Help to avoid sending over the mnemonic to nexus for search #656

csillag · 2023-07-04T14:59:57Z

Up to now, we could only search for strings in a few very strictly specified format. (Ie. block number, tx hash, etc.) But now that we can do free full-text search for token names, it has become a bit of a security vulnerability that it's possible to accidentally copy and send sensitive information, like your wallet private key mnemonics, if you are working with the wallet and the explorer at the same time, and accidentally copy the wrong string to the wrong field.

Although would probably not be an everyday event, it's worth to add a simple check to warn about this, before doing it.

If it happens, this is what we do:

github-actions · 2023-07-04T15:00:14Z

Deployed to Cloudflare Pages

Latest commit:	`8131714f982c1bcb1845ce9dfa75c526303c030e`
Status:	✅ Deploy successful!
Preview URL:	https://b301e2ee.oasis-explorer.pages.dev

nhynes · 2023-07-04T18:02:08Z

Wait, why don't you instead detect the mnemonic and send it to your personal computer? You're just leaving money on the table!

csillag · 2023-07-04T18:09:30Z

Wait, why don't you instead detect the mnemonic and send it to your personal computer? You're just leaving money on the table!

That will come in a subsequent change, when the buzz around explorer has already faded... 😁

lukaw3d

I don't think most of this is worth the maintenance burden. I definitely don't want TFunction inside routes :/ and sending slightly invalid mnemonic isn't safe either

csillag · 2023-07-04T18:28:11Z

I don't think most of this is worth the maintenance burden. I definitely don't want TFunction inside routes :/

If we are OK with having to say "I command thee" in English, independently of i18n, then we can get rid of most of the extra complexity, including the one impacting the routes.

sending slightly invalid mnemonic isn't safe either

My guees would be that this typically happens using copy-paste. Copy-paste doesnt usually introduce slight errors...

csillag · 2023-07-04T19:24:50Z

If we are OK with having to say "I command thee" in English, independently of i18n, then we can get rid of most of the extra complexity, including the one impacting the routes.

I simplified the implementation.

before	after

The routing code is no longer impacted in any way.

csillag · 2023-07-04T20:49:18Z

I don't think most of this is worth the maintenance burden.

@lukaw3d how about the new, simplified implementation? (With no TFunction creep)

csillag · 2023-07-04T21:46:44Z

Wait, I have another idea...

csillag · 2023-07-05T12:50:30Z

If a user is doing this (which arguably is stupid) it would even give us more reason to make the message shorter and clearer IMO. A stupid user definitely won't be reading this.

OK, rephreasing in idiocracy lingo.

src/app/components/Search/index.tsx

lukaw3d · 2023-07-05T13:32:51Z

src/locales/en/translation.json

@@ -364,6 +364,10 @@
  },
  "search": {
    "placeholder": "Address, Block, Contract, Txn Hash, Transaction ID, Token name, etc",
+    "error": {
+      "tooShort": "Please enter at least 3 characters for searching",
+      "privacy": "This thing that you are trying to search for looks an awful lot like a mnemonic for an Oasis wallet. Please note that this is super-secret data that should never ever be shared with anyone; not even with such excellent services as our {{ appName }}. That being said, we are not here to tell you what you can or can not do with your own data, so if you insist, we WILL search for it. So, if you really think that there is a token with a name that contains this, then in order to signify that you understand and accept the terrible risk of sending this data to our servers, please insert this to the beginning of your search: '{{ wordsOfPower }}'! (Without quotation marks, of course.) If you do so, we will comply with your command."


I don't think the message matters much; this is fine. Bit awkward for future translators

donouwens · 2023-07-05T16:28:25Z

Yes but first I want to change the UX according to @donouwens's suggestion about the search suggestions.

I would suggest this for the 'too little characters' notification: https://www.figma.com/file/ifCrok8cP5ymEYjMa2PIi9/Block-Explorer?type=design&node-id=6624%3A246974&mode=design&t=Gk19GONKNbhNZF6X-1

csillag · 2023-07-05T17:02:19Z

Maybe we can create an integration for the second one that works in the same way as the search suggestions under the search bar (https://www.figma.com/file/ifCrok8cP5ymEYjMa2PIi9/Block-Explorer?type=design&node-id=6092%3A227275&mode=design&t=3K5SlcjhCb4mkoJv-1)?

Did that now:

Also, when using the Words of Power:

csillag · 2023-07-05T17:14:46Z

Continuing the discussion about the "too short" case in #671

donouwens · 2023-07-05T17:53:27Z

Could this design and text work @csillag?

https://www.figma.com/file/ifCrok8cP5ymEYjMa2PIi9/Block-Explorer?type=design&node-id=6626%3A247268&mode=design&t=Gk19GONKNbhNZF6X-1

csillag · 2023-07-05T17:59:05Z

Could this design and text work @csillag?

Sure, but now that we have split this to two, let's finish and merge #671 first, and then I will return to this.

csillag · 2023-07-06T16:09:44Z

Could this design and text work @csillag?

https://www.figma.com/file/ifCrok8cP5ymEYjMa2PIi9/Block-Explorer?type=design&node-id=6626%3A247268&mode=design&t=Gk19GONKNbhNZF6X-1

Implemented like this:

csillag · 2023-07-06T16:13:08Z

@lukaw3d this has now been updated after merging the "too short" warning message separately.

src/locales/en/translation.json

donouwens · 2023-07-07T07:58:22Z

@csillag This could work, but I feel we should stay closer to the new design. I’ve updated it a little here: https://www.figma.com/file/ifCrok8cP5ymEYjMa2PIi9/Block-Explorer?type=design&node-id=6673%3A248818&mode=design&t=NgiFzpta47LLPkRx-1

Also, the icon used is incorrect.

csillag · 2023-07-07T11:56:16Z

See follow up in #689

csillag force-pushed the csillag/dont-reveal-secrets branch 15 times, most recently from fabec01 to 8c05974 Compare July 4, 2023 16:41

csillag marked this pull request as ready for review July 4, 2023 16:44

csillag requested a review from lukaw3d July 4, 2023 16:44

csillag force-pushed the csillag/dont-reveal-secrets branch from 8c05974 to fcdd0a9 Compare July 4, 2023 16:50

csillag changed the title ~~Help to avoid sending over the mnemonics for search~~ Help to avoid sending over the mnemonic to nexus for search Jul 4, 2023

lukaw3d reviewed Jul 4, 2023

View reviewed changes

csillag force-pushed the csillag/dont-reveal-secrets branch from fcdd0a9 to 4805c18 Compare July 4, 2023 19:23

csillag requested a review from lukaw3d July 4, 2023 19:25

csillag force-pushed the csillag/dont-reveal-secrets branch from 4805c18 to 5f114ad Compare July 4, 2023 19:27

lukaw3d reviewed Jul 5, 2023

View reviewed changes

src/app/components/Search/index.tsx Outdated Show resolved Hide resolved

lukaw3d reviewed Jul 5, 2023

View reviewed changes

csillag force-pushed the csillag/dont-reveal-secrets branch from e0867d7 to e974b6b Compare July 5, 2023 15:50

csillag force-pushed the csillag/dont-reveal-secrets branch from c6687d2 to 48e4368 Compare July 5, 2023 17:00

csillag force-pushed the csillag/dont-reveal-secrets branch from 48e4368 to 0597d1b Compare July 6, 2023 15:59

csillag added 2 commits July 6, 2023 18:00

Add bip39 depencency (for working with mnemonics)

b6d3e64

Add helper function for recognizing a valid mnemonic

03e5842

csillag force-pushed the csillag/dont-reveal-secrets branch 4 times, most recently from b5c8f34 to 127bced Compare July 6, 2023 16:08

csillag force-pushed the csillag/dont-reveal-secrets branch from 127bced to 5cce1b9 Compare July 6, 2023 16:12

csillag requested a review from lukaw3d July 6, 2023 16:13

lukaw3d reviewed Jul 6, 2023

View reviewed changes

src/locales/en/translation.json Show resolved Hide resolved

lukaw3d approved these changes Jul 6, 2023

View reviewed changes

Add check against sending menmonics to search

8131714

csillag force-pushed the csillag/dont-reveal-secrets branch from 5cce1b9 to 8131714 Compare July 6, 2023 18:35

csillag enabled auto-merge July 6, 2023 18:36

csillag merged commit ddc4482 into master Jul 6, 2023
7 checks passed

csillag deleted the csillag/dont-reveal-secrets branch July 6, 2023 18:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Help to avoid sending over the mnemonic to nexus for search #656

Help to avoid sending over the mnemonic to nexus for search #656

csillag commented Jul 4, 2023 •

edited

github-actions bot commented Jul 4, 2023 •

edited

nhynes commented Jul 4, 2023

csillag commented Jul 4, 2023

lukaw3d left a comment

csillag commented Jul 4, 2023

csillag commented Jul 4, 2023

csillag commented Jul 4, 2023

csillag commented Jul 4, 2023

csillag commented Jul 5, 2023

lukaw3d Jul 5, 2023

donouwens commented Jul 5, 2023

csillag commented Jul 5, 2023

csillag commented Jul 5, 2023

donouwens commented Jul 5, 2023

csillag commented Jul 5, 2023

csillag commented Jul 6, 2023

csillag commented Jul 6, 2023

donouwens commented Jul 7, 2023

csillag commented Jul 7, 2023

Help to avoid sending over the mnemonic to nexus for search #656

Help to avoid sending over the mnemonic to nexus for search #656

Conversation

csillag commented Jul 4, 2023 • edited

github-actions bot commented Jul 4, 2023 • edited

Deployed to Cloudflare Pages

nhynes commented Jul 4, 2023

csillag commented Jul 4, 2023

lukaw3d left a comment

Choose a reason for hiding this comment

csillag commented Jul 4, 2023

csillag commented Jul 4, 2023

csillag commented Jul 4, 2023

csillag commented Jul 4, 2023

csillag commented Jul 5, 2023

lukaw3d Jul 5, 2023

Choose a reason for hiding this comment

donouwens commented Jul 5, 2023

csillag commented Jul 5, 2023

csillag commented Jul 5, 2023

donouwens commented Jul 5, 2023

csillag commented Jul 5, 2023

csillag commented Jul 6, 2023

csillag commented Jul 6, 2023

donouwens commented Jul 7, 2023

csillag commented Jul 7, 2023

csillag commented Jul 4, 2023 •

edited

github-actions bot commented Jul 4, 2023 •

edited