search

vulpemventures / ocean

:ocean: Elements/Liquid wallet daemon
MIT License
5 stars 7 forks source link

Protect RPCs with 2FA #19

Open altafan opened 1 year ago

altafan commented 1 year ago

Let's add a password_hash string field to Transfer request message in order to protect this endpoint in such a sensitive operation.

tiero commented 1 year ago

For Ocean instead it may be interesting to move to 2fa/topt server as definitive solution.

Also some user may and other may not want it, so it should be enabled at will and maybe for all and specific RPCs

altafan commented 1 year ago

Not sure if requiring 2fa for generating a receiving address is a feature from user POV.

Tipically, wallets protect with 2fa the login, the transfer of funds and eventually some settings operation like changing the password for example. We could start by protecting these 3 RPCs initally.

tiero commented 1 year ago

Yes agreed, but my point was that if we have a whitelist/blacklist system to filter out RPCs would be easier to add/remove the protected route at will