search

alexpmorris / WhaleVault

WhaleVault :: Secure Graphene Cross-Chain Key Store Extension
MIT License
11 stars 0 forks source link

“Wrong password!” even when the correct password was entered. #2

Closed krischik closed 3 years ago

krischik commented 3 years ago

WhaleVault reports “Wrong password!” even when the correct password was entered. This has not happened several times to me.

I noticed that in particular when the computer was restarted or when I temporarily deactivated WhaleVault. Could it be that an encrypting seed is lost on restart?

The other thing I noticed that WhaleVault, unlike Steem- and Hive-Keychain forces me to add a “special character” to the password. Something I would normally avoid as special characters are a notorious source of problems in password.

I don't consider the added security of a special character worse the potential problems. Which reminds me: It's not really yours to tell me what password to use. You can suggest that a password is insecure but at the end of the day it is my decision which risks I'm prepared to take.

krischik commented 3 years ago

I tried to export and import the vault as well. That too didn't work. Are you sure you password handling can handle the special characters you demand the users to use? You might consider the implication of using arithmetic characters like +-*/ — JavaScript can be funny when it comes to these characters.

krischik commented 3 years ago

Another interesting observation. Copy / Paste the password did work. So you might want to look a keyboard handler.

alexpmorris commented 3 years ago

The password requirements including a "special character" originated from the original Steem Keychain version that WhaleVault is based on, so I guess they removed that constraint since then.

It sounds like it could be an issue with international keyboards, as I've seen that before. it usually has to do with the user having set a different keyboard layout than the one used to set the password. While it could potentially affect any characters used, I did remove the requirement to use a "special character" in the latest release.

krischik commented 3 years ago

Thanks. Also I haven't noticed the problem in recent time. If you didn't do anything there might be a fix in WebKit.