selfcustody/krux

[Bug] passphrase QR with apostrophes doesn't scan correctly

2oh1 opened this issue · 12 comments

2oh1 commented

When scanning a passphrase QR that contains an apostrophe, the apostrophe gets deleted and replaced by the preceding letter.

For example, in a passphrase QR, "they've" scans as "theyyve", which leads to an incorrect wallet (xpub/zpub/etc).

This issue doesn't occur when typing the passphrase manually. In other words, when typed manually, "they've" is shown and processed correctly as "they've".

I'm running Krux v. 23.09.0 on a Maix Amigo.

Also, just to confirm (since it's a tiny symbol), the ' shown below the # and to the left of the ( is an apostrophe, correct? Just checking, though I'm sure it is.

odudex commented

I was not able to reproduce the bug yet.
Are you sure the ' is there? Is it there if you scan with a generic QR scanner?
Did you generate the QR using Krux tools?
If you don't mind, could you share the QR image?

Hi @2oh1 , regarding the characters available to select, they are listed below (yes, it shows an ' apostrophe below the # on the screen):

LETTERS = "abcdefghijklmnopqrstuvwxyz"
UPPERCASE_LETTERS = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
NUM_SPECIAL_1 = "0123456789 !#$%&'()*"
NUM_SPECIAL_2 = '+,-./:;<=>?@[\\]^_"{|}~'
2oh1 commented

They're / Theyyre

I didn't create the QR with Krux. Here's an example QR to scan. The QR scans as "They're" but in Krux it scans as "Theyyre"

odudex commented

They're / Theyyre

The QR code contains "They’re" not "They're". Do you see the difference? Krux doesn't have the ’ glyph, only '.

2oh1 commented

Interesting! I had to really zoom the screen to see the difference, but I do. I typed it with an apostrophe on a Mac.

odudex commented

This case should be shared! A very interesting example of dangers of using passphrases, how tiny details may end up creating BIG headaches!
If krux had the ’ glyph, the difference would not be noticed, and one day could try to load your wallet in an another device and would end up in an empty wallet if you used ' instead.

2oh1 commented

This is why I double-test everything when creating a new seed & passphrase using different methods to confirm zpubs & addresses are identical. It's so important to find errors, or even potential errors, ahead of time. And speaking of which, I freaking HATE "smart" characters like curly quotes and now this stupid apostrophe, but it's better to find these potential traps ahead of time. It's great learning lessons with zero consequences.

odudex commented

Yes, you did nothing wrong! Good you make these tests and helped to find this potential source of trouble.

2oh1 commented

I solved it. On my Mac, in the menubar under Edit > Substitutions, I de-selected smart quotes, smart dashes, etc, and that solved it. The QR now contains the correct apostrophe, which means Krux reads it as I intended. That being said... I'm going to avoid using anything that could have a "Smart Character" conflict as a passphrase.

This is a very good lesson learned, and learned the easy way.

More info about the chars and the difference in codes here:

U+0027 APOSTROPHE
U+2018 LEFT SINGLE QUOTATION MARK
U+2019 RIGHT SINGLE QUOTATION MARK

https://www.cl.cam.ac.uk/~mgk25/ucs/quotes.html

odudex commented

Great, I'm glad for two reasons:
There's no bug and the shared lesson. Thank you!

odudex commented

Closing as there's no issue. If you would like to generate QR code images, now with beta version you can export png images to SD card from QR codes created in Krux tools and encrypted QR codes