cryptoadvance / cryptoadvance/specter-desktop
ColdCard Message Signing doesn't check the fingerprint properly.
- Dominant language
- Python
- Stars
- 847
- Forks
- 259
- Avg merge
- 6d 18h
- Merged PRs (30d)
- 2
Description
I have Added over USB connection my Coldcard with and without a passphrase.
The fingerprint displayed on Coldcard can be used to confirm the passphrase was entered correctly, and matches the imported device fingerprint.
However even if I unlock Coldcard with no passphrase, Specter still lets me sign a message when I am in the Device ColdCard-PassphraseA with a different fingerprint.
Specter also lets me sign when logged into Coldcard with PassphraseA with the Specter Device-ColdCard-PassphraseB.
Contributor guide
Research direction
No files or tests are named. Reproduce message signing over USB with ColdCard devices using different passphrases, then trace the message-signing flow and its fingerprint comparison. Done means signing is rejected when the active ColdCard fingerprint differs from the imported device fingerprint.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100