5

If the wallet private key is in \AppData\Roaming\Daedalus\Secrets-1.0 what security exists from physical access to this file?

Per this https://forum.cardano.org/t/where-are-the-public-and-private-keys-located-in-daedalus/6522/2 a user states this file is encrypted but I assume a attack can could still result in retrieval if access is available while Daedalus is running.

Improve this question

1 Answer 1

Reset to default
2

About password and physical access

First of all, your wallet must be password-protected and then, as you already said, it will be encrypted. You also need a strong OS password to protect your computer from physical access. And yes, remote attacks are highly possible (in case you installed Daedalus on a machine that's used for web surfing). So Firewall is a good choice, as well as HDD/SSD encryption.

However, if someone downloaded a file containing your private key, the probability of guessing a password for this file depends on the complexity of your password – it can be up to 255 characters long. Brute force methods are still alive (you can explore some rainbow tables for simple and frequently used passwords).

Official docs page says:

Note that password only works to encrypt/decrypt your private key on the computer where your wallet is restored. Anyone with access to the recovery phrase can restore the wallet on a different machine and set a different spending password on that. So keeping your recovery phrase secure is vital!

Hardware wallet pair

The solution is banal – keep your coins on a hardware cold wallet, or, at least, use hardware wallet in combination with Daedalus. In my opinion, "pure" Daedalus (without pairing it with hardware wallet) is suitable for storing a small amount of coins (equivalent of $500 to $1000). Although everyone has their own personal opinion about security.


P.S.

When you're spending your coins, you need to enter your password. At this very moment, the private key must be decrypted, and after sending the funds, it must be immediately encrypted again.

As far as I understand, there's no need to decrypt/re-encrypt a private key at staking stage...

Improve this answer
2
  • 1
    I kinda disagree. The largest attack vector for both a hardware and a software wallet is the human factor of keeping the key safe. Hardware wallet offers more potential attack vectors such as someone simply forcing someone plug it in and press the button. Where if I have a software wallet over a protected user account over a encrypted disk it actually seems much safer. My question was more of a technical what happens behind the scenes when Daedalus references the key how/when does it unencrypt it and reecrypt it. Does it ever need to un-encrypt the file after its initially established etc.
    – 011000010110111001101111011011
    Sep 8, 2021 at 14:47
  • 1
    I've updated my answer.
    – Andy Jazz
    Sep 8, 2021 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.