Blockstream / Blockstream/green_qt

Support hardware authentication without entering PIN

Open
#182 7 comments 0 reactions 1 assignee Claimed by @ardier16 View on GitHub
feature request status: planned
Dominant language
C++
Stars
262
Forks
44
PR merge metrics
No merged PRs in 30d

Description

From https://github.com/Blockstream/green_qt/issues/181:
> Since 2021, all models of Mac have supported Touch ID. Touch ID can be used to authenticate access to encrypted Keychain data, providing stronger hardware-level protection than a simple PIN. I refuse to use an app that thinks a PIN is secure; a 6-digit PIN can be brute forced offline in under a second. Even if a PIN were secure, I refuse to use an app that forces me to set one, because there is far more secure hardware available that you should be using.

As suggested in https://github.com/Blockstream/green_qt/issues/181#issuecomment-3857811762 I am creating a new issue about this.

For version 3.0.1 of the Blockstream app on Mac, when creating a new wallet I am presented with these options:

Image

If I select "On This Device", and then "New Wallet", it creates the wallet and then asks me for a PIN:

Image

It does not seem possible for me to bypass this screen. Specifically:

- Pressing Enter without any digits does not work.
- There are no buttons (not even on the pin pad) to proceed without a PIN.
- If I click the X in the top right, the entire flow closes and I am brought all the way back to the My Wallets screen, with no wallets.

Given that [a PIN apparently locks the wallet behind access to a remote server](https://github.com/Blockstream/green_qt/issues/181#issuecomment-3855190569), I would prefer not to set one.

P.S. your locking comment is a mischaracterization; just because I didn't respond to your every single point does not mean I was re-asserting my initial ones. But I digress.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.