search

airgap-it / airgap-vault

The AirGap Vault is installed on a spare smartphone that has no connection to any network, thus it is air gapped. This app handles the private key.
MIT License
386 stars 109 forks source link

Two security improvement, Vault. #69

Closed Originalimoc closed 3 years ago

Originalimoc commented 3 years ago

1/ build a built-in keyboard for, restore a wallet. Like Coinomi. 2/ Use Android KeyStore w/ user entered password(not bio fallback screen lock) + bio double auth. With StrongBox support is even better.

Originalimoc commented 3 years ago

Hmmmm. Why is Passcode option grey out?

AndreasGassmann commented 3 years ago

Hi, thanks for your feedback.

  1. Is already being worked on. The branch is here https://github.com/airgap-it/airgap-vault/tree/feat/mnemonic-import and a you can try it out online here: https://608ad24a2be17900076a5ba6--airgap-vault-dev.netlify.app/ (in the alert that says the app can't load, hit cancel and wait). This is only a first draft and we're testing what the best approach is. We are planning to include this in the next few weeks.

  2. During the setup of your secret, you can set a passcode. You cannot change this afterwards, that's why it's greyed out. To add a passcode you have to import that mnemonic again and set it during the setup.

Originalimoc commented 3 years ago

Ohoh, let me try again, is Passcode PIN only?

AndreasGassmann commented 3 years ago

No, it's a regular password (letters, numbers and symbols).

Originalimoc commented 3 years ago

3/ lock after phone screen lock. (4)/ seem like I can spam cancel to skip authentication, trying again with a test account, please wait.

Originalimoc commented 3 years ago

KeyStore implementation seems, wonky. I encontered Bio auth loop same as another issue, must use screen lock pin. And Passcode is not done using KeyStore.

Originalimoc commented 3 years ago

Essentially, is private key properly stored on TEE/SE of an Android device and sign transaction with KeyStore(Bio/Pwd/Bio+Pwd) so privilege escalation attack/root is not a problem.

Originalimoc commented 3 years ago

Because I can view phrases just using Passcode. Does that mean private key entered main memory? Or just hold a token to be used later when invoking signing and viewing phrases?

Originalimoc commented 3 years ago

Now transaction broadcasting failed: network error. Using a VPN or proxy don't help? WTH......

Originalimoc commented 3 years ago

5/ can't exit Vault or Wallet using back button.

Originalimoc commented 3 years ago

I'll close this and sperate all issue apart.