Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mnemonic can be read by anyone on the server #3

Open
cloudnull opened this issue Jul 20, 2022 · 0 comments
Open

Mnemonic can be read by anyone on the server #3

cloudnull opened this issue Jul 20, 2022 · 0 comments

Comments

@cloudnull
Copy link

As an operator I would like to have the mnemonic secret file to be read by the underlying process instead of being read and passed through as a string.

kyve      172091  0.0  1.8 842188 75264 ?        Ssl  13:41   0:02 node /usr/share/yarn/bin/yarn.js start
kyve      172115  0.0  0.0   2608   536 ?        S    13:42   0:00  \_ /bin/sh -c rimraf dist && tsc && node ./dist/src/index.js
kyve      172209  0.0  2.0 9638248 84064 ?       Sl   13:42   0:02      \_ /usr/bin/node ./dist/src/index.js
kyve      172220  0.5  2.8 21891908 115916 ?     Sl   13:42   0:42          \_ ./runtimes/@kyve/substrate/0.3.5/kyve-linux --poolId 17 --mnemonic ${MNEMONIC_STRING} --network korellia --keyfile ./secrets/arweave.json --initialStake ${STAKE_INT} --space 1073741824 --verbose

The current setup is functional, but it creates a trust situation when multiple operators may have access to a given machine. While it may be argued that operators with access to the machine should be trusted, I would argue that having the mnemonic as something globally visible by any user is exposing the service to risk which should be otherwise clamped down.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant