search

chaincase-app / Chaincase-iOS-Beta

The only privacy preserving bitcoin app on iOS
https://chaincase.app
GNU General Public License v3.0
76 stars 16 forks source link

Encrypt hdMasterSecret with TouchID/FaceID #43

Closed DanGould closed 2 years ago

DanGould commented 4 years ago

DO NOT USE LOCALSTORAGE

keep in mind OWASP M4 & M6

https://owasp.org/www-project-mobile-top-10/2016-risks/m4-insecure-authentication https://owasp.org/www-project-mobile-top-10/2016-risks/m6-insecure-authorization

DanGould commented 3 years ago

Now the hdMaster secret is encrypted with an intermediate key derived from the password.

That both lets the user change the password and can be safely stored with TouchID/FaceID instead of the actual hdMaster secret. The caveat is that the hdMasterSecret is derived from the original 12 words & password as passcode