dusk-blockchain icon indicating copy to clipboard operation
dusk-blockchain copied to clipboard

Encrypt RPC username and password, instead of having them out in the open in the config

Open jules opened this issue 5 years ago • 0 comments

The RPC username and password are currently stored in cleartext, in the dusk.toml file. This would allow any other process running on the same machine to read these credentials, and then connect to the node RPC server, allowing it to wreak havoc (for example, draining one's wallet). If the credentials were to be stored in a password-encrypted file, we can avoid this attack vector.

This would then entail adding some extra stuff on startup. The first time the node is started, the user should pick a password to encrypt the credentials file with, which should be randomly generated. Then any time the node starts up and the CLI is opened, the first prompt should be for a password to unlock the credentials with and to be able to authenticate the session.

jules avatar Jan 21 '20 10:01 jules