Hacker News Reader

Comment by sigil | Hacker News Reader

Careful using this, I'd personally wait until a proper security audit was done.

For instance, you're getting the user's wallet passphrase at line 1361. Does the passphrase just sit around in memory somewhere, long after the wallet encryption has been kicked off?

https://github.com/chjj/termcoin/blob/master/bin/termcoin#L1...

View on HN

It's a bit tough to deal with this since javascript doesn't offer any real way to zero a string's memory. The way to do this would be to read from stdin directly into a Buffer object (which is malloc'd separately from the v8 allocator) and to buff.fill(0)/memset(buff, 0) once we're done. I'll definitely work on implementing this. Thanks for pointing this out.

Assuming you trust your hosting company (maybe that's another discussion?) I don't think it's possible to leak memory contents VPS-to-VPS but I could be wrong.

In any case, if I had a pile of Bitcoin (unfortunately I do not) I wouldn't put it all in one wallet on one server. From what I've heard, paper wallets are the safest.

That said, maybe "zero out" your wallet before switching VPS providers, changing plans, etc.

This is from 2012 but probably still relevant as we saw with the recent Digital Ocean outrage. http://www.contextis.com/research/blog/dirty-disks-raise-new...

"It is worth noting that the data was not live, in that it was not due to sharing of disk contents between running instances of virtual servers. It is understood that the data is due to disk and swap data not being zeroed after use."

Reply on news.ycombinator.com