Electrum Android: many external sites that the app sends data to

[jbrepogmailcom]

Hello,

I have noticed there are many (possible tens of) external domains that electrum communicates with. Is there any list of all external sites and description what data does it send there? As it is not possible to do security check of external sites, I think it may be security risk if so many sites are utilized.

Jan

[SomberNight]

Right, depending on how you use the client, it initiates lots of connections for various reasons, including:

• Electrum (the client) connects to many Electrum servers, selected at random by default.
• If you enable exchange rates (e.g. USD conversion), it also connects to the selected FX rate provider.
• If you enable version update checks (to get notified if a newer version is available), it also connects to https://electrum.org/version.
• If you use lightning, re gossip (trampoline disabled), it connects to random lightning peers (as in BOLT-08) to get messages about the graph (BOLT-07).
• If you use lightning and have channels, it connects to your channel counterparties (as in BOLT-08).
• If you use lightning and go into the submarine swaps menu, it connects to swaps.electrum.org.
• The cosigner_pool plugin connects to cosigner.electrum.org.
• The labels plugin connects to labels.electrum.org.
• The trustedcoin plugin (for 2fa wallets) connects to api.trustedcoin.com.

Is there any list of all external sites and description what data does it send there? As it is not possible to do security check of external sites, I think it may be security risk if so many sites are utilized.

This is free/libre software, you can review the source code: no security-critical data leaves the device, and as for privacy-critical data, we carefully try to balance it with the user-experience.