• ryannathans
      link
      fedilink
      arrow-up
      3
      ·
      7 months ago

      If you set a small pin, perhaps. Most people set a password

          • jet@hackertalks.com
            link
            fedilink
            English
            arrow-up
            1
            ·
            7 months ago

            For the people who really care, they can disable The pin. I believe the client will generate a BIP 38 password randomly, and use that for the data encrypted in the SVR. But all the data is still uploaded to the cloud. So if there’s a problem with the SVR encoding, the BIP 38 password generation etc the data is still exploited

            Not only do you have to care, everyone you talk to has to do the same thing, because if your counterparty has their key in the cloud, the conversation is at risk.

              • jet@hackertalks.com
                link
                fedilink
                English
                arrow-up
                1
                ·
                edit-2
                7 months ago

                All the bits to reconstruct the master key minus the pin code are uploaded. So it’s equivalent to uploading to the cloud The master key itself.

                Very few people are using BIP 38 level passwords. So the vast majority of people have their key constructively uploaded fully in the cloud