thenewboston-blockchain / Account-Manager

Account manager desktop application for thenewboston digital currency.
https://thenewboston.com
MIT License
308 stars 91 forks source link

Two Active Banks At A Same Time? #473

Open AmanJain27 opened 3 years ago

AmanJain27 commented 3 years ago

I think config.json file lets you have 2 active banks at a same time.

Steps to Reproduce Steps to reproduce the behavior:

  1. Go to '/home/{linux user name folder}/.config/TNB Account Manager/' folder.
  2. Edit the config.json on the line which says "is_default" : "false" to "true" under managed banks section.
  3. Make sure that all the banks that you currently use have the value set to true.
  4. then execute the TNB software.
  5. You'll see that both the banks are marked active.

Expected behavior I'm unsure as to what it may lead to. Its mostly client side and should not affect the server side functionality. I did not perform any transactions through the banks to check the issue as I currently don't own any coins. I'd still like you to at least check the functionality if this has some real effect on the working on banks. But I think this may cause some conflict between the banks or worse, the transaction may take place through both the banks if the issue affects the server side.

I am attaching a screenshot of my TNB software indicating two active banks tnb

Account Number eef9c0570d9d8eab23fed3f997cce01abec4e56922fbdff5d9caa4420e47a3e0

AmanJain27 commented 3 years ago

Actually it really doesn't matter if the signing keys are saved as plaintext. Because config.json is only used to set up individual account information. To steal the config.json, you'd actually have to hack into his computer.

Ramin-RX7 commented 3 years ago

So you think why there is no program do this? (like browsers, GitHub, Games or any other application which has login credentials) Generally its good to encrypt/hide them.

AmanJain27 commented 3 years ago

Login credentials are not stored on your machine. Its stored in the browser when you click on remember me. Here, the signing key is just as a license key of a paid software. A license key is always stored on the user's computer as a plain text because its never gonna be used anywhere else except to verify that its you. Because when you buy a new laptop, you wouldn't have to buy the software(in this case create a new account) again. Instead the config file will let all the goodies done by itself. You can surely encrypt it but there's actually no need of that :)

Ramin-RX7 commented 3 years ago

Login credentials are not stored on your machine

First of all this is wrong. They are all saved in your machine! Take a look at some simple scripts which can steal them from your computer even though they are encrypted.

A license key is always stored on the user's computer as a plain text

This is also wrong because signing keys are Login credentials not just a license key (because you can have access to its account with it). You will never see Bank app store your password in a plain text. And also because this is a currency, it is important to hide/encrypt them (Maybe someday they will be valuable)

You can surely encrypt it but there's actually no need of that

I know I don't care about my bank account because I'm here to just help (not think about my money 😄) But I think this is what their team will decide about it

AmanJain27 commented 3 years ago

First of all this is wrong. They are all saved in your machine! Take a look at some simple scripts which can steal them from your computer even though they are encrypted.

No my friend. When you login your passwords are stored in the browsers.

You will never see Bank app store your password in a plain text. And also because this is a currency, it is important to hide/encrypt them (Maybe someday they will be valuable)

Thats because bank doesn't store your passwords in your computer. There's no such file in your computer with your login credentials. Of course the browsers have it. You can find that data in your browsers folder. But once you delete the browser and its data there's no file with your login credentials in your computer

Ramin-RX7 commented 3 years ago

I think we can not understand each other. Because from your first comment until my last comment we are just repeating our ideas and denying the other one. But as you said "when we delete the browser there won't be any file which contains our passwords" and should be here too (if it isn't).

When you login your passwords are stored in the browsers.

I think I'm not understanding this, BROWSER? what is the difference when browser folder is in my machine?

Bucky set label 'discussion' which means that even he is not sure which one is better (and I think we had to say these things in my issue not here.) I'm still on my word that there is no where an app to do this. of course this file is not only about signing keys but these important information are encrypted everywhere. I do not know about signing key in cryptography of thenewboston bank and I do not know exactly how it works, but for example just using a simple cipher or a file with so many random letters+password .

But whatever it doesn't matter, I'm done for this and I don't wanna talk about it anymore (I'm too tired of it :|) and I think it was a good discussion :)