search

cashubtc / cashu.me

Cashu wallet PWA
https://cashu.me
96 stars 39 forks source link

Loss of funds, backups are a fake feature #191

Closed nakoshi-satamoto closed 2 months ago

nakoshi-satamoto commented 3 months ago

When I first setup cashu.me wallet it told me to backup the seed phrase and it said that it is needed to restore the wallet and funds if the browser session gets wiped.

I opened up cashu.me today and my original wallet and funds were gone. The browser lost the previous session.

I went to restore my backup but realize that the backup is actually not even a supported feature.

Why tell users to backup their seed phrase and that it can be used to restore funds, if this is simply not true?

This wallet is dangerous to use in the meantime because it does not support restoring from backup. If there is a different way users are supposed to backup it does not tell the user how. It instructs users to backup the seed phrase and hides other ways of backing up the wallet.

When I setup the wallet it said this "Back up your seed phrase. This wallet stores ecash tokens in its database. If you delete your browser data without backing up, you will lose your tokens. Make sure to back up your wallet seed phrase in the settings."

When I try to restore it then said this "Warning: this wallet does not support seed phrase recovery yet. Use a different Cashu wallet to recover from seed phrase."

Are my funds lost? How can I restore? I dont use spying devices like android or ios. I simply use a linux computer. Please do not advise me to use some googley phone or iphone "app". Does any cashu application even support restoring from seed phrase?

nakoshi-satamoto commented 3 months ago

I did not lose much, maybe 50,000 sats. But it would be nice to be able to restore these funds. And 50,000 sats will be worth alot in the future.

elnosh commented 3 months ago

if you have the seed phrase you should be able to restore the wallet using nutshell. There is a cashu restore command to restore a wallet from seed phrase

nakoshi-satamoto commented 3 months ago

On 2024-07-04 19:05, elnosh wrote:

if you have the seed phrase you should be able to restore the wallet using nutshell. There is a cashu restore command to restore a wallet from seed phrase

Thank you for trying to be heplful. But this is absolutely not an option because it is python. I don't want to run malware on my computer and make my system vulnerable.

Python apps a massive horrendous dependency tree. This one is a MASSIVE dependency tree.

  1. python apps are not reproducible, thus python apps are only open source if you actually build it from source yourself. The source code consists of the entire dependency tree. Many python apps actually cannot be built from source because they were built around pre-made binaries and build never tested as actually being built from source.

  2. Because python apps are so heavy on dependencies, and dependencies having dependencies, and those dependencies having dependencies, and the dependencies of those dependencies having dependencies, and so on....., it is VERY common for python dependencies to be backdoored and actually malware. But most people don't realize this and they fall victim because they don't build the python apps and dependencies from source code.

  3. Even if it was possible to build a python app from source (also consisting of its dependencies), it is a major PAIN, anyone who disagrees with me, I'd challenge them by asking if they even ever tried this before; it is unsafe to do so. Simply downloading a malicous or modified python dependency can compromise your system. Python automatically executes code upon package download.

Python is mainstream only because people fail to realize all the flaws and problems it poses. I'm just talking about the security issues here, not even going into the other issues.

Maybe I can go through the trouble of installing a dedicated OS to a spare drive, just for the purpoes of restoring these sats, then wipe the drive afterwards. This is a big hassle though.

I think cashu wallet should just simply get rid of the word list backup since it misleads users and just simply a fake backup feature. I'm thinking like it used to be where the user would download a backup file, maybe have the backup automatically update anytime there is a new change in the wallet transactions.

nakoshi-satamoto commented 3 months ago

On 2024-07-06 04:08, Satoshi wrote:

Thank you for trying to be heplful. But this is absolutely not an option because it is python.

I am not bashing on the wallet or developer. I have upmost respect for developers. I am bashing on the programming choice, python.

callebtc commented 2 months ago

Web-based seed recovery: https://v2alpha.nutstash.app

I am bashing on the programming choice, python.

Closing.