project-robius / project-robius/robrix

[TSP] Do not store (or securely store) a TSP wallet's password

Open
#600 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

tsp
Dominant language
Rust
Stars
487
Forks
68
Avg merge
1h 22m
Merged PRs (30d)
54

Description

Currently, the password for each TSP wallet is stored in its metadata, which itself is serialized to disk and stored

This is fine for a testing environment, but obviously not suitable for production.

There are two solutions for this:

  1. Force the user to enter their wallet password upon app startup, and/or whenever access to the wallet is needed.
    • Up front is much better because we cannot otherwise listen for incoming messages on the wallet's default DID if it's not unlocked/opened.
  2. Store the password for the TSP wallet securely in the OS-native keychain, and prompt the user to unlock it using OS-level authentication (password, biometrics, etc).
    • We have a lightly-tested robius-keychain crate for this (as well as the third-party crate keyring-rs), so the platform abstraction is mostly be ready to go, but we'll still need to use it and test it thoroughly across all platforms, which is likely to be challenging.

Obviously (2) is better, but is far more involved. Option (1) would be an initial first step that makes it easy for us to share a publish-able demo build of TSP + Robrix.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how TSP wallet metadata is serialized to disk and review the lightly tested robius-keychain crate and possible keyring-rs use. Compare the startup password prompt with secure OS keychain storage, and consider the supported platforms; done means the wallet password is no longer stored insecurely and the chosen approach is tested across platforms.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
authentication, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.