Store scanner viewing keys in a separate file, and give them more restrictive file permissions #8048
Closed
Labels
A-blockchain-scanner
Area: Blockchain scanner of shielded transactions
C-security
Category: Security issues
I-privacy
Zebra discloses private information
Motivation
Storing secret keys in the same file as non-sensitive configs makes it harder to secure those keys.
Since we are scanning using viewing keys, this is a transaction privacy issue, not a funds loss issue.
Suggested Solution
Best practice is to store the key or keys in separate files, and put the file paths in the config. Then the key files can have restrictive filesystem permissions, or be excluded from backups.
We could support multiple keys per file if we want, one per line.
The text was updated successfully, but these errors were encountered: