21
1
With bitcoin 0.4.0 I have encrypted my wallet. Now when I would want to use bitcoind, the only way to send money is to provide my wallet decryption key on the cmd line first. I do not want to do that as my password will show up in the shell history.
Is there a way to let bitcoind ask for the wallet passphrase?
13
Anything you can do from the command line you can also do from the JSON API which means that the same unlock command could be sent from within code just as easily. To my knowledge there is no pre-built utility capable of this, but the API is simple enough that I can't imagine it being terribly difficult to actually build such a tool.
Edit: It was much easier than expected to do this in Python. Assuming you have Python's JSON-RPC module installed just use this code:
from jsonrpc import ServiceProxy
from getpass import getpass
access = ServiceProxy("http://127.0.0.1:8332")
pwd = getpass("Enter wallet passphrase: ")
access.walletpassphrase(pwd, 60)
Similarly you could call access.walletlock() to lock the wallet on demand and walletpassphrasechange(old, new) to change the passphrase without ever having it see the command line.
Edit 2: I also submitted an issue to the devs on github on your behalf.
Edit 3: A pull request containing my python scripts has been accepted. Downloading the bitcoin source from github now includes scripts for this purpose in contrib/wallettools
Edit 4: A new bug report was filed to request that the builtin command behaves properly.
9
You can avoid having the password show up in the shell history like this:
$ read x
password goes here
$ bitcoind walletpassphrase "$x" 60
$ x=
$
The read x command reads the next line of text you type and puts it into a shell variable x.
The x= command overwrites the shell variable; otherwise $x will hold your password until you exit the current shell.
It shows up in the history like this:
2032 read x
2033 bitcoind walletpassphrase "$x" 60
2034 x=
2035 history
I expect the password will show up in /proc/ while the bitcoind command is running, but that should be only for a fraction of a second.
2While this hides the passphrase from the shell history it will still show up in other places (ps -ax or ps -ef, for example, will show the bitcoind command as invoked, including the value of $x) – voretaq7 – 2014-05-02T21:22:37.830
2It shows up in ps output for me, but only for as long as the bitcoind command takes to run, which is approximately no time at all. Try "sleep $x" where x is 999, then 'ps -ef | grep sleep' in another window to see it. – Chris Moore – 2014-05-04T05:47:04.447
1
The official developer answer is to use the provided python wrapper in contrib/bitrpc/bitrpc.py (github):
It asks for a password in a secure way if you use the command
walletpassphrase, for example. There are no plans to add interactive functionality tobitcoin-cli.
and:
bitcoin-cliwill remain as-is and not gain interactive functionality.
Source: #2318
Unlock wallet:
$ python bitrpc.py walletpassphrase
Change passphrase:
$ python bitrpc.py walletpassphrasechange
https://github.com/bitcoin/bitcoin/tree/master/contrib/bitrpc
this file not longer exists. – erikvold – 2016-03-22T01:26:29.553
0
While in command prompt press ALT+F7 to delete all commands stored in memory for the current history buffer.
5That solves the problem for now but it's really not acceptable for the passphrase to appear in the buffer in the first place. Also, is the buffer held solely in memory or is it at some point written to disk? If so, does Alt+F7 securely destroy the contents of such files or simply delete them? – David Perry – 2011-10-03T17:08:13.527
The buffer is held solely in memory, and assuming user won't forget to clear history, I don't see how it's less secure then having additional prompt for password. Because if a malicious program have access to cmd memory buffer that also means it can intercept password input directly from keyboard. – Serith – 2011-10-03T21:23:35.667
I don't think it's memory-grabbing malware we're concerned with here so much as multi-user PCs and forgetting to clear the buffer. – David Perry – 2011-10-03T23:14:43.827
What operating system does this keyboard shortcut work in? – akaihola – 2011-10-08T04:22:43.263
@akaihola, Windows Command Prompt – Serith – 2011-10-08T15:20:44.217
2
See this related post: http://security.stackexchange.com/questions/146019/input-password-to-bitcoin-cli
– e18r – 2016-12-21T17:09:14.260And this: http://serverfault.com/q/592744/116529
– Afr – 2017-02-28T20:16:15.130