Quote from: Saint-loup on December 22, 2024, 01:21:59 PM

Quote from: Pablo-wood on December 21, 2024, 09:40:36 PM

Nice work mate but a few point to mention
First :
Handling private keys and seed phrases in plaintext is inherently risky. You stand at a very high risk if an attacker gets hold of your system.

What do you mean by that? How could he do otherwise? All wallets display in their GUI, in the console or even in plain text files sometimes, the private keys and the HD seed of the wallet if you request it. You think it should be encoded with a scheme or even encrypted with a key or a password ? But how and where the user could decypher it safely then?

It's not that complex. The script could ask user to input the variable value when running the program and enter password before storing encrypted key on disk.

Quote from: Saint-loup on December 22, 2024, 01:21:59 PM

Quote from: Pablo-wood on December 21, 2024, 09:40:36 PM

Quote

user_variable = "test"

Using user_variable for entropy is highly risky. Assuming a user provides a weak or predictable input?. Despite introducing randomness via salting understanding the strength of the entropy greatly relies on the quality of the user input
[...]

He just shifts this responsibility onto the user, taking it on. An explicit warning message would certainly be more cautious, but if you don't trust or don't want to trust reliability of some libraries or environnement behaviors on all equipments and hardware configurations, it's simpler and safer to delegate the burden of this task and its responsibility directly to the user IMO. He sould be informed of what this implies though.

Average user wouldn't run OP script in first place.