4 ms·
Be warned, the security of this app is not great. It stores your Blockchain.info password and your app's PIN in plaintext on your phone, retrievable over USB. I
by dgarrett 12y ago
Be warned, the security of this app is not great. It stores your Blockchain.info password and your app's PIN in plaintext on your phone, retrievable over USB. It also stores an encrypted copy of your Bitcoin wallet right next to the plaintext password (which can be used to decrypt the wallet). I haven't checked, but I imagine these files might be included in iTunes backups of the device too.
The sandbox keeps it safe from other apps, but you are 100% insecure on a jailbroken device.
They did add a new PIN lock to the app, but again this is not used to encrypt your private key and is only a UI lock.
- interpol_p 12y agoThat does sound pretty poor. However, if the app stores its data in /Documents and you have a lock on your phone (preferably complex passphrase / touch ID) then the app's data should be encrypted on your device.
- schrodinger 12y agoThey should really just store the private key and password in the keychain, it's super simple to do.
- 0x0 12y agoDidn't the recent "scandal" about those usb "backdoor" services show that this isn't good enough; you need to set those explicit NSFileProtectionComplete attributes?
- superuser2 12y agoThe usb "backdoor" applies only to computers you have specifically authorized by unlocking the phone and tapping "trust this computer." If you can unlock the phone, you could just transfer yourself the contents of the bitcoin wallet anyway.
- dgarrett 12y agoWell, if you have access to an unlockable phone, this would get you access to the Blockchain app's data despite the app's PIN lock.