cryptoadvance / cryptoadvance/specter-desktop
Wallet data plaintext in files despite using password for Specter
- Dominant language
- Python
- Stars
- 847
- Forks
- 259
- Avg merge
- 6d 18h
- Merged PRs (30d)
- 2
Description
**Describe the bug**
I created wallets in Specter. As i do not want this sensitive data to be readable by anyone or any process, I added a password to Specter. To open the app I indeed need to use the password.
However, all wallet data is visible in plaintext in the .specter folder as json and csv files: xpubs, addresses, descriptions..
Anyone with read access to the user profile (another local user, malware, backup software, forensic tools, etc.) can access wallet metadata without needing the Specter password.
This is a serious flaw imo, especially for this domain.
**To Reproduce**
Steps to reproduce the behavior:
1. Go to your user folder/.specter
2. Open the json or csv files
3. Be amazed
**Expected behavior**
Data should be encrypted at rest. Preferably the wallet name is not even in the filename, but at minimum the file is fully encrypted.
**Desktop (please complete the following information):**
- Where is your specter running: local desktop
- If you're running a binary, which OS: MacOs
- Specter Version 2.1.10 (latest)
Contributor guide
Research direction
Start by inspecting the local desktop data under the user’s .specter folder, especially the JSON and CSV wallet files, and trace how the Specter password is applied when opening the app. Define done as wallet metadata being encrypted at rest and wallet names no longer being exposed in filenames, then verify that the password is required to access the stored data.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- desktop, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100