{"action":"created","issue":{"url":"https://api.github.com/repos/spesmilo/electrum/issues/2638","repository_url":"https://api.github.com/repos/spesmilo/electrum","labels_url":"https://api.github.com/repos/spesmilo/electrum/issues/2638/labels{/name}","comments_url":"https://api.github.com/repos/spesmilo/electrum/issues/2638/comments","events_url":"https://api.github.com/repos/spesmilo/electrum/issues/2638/events","html_url":"https://github.com/spesmilo/electrum/issues/2638","id":245976676,"number":2638,"title":"SECURITY: \"electrum restore\" requires seed entry as argument to command","user":{"login":"lannocc","id":11672586,"avatar_url":"https://avatars2.githubusercontent.com/u/11672586?v=4","gravatar_id":"","url":"https://api.github.com/users/lannocc","html_url":"https://github.com/lannocc","followers_url":"https://api.github.com/users/lannocc/followers","following_url":"https://api.github.com/users/lannocc/following{/other_user}","gists_url":"https://api.github.com/users/lannocc/gists{/gist_id}","starred_url":"https://api.github.com/users/lannocc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lannocc/subscriptions","organizations_url":"https://api.github.com/users/lannocc/orgs","repos_url":"https://api.github.com/users/lannocc/repos","events_url":"https://api.github.com/users/lannocc/events{/privacy}","received_events_url":"https://api.github.com/users/lannocc/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-07-27T09:18:41Z","updated_at":"2017-07-27T10:55:08Z","closed_at":"2017-07-27T10:54:27Z","body":"I found that using \"electrum restore\" requires the entry of user's seed right on the command-line as an argument to command invocation. It is considered bad practice to ask for sensitive data in this manner and is a security issue for two reasons:\r\n\r\n1. Any other active user on the system can see the full seed in plaintext while the command is running by simply looking at the process list.\r\n\r\n2. This seed is now stored as plaintext in the user's shell history file (e.g. ~/.bash_history)."},"comment":{"url":"https://api.github.com/repos/spesmilo/electrum/issues/comments/318329127","html_url":"https://github.com/spesmilo/electrum/issues/2638#issuecomment-318329127","issue_url":"https://api.github.com/repos/spesmilo/electrum/issues/2638","id":318329127,"user":{"login":"ecdsa","id":2343238,"avatar_url":"https://avatars0.githubusercontent.com/u/2343238?v=4","gravatar_id":"","url":"https://api.github.com/users/ecdsa","html_url":"https://github.com/ecdsa","followers_url":"https://api.github.com/users/ecdsa/followers","following_url":"https://api.github.com/users/ecdsa/following{/other_user}","gists_url":"https://api.github.com/users/ecdsa/gists{/gist_id}","starred_url":"https://api.github.com/users/ecdsa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ecdsa/subscriptions","organizations_url":"https://api.github.com/users/ecdsa/orgs","repos_url":"https://api.github.com/users/ecdsa/repos","events_url":"https://api.github.com/users/ecdsa/events{/privacy}","received_events_url":"https://api.github.com/users/ecdsa/received_events","type":"User","site_admin":false},"created_at":"2017-07-27T10:55:08Z","updated_at":"2017-07-27T10:55:08Z","body":"in addition, you can type shell commands preceded with a space if you don't want them in history."}}
{"actor":{"display_login":"ecdsa"}}