backend/lightning: don't expose mnemonic words for lightning #2741
Conversation
strmci
force-pushed
the
lightning_mnemonic_update
branch
2 times, most recently
from
80c038f
to
dc8913a
Compare
backend/config/lightning.go
Outdated
| @@ -23,7 +23,7 @@ import ( | |||
| // LightningAccountConfig is the configuration of a single Lightning account. | |||
| type LightningAccountConfig struct { | |||
| // Mnemonic is the wallet node generated from the device entropy. | |||
| Mnemonic string `json:"mnemonic"` | |||
| Mnemonic string `json:"-"` | |||
There was a problem hiding this comment.
With this you delete the mnemonic also from the config, and the user can't spend anymore 😰 You even changed the test above to reflect this 😅
There was a problem hiding this comment.
hmm, I'll look into it, thanks.
strmci
force-pushed
the
lightning_mnemonic_update
branch
4 times, most recently
from
0e2deee
to
97a77d6
Compare
strmci
force-pushed
the
lightning_mnemonic_update
branch
from
97a77d6
to
480aa66
Compare
Removed. |
backend/handlers/handlers.go
Outdated
| return handlers.backend.Config().LightningConfig() | ||
| lightningConfig := handlers.backend.Config().LightningConfig() | ||
| for _, account := range lightningConfig.Accounts { | ||
| account.Mnemonic = "" |
There was a problem hiding this comment.
Why set to empty string? Is there a way to remove the mnemonic field?
There was a problem hiding this comment.
It's now removed by adding omitempty to the json descriptor (thanks @Beerosagos)
There was a problem hiding this comment.
This still removes the mnemonic from the actual lightning account object in the config, so it will be gone afterwards, and also persisted on the next config save() I think.
To do this properly, you'd have to change the handler that returns the data to the frontend, probably recreating a structure with the relevant data for the frontend without the mnemonic.
strmci
force-pushed
the
lightning_mnemonic_update
branch
2 times, most recently
from
78694e3
to
ed76102
Compare
|
@Beerosagos @benma |
strmci
force-pushed
the
lightning_mnemonic_update
branch
from
ed76102
to
13da20e
Compare
This commit ensures the mnemonic words created for lightning wallet are not exposed to frontend.
strmci
force-pushed
the
lightning_mnemonic_update
branch
from
13da20e
to
04c56d0
Compare
This commit ensures the mnemonic words created
for lightning wallet are not exposed to frontend.