pull down to refresh
3 sats \ 0 replies \ @ZezzebbulTheMysterious 31 Dec 2024 \ on: Tangem wallet collects and exposes users seed phrase via email glitch bitcoin
Utterly incompetent.
These kinds of terrible security engineering decisions -- in this case, logging key material in the application, stink. What other horrors are lurking in the Tangem codebase that their developers would think it is acceptable to log keys!
These code smells indicate something deeper at play.
When wallets make such n00b mistakes, and I have looked at many a wallet source over the years, run. The classic mistake is using a bad CSPRNG for keygen. ;-)
Any app that logged key material, ever, one should burn the seed and regenerate any new keys on trusted hardware/software.