transaction, but as mentioned above, a private key is not an additional choice, it is necessary. CMIIW.

One has nothing to do with the other. You have no influence over the private key that gets generated nor can you choose one that you prefer. The wallet isn't going to "request" the private key when you try to open it, and no one makes backups of individual private keys for each used address nowadays unless they have to. Just backup your seed and it takes care of everything else.

- The private key is a signing key that you need to make transactions. The process is automated and the wallet does that for you. The wallet doesn't ask you to point it towards the correct private key.
- Password and biometric entries aren't automated. You use them manually to access your wallet.

What's the name of the software wallet you're talking about dude? Then I haven't tried what you're saying, and I rarely use soft wallets on mobile unless necessary.

And if I do install a wallet on a mobile device, I create a private key in addition to the password that will be requested and keep it in a safe place.

In addition to that, even with the password that's been set, one will still be requested to input the private keys in a situation where you change your device to a new one even after inputting your password. So invariably it shows how quintessential the private keys is to a password that's just mainly preventing access to device before assets itself.

That wouldn't deduct it as an attack vector.
He could have used the vulnerable versions prior to downloading 4.3.2 in December, used a malicious URI that lead to a compromised PC.

That's one directly related to Electrum; But like I said, it's a hot wallet, so there's a lot of other possible scenario.

You are talking about a vulnerability that was fixed with the release of Electrum version 4.2.2. The person who lost their coins was using Electrum version 4.3.2., so that issue would have been fixed a long time ago. Julerz12 must have done something else that resulted in someone stealing his money.

He allegedly kept the funds in a "Hot wallet" so there are a lot of possible scenarios in that case.
Google "hot wallet issues" for some insights.
He had the option to create MultiSig, 2FA or connect his hardware wallet (which he mentioned that he has one) but used a standard wallet instead to escrow funds.

As for Electrum, there was a recent vulnerability found in BIP70 payment request: https://github.com/spesmilo/electrum/security/advisories/GHSA-4fh4-hx35-r355
But that wont directly lead to loss of funds, read the security advisory and the linked commit below it for more info.

I am not familiar with the case, so I can't comment on that incident itself. The newest Electrum version is 4.3.3., released just a week ago. I have just gone through the release notes, and there is no mention of any serious vulnerabilities that were fixed from the version before. In my experience, 99% of all cases where people loss funds or have them hacked/stolen is because the user made a mistake. Fake wallets, phishing, malware, keyloggers, etc. Even the people he talked with from the signature campaign he managed are potential suspects who could in theory have given him an infected file.

If there was something seriously wrong with Electrum 4.3.2, I think we would hear many more complains than only that of julerz12.   

The software wallet (Electrum 4.3.2) hacking incident experienced by julerz12, what was possibly the cause?

This is exactly what I was worried about earlier in that you only need to enter your PK once at the start and let the password permit all your subsequent activities as long as you're in control of the device.

What do y'all think?

What you said sounds like something that a badly configured AI would say.

You don't log in with private keys, you do it with PINs or passwords. You don't sign transactions with PINs or passwords, you do it with private keys.

Good enough for what? Being a substitute for a private key?

Hardware wallets don't even show you the private keys in their native apps or software, so that a newbie wouldn't mistakenly copy them or save them somewhere digitally. It also doesn't allow a remote hacker to steal the keys.

It's already mentioned that the private key doesn't work like the password, there are already multiple replies that covers that info.

In fact password or private key is the same, when you log in. Of course if your password is good enough. Wallet security start with hardware wallet. 

In response to this problem, I organized my thoughts through a mind map, please refer to it.

https://i.imgur.com/STjztir.png

Once you enter your software wallet's password, PIN, or biometric scan, you have all you need to access the wallet information. Take Electrum as an example. Once the wallet has been decrypted with the correct password, you can easily access the private keys and copy them from the wallet. The private key doesn't help in securing your wallet from being accessed. It's just the string required to sign your transactions. 

The private key is the "sensitive information" that you're protecting with your wallet's password, it doesn't function as its security.
(in other words: it should be secured, it's not what securing your wallet)

It should've already addressed by the quoted message in the first reply.