Post
Topic
Board Project Development
Re: [BOUNTY] Help test next major release of Armory! [0.04 BTC/bug]
by
whault
on 16/11/2013, 07:32:39 UTC

If your machine is compromised, nothing will save you from having the contents of your wallet stolen. Onscreen keyboards, "scrambling" and checking the clipboard are just feel-good measures and offer no tangible security.

I don't promote the feature much, because it's minimal security improvement.  But it does protect against the simplest of keyloggers.  There's this notion that all viruses are omniscient, and targeting your bitcoin wallet.  If it's targeting your wallet, the OSD keyboard probably won't help.  But if it's just sucking data off your system looking for banking login passwords, etc... you avoided giving away too much info.

But I agree the feature is really quite minimal in terms of its security benefit.   (and generally, I try to assume omniscient malware when thinking about security, but not everything has to be super-effective to be part of the interface)

I'm more inclined believe that systems like this do more harm than good, they promote a sense of security in what is a fairly sensitive environment. If the protection is just against casual un-targeted key logging, then I'm not sure of the point, having a password is useless if you don't have the associated Armory wallet binary.

Even more importantly, people who habitually use an onscreen keyboard to type their password (let alone one with a non-standard layout) will ultimately be choosing much weaker passwords as a direct result. This would be detrimental in the situation where malware manages to take the wallet binary but not the password.

Having the feature there implies that it will afford the user security, meaning that people may lapse in believing that will be be an end-all protection from malware, when it's most obviously not.