Blockstream / Blockstream/green_qt
Support hardware authentication without entering PIN
- Dominant language
- C++
- Stars
- 262
- Forks
- 44
- PR merge metrics
- No merged PRs in 30d
Description
From https://github.com/Blockstream/green_qt/issues/181:
> Since 2021, all models of Mac have supported Touch ID. Touch ID can be used to authenticate access to encrypted Keychain data, providing stronger hardware-level protection than a simple PIN. I refuse to use an app that thinks a PIN is secure; a 6-digit PIN can be brute forced offline in under a second. Even if a PIN were secure, I refuse to use an app that forces me to set one, because there is far more secure hardware available that you should be using.
As suggested in https://github.com/Blockstream/green_qt/issues/181#issuecomment-3857811762 I am creating a new issue about this.
For version 3.0.1 of the Blockstream app on Mac, when creating a new wallet I am presented with these options:
If I select "On This Device", and then "New Wallet", it creates the wallet and then asks me for a PIN:
It does not seem possible for me to bypass this screen. Specifically:
- Pressing Enter without any digits does not work.
- There are no buttons (not even on the pin pad) to proceed without a PIN.
- If I click the X in the top right, the entire flow closes and I am brought all the way back to the My Wallets screen, with no wallets.
Given that [a PIN apparently locks the wallet behind access to a remote server](https://github.com/Blockstream/green_qt/issues/181#issuecomment-3855190569), I would prefer not to set one.
P.S. your locking comment is a mischaracterization; just because I didn't respond to your every single point does not mean I was re-asserting my initial ones. But I digress.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.