JWWeatherman / yeticold

https://yeticold.com
Other
66 stars 24 forks source link

rpc password generated insecurely #172

Open BenWestgate opened 2 years ago

BenWestgate commented 2 years ago

From https://github.com/JWWeatherman/yeticold/blob/master/appyeticold.py

v.rpcpsw = str(random.randrange(0,1000000))
v.settings = {"rpc_username": "rpcuser","rpc_password": v.rpcpsw, "rpc_host": "127.0.0.1","rpc_port": 8332,"address_chunk": 100}
v.wallet_template = "http://{rpc_username}:{rpc_password}@{rpc_host}:{rpc_port}/wallet/{wallet_name}"

From https://docs.python.org/3/library/random.html

Warning

The pseudo-random generators of this module should not be used for security purposes. For security or cryptographic uses, see the secrets module.

The secrets module should be used for passwords and keys, random is designed to be fast for simulation purposes but can be predicable.