Two security improvement, Vault. about airgap-vault HOT 11 CLOSED

Hmmmm. Why is Passcode option grey out?

from airgap-vault.

Hi, thanks for your feedback.

1. Is already being worked on. The branch is here https://github.com/airgap-it/airgap-vault/tree/feat/mnemonic-import and a you can try it out online here: https://608ad24a2be17900076a5ba6--airgap-vault-dev.netlify.app/ (in the alert that says the app can't load, hit cancel and wait). This is only a first draft and we're testing what the best approach is. We are planning to include this in the next few weeks.

2. During the setup of your secret, you can set a passcode. You cannot change this afterwards, that's why it's greyed out. To add a passcode you have to import that mnemonic again and set it during the setup.

from airgap-vault.

Ohoh, let me try again, is Passcode PIN only?

from airgap-vault.

No, it's a regular password (letters, numbers and symbols).

from airgap-vault.

3/ lock after phone screen lock.
(4)/ seem like I can spam cancel to skip authentication, trying again with a test account, please wait.

from airgap-vault.

KeyStore implementation seems, wonky. I encontered Bio auth loop same as another issue, must use screen lock pin. And Passcode is not done using KeyStore.

from airgap-vault.

Essentially, is private key properly stored on TEE/SE of an Android device and sign transaction with KeyStore(Bio/Pwd/Bio+Pwd) so privilege escalation attack/root is not a problem.

from airgap-vault.

Because I can view phrases just using Passcode. Does that mean private key entered main memory? Or just hold a token to be used later when invoking signing and viewing phrases?

from airgap-vault.

Now transaction broadcasting failed: network error. Using a VPN or proxy don't help? WTH......

from airgap-vault.

5/ can't exit Vault or Wallet using back button.

from airgap-vault.

I'll close this and sperate all issue apart.

from airgap-vault.