Quote from: Jubettarr on August 10, 2014, 09:13:14 AM

Quote from: smashingpumpkin on August 09, 2014, 10:23:48 AM

Quote from: JypsiCreme on August 09, 2014, 09:04:49 AM

Quote from: PalmerLaura on August 09, 2014, 08:28:38 AM

Be warned, the security of this app is not great. It stores your Blockchain.info password and your app's PIN in plaintext on your phone, retrievable over USB. It also stores an encrypted copy of your Bitcoin wallet right next to the plaintext password (which can be used to decrypt the wallet). I haven't checked, but I imagine these files might be included in iTunes backups of the device too.

The sandbox keeps it safe from other apps, but you are 100% insecure on a jailbroken device.

They did add a new PIN lock to the app, but again this is not used to encrypt your private key and is only a UI lock.

That does sound pretty poor. However, if the app stores its data in /Documents and you have a lock on your phone (preferably complex passphrase / touch ID) then the app's data should be encrypted on your device.

Didn't the recent "scandal" about those usb "backdoor" services show that this isn't good enough; you need to set those explicit NSFileProtectionComplete attributes?

The usb "backdoor" applies only to computers you have specifically authorized by unlocking the phone and tapping "trust this computer." If you can unlock the phone, you could just transfer yourself the contents of the bitcoin wallet anyway.

You would still have some amount of time to access your blockchain wallet and transfer it to another, safe BTC address while someone who has stolen your phone tries to figure out the code to unlock your phone and get your phone to "trust" their computer.