search

iancoleman / bip39

A web tool for converting BIP39 mnemonic codes
https://iancoleman.io/bip39/
MIT License
3.41k stars 1.42k forks source link

No more hash on Twitter? #644

Open baro77 opened 10 months ago

baro77 commented 10 months ago

It's a pity, it was an extra security 'cause compromising BIP39 Tool was meaning to compromise the repo but also your twitter account (the bip39-standalone.html compiled from a compromised source couldn't have matched the right hash): now it's "enough" to compromise your GitHub... hope you'll step back to the former procedure involving another platform as well. Thanks!

ghscuuo commented 10 months ago

I verify [edit: standalone html file integrity] by uploading the well-exercised old-faithful 0.5.4 standalone here: https://www.virustotal.com/gui/file/8b8e3c1be03501f57e395781de8a59fd553808e1eb1278710bd7b96dacb6d0f6

(Can also check the pgp signature. https://github.com/iancoleman/bip39/releases/tag/0.5.6)

baro77 commented 10 months ago

virustotal check is meaningless, since it wouldn't discover, for example, biases in RNG

pgp signature check is less immediate than athe comparison of two hashes

just imho