search

shermand100 / PiNodeXMR

Monero Node for Single Board Computers with Web Interface and additional tools pre-configured. Self Installing.
GNU General Public License v3.0
219 stars 41 forks source link

Add Warning label to LWS readme- Android/iOS/Desktop easily leaks view key info to MyMonero #57

Closed CryptoGrampy closed 2 years ago

CryptoGrampy commented 2 years ago

Issues are described towards the end here: https://github.com/vtnerd/monero-lws/pull/30 . Basically, when you're setting your custom server field in MyMonero, it will send an API request to the MyMonero server with your view key... Not a very nice thing. Please add a warning to the LWS readme until these issues are resolved.

shermand100 commented 2 years ago

Thanks. I've had a skim of that issue and will continue to monitor.

Wiki amended: https://github.com/monero-ecosystem/PiNode-XMR/wiki/Monero-LWS-Install-and-Use/3002e90491fe096d80fbf812353b28cd78c36390

devinpearson commented 2 years ago

With the latest updates, we have resolved the leaking of view keys to the server. The only exception currently is the iOS app in beta has the fixes and not the older app in the store. This should change in about a week.

Originally the code sent a request with the critical info on every keypress. We have changed that to now send a blank request for each keypress and check if the response is an expected error, and after the user clicks save, it will then update the app to use the new URL and send the view key. If the URL is incorrect, the app will not fall back to using the mymonero API.

shermand100 commented 2 years ago

Thanks for the changes. I left this open for a little longer should anything else pop up related to it. Nothing heard. Closing.