bitshares / bitshares/bitshares-ui

Possible security flaw

Open
#1,813 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
520
Forks
575
Avg merge
12h 7m
Merged PRs (30d)
5

Description

**Describe the bug**
I just had a long conversation with a Russian who had problems with the app. He had tried many things on three different computers. I noticed right away that the password was too short for a cloud account which was evident that he tried to from a screen shot.

I went on and suggested that it might be the problem and yes, he had a backup of a .bin file.

He went on trying to restore and managed to get in somehow. But vital elements in the GUI was either greyed out or missing. The padlock for example would not show. And all attempts to send to an external addresses failed.

I had also noticed from one of the screenshots that he had renamed his .bin to remember his account name presumably. I suggested this as a possible explanation and gave no guarantees it was right. The guy then went on and renamed the file after the naming convention and restored it. And to my surprise reported everything worked as normal.

**To Reproduce**
I'm uncertain if he renamed the file while saving it or afterwards.

**Expected behavior**

Unconventional naming renders GUI useless

**Screenshots**

Available here: https://t.me/btsWalletHelp

There are a lot of them, not all relevant.

**Desktop (please complete the following information):**
Various OSes from windows 7 to 10 and Mac OS high sierra

Bitshares desktop GUI used. The first one over a year old, which I persuaded him to throw away.

**Additional context**
User was unfamiliar with basic concepts of Mac OS

Contributor guide

Open the contributing guide

Research direction

Start by clarifying whether the .bin file was renamed during saving or afterward, then reproduce restoration with the reported naming convention on the listed Windows and macOS environments. Use the linked screenshots as context. Done means an unconventionally named backup either restores correctly or produces a clear error without disabling GUI elements or external transfers.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
desktop, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
15/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.