Comments (8)
I agree that LND password in plain text on the filesystem is a non issue. The risk of having the LND password in plain text on the Umbrel is very low, the wallet is already hot with the keys available most of the time.
There is probably more chance of funds loss due to an offline node than there is due to storing the password for a hot wallet on the same fs as the hot wallet itself.
The only attack vector I see with storing the wallet password in plain text is that in the event the user accidentally leaves their Umbrel drive lying around somewhere, someone could take it and then decrypt their wallet and steal their funds. I think this is user error and not something we should hurt the uptime and stability of all Umbrel users to protect against.
from umbrel.
Concept ACK. Implementation NACK.
lnd-unlock
container requires storing plain text lnd
password on the Umbrel at all times, which is simply an unacceptable amount of risk to take. Unless lnd
comes up with a better way to keep the wallet online without requiring a password to unlock, there isn't a way we can have the wallet unlocked at all times.
Meanwhile, we can notify users when they shut down or reboot their Umbrel to not forget to log in to their dashboard once after it restarts.
from umbrel.
How about a warning that they need store their password on the filesystem, and they accept all risks. It's their node after all.
We shouldn't try to stop people from doing so, but warn them.
Its important to have the node and channels online all the time as its risky to do so - an evil node can simply just close the connection with an earlier version of the database.
Notification may not cut it as there is the dashboard seems to not work on some mobile tor clients. And alsot everyone can stay monitoring their node 24/7.
from umbrel.
The credentials to unlock lnd must come from somewhere and in order to automate the unlock, these must be in plain text (otherwise you'd have to provide a passphrase to decrypt the lnd passphrase, at which point were are back to square one). So as far as I can see it, there is no way around storing the lnd password in plain text.
Automatic unlock of lnd is a must have, otherwise users might forget to unlock lnd after a reboot or crash and their node would be offline.
from umbrel.
So lnd-unlock can be brought back?
It's opt-in only, it will do nothing if the file is not present. So you can display a warning at that point then to let them make the decision whether or not to enable it. Also physical access means you literally have root (through 'physical' persuation anyway)
from umbrel.
It's opt-in only, it will do nothing if the file is not present.
I think it should be opt-out, that is if it's even worth exposing the setting.
I personally think auto unlock by default without any way to disable it is fine.
Also physical access means you literally have root (through 'physical' persuation anyway)
I'm talking about physical access to the storage device, not the Umbrel device.
e.g the user unplugs the external storage device, carries it around on them, then puts it down somewhere in public and forgets about it.
If someone finds the drive, they can recover the funds if the wallet password is stored in plain text. If the password was encrypted or not stored on disk, the funds would be safe.
from umbrel.
optin or opt out Is fine.
The likelihood of anyone knowing what the drive is to an average onlooker is extremely miniscule.
Losing your physical wallet is more risky, which has paper in it which most people know what it is.
Plus with the disclaimer of not being too reckless unless a user knows what they are doing is all there when they sign up.
from umbrel.
Closing this old issue as it is no longer applicable.
from umbrel.
Related Issues (20)
- Updates fail, can´t install apps HOT 1
- Ubuntu 22.04.04 LTS installation issue 'ssl_version' - Cant start Docker services HOT 8
- Separate Umbrel Accounts - Suggestion HOT 2
- Add Custom Docker Container over GUI HOT 1
- I can't connect to LND after the update. HOT 3
- LND Restarts Constantly
- UmbrelOS 1.0 Does NOT recognize NVMe M.2 SSD drive at all... HOT 4
- NTP Time sync did not work, rendering Umbrel OS unusable HOT 2
- OTA updates broken on RPI-4. HOT 7
- Qbittorent or Filebrowser Issue ‼️ HOT 8
- larger swap file HOT 2
- Doesn't work with Pi 4 HOT 2
- Not possible to boot from usb on Raspberry Pi 5 HOT 1
- `docker exec` seems to be broken on UmbrelOS 1.0 (RPi) HOT 3
- Add Telegram Support
- Fail on starting docker (umbrelOS) Ubuntu HOT 5
- UmbrelOS install on Debian fails [solution found, needs review] HOT 5
- UmbrelOS install on Ubuntu Server Fails HOT 6
- Update stuck on "Downloading Umbrel v1.0.0" [debian] HOT 7
- Failing to install on ubuntu 20.04 HOT 7
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from umbrel.