search

Lindacoin / Linda

MIT License
42 stars 51 forks source link

unlocking the wallet by console #66

Open randolphsadler opened 6 years ago

randolphsadler commented 6 years ago

hi, i'm using the current branch of Lindad on ubuntu linux and i assume a security flaw in terms of standard liunx configurations. In my case i detected, that bash history, which is some kind of standard in ubuntu, will hold the command line i used to unlock for stakeing. sure i know to clean up my history file and i am clear of someone needs acces rights to go so far. but i decided to file that issue, because i want to encourage the comunity to think about human failure and develop a safer method for unlocking the wallet by console, preventing the password to be a console parameter.

thank you, randolph

nibbles83 commented 6 years ago

On a default installation of Ubuntu adding a leading space to the command will prevent it getting saved in the bash history. I do agree however that providing perhaps a prompt based passphrase entry would be more secure.