blur-network/blur

Enhancement: Mnemonic seeds and keys are not handled securely

Opened this issue · 0 comments

Since our mnemonic seed is a representation of the private spendkey, we should take better care to ensure that it is not trivially read from some plain-text source. This issue was raised by a member of our Telegram chat.

We should be using some secure storage mechanism (like that which libhydrogen provides for stored representations of passwords, for example) to protect users from phishing attacks.

We should also avoid displaying the key as a default behavior. Giving users a choice to display key, or even using something like GPGme to securely store the key in a file, or something, would probably be better.