Stories
Slash Boxes
Comments

SoylentNews is people

Cryptocurrency Wallet Caught Sending User Passwords to Google's Spellchecker

posted by mrpg on Tuesday March 05 2019, @12:30AM   Printer-friendly
from the we-need-a-new-category-for-these dept.

"exec" writes:

Coinomi wallet bug sends users' secret passphrases to Google's Spellcheck API via HTTP, in plaintext.

Cryptocurrency wallet caught sending user passwords to Google's spellchecker

[...] "To understand what's going on, I will explain it technically," Al Maawali said. "Coinomi core functionality is built using Java programming language. The user interface is designed using HTML/JavaScript and rendered using integrated Chromium (Google's open-source project) based browser."

Al Maawali says that just like any other Chromium-based app, it comes integrated with various Google-centered features, such as the automatic spellcheck feature for all user input text boxes.

The issue appears to be that the Coinomi team did not bother to disable this feature in their wallet's UI code, leading to a situation where all their users' passwords are leaking via HTTP during the setup process.

Coinomi's official statement

-- submitted from IRC

Original Submission

 
This discussion has been archived. No new comments can be posted.
Cryptocurrency Wallet Caught Sending User Passwords to Google's Spellchecker | Log In/Create an Account | Top | 33 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 5, Insightful) by hemocyanin on Tuesday March 05 2019, @01:52AM (1 child)

    by hemocyanin (186) on Tuesday March 05 2019, @01:52AM (#810085) Journal

    Makes me long for the days of yore when the internet didn't require javascript. Javascript libraries may help people write slick looking websites fast -- what I wouldn't give to visit a site full of blinking side scrolling text, secure in the knowledge that all the code came from that one single place. Instead, websites are now a collage of all the bad players out there looking to profile you.

    Starting Score:    1  point
    Moderation   +3  
       Insightful=3, Total=3
    Extra 'Insightful' Modifier   0  
    Karma-Bonus Modifier   +1  
    Total Score:   5  

  • (Score: 2, Insightful) by Anonymous Coward on Tuesday March 05 2019, @02:05AM

    by Anonymous Coward on Tuesday March 05 2019, @02:05AM (#810089)

    They aren't even slick, they are annoying. I just wanted to use google earth earlier and even that website has gone to shit. It took me like 4 clicks to download it. I am sure AB testing optimized for "time on site" or whatever.