search

tari-project / universe

Other
11 stars 24 forks source link

If the user refused keychain access, we must show them a warning on every startup to prompt them to allow keychain access #551

Open stringhandler opened 2 months ago

stringhandler commented 2 months ago

500 introduced the storing of a password in the wallet_config.json if the user denied keychain access. This is unsafe and we should prompt the user on start up "Your seed words are vulnerable because they are stored locally on disk. Do you want to move them to the keychain?". If the user says yes, then we should:

  1. Decrypt the seed words with the current password
  2. Generate a new password
  3. Store the new password in the keychain (Provided the user grants keychain access)
  4. If successful, delete password and update seedwords in wallet_Config.json
  5. If unsuccessful, leave wallet_config.json

The app should prompt the user on every startup as long as the password is stored in wallet_config.json

stringhandler commented 3 weeks ago

Already implemented in Monero fixes