-
Notifications
You must be signed in to change notification settings - Fork 3.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Config file stores console history, this can be a privacy or security risk #5563
Comments
Nice catch. I see absolutely no usefulness in keeping this "feature". I am wondering if it was intentional or just didn't raise in nobody's eyes until now. I don't think this is needed to anything, what is the sense to keep such stuff in the config file on disk? It makes sense to keep some last lines in RAM only in that session. I think the % of users using console to send btc / build transactions when they have a GUI wallet tool is very small, but still this should be addressed. |
This is not the case with bash history at least.
There are at least two usecases for the console: using it for handling real money, and debugging stuff.
Indeed the only people affected are power users who use the console with secret data and don't know about the history being saved. Still, I'm not arguing that they should know about the history being saved.
Or there could be an option to toggle this. Although there are already so many options :) |
I dont want to add another option. |
This could work, but I think there are more complications. |
it's fine to make commands wallet specific
no it would not. you are not supposed to enter your seed or password in the console. |
Let me rephrase this part. When we partially encrypt an Electrum wallet file, inside that JSON, fields such as |
How about people who do not use a GUI for various reasons? If I interpret correctly, Electrum is not recommended in such a case? In my opinion, it would be nice to have solution to this problem. Configurability sounds good. The daily user does not need to know anything about it. But if someone uses the console then he should be able to disable such disk storing. |
You do not understand what this issue is about. |
This is something I have to deal with. However, I would not expect Electrum to write sensitive data to disk unless it is necessary. For me It doesn't matter if we're talking about GUI, console tab in the GUI or terminal input. I think controlling all system dependencies (like bash) is pointless. It looks different when it comes to your own files, I mean files that Electrum creates and saves its own data in them (like the mentioned config file). Argument like the following does not quite convince me - The runtime environment stores sensitive data explicitly on the disk, which is why we will do it too. Maybe I'm a little oversensitive :). I do not know... |
Whatever is in your console history is as private as the rest of your wallet file (addresses, history, etc). There is no reason to add an extra encryption layer. Note that if you use password protected commands from the console, a password dialog pops up so that you do not need to enter your password directly in the console. |
@Coding-Enthusiast Speaking to the potential security aspect, what are the default permissions of the 'config' file? |
@attritionorg on UNIX-based systems, I believe it is electrum/electrum/simple_config.py Lines 257 to 263 in db8e6ca
|
@SomberNight Thanks! That means that by itself, it isn't a vulnerability I would say. It would require someone compromising an account in some fashion (e.g. another vuln, social engineering, leaked creds) to gain access to any sensitive information in that file. |
The
config
file is storing the last 50 "strings" that were written in console. This can be both privacy concern (for those who use commands involving transactions or addresses and don't want them lying around unencrypted) or a security risk (for those who used commands involving secrets such asconvert_xkey
, ...).In my opinion this feature is not needed at all and should be removed entirely. Consoles/terminals are usually storing the last couple of commands in memory as long as the console is running not forever (on disk) to make it easy to repeat the command in that session only.
If there is any other reason for this feature that I'm not aware of, then at least the following 2 needs be added:
DeleteConsoleHistoryFromDisk
(or something similar) so that user can choose to delete this through console without having to go through config file for manual deletion.The text was updated successfully, but these errors were encountered: