search

filidorwiese / ripple-wallet

Lightweight command-line Ripple wallet (node based)
ISC License
41 stars 19 forks source link

Example image data not appropriately obfuscated #22

Closed professorhantzen closed 6 years ago

professorhantzen commented 6 years ago

It would be possible to figure out the secret from the information provided. The supplied public/private key pair should not be considered safe for holding funds. Also, if the intention in masking the public addresses is to maintain privacy, the provided portions are readily grep-able within any ledgers accountState to reveal the full address. (Information also useful in unmasking the secret.)

I would attempt to convey this information privately, but the repository has already been forked several times. (A safer way to provide examples might be to paste over the real addresses with dummy/unused accounts or random values, prior to taking a screenshot.)

Ponderjaunt commented 6 years ago

I'm very glad someone brought this up, I had the same concerns aftering viewing the git; it would be very easy to brute the remaining characters of the public wallet I'd and PK based on that photo.

On Jun 30, 2018 11:24 AM, "professorhantzen" notifications@github.com wrote:

It would be possible to figure out the secret from the information provided. The supplied public/private key pair should not be considered safe for holding funds. Also, if the intention in masking the public addresses is to maintain privacy, the provided portions are readily grep-able within any ledgers accountState to reveal the full address. (Information also useful in unmasking the secret.)

I would attempt to convey this information privately, but the repository has already been forked several times. (A safer way to provide examples might be to paste over the real addresses with dummy/unused accounts or random values, prior to taking a screenshot.)

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/filidorwiese/ripple-wallet/issues/22, or mute the thread https://github.com/notifications/unsubscribe-auth/AdZUSj_uxF7g720caAvz_xKGMd8kp44wks5uB8JfgaJpZM4U-D3e .

filidorwiese commented 6 years ago

Thanks for your concern. The account mentioned in the image is actually dummy. The obfuscation in the image was to illustrate the fact that the private key should be secret. I'll make a new version of the image to make that more clear.